File name:

Trojan-Ransom.Win32.Purgen.fk-ecd3b069ea23e7905a1d4c4eff4a649cabef85bd541735ed810ab87cbf0ee9a3.7z

Full analysis: https://app.any.run/tasks/34bc294b-aa12-4ca2-b636-ace943e4e898
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 14:01:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
arch-exec
ransomware
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

0C3C382F1861B5C6DB94737E0F3864DB

SHA1:

F87E11B7CFD5BC6AC3A1468F1AB59B928DF9A4F9

SHA256:

5953F8A7AD81AD613849F363361246143038BC12B45D01B3A49373D5DB2A01F2

SSDEEP:

1536:9yH6tJsrtAhtClFbgNnzbLKbx1vQDc5hOs/HERZCu:9PJsBqtERgNnzb4fio/+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • Trojan-Ransom.Win32.Purgen.fk-ecd3b069ea23e7905a1d4c4eff4a649cabef85bd541735ed810ab87cbf0ee9a3.exe (PID: 2516)

    • Deletes shadow copies

      • cmd.exe (PID: 328)

    • Renames files like ransomware

      • Trojan-Ransom.Win32.Purgen.fk-ecd3b069ea23e7905a1d4c4eff4a649cabef85bd541735ed810ab87cbf0ee9a3.exe (PID: 2516)

    • RANSOMWARE has been detected

      • Trojan-Ransom.Win32.Purgen.fk-ecd3b069ea23e7905a1d4c4eff4a649cabef85bd541735ed810ab87cbf0ee9a3.exe (PID: 2516)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Trojan-Ransom.Win32.Purgen.fk-ecd3b069ea23e7905a1d4c4eff4a649cabef85bd541735ed810ab87cbf0ee9a3.exe (PID: 2516)

    • Starts CMD.EXE for commands execution

      • Trojan-Ransom.Win32.Purgen.fk-ecd3b069ea23e7905a1d4c4eff4a649cabef85bd541735ed810ab87cbf0ee9a3.exe (PID: 2516)

    • Executing commands from a ".bat" file

      • Trojan-Ransom.Win32.Purgen.fk-ecd3b069ea23e7905a1d4c4eff4a649cabef85bd541735ed810ab87cbf0ee9a3.exe (PID: 2516)

    • Executes as Windows Service

      • VSSVC.exe (PID: 2744)

    • Creates file in the systems drive root

      • Trojan-Ransom.Win32.Purgen.fk-ecd3b069ea23e7905a1d4c4eff4a649cabef85bd541735ed810ab87cbf0ee9a3.exe (PID: 2516)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 328)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 328)

    • Likely accesses (executes) a file from the Public directory

      • msedge.exe (PID: 3632)

    • Write to the desktop.ini file (may be used to cloak folders)

      • Trojan-Ransom.Win32.Purgen.fk-ecd3b069ea23e7905a1d4c4eff4a649cabef85bd541735ed810ab87cbf0ee9a3.exe (PID: 2516)

    • Reads browser cookies

      • Trojan-Ransom.Win32.Purgen.fk-ecd3b069ea23e7905a1d4c4eff4a649cabef85bd541735ed810ab87cbf0ee9a3.exe (PID: 2516)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 372)

    • Creates files or folders in the user directory

      • Trojan-Ransom.Win32.Purgen.fk-ecd3b069ea23e7905a1d4c4eff4a649cabef85bd541735ed810ab87cbf0ee9a3.exe (PID: 2516)

    • Manual execution by a user

      • Trojan-Ransom.Win32.Purgen.fk-ecd3b069ea23e7905a1d4c4eff4a649cabef85bd541735ed810ab87cbf0ee9a3.exe (PID: 2516)
      • msedge.exe (PID: 3632)

    • Checks supported languages

      • Trojan-Ransom.Win32.Purgen.fk-ecd3b069ea23e7905a1d4c4eff4a649cabef85bd541735ed810ab87cbf0ee9a3.exe (PID: 2516)

    • Create files in a temporary directory

      • Trojan-Ransom.Win32.Purgen.fk-ecd3b069ea23e7905a1d4c4eff4a649cabef85bd541735ed810ab87cbf0ee9a3.exe (PID: 2516)

    • Reads the machine GUID from the registry

      • Trojan-Ransom.Win32.Purgen.fk-ecd3b069ea23e7905a1d4c4eff4a649cabef85bd541735ed810ab87cbf0ee9a3.exe (PID: 2516)

    • Creates files in the program directory

      • Trojan-Ransom.Win32.Purgen.fk-ecd3b069ea23e7905a1d4c4eff4a649cabef85bd541735ed810ab87cbf0ee9a3.exe (PID: 2516)

    • Application launched itself

      • msedge.exe (PID: 3632)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2017:08:08 05:00:58+00:00
ArchivedFileName: Trojan-Ransom.Win32.Purgen.fk-ecd3b069ea23e7905a1d4c4eff4a649cabef85bd541735ed810ab87cbf0ee9a3.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
76
Monitored processes
35
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe THREAT trojan-ransom.win32.purgen.fk-ecd3b069ea23e7905a1d4c4eff4a649cabef85bd541735ed810ab87cbf0ee9a3.exe cmd.exe no specs vssadmin.exe no specs vssvc.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs attrib.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
216"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=4976 --field-trial-handle=1308,i,6458120509120752400,10455402203061390892,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
328C:\Windows\system32\cmd.exe /c C:\Users\admin\AppData\Local\Temp\__t46D8.tmp.batC:\Windows\System32\cmd.exe—Trojan-Ransom.Win32.Purgen.fk-ecd3b069ea23e7905a1d4c4eff4a649cabef85bd541735ed810ab87cbf0ee9a3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
255
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
348"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2232 --field-trial-handle=1308,i,6458120509120752400,10455402203061390892,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
372"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\Trojan-Ransom.Win32.Purgen.fk-ecd3b069ea23e7905a1d4c4eff4a649cabef85bd541735ed810ab87cbf0ee9a3.7zC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
692"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4036 --field-trial-handle=1308,i,6458120509120752400,10455402203061390892,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1400"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=3332 --field-trial-handle=1308,i,6458120509120752400,10455402203061390892,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1460"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=3304 --field-trial-handle=1308,i,6458120509120752400,10455402203061390892,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1592"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=2308 --field-trial-handle=1308,i,6458120509120752400,10455402203061390892,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1744"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 --field-trial-handle=1308,i,6458120509120752400,10455402203061390892,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1760"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4856 --field-trial-handle=1308,i,6458120509120752400,10455402203061390892,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
10 299
Read events
10 229
Write events
64
Delete events
6

Modification events

(PID) Process:(372) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(372) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(372) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(372) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(372) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(372) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(372) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Trojan-Ransom.Win32.Purgen.fk-ecd3b069ea23e7905a1d4c4eff4a649cabef85bd541735ed810ab87cbf0ee9a3.7z
(PID) Process:(372) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(372) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(372) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
24
Suspicious files
1 171
Text files
246
Unknown types
0

Dropped files

PID
Process
Filename
Type
2516Trojan-Ransom.Win32.Purgen.fk-ecd3b069ea23e7905a1d4c4eff4a649cabef85bd541735ed810ab87cbf0ee9a3.exeC:\autoexec.bat.707binary
MD5:388189B96888C79B22D978AF33FE5246
SHA256:608137396F5D6DA9608BA76F354EE82FA19DCE5A6054CE66D3E40F80076F1219
2516Trojan-Ransom.Win32.Purgen.fk-ecd3b069ea23e7905a1d4c4eff4a649cabef85bd541735ed810ab87cbf0ee9a3.exeC:\Users\admin\AppData\Local\Temp\{e29ac6c0-7037-11de-816d-806e6f6e6963}text
MD5:43C074E2E7F38B360754D27C9A84CBBE
SHA256:D8CEA55FA5324CB0A8E3AD25F213096F65532434997E472B681CA5B95BA8D239
2516Trojan-Ransom.Win32.Purgen.fk-ecd3b069ea23e7905a1d4c4eff4a649cabef85bd541735ed810ab87cbf0ee9a3.exeC:\Users\Public\Videos\Sample Videos\Wildlife.wmv —
MD5:—
SHA256:—
2516Trojan-Ransom.Win32.Purgen.fk-ecd3b069ea23e7905a1d4c4eff4a649cabef85bd541735ed810ab87cbf0ee9a3.exeC:\Users\Public\Videos\Sample Videos\Wildlife.wmv.707 —
MD5:—
SHA256:—
2516Trojan-Ransom.Win32.Purgen.fk-ecd3b069ea23e7905a1d4c4eff4a649cabef85bd541735ed810ab87cbf0ee9a3.exeC:\Users\admin\AppData\Local\Temp\__t46D8.tmp.battext
MD5:32D8F7A3D0C796CEE45F64B63C1CCA38
SHA256:1A6F73B5C28D1C10F63F2056068C1DE61487B8CF8F1DCF7516548DF144B3E9EA
2516Trojan-Ransom.Win32.Purgen.fk-ecd3b069ea23e7905a1d4c4eff4a649cabef85bd541735ed810ab87cbf0ee9a3.exeC:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\Trojan-Ransom.Win32.Purgen.fk-ecd3b069ea23e7905a1d4c4eff4a649cabef85bd541735ed810ab87cbf0ee9a3.exeexecutable
MD5:F3443F0A0582171901DF76C68C12C11D
SHA256:ECD3B069EA23E7905A1D4C4EFF4A649CABEF85BD541735ED810AB87CBF0EE9A3
372WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb372.12655\Trojan-Ransom.Win32.Purgen.fk-ecd3b069ea23e7905a1d4c4eff4a649cabef85bd541735ed810ab87cbf0ee9a3.exeexecutable
MD5:F3443F0A0582171901DF76C68C12C11D
SHA256:ECD3B069EA23E7905A1D4C4EFF4A649CABEF85BD541735ED810AB87CBF0EE9A3
2516Trojan-Ransom.Win32.Purgen.fk-ecd3b069ea23e7905a1d4c4eff4a649cabef85bd541735ed810ab87cbf0ee9a3.exeC:\config.sys.707binary
MD5:2B8997F5F749F75B808438C6494FA4C4
SHA256:AB7416EC714B4C7FAE2FD09828B3ED719CA2C574EE28C269740F885F48116F72
2516Trojan-Ransom.Win32.Purgen.fk-ecd3b069ea23e7905a1d4c4eff4a649cabef85bd541735ed810ab87cbf0ee9a3.exeC:\RECOVER-FILES.htmlhtml
MD5:560ABB40B6398E339B0522565D964A16
SHA256:40ABE4F2D7B9503B810555F90D8A6B9DCEA70B519052B914484A6CE62C8C8926
2516Trojan-Ransom.Win32.Purgen.fk-ecd3b069ea23e7905a1d4c4eff4a649cabef85bd541735ed810ab87cbf0ee9a3.exeC:\config.sysbinary
MD5:2B8997F5F749F75B808438C6494FA4C4
SHA256:AB7416EC714B4C7FAE2FD09828B3ED719CA2C574EE28C269740F885F48116F72
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
57
DNS requests
86
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3220
msedge.exe
GET
200
207.241.237.3:80
http://web.archive.org/
unknown
—
—
whitelisted
3220
msedge.exe
GET
200
207.241.224.2:80
http://archive.org/includes/build/css/archive.min.css?v=044db933
unknown
—
—
whitelisted
3220
msedge.exe
GET
200
207.241.224.2:80
http://archive.org/includes/athena.js?v=044db933
unknown
—
—
whitelisted
3220
msedge.exe
GET
200
207.241.224.2:80
http://archive.org/includes/apollo.js?v=044db933
unknown
—
—
whitelisted
3220
msedge.exe
GET
200
207.241.224.2:80
http://archive.org/components/npm/@webcomponents/webcomponentsjs/webcomponents-bundle.js?v=044db933
unknown
—
—
whitelisted
3220
msedge.exe
GET
200
207.241.224.2:80
http://archive.org/includes/build/js/ia-topnav.min.js?v=044db933
unknown
—
—
whitelisted
3220
msedge.exe
GET
200
207.241.224.2:80
http://archive.org/components/npm/lit/polyfill-support.js?v=044db933
unknown
—
—
whitelisted
3220
msedge.exe
GET
200
207.241.224.2:80
http://apollo.archive.org/js/container_kzRD6OIl.js
unknown
—
—
whitelisted
3220
msedge.exe
GET
200
207.241.224.2:80
http://archive.org/includes/build/js/archive.min.js?v=044db933
unknown
—
—
whitelisted
3220
msedge.exe
GET
200
207.241.225.195:80
http://athena.archive.org/0.gif?cache_bust=0.40949052539289976&kind=track_js&track_js_case=external_executes&service=ao_2&version=2&count=6
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3632
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
3220
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3220
msedge.exe
150.171.28.11:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3220
msedge.exe
104.26.4.59:443
serv1.xyz
CLOUDFLARENET
US
malicious
3220
msedge.exe
35.190.80.1:443
a.nel.cloudflare.com
—
—
whitelisted
3220
msedge.exe
92.123.104.62:443
www.bing.com
Akamai International B.V.
DE
whitelisted
3632
msedge.exe
224.0.0.251:5353
—
—
—
unknown

DNS requests

Domain
IP
Reputation
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 150.171.28.11
  • 150.171.27.11
whitelisted
serv1.xyz
  • 104.26.4.59
  • 104.26.5.59
  • 172.67.71.135
malicious
a.nel.cloudflare.com
  • 35.190.80.1
whitelisted
www.bing.com
  • 92.123.104.62
  • 92.123.104.58
  • 92.123.104.59
  • 92.123.104.53
  • 92.123.104.63
  • 92.123.104.54
  • 92.123.104.66
  • 92.123.104.56
  • 92.123.104.67
  • 92.123.104.32
  • 92.123.104.38
  • 92.123.104.41
  • 92.123.104.42
  • 92.123.104.36
  • 92.123.104.30
  • 92.123.104.35
  • 92.123.104.46
  • 92.123.104.33
whitelisted
satoshibox.com
  • 178.248.62.3
whitelisted
ntp.msn.com
  • 131.253.33.203
whitelisted
assets.msn.com
  • 23.50.131.84
  • 23.50.131.80
  • 23.50.131.76
  • 23.50.131.72
whitelisted
img-s-msn-com.akamaized.net
  • 184.24.77.12
  • 184.24.77.9
whitelisted
sb.scorecardresearch.com
  • 18.244.18.122
  • 18.244.18.27
  • 18.244.18.32
  • 18.244.18.38
whitelisted

Threats

PID
Process
Class
Message
3220
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
3220
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Trojan-Ransom.Win32.Purgen.fk-ecd3b069ea23e7905a1d4c4eff4a649cabef85bd541735ed810ab87cbf0ee9a3.7z