File name:

Infinite_Jump-Installer.exe

Full analysis: https://app.any.run/tasks/1952381c-cc60-418c-8585-838e567ddec6
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Analysis date: June 21, 2025, 17:18:05
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
adware
discord
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

E2E0D3A15093E5E2A27CD135DBC9B8B2

SHA1:

A69045FE17B837FC1BD7D7B3CBC144560B0A31F0

SHA256:

E9CD46CC9350739DBEB6A6B5A3C364A05739E7F04659E50DB6458719D9A822CC

SSDEEP:

98304:vUdAexizPT/j6RMIqmXieMDFMh34rUWYnJN0wA/OQRunYnElnItUjBNC2Qq3Z0Ix:D

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • ADWARE has been detected (SURICATA)

      • Infinite_Jump-Installer.exe (PID: 4888)
  • SUSPICIOUS

    • Searches for installed software

      • Infinite_Jump-Installer.exe (PID: 4888)
    • Reads security settings of Internet Explorer

      • Infinite_Jump-Installer.exe (PID: 4888)
    • Access to an unwanted program domain was detected

      • Infinite_Jump-Installer.exe (PID: 4888)
    • There is functionality for taking screenshot (YARA)

      • Infinite_Jump-Installer.exe (PID: 4888)
  • INFO

    • Checks supported languages

      • Infinite_Jump-Installer.exe (PID: 4888)
    • Checks proxy server information

      • Infinite_Jump-Installer.exe (PID: 4888)
    • Reads the software policy settings

      • Infinite_Jump-Installer.exe (PID: 4888)
    • Reads the computer name

      • Infinite_Jump-Installer.exe (PID: 4888)
    • Creates files or folders in the user directory

      • Infinite_Jump-Installer.exe (PID: 4888)
    • Reads the machine GUID from the registry

      • Infinite_Jump-Installer.exe (PID: 4888)
    • Create files in a temporary directory

      • Infinite_Jump-Installer.exe (PID: 4888)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:07:02 16:37:43+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.21
CodeSize: 3804672
InitializedDataSize: 1515008
UninitializedDataSize: -
EntryPoint: 0x3207aa
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ADWARE infinite_jump-installer.exe rundll32.exe no specs infinite_jump-installer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
640C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
4888"C:\Users\admin\AppData\Local\Temp\Infinite_Jump-Installer.exe" C:\Users\admin\AppData\Local\Temp\Infinite_Jump-Installer.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\infinite_jump-installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6640"C:\Users\admin\AppData\Local\Temp\Infinite_Jump-Installer.exe" C:\Users\admin\AppData\Local\Temp\Infinite_Jump-Installer.exeexplorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\infinite_jump-installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
1 134
Read events
1 113
Write events
3
Delete events
18

Modification events

(PID) Process:(4888) Infinite_Jump-Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4888) Infinite_Jump-Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4888) Infinite_Jump-Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4888) Infinite_Jump-Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Spelling\Dictionaries
Operation:delete valueName:en-us
Value:
(PID) Process:(4888) Infinite_Jump-Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Spelling\Dictionaries
Operation:delete valueName:en
Value:
(PID) Process:(4888) Infinite_Jump-Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Spelling\Dictionaries
Operation:delete valueName:_Global_
Value:
Executable files
0
Suspicious files
6
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
4888Infinite_Jump-Installer.exeC:\Users\admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dictext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
4888Infinite_Jump-Installer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:73CBBB1679BDB26C080B40B4960A2B1F
SHA256:E5C66E175F79A60ECB5FC7CEC0214CC662FBD5D8B48B0ED273C63769CF855BF7
4888Infinite_Jump-Installer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CCED0039564BBA651D2D6C127995A918binary
MD5:68AF866706DF5E18978EA93EB0028C88
SHA256:5CDE4A37DF8857FC48A7149F1884AC66FF0659372EEE98FDB408ED34A1DB3207
4888Infinite_Jump-Installer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:5CB371C2515454ACAD2A6F80ED1B6F54
SHA256:0630782CB23C9FB513903984FD765ED3887CB65201AB22B44CEE68DDCB17C844
4888Infinite_Jump-Installer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:1FBB37F79B317A9A248E7C4CE4F5BAC5
SHA256:9BF639C595FE335B6F694EE35990BEFD2123F5E07FD1973FF619E3FC88F5F49F
4888Infinite_Jump-Installer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CCED0039564BBA651D2D6C127995A918binary
MD5:925DBDAC32C13C3D6C689BFDF02ED485
SHA256:BF8D7E7BD7C860E06E8429622A4CCB0E5CC1F9018EC2F6E1B3DEE43FC04DFCF1
4888Infinite_Jump-Installer.exeC:\Users\admin\AppData\Roaming\Microsoft\Spelling\en-US\default.acltext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
4888Infinite_Jump-Installer.exeC:\Users\admin\AppData\Local\Temp\Infinite_Jump.exetext
MD5:A1CA4BEBCD03FAFBE2B06A46A694E29A
SHA256:C3FA59901D56CE8A95A303B22FD119CB94ABF4F43C4F6D60A81FD78B7D00FA65
4888Infinite_Jump-Installer.exeC:\Users\admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exctext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
4888Infinite_Jump-Installer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:4A90329071AE30B759D279CCA342B0A6
SHA256:4F544379EDA8E2653F71472AB968AEFD6B5D1F4B3CE28A5EDB14196184ED3B60
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
28
DNS requests
15
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4888
Infinite_Jump-Installer.exe
POST
404
35.190.60.70:80
http://dlsft.com/callback/geo/geo.php
unknown
malicious
4888
Infinite_Jump-Installer.exe
GET
404
35.190.60.70:80
http://dlsft.com/callback/offers.php
unknown
malicious
4888
Infinite_Jump-Installer.exe
POST
200
35.190.60.70:80
http://dlsft.com/callback/?channel=Wrd&action=started
unknown
whitelisted
4888
Infinite_Jump-Installer.exe
GET
200
104.18.20.213:80
http://e5.c.lencr.org/17.crl
unknown
whitelisted
4888
Infinite_Jump-Installer.exe
POST
200
35.190.60.70:80
http://dlsft.com/callback/?channel=Wrd&action=completed
unknown
whitelisted
4888
Infinite_Jump-Installer.exe
GET
200
172.217.18.3:80
http://c.pki.goog/r/gsr1.crl
unknown
whitelisted
4888
Infinite_Jump-Installer.exe
GET
200
172.217.18.3:80
http://c.pki.goog/r/r4.crl
unknown
whitelisted
1816
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
184.25.50.10:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
5944
MoUsoCoreWorker.exe
20.73.194.208:443
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5116
RUXIMICS.exe
20.73.194.208:443
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
20.73.194.208:443
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4888
Infinite_Jump-Installer.exe
104.26.7.147:443
wearedevs.net
CLOUDFLARENET
US
whitelisted
4888
Infinite_Jump-Installer.exe
35.190.60.70:80
dlsft.com
GOOGLE
US
whitelisted
4888
Infinite_Jump-Installer.exe
104.18.20.213:80
e5.c.lencr.org
CLOUDFLARENET
whitelisted
4
System
192.168.100.255:138
whitelisted
4888
Infinite_Jump-Installer.exe
162.159.133.233:443
cdn.discordapp.com
CLOUDFLARENET
whitelisted
4888
Infinite_Jump-Installer.exe
172.217.18.3:80
c.pki.goog
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.16.206
whitelisted
wearedevs.net
  • 104.26.7.147
  • 104.26.6.147
  • 172.67.71.2
whitelisted
dlsft.com
  • 35.190.60.70
unknown
e5.c.lencr.org
  • 104.18.20.213
  • 104.18.21.213
whitelisted
cdn.discordapp.com
  • 162.159.133.233
  • 162.159.134.233
  • 162.159.129.233
  • 162.159.130.233
  • 162.159.135.233
whitelisted
c.pki.goog
  • 172.217.18.3
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.66
  • 40.126.32.68
  • 20.190.160.4
  • 20.190.160.132
  • 40.126.32.133
  • 40.126.32.134
  • 20.190.160.67
  • 40.126.32.136
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
nexusrules.officeapps.live.com
  • 52.111.243.30
whitelisted

Threats

PID
Process
Class
Message
4888
Infinite_Jump-Installer.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Win32/LinkPadBundle (geolocation request)
2200
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discordapp .com)
4888
Infinite_Jump-Installer.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
No debug info