File name:

Endermanch@InfinityCrypt.exe

Full analysis: https://app.any.run/tasks/a13e8d11-6d29-455a-b545-ec87a4ca5a8f
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 20:46:45
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ransomware
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 4 sections
MD5:

B805DB8F6A84475EF76B795B0D1ED6AE

SHA1:

7711CB4873E58B7ADCF2A2B047B090E78D10C75B

SHA256:

F5D002BFE80B48386A6C99C41528931B7F5DF736CD34094463C3F85DDE0180BF

SSDEEP:

1536:YoCFfC303p22fkZrRQpnqjoi7l832fbu9ZXILwVENbMz:rCVC303p22sZrRQpnviB832Du9WMONu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • Endermanch@InfinityCrypt.exe (PID: 4784)

  • SUSPICIOUS

    • Contacting a server suspected of hosting an CnC

      • Endermanch@InfinityCrypt.exe (PID: 4784)

  • INFO

    • Reads the machine GUID from the registry

      • Endermanch@InfinityCrypt.exe (PID: 4784)

    • Reads the computer name

      • Endermanch@InfinityCrypt.exe (PID: 4784)

    • Checks supported languages

      • Endermanch@InfinityCrypt.exe (PID: 4784)

    • Reads CPU info

      • Endermanch@InfinityCrypt.exe (PID: 4784)

    • Creates files or folders in the user directory

      • Endermanch@InfinityCrypt.exe (PID: 4784)

    • Disables trace logs

      • Endermanch@InfinityCrypt.exe (PID: 4784)

    • Checks proxy server information

      • Endermanch@InfinityCrypt.exe (PID: 4784)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (55.8)
.exe | Win64 Executable (generic) (21)
.scr | Windows screen saver (9.9)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:06:14 15:34:11+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 189440
InitializedDataSize: 25600
UninitializedDataSize: -
EntryPoint: 0x3035e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 2.3.77.2
ProductVersionNumber: 2.3.77.2
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: PremiereCrack
CompanyName: Adobe Inc.
FileDescription: PremiereCrack
FileVersion: 2.3.77.2
InternalName: PremiereCrack.exe
LegalCopyright: Copyright © Adobe 2017
LegalTrademarks: Adobe Inc.
OriginalFileName: PremiereCrack.exe
ProductName: PremiereCrack
ProductVersion: 2.3.77.2
AssemblyVersion: 2.3.77.2
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
128
Monitored processes
3
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start endermanch@infinitycrypt.exe sppextcomobj.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
4228C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4784"C:\Users\admin\AppData\Local\Temp\Endermanch@InfinityCrypt.exe" C:\Users\admin\AppData\Local\Temp\Endermanch@InfinityCrypt.exe
explorer.exe
User:
admin
Company:
Adobe Inc.
Integrity Level:
MEDIUM
Description:
PremiereCrack
Version:
2.3.77.2
Modules
Images
c:\users\admin\appdata\local\temp\endermanch@infinitycrypt.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5304"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
925
Read events
911
Write events
14
Delete events
0

Modification events

(PID) Process:(4784) Endermanch@InfinityCrypt.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Endermanch@InfinityCrypt_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4784) Endermanch@InfinityCrypt.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Endermanch@InfinityCrypt_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4784) Endermanch@InfinityCrypt.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Endermanch@InfinityCrypt_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4784) Endermanch@InfinityCrypt.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Endermanch@InfinityCrypt_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(4784) Endermanch@InfinityCrypt.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Endermanch@InfinityCrypt_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(4784) Endermanch@InfinityCrypt.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Endermanch@InfinityCrypt_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(4784) Endermanch@InfinityCrypt.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Endermanch@InfinityCrypt_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(4784) Endermanch@InfinityCrypt.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Endermanch@InfinityCrypt_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4784) Endermanch@InfinityCrypt.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Endermanch@InfinityCrypt_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4784) Endermanch@InfinityCrypt.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Endermanch@InfinityCrypt_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
0
Suspicious files
54
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
4784Endermanch@InfinityCrypt.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini.C428C0EA7179835CF44B6AD71BFAB7BD6920E1308919C7A1E3610A3F2725E0B0binary
MD5:317CE110CFCE2D46744C6698877D64BE
SHA256:9F378F9A5B46A50BDE357D2D6D59B3754630F560A4CC3976C2DFD67F3F4D65C4
4784Endermanch@InfinityCrypt.exeC:\Users\admin\Documents\Database1.accdb.C428C0EA7179835CF44B6AD71BFAB7BD6920E1308919C7A1E3610A3F2725E0B0binary
MD5:6A406EFDFDF17DC9FFACCD15DEA32412
SHA256:80A9A5808D1AD8EBCD52613D2853420E503AC77B55C5A9B90E64E3D52BAC4F8B
4784Endermanch@InfinityCrypt.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini.C428C0EA7179835CF44B6AD71BFAB7BD6920E1308919C7A1E3610A3F2725E0B0binary
MD5:6A80FD6C4F172DD7BDF3277062CD43C5
SHA256:FE0A4461A3AB037B223C44CC51C24F1FE2EED27A8A6B69EB3B83AD5B911CDB82
4784Endermanch@InfinityCrypt.exeC:\Users\admin\Documents\characterl.rtf.C428C0EA7179835CF44B6AD71BFAB7BD6920E1308919C7A1E3610A3F2725E0B0binary
MD5:64B0FCF454AF27125B6D9DE463AECBEC
SHA256:1491ADFE1ACB190EC9019618689FC6D3A212BD83CCECCD43D51D3ABEC34A9137
4784Endermanch@InfinityCrypt.exeC:\Users\admin\Documents\monfather.rtf.C428C0EA7179835CF44B6AD71BFAB7BD6920E1308919C7A1E3610A3F2725E0B0binary
MD5:0BDB6153B5DFE394AC99865B6DD4B6A5
SHA256:711C04DB9283F95CE9CF0DA45DE397A9CE02C0AAB5D0A966275B2A61C723D01F
4784Endermanch@InfinityCrypt.exeC:\Users\admin\Documents\expectedrecord.rtf.C428C0EA7179835CF44B6AD71BFAB7BD6920E1308919C7A1E3610A3F2725E0B0binary
MD5:497659BF215C8629E084EFC20414E320
SHA256:DB07C3A6ADC85A5CCE15D143CA127BF39C658A820770CB3730278A03C5C47DFE
4784Endermanch@InfinityCrypt.exeC:\Users\admin\Documents\PowerShell\Modules\PSSQLite\1.1.0\Update-Sqlite.ps1.C428C0EA7179835CF44B6AD71BFAB7BD6920E1308919C7A1E3610A3F2725E0B0binary
MD5:592319AA9A9B9D889FE97E07F4AF9D68
SHA256:E626EDF3684494A92A7F24449E39589CC16223ABFD34045EBB7B2610E9419B27
4784Endermanch@InfinityCrypt.exeC:\Users\admin\Documents\PowerShell\Modules\PSSQLite\1.1.0\Invoke-SqliteBulkCopy.ps1.C428C0EA7179835CF44B6AD71BFAB7BD6920E1308919C7A1E3610A3F2725E0B0binary
MD5:874528BBB187885A954BE54C3F02A205
SHA256:287927634C2BFADE554F7BC9DBF86CC75CB4F5F5F1486DC497D5D3E3D5E64C90
4784Endermanch@InfinityCrypt.exeC:\Users\admin\Documents\PowerShell\Modules\PSSQLite\1.1.0\Invoke-SqliteQuery.ps1.C428C0EA7179835CF44B6AD71BFAB7BD6920E1308919C7A1E3610A3F2725E0B0binary
MD5:1349542C43CC642175D3DBA08DA9D795
SHA256:8982A11371FC807722EDC30C46C70D88465975647AA559FD9DFF3888933B3C5F
4784Endermanch@InfinityCrypt.exeC:\Users\admin\Documents\PowerShell\Modules\PSSQLite\1.1.0\New-SqliteConnection.ps1.C428C0EA7179835CF44B6AD71BFAB7BD6920E1308919C7A1E3610A3F2725E0B0binary
MD5:A6C3941C0AD502E42605C47B61160B14
SHA256:A7C9A20A985F142D1DC7350B6CAE1C9C69A4C035BF0739EE60C85C2711254359
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
40
DNS requests
13
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4784
Endermanch@InfinityCrypt.exe
GET
404
162.55.0.137:80
http://arizonacode.bplaced.net/rnsm/add.php?type=add&data=InfinityCrypt%7Cadmin%7CwWrVVxXxawBFxXxxcjKxXx7rsdxXxZiR7xXxBj6yxXx%7CMicrosoft%20Windows%2010%20Pro%7CC428C0EA7179835CF44B6AD71BFAB7BD6920E1308919C7A1E3610A3F2725E0B0%7C54
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4784
Endermanch@InfinityCrypt.exe
162.55.0.137:80
arizonacode.bplaced.net
Hetzner Online GmbH
DE
whitelisted
6544
svchost.exe
40.126.32.136:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 142.250.186.78
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
arizonacode.bplaced.net
  • 162.55.0.137
whitelisted
login.live.com
  • 40.126.32.136
  • 20.190.160.66
  • 20.190.160.2
  • 20.190.160.65
  • 20.190.160.130
  • 20.190.160.131
  • 40.126.32.74
  • 40.126.32.138
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
  • 2603:1030:408:7::3d
whitelisted
171.39.242.20.in-addr.arpa
  • —
unknown
d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa
  • —
unknown

Threats

PID
Process
Class
Message
4784
Endermanch@InfinityCrypt.exe
Malware Command and Control Activity Detected
RANSOMWARE [ANY.RUN] InfinityLock Ransomware CnC Communication
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Endermanch@InfinityCrypt.exe