File name:

Endermanch@InfinityCrypt.exe

Full analysis: https://app.any.run/tasks/a13e8d11-6d29-455a-b545-ec87a4ca5a8f
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 20:46:45
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ransomware
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 4 sections
MD5:

B805DB8F6A84475EF76B795B0D1ED6AE

SHA1:

7711CB4873E58B7ADCF2A2B047B090E78D10C75B

SHA256:

F5D002BFE80B48386A6C99C41528931B7F5DF736CD34094463C3F85DDE0180BF

SSDEEP:

1536:YoCFfC303p22fkZrRQpnqjoi7l832fbu9ZXILwVENbMz:rCVC303p22sZrRQpnviB832Du9WMONu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • Endermanch@InfinityCrypt.exe (PID: 4784)

  • SUSPICIOUS

    • Contacting a server suspected of hosting an CnC

      • Endermanch@InfinityCrypt.exe (PID: 4784)

  • INFO

    • Creates files or folders in the user directory

      • Endermanch@InfinityCrypt.exe (PID: 4784)

    • Reads the computer name

      • Endermanch@InfinityCrypt.exe (PID: 4784)

    • Disables trace logs

      • Endermanch@InfinityCrypt.exe (PID: 4784)

    • Checks supported languages

      • Endermanch@InfinityCrypt.exe (PID: 4784)

    • Reads CPU info

      • Endermanch@InfinityCrypt.exe (PID: 4784)

    • Reads the machine GUID from the registry

      • Endermanch@InfinityCrypt.exe (PID: 4784)

    • Checks proxy server information

      • Endermanch@InfinityCrypt.exe (PID: 4784)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (55.8)
.exe | Win64 Executable (generic) (21)
.scr | Windows screen saver (9.9)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:06:14 15:34:11+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 189440
InitializedDataSize: 25600
UninitializedDataSize: -
EntryPoint: 0x3035e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 2.3.77.2
ProductVersionNumber: 2.3.77.2
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: PremiereCrack
CompanyName: Adobe Inc.
FileDescription: PremiereCrack
FileVersion: 2.3.77.2
InternalName: PremiereCrack.exe
LegalCopyright: Copyright © Adobe 2017
LegalTrademarks: Adobe Inc.
OriginalFileName: PremiereCrack.exe
ProductName: PremiereCrack
ProductVersion: 2.3.77.2
AssemblyVersion: 2.3.77.2
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
128
Monitored processes
3
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start endermanch@infinitycrypt.exe sppextcomobj.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
4228C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4784"C:\Users\admin\AppData\Local\Temp\Endermanch@InfinityCrypt.exe" C:\Users\admin\AppData\Local\Temp\Endermanch@InfinityCrypt.exe
explorer.exe
User:
admin
Company:
Adobe Inc.
Integrity Level:
MEDIUM
Description:
PremiereCrack
Version:
2.3.77.2
Modules
Images
c:\users\admin\appdata\local\temp\endermanch@infinitycrypt.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5304"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
925
Read events
911
Write events
14
Delete events
0

Modification events

(PID) Process:(4784) Endermanch@InfinityCrypt.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Endermanch@InfinityCrypt_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4784) Endermanch@InfinityCrypt.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Endermanch@InfinityCrypt_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4784) Endermanch@InfinityCrypt.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Endermanch@InfinityCrypt_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4784) Endermanch@InfinityCrypt.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Endermanch@InfinityCrypt_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(4784) Endermanch@InfinityCrypt.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Endermanch@InfinityCrypt_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(4784) Endermanch@InfinityCrypt.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Endermanch@InfinityCrypt_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(4784) Endermanch@InfinityCrypt.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Endermanch@InfinityCrypt_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(4784) Endermanch@InfinityCrypt.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Endermanch@InfinityCrypt_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4784) Endermanch@InfinityCrypt.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Endermanch@InfinityCrypt_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4784) Endermanch@InfinityCrypt.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Endermanch@InfinityCrypt_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
0
Suspicious files
54
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
4784Endermanch@InfinityCrypt.exeC:\Users\admin\Documents\expectedrecord.rtf.C428C0EA7179835CF44B6AD71BFAB7BD6920E1308919C7A1E3610A3F2725E0B0binary
MD5:497659BF215C8629E084EFC20414E320
SHA256:DB07C3A6ADC85A5CCE15D143CA127BF39C658A820770CB3730278A03C5C47DFE
4784Endermanch@InfinityCrypt.exeC:\Users\admin\Documents\Outlook Files\Outlook.pst.C428C0EA7179835CF44B6AD71BFAB7BD6920E1308919C7A1E3610A3F2725E0B0binary
MD5:CB9FBB51638053BD05939622610B5F98
SHA256:62964E375A2CAAD656C69F81D2F6DDB9690FD415E8FF6A3F21A87EA58A9B22F4
4784Endermanch@InfinityCrypt.exeC:\Users\admin\Documents\characterl.rtf.C428C0EA7179835CF44B6AD71BFAB7BD6920E1308919C7A1E3610A3F2725E0B0binary
MD5:64B0FCF454AF27125B6D9DE463AECBEC
SHA256:1491ADFE1ACB190EC9019618689FC6D3A212BD83CCECCD43D51D3ABEC34A9137
4784Endermanch@InfinityCrypt.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini.C428C0EA7179835CF44B6AD71BFAB7BD6920E1308919C7A1E3610A3F2725E0B0binary
MD5:6A80FD6C4F172DD7BDF3277062CD43C5
SHA256:FE0A4461A3AB037B223C44CC51C24F1FE2EED27A8A6B69EB3B83AD5B911CDB82
4784Endermanch@InfinityCrypt.exeC:\Users\admin\Documents\OneNote Notebooks\My Notebook\Quick Notes.one.C428C0EA7179835CF44B6AD71BFAB7BD6920E1308919C7A1E3610A3F2725E0B0binary
MD5:130DB352C43CA584952D06AFB5DC8B41
SHA256:B13365483BBEE56C6CB8064E15E5A42738A4EC0057B7B10A43BF9780867816F9
4784Endermanch@InfinityCrypt.exeC:\Users\admin\Documents\PowerShell\Modules\PSSQLite\1.1.0\Invoke-SqliteBulkCopy.ps1.C428C0EA7179835CF44B6AD71BFAB7BD6920E1308919C7A1E3610A3F2725E0B0binary
MD5:874528BBB187885A954BE54C3F02A205
SHA256:287927634C2BFADE554F7BC9DBF86CC75CB4F5F5F1486DC497D5D3E3D5E64C90
4784Endermanch@InfinityCrypt.exeC:\Users\admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2.C428C0EA7179835CF44B6AD71BFAB7BD6920E1308919C7A1E3610A3F2725E0B0binary
MD5:A91B284B348BF2257205CFF41B9D7EBB
SHA256:AA38A59771CCFE74568202199A24DCD6A4E15AF3466CE3E9462579865FC2939F
4784Endermanch@InfinityCrypt.exeC:\Users\admin\Documents\presidentchicago.rtf.C428C0EA7179835CF44B6AD71BFAB7BD6920E1308919C7A1E3610A3F2725E0B0binary
MD5:491C17F36A910E68D9E8781E8CD2F206
SHA256:049F64E3BD9936AFBBFC52A6F5194E5B36552887E2924184FCF754622559FAB8
4784Endermanch@InfinityCrypt.exeC:\Users\admin\Documents\PowerShell\Modules\PSSQLite\1.1.0\Invoke-SqliteQuery.ps1.C428C0EA7179835CF44B6AD71BFAB7BD6920E1308919C7A1E3610A3F2725E0B0binary
MD5:1349542C43CC642175D3DBA08DA9D795
SHA256:8982A11371FC807722EDC30C46C70D88465975647AA559FD9DFF3888933B3C5F
4784Endermanch@InfinityCrypt.exeC:\Users\admin\Documents\materialtypes.rtf.C428C0EA7179835CF44B6AD71BFAB7BD6920E1308919C7A1E3610A3F2725E0B0binary
MD5:638FBBD62B00B1F286D0B5971B8ED527
SHA256:41F645338F292553C5A50B734F7C7A9947570BDC63DEA7F568DEDA67299FA41A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
40
DNS requests
13
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4784
Endermanch@InfinityCrypt.exe
GET
404
162.55.0.137:80
http://arizonacode.bplaced.net/rnsm/add.php?type=add&data=InfinityCrypt%7Cadmin%7CwWrVVxXxawBFxXxxcjKxXx7rsdxXxZiR7xXxBj6yxXx%7CMicrosoft%20Windows%2010%20Pro%7CC428C0EA7179835CF44B6AD71BFAB7BD6920E1308919C7A1E3610A3F2725E0B0%7C54
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4784
Endermanch@InfinityCrypt.exe
162.55.0.137:80
arizonacode.bplaced.net
Hetzner Online GmbH
DE
whitelisted
6544
svchost.exe
40.126.32.136:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 142.250.186.78
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
arizonacode.bplaced.net
  • 162.55.0.137
whitelisted
login.live.com
  • 40.126.32.136
  • 20.190.160.66
  • 20.190.160.2
  • 20.190.160.65
  • 20.190.160.130
  • 20.190.160.131
  • 40.126.32.74
  • 40.126.32.138
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
  • 2603:1030:408:7::3d
whitelisted
171.39.242.20.in-addr.arpa
  • —
unknown
d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa
  • —
unknown

Threats

PID
Process
Class
Message
4784
Endermanch@InfinityCrypt.exe
Malware Command and Control Activity Detected
RANSOMWARE [ANY.RUN] InfinityLock Ransomware CnC Communication
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Endermanch@InfinityCrypt.exe