File name:

jokeware.exe

Full analysis: https://app.any.run/tasks/ee516333-499c-4b9e-8fe1-f5e5f1f98a11
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 21, 2025, 18:49:48
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
desktopboom
endermanch
auto
generic
delphi
aspack
badjoke
ahk
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 7 sections
MD5:

DE539DE4B9010ECFB4234F3FA1B0E9B6

SHA1:

6DDC2FBAF2EC9BCE7CD027E2ABF3E7AA9E433B3F

SHA256:

5275EA158F1F258864B9026E7124BE41AB06C06B09B7DB5EC2306D6959A43625

SSDEEP:

98304:prL6kpK7J5Ks+o02K93YpWnTb1kVmUV7Vt6+26hFmTztG4E+1e9xuMWudny3MzMS:znMjz47u6dBYqys5g+1Ix

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • DESKTOPBOOM has been detected

      • jokeware.exe (PID: 1628)

    • Disables task manager

      • Endermanch@Trololo.exe (PID: 7404)

    • BADJOKE has been detected (YARA)

      • Endermanch@Avoid.exe (PID: 4880)

    • AHK has been detected (YARA)

      • Endermanch@DesktopBoom.exe (PID: 2096)

    • GENERIC has been found (auto)

      • jokeware.exe (PID: 1628)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • jokeware.exe (PID: 1628)

    • Reads the date of Windows installation

      • jokeware.exe (PID: 1628)

    • Reads security settings of Internet Explorer

      • jokeware.exe (PID: 1628)
      • Endermanch@ChilledWindows.exe (PID: 4756)

    • Executing commands from a ".bat" file

      • jokeware.exe (PID: 1628)

    • The executable file from the user directory is run by the CMD process

      • Endermanch@ChilledWindows.exe (PID: 4756)
      • Endermanch@CrazyNCS.exe (PID: 6656)
      • Endermanch@Avoid.exe (PID: 4880)
      • Endermanch@DesktopBoom.exe (PID: 2096)
      • Endermanch@Curfun.exe (PID: 4164)
      • Endermanch@Hydra.exe (PID: 7184)
      • Endermanch@Flasher.exe (PID: 4228)
      • Endermanch@Launcher.exe (PID: 7192)
      • Endermanch@Trololo.exe (PID: 7404)
      • jokeware.exe (PID: 7636)
      • Endermanch@Popup.exe (PID: 7212)
      • Endermanch@Windows-KB2670838.msu.exe (PID: 7584)
      • Endermanch@ScreenScrew.exe (PID: 7220)
      • Endermanch@Time.exe (PID: 7232)
      • Endermanch@Vista.exe (PID: 7412)
      • RainbowIsKawaii@CookieClickerHack.exe (PID: 7648)
      • Endermanch@WindowsUpdate.exe (PID: 7608)
      • Zer0Mem0ry@Melting.exe (PID: 7668)

    • Starts CMD.EXE for commands execution

      • jokeware.exe (PID: 1628)

    • Starts a Microsoft application from unusual location

      • Endermanch@Hydra.exe (PID: 7184)
      • Endermanch@Windows-KB2670838.msu.exe (PID: 7584)

    • Uses TASKKILL.EXE to kill process

      • Endermanch@Trololo.exe (PID: 7404)

    • SQL CE related mutex has been found

      • Endermanch@ChilledWindows.exe (PID: 4756)

    • There is functionality for taking screenshot (YARA)

      • Endermanch@Avoid.exe (PID: 4880)
      • Endermanch@Curfun.exe (PID: 4164)
      • Endermanch@Flasher.exe (PID: 4228)
      • Endermanch@DesktopBoom.exe (PID: 2096)
      • Endermanch@Launcher.exe (PID: 7192)
      • Endermanch@Popup.exe (PID: 7212)
      • Endermanch@CrazyNCS.exe (PID: 6656)
      • Endermanch@ScreenScrew.exe (PID: 7220)
      • Endermanch@Time.exe (PID: 7232)
      • Endermanch@Vista.exe (PID: 7412)

    • Process drops legitimate windows executable

      • jokeware.exe (PID: 1628)

  • INFO

    • Create files in a temporary directory

      • jokeware.exe (PID: 1628)
      • Endermanch@ChilledWindows.exe (PID: 4756)

    • The sample compiled with english language support

      • jokeware.exe (PID: 1628)

    • Reads the computer name

      • jokeware.exe (PID: 1628)
      • Endermanch@Trololo.exe (PID: 7404)
      • RainbowIsKawaii@CookieClickerHack.exe (PID: 7648)

    • Process checks computer location settings

      • jokeware.exe (PID: 1628)

    • Checks supported languages

      • jokeware.exe (PID: 1628)

    • Creates files or folders in the user directory

      • Endermanch@ChilledWindows.exe (PID: 4756)

    • Reads the machine GUID from the registry

      • Endermanch@ChilledWindows.exe (PID: 4756)

    • Checks proxy server information

      • Endermanch@ChilledWindows.exe (PID: 4756)

    • Compiled with Borland Delphi (YARA)

      • Endermanch@Avoid.exe (PID: 4880)
      • Endermanch@CrazyNCS.exe (PID: 6656)
      • Endermanch@ChilledWindows.exe (PID: 4756)
      • Endermanch@Curfun.exe (PID: 4164)
      • Endermanch@DesktopBoom.exe (PID: 2096)
      • Endermanch@Flasher.exe (PID: 4228)
      • Endermanch@Hydra.exe (PID: 7184)
      • Endermanch@Launcher.exe (PID: 7192)
      • Endermanch@Popup.exe (PID: 7212)
      • Endermanch@Time.exe (PID: 7232)
      • Endermanch@Trololo.exe (PID: 7404)
      • Endermanch@Vista.exe (PID: 7412)
      • Endermanch@ScreenScrew.exe (PID: 7220)

    • Aspack has been detected

      • Endermanch@Avoid.exe (PID: 4880)
      • Endermanch@Popup.exe (PID: 7212)
      • Endermanch@Launcher.exe (PID: 7192)
      • Endermanch@Flasher.exe (PID: 4228)
      • Endermanch@Vista.exe (PID: 7412)
      • Endermanch@ScreenScrew.exe (PID: 7220)

    • Detects AutoHotkey samples (YARA)

      • Endermanch@DesktopBoom.exe (PID: 2096)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:03:18 08:55:43+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.42
CodeSize: 307200
InitializedDataSize: 208384
UninitializedDataSize: -
EntryPoint: 0x32690
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
163
Monitored processes
27
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #DESKTOPBOOM jokeware.exe cmd.exe no specs #BADJOKE endermanch@avoid.exe no specs endermanch@chilledwindows.exe no specs endermanch@crazyncs.exe no specs endermanch@curfun.exe no specs #AHK endermanch@desktopboom.exe no specs endermanch@flasher.exe no specs endermanch@hydra.exe no specs endermanch@launcher.exe no specs endermanch@popup.exe no specs endermanch@screenscrew.exe no specs endermanch@time.exe no specs endermanch@trololo.exe endermanch@vista.exe no specs sppextcomobj.exe no specs endermanch@windows-kb2670838.msu.exe endermanch@windowsupdate.exe no specs jokeware.exe no specs rainbowiskawaii@cookieclickerhack.exe no specs zer0mem0ry@melting.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs searchapp.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
664C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\jokeload.bat" "C:\Windows\System32\cmd.exe—jokeware.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
1628"C:\Users\admin\AppData\Local\Temp\jokeware.exe" C:\Users\admin\AppData\Local\Temp\jokeware.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\jokeware.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2096"C:\Users\admin\AppData\Local\Temp\Endermanch@DesktopBoom.exe" C:\Users\admin\AppData\Local\Temp\Endermanch@DesktopBoom.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Description:
DesktopBoom - by Nay1l
Version:
1.0.0.0
4164"C:\Users\admin\AppData\Local\Temp\Endermanch@Curfun.exe" C:\Users\admin\AppData\Local\Temp\Endermanch@Curfun.exe—cmd.exe
User:
admin
Company:
RJL Software
Integrity Level:
MEDIUM
Description:
Randomly changes cursor
Version:
1.0.1.0
4228"C:\Users\admin\AppData\Local\Temp\Endermanch@Flasher.exe" C:\Users\admin\AppData\Local\Temp\Endermanch@Flasher.exe—cmd.exe
User:
admin
Company:
RJL Software, Inc.
Integrity Level:
MEDIUM
Description:
Flashes any image to the screen quickly.
Version:
1.0.0.0
Modules
Images
c:\windows\syswow64\kernel.appcore.dll
c:\windows\syswow64\bcryptprimitives.dll
c:\windows\syswow64\textinputframework.dll
c:\windows\syswow64\coreuicomponents.dll
c:\windows\syswow64\shcore.dll
c:\windows\syswow64\coremessaging.dll
c:\windows\syswow64\ws2_32.dll
c:\windows\syswow64\ntmarta.dll
c:\windows\syswow64\wintypes.dll
4756"C:\Users\admin\AppData\Local\Temp\Endermanch@ChilledWindows.exe" C:\Users\admin\AppData\Local\Temp\Endermanch@ChilledWindows.exe—cmd.exe
User:
admin
Company:
GAMELASTER
Integrity Level:
MEDIUM
Description:
ChilledWindows
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\windows\system32\mlang.dll
c:\windows\assembly\nativeimages_v4.0.30319_64\presentatioaec034ca#\8c21e4c17cb311c9b7f5d3cf12e3da9b\presentationframework.aero2.ni.dll
c:\windows\system32\winmm.dll
c:\windows\system32\wmnetmgr.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\netutils.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\mscms.dll
c:\windows\system32\userenv.dll
4880"C:\Users\admin\AppData\Local\Temp\Endermanch@Avoid.exe" C:\Users\admin\AppData\Local\Temp\Endermanch@Avoid.exe
cmd.exe
User:
admin
Company:
RJL Software, Inc.
Integrity Level:
MEDIUM
Description:
Start Button avoids the mouse cursor.
Version:
1.0.1.0
6656"C:\Users\admin\AppData\Local\Temp\Endermanch@CrazyNCS.exe" C:\Users\admin\AppData\Local\Temp\Endermanch@CrazyNCS.exe—cmd.exe
User:
admin
Company:
RJL Software - www.rjlsoftware.com
Integrity Level:
MEDIUM
Description:
Toggles Num, Caps, Scroll Lock at specified intervals
Version:
1.0.4.0
6972C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7184"C:\Users\admin\AppData\Local\Temp\Endermanch@Hydra.exe" C:\Users\admin\AppData\Local\Temp\Endermanch@Hydra.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Hydra
Version:
1.0.0.0
Modules
Images
c:\windows\syswow64\windowscodecs.dll
c:\windows\syswow64\textshaping.dll
c:\windows\syswow64\textinputframework.dll
c:\windows\syswow64\coreuicomponents.dll
c:\windows\syswow64\coremessaging.dll
c:\windows\syswow64\ws2_32.dll
c:\windows\syswow64\ntmarta.dll
c:\windows\syswow64\wintypes.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_a863d714867441db\comctl32.dll
Total events
2 901
Read events
2 832
Write events
68
Delete events
1

Modification events

(PID) Process:(4756) Endermanch@ChilledWindows.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Media\WMSDK\Namespace
Operation:writeName:LocalBase
Value:
C:\Users\admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
(PID) Process:(4756) Endermanch@ChilledWindows.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Media\WMSDK\Namespace
Operation:writeName:DTDFile
Value:
C:\Users\admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
(PID) Process:(4756) Endermanch@ChilledWindows.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Media\WMSDK\Namespace
Operation:writeName:LocalDelta
Value:
C:\Users\admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSD.XML
(PID) Process:(4756) Endermanch@ChilledWindows.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Media\WMSDK\Namespace
Operation:writeName:RemoteDelta
Value:
C:\Users\admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSR.XML
(PID) Process:(4756) Endermanch@ChilledWindows.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\MediaPlayer\Player\Tasks\NowPlaying
Operation:writeName:InitFlags
Value:
1
(PID) Process:(4756) Endermanch@ChilledWindows.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Media\WMSDK\General
Operation:writeName:UniqueID
Value:
{51A7A65A-503D-4724-B800-0802CDEF0195}
(PID) Process:(4756) Endermanch@ChilledWindows.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Media\WMSDK\General
Operation:writeName:ComputerName
Value:
DESKTOP-JGLLJLD
(PID) Process:(4756) Endermanch@ChilledWindows.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Media\WMSDK\General
Operation:writeName:VolumeSerialNumber
Value:
649566714
(PID) Process:(4756) Endermanch@ChilledWindows.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\MediaPlayer\Player\Settings
Operation:delete valueName:Client ID
Value:
{CECDFD5C-8F08-4FEF-8713-FAA895A422EB}
(PID) Process:(4756) Endermanch@ChilledWindows.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\MediaPlayer\Preferences\ProxySettings\HTTP
Operation:writeName:ProxyStyle
Value:
1
Executable files
17
Suspicious files
3
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
1628jokeware.exeC:\Users\admin\AppData\Local\Temp\Endermanch@Flasher.exeexecutable
MD5:9254CA1DA9FF8AD492CA5FA06CA181C6
SHA256:30676AD5DC94C3FEC3D77D87439B2BF0A1AAA7F01900B68002A06F11CAEE9CE6
1628jokeware.exeC:\Users\admin\AppData\Local\Temp\Endermanch@Popup.exeexecutable
MD5:9C3E9E30D51489A891513E8A14D931E4
SHA256:F8F7B5F20CA57C61DF6DC8FF49F2F5F90276A378EC17397249FDC099A6E1DCD8
1628jokeware.exeC:\Users\admin\AppData\Local\Temp\Endermanch@Launcher.exeexecutable
MD5:7506EB94C661522AFF09A5C96D6F182B
SHA256:D5B962DFE37671B5134F0B741A662610B568C2B5374010EE92B5B7857D87872C
1628jokeware.exeC:\Users\admin\AppData\Local\Temp\Endermanch@Time.exeexecutable
MD5:9D0D2FCB45B1FF9555711B47E0CD65E5
SHA256:DC476AE39EFFDD80399B6E36F1FDE92C216A5BBDB6B8B2A7ECBE753E91E4C993
1628jokeware.exeC:\Users\admin\AppData\Local\Temp\Zer0Mem0ry@Melting.exeexecutable
MD5:833619A4C9E8C808F092BF477AF62618
SHA256:92A284981C7CA33F1AF45CE61738479FBCBB5A4111F5498E2CB54931C8A36C76
1628jokeware.exeC:\Users\admin\AppData\Local\Temp\Endermanch@ChilledWindows.exeexecutable
MD5:6A4853CD0584DC90067E15AFB43C4962
SHA256:CCB9502BF8BA5BECF8B758CA04A5625C30B79E2D10D2677CC43AE4253E1288EC
1628jokeware.exeC:\Users\admin\AppData\Local\Temp\Endermanch@WindowsUpdate.exeexecutable
MD5:515198A8DFA7825F746D5921A4BC4DB9
SHA256:0FDA176B199295F72FAFC3BC25CEFA27FA44ED7712C3A24CA2409217E430436D
1628jokeware.exeC:\Users\admin\AppData\Local\Temp\Endermanch@Hydra.exeexecutable
MD5:B2ECA909A91E1946457A0B36EAF90930
SHA256:0B6C0AF51CDE971B3E5F8AA204F8205418AB8C180B79A5AC1C11A6E0676F0F7C
4756Endermanch@ChilledWindows.exeC:\Users\admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XMLtext
MD5:5433EAB10C6B5C6D55B7CBD302426A39
SHA256:23DBF7014E99E93AF5F2760F18EE1370274F06A453145C8D539B66D798DAD131
1628jokeware.exeC:\Users\admin\AppData\Local\Temp\RainbowIsKawaii@CookieClickerHack.exeexecutable
MD5:BC1E7D033A999C4FD006109C24599F4D
SHA256:13ADAE722719839AF8102F98730F3AF1C5A56B58069BFCE8995ACD2123628401
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
25
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6240
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6152
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6152
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3216
svchost.exe
20.197.71.89:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
—
—
20.190.160.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
—
—
20.197.71.89:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
20.190.160.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.142
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
client.wns.windows.com
  • 20.197.71.89
whitelisted
login.live.com
  • 20.190.160.64
  • 40.126.32.76
  • 20.190.160.14
  • 20.190.160.20
  • 40.126.32.72
  • 20.190.160.132
  • 40.126.32.140
  • 40.126.32.74
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
arc.msn.com
  • 20.105.99.58
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
jokeware.exe