File name:

WinLocker.exe

Full analysis: https://app.any.run/tasks/2246047f-d7b1-4166-9944-00c5786876d2
Verdict: Malicious activity
Analysis date: August 25, 2024, 14:33:45
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

88C574CE28B1FEEAB4C6C1CBB781F421

SHA1:

EA6AB2E1EE21BCEC0B23ABCCD2221D69A5013A2C

SHA256:

EAA737ADA3D93DBCE50FD1251F6AADEE1CC3221C0389E58F1745B35AB5EA278B

SSDEEP:

98304:9cCyub1kqAzajfr/qSRmkgT9908yj2fBRhdLfCdat6zcMlU3UJfdA48X6GM+l:Grj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • UAC/LUA settings modification

      • WinLocker.exe (PID: 6692)

    • Changes the autorun value in the registry

      • WinLocker.exe (PID: 6692)

    • Disables the Find the Start menu

      • WinLocker.exe (PID: 6692)

    • Disables the LogOff the Start menu

      • WinLocker.exe (PID: 6692)

    • Disables the Run the Start menu

      • WinLocker.exe (PID: 6692)

    • Changes image file execution options

      • WinLocker.exe (PID: 6692)

    • Disables the Shutdown in the Start menu

      • WinLocker.exe (PID: 6692)

  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • WinLocker.exe (PID: 6692)

    • Reads security settings of Internet Explorer

      • ShellExperienceHost.exe (PID: 6788)
      • WinLocker.exe (PID: 6692)
      • GameBar.exe (PID: 6632)
      • ShellExperienceHost.exe (PID: 5720)
      • StartMenuExperienceHost.exe (PID: 6920)

    • There is functionality for taking screenshot (YARA)

      • WinLocker.exe (PID: 6692)

    • Reads the Windows owner or organization settings

      • WinLocker.exe (PID: 6692)

    • Reads the date of Windows installation

      • WinLocker.exe (PID: 6692)
      • StartMenuExperienceHost.exe (PID: 6920)

    • The process executes via Task Scheduler

      • explorer.exe (PID: 1292)

  • INFO

    • Reads Environment values

      • WinLocker.exe (PID: 6692)
      • SearchApp.exe (PID: 3144)

    • Create files in a temporary directory

      • WinLocker.exe (PID: 6692)

    • Checks supported languages

      • ShellExperienceHost.exe (PID: 6788)
      • WinLocker.exe (PID: 6692)
      • GameBar.exe (PID: 6632)
      • ShellExperienceHost.exe (PID: 5720)
      • TextInputHost.exe (PID: 6760)
      • SearchApp.exe (PID: 3144)
      • StartMenuExperienceHost.exe (PID: 6920)

    • Process checks computer location settings

      • WinLocker.exe (PID: 6692)
      • SearchApp.exe (PID: 3144)
      • StartMenuExperienceHost.exe (PID: 6920)

    • Reads the computer name

      • WinLocker.exe (PID: 6692)
      • GameBar.exe (PID: 6632)
      • ShellExperienceHost.exe (PID: 5720)
      • TextInputHost.exe (PID: 6760)
      • SearchApp.exe (PID: 3144)
      • StartMenuExperienceHost.exe (PID: 6920)
      • ShellExperienceHost.exe (PID: 6788)

    • Reads Windows Product ID

      • WinLocker.exe (PID: 6692)

    • Reads Microsoft Office registry keys

      • explorer.exe (PID: 1292)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 1292)

    • Reads the machine GUID from the registry

      • SearchApp.exe (PID: 3144)

    • Checks proxy server information

      • SearchApp.exe (PID: 3144)
      • explorer.exe (PID: 1292)

    • Process checks Internet Explorer phishing filters

      • SearchApp.exe (PID: 3144)

    • Creates files or folders in the user directory

      • explorer.exe (PID: 1292)

    • Reads the software policy settings

      • SearchApp.exe (PID: 3144)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Borland Delphi 7 (94.6)
.exe | Win32 Executable Delphi generic (2)
.scr | Windows screen saver (1.8)
.exe | Win32 Executable (generic) (0.6)
.exe | Win16/32 Executable Delphi generic (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 1146368
InitializedDataSize: 1500160
UninitializedDataSize: -
EntryPoint: 0x118d94
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
12
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT winlocker.exe shellexperiencehost.exe no specs explorer.exe no specs explorer.exe no specs gamebar.exe no specs textinputhost.exe no specs shellexperiencehost.exe no specs tiworker.exe no specs startmenuexperiencehost.exe no specs searchapp.exe mobsync.exe no specs winlocker.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1128"C:\Windows\explorer.exe" C:\Windows\explorer.exe—WinLocker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Explorer
Exit code:
2
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\twinapi.dll
1292"C:\Windows\explorer.exe" /NoUACCheckC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\shcore.dll
3144"C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Search application
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4892C:\WINDOWS\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\TiWorker.exe -EmbeddingC:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\TiWorker.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Modules Installer Worker
Version:
10.0.19041.3989 (WinBuild.160101.0800)
Modules
Images
c:\windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\tiworker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
5720"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\wincorlib.dll
6032C:\WINDOWS\System32\mobsync.exe -EmbeddingC:\Windows\System32\mobsync.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Sync Center
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mobsync.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6632"C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe" -ServerName:App.AppXbdkk0yrkwpcgeaem8zk81k8py1eaahny.mcaC:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\program files\windowsapps\microsoft.xboxgamingoverlay_2.34.28001.0_x64__8wekyb3d8bbwe\gamebar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\program files\windowsapps\microsoft.vclibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe\vccorlib140_app.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
6644"C:\Users\admin\AppData\Local\Temp\WinLocker.exe" C:\Users\admin\AppData\Local\Temp\WinLocker.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\winlocker.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6692"C:\Users\admin\AppData\Local\Temp\WinLocker.exe" C:\Users\admin\AppData\Local\Temp\WinLocker.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\winlocker.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6760"C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mcaC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Version:
123.26505.0.0
Modules
Images
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\textinputhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\vcruntime140_app.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
Total events
46 044
Read events
45 735
Write events
265
Delete events
44

Modification events

(PID) Process:(6692) WinLocker.exeKey:HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\System
Operation:writeName:DisableCMD
Value:
2
(PID) Process:(6692) WinLocker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:EnableLUA
Value:
0
(PID) Process:(6692) WinLocker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:Java
Value:
C:\Users\admin\AppData\Local\Temp\WinLocker.exe
(PID) Process:(6692) WinLocker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe
Operation:writeName:Debugger
Value:
C:\Users\admin\AppData\Local\Temp\WinLocker.exe
(PID) Process:(6692) WinLocker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe
Operation:writeName:Debugger
Value:
C:\Users\admin\AppData\Local\Temp\WinLocker.exe
(PID) Process:(6692) WinLocker.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Uninstall
Operation:writeName:NoAddRemovePrograms
Value:
1
(PID) Process:(6692) WinLocker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:HideFastUserSwitching
Value:
1
(PID) Process:(6692) WinLocker.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Advanced
Operation:writeName:NoClose
Value:
1
(PID) Process:(6692) WinLocker.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:DisableLockWorkstation
Value:
1
(PID) Process:(6692) WinLocker.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:DisableChangePassword
Value:
1
Executable files
2
Suspicious files
13
Text files
152
Unknown types
0

Dropped files

PID
Process
Filename
Type
3144SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:85770E04C47BBC69B9EF0065BFC13A70
SHA256:70561937109CAF210C0B3D7C7C361C5A3D362895BAB381C2AF5B9FBDC6D087FC
6692WinLocker.exeC:\Users\admin\AppData\Local\Temp\Time2.initext
MD5:97ABE1980F4EA3804340CCA16CD914EC
SHA256:DCBF287018F6ACDF68B133E4DBC9A910F8078C7A425FE6CDA2322307FE86E305
4892TiWorker.exeC:\Windows\Logs\CBS\CBS.logtext
MD5:3C59445785D7107AD887453F665BDDB5
SHA256:DD36690DDAF032984FBBC87B921A0169E7481FFD6A312AF8112B4B682488F0E7
6692WinLocker.exeC:\Users\admin\AppData\Local\Temp\Time.initext
MD5:EB13B7EAF7F30D348E471F0907B31AAC
SHA256:94BA214735774FB4E68BE906C3E181D29C71DBBCD10540E70BA7021FCF5EA3AA
3144SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\5Y734AMR\64\oT6Um3bDKq3bSDJ4e0e-YJ5MXCI[1].csstext
MD5:212CA645026552E6E0430DD815E209A8
SHA256:C7DE31F7449EB7373452E3F942A2B070BC5893087C5BB2BC50E565244DA70CD3
3144SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\5Y734AMR\64\CYGXBN1kkA_ojDY5vKbCoG4Zy0E[1].csstext
MD5:DF25912CCFEE50A9E57BC97B4D05B5C0
SHA256:3CA3D1262A62E919C72A641F7491B38769CFB8149704E69CB6C960836DD9C6F8
3144SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\Q84V0JUH\Btu7tBP0vQIHDIMxag4vCxAtQuY[1].jsbinary
MD5:311DCE82D58535DF1732613BB3B11B03
SHA256:86AA6BBA01160BB5E841A87C3417AC6065F765870011EA8FA46E19B86386A5A6
3144SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:32CF244E5CDD2A7D2F3404DDBDE18A05
SHA256:9885283FA02F861E2475798A14D98186FA280C17CB5A5759A2D5579D861A26F0
3144SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbresbinary
MD5:62BF9D1C01828E67205F66113C0C50F3
SHA256:D22E2CB2E03C2ACA9A59F7F5C83EB3D89115C9B3872EE20BD5D370BF31D0C91A
3144SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\M8N5R19A\th[1].svgimage
MD5:48E632A133BAE466E88AD5B3D0117000
SHA256:2BC5C4074744AC3C2D4FD718ED8E5B804E61E9108E940BF86E79CAB0BD05C096
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
27
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3144
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
812
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5876
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5876
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
1344
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1432
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1432
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3260
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
812
svchost.exe
20.190.160.14:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
  • 20.73.194.208
whitelisted
google.com
  • 142.250.74.206
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 20.190.160.14
  • 20.190.160.20
  • 40.126.32.138
  • 40.126.32.140
  • 40.126.32.68
  • 40.126.32.76
  • 20.190.160.17
  • 40.126.32.72
whitelisted
r.bing.com
  • 92.123.104.9
  • 92.123.104.7
  • 92.123.104.62
  • 92.123.104.65
  • 92.123.104.63
  • 92.123.104.8
  • 92.123.104.5
  • 92.123.104.6
  • 92.123.104.67
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.bing.com
  • 92.123.104.9
  • 92.123.104.6
  • 92.123.104.67
  • 92.123.104.5
  • 92.123.104.17
  • 92.123.104.12
  • 92.123.104.10
  • 92.123.104.8
  • 92.123.104.7
whitelisted
slscr.update.microsoft.com
  • 52.165.165.26
whitelisted
th.bing.com
  • 92.123.104.30
  • 92.123.104.22
  • 92.123.104.26
  • 92.123.104.23
  • 92.123.104.21
  • 92.123.104.29
  • 92.123.104.32
  • 92.123.104.31
  • 92.123.104.18
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WinLocker.exe