File name:

WinLocker.exe

Full analysis: https://app.any.run/tasks/2246047f-d7b1-4166-9944-00c5786876d2
Verdict: Malicious activity
Analysis date: August 25, 2024, 14:33:45
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

88C574CE28B1FEEAB4C6C1CBB781F421

SHA1:

EA6AB2E1EE21BCEC0B23ABCCD2221D69A5013A2C

SHA256:

EAA737ADA3D93DBCE50FD1251F6AADEE1CC3221C0389E58F1745B35AB5EA278B

SSDEEP:

98304:9cCyub1kqAzajfr/qSRmkgT9908yj2fBRhdLfCdat6zcMlU3UJfdA48X6GM+l:Grj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • UAC/LUA settings modification

      • WinLocker.exe (PID: 6692)

    • Changes the autorun value in the registry

      • WinLocker.exe (PID: 6692)

    • Disables the LogOff the Start menu

      • WinLocker.exe (PID: 6692)

    • Changes image file execution options

      • WinLocker.exe (PID: 6692)

    • Disables the Shutdown in the Start menu

      • WinLocker.exe (PID: 6692)

    • Disables the Run the Start menu

      • WinLocker.exe (PID: 6692)

    • Disables the Find the Start menu

      • WinLocker.exe (PID: 6692)

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • WinLocker.exe (PID: 6692)

    • Drops the executable file immediately after the start

      • WinLocker.exe (PID: 6692)

    • Reads security settings of Internet Explorer

      • ShellExperienceHost.exe (PID: 6788)
      • WinLocker.exe (PID: 6692)
      • GameBar.exe (PID: 6632)
      • ShellExperienceHost.exe (PID: 5720)
      • StartMenuExperienceHost.exe (PID: 6920)

    • There is functionality for taking screenshot (YARA)

      • WinLocker.exe (PID: 6692)

    • The process executes via Task Scheduler

      • explorer.exe (PID: 1292)

    • Reads the date of Windows installation

      • StartMenuExperienceHost.exe (PID: 6920)
      • WinLocker.exe (PID: 6692)

  • INFO

    • Reads Environment values

      • WinLocker.exe (PID: 6692)
      • SearchApp.exe (PID: 3144)

    • Reads Windows Product ID

      • WinLocker.exe (PID: 6692)

    • Checks supported languages

      • WinLocker.exe (PID: 6692)
      • ShellExperienceHost.exe (PID: 6788)
      • StartMenuExperienceHost.exe (PID: 6920)
      • GameBar.exe (PID: 6632)
      • ShellExperienceHost.exe (PID: 5720)
      • TextInputHost.exe (PID: 6760)
      • SearchApp.exe (PID: 3144)

    • Reads the computer name

      • WinLocker.exe (PID: 6692)
      • ShellExperienceHost.exe (PID: 6788)
      • GameBar.exe (PID: 6632)
      • ShellExperienceHost.exe (PID: 5720)
      • TextInputHost.exe (PID: 6760)
      • StartMenuExperienceHost.exe (PID: 6920)
      • SearchApp.exe (PID: 3144)

    • Create files in a temporary directory

      • WinLocker.exe (PID: 6692)

    • Process checks computer location settings

      • WinLocker.exe (PID: 6692)
      • StartMenuExperienceHost.exe (PID: 6920)
      • SearchApp.exe (PID: 3144)

    • Reads Microsoft Office registry keys

      • explorer.exe (PID: 1292)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 1292)

    • Reads the machine GUID from the registry

      • SearchApp.exe (PID: 3144)

    • Process checks Internet Explorer phishing filters

      • SearchApp.exe (PID: 3144)

    • Checks proxy server information

      • explorer.exe (PID: 1292)
      • SearchApp.exe (PID: 3144)

    • Creates files or folders in the user directory

      • explorer.exe (PID: 1292)

    • Reads the software policy settings

      • SearchApp.exe (PID: 3144)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Borland Delphi 7 (94.6)
.exe | Win32 Executable Delphi generic (2)
.scr | Windows screen saver (1.8)
.exe | Win32 Executable (generic) (0.6)
.exe | Win16/32 Executable Delphi generic (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 1146368
InitializedDataSize: 1500160
UninitializedDataSize: -
EntryPoint: 0x118d94
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
12
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT winlocker.exe shellexperiencehost.exe no specs explorer.exe no specs explorer.exe no specs gamebar.exe no specs textinputhost.exe no specs shellexperiencehost.exe no specs tiworker.exe no specs startmenuexperiencehost.exe no specs searchapp.exe mobsync.exe no specs winlocker.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1128"C:\Windows\explorer.exe" C:\Windows\explorer.exe—WinLocker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Explorer
Exit code:
2
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\twinapi.dll
1292"C:\Windows\explorer.exe" /NoUACCheckC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\shcore.dll
3144"C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Search application
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4892C:\WINDOWS\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\TiWorker.exe -EmbeddingC:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\TiWorker.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Modules Installer Worker
Version:
10.0.19041.3989 (WinBuild.160101.0800)
Modules
Images
c:\windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\tiworker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
5720"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\wincorlib.dll
6032C:\WINDOWS\System32\mobsync.exe -EmbeddingC:\Windows\System32\mobsync.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Sync Center
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mobsync.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6632"C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe" -ServerName:App.AppXbdkk0yrkwpcgeaem8zk81k8py1eaahny.mcaC:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\program files\windowsapps\microsoft.xboxgamingoverlay_2.34.28001.0_x64__8wekyb3d8bbwe\gamebar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\program files\windowsapps\microsoft.vclibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe\vccorlib140_app.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
6644"C:\Users\admin\AppData\Local\Temp\WinLocker.exe" C:\Users\admin\AppData\Local\Temp\WinLocker.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\winlocker.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6692"C:\Users\admin\AppData\Local\Temp\WinLocker.exe" C:\Users\admin\AppData\Local\Temp\WinLocker.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\winlocker.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6760"C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mcaC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Version:
123.26505.0.0
Modules
Images
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\textinputhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\vcruntime140_app.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
Total events
46 044
Read events
45 735
Write events
265
Delete events
44

Modification events

(PID) Process:(6692) WinLocker.exeKey:HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\System
Operation:writeName:DisableCMD
Value:
2
(PID) Process:(6692) WinLocker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:EnableLUA
Value:
0
(PID) Process:(6692) WinLocker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:Java
Value:
C:\Users\admin\AppData\Local\Temp\WinLocker.exe
(PID) Process:(6692) WinLocker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe
Operation:writeName:Debugger
Value:
C:\Users\admin\AppData\Local\Temp\WinLocker.exe
(PID) Process:(6692) WinLocker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe
Operation:writeName:Debugger
Value:
C:\Users\admin\AppData\Local\Temp\WinLocker.exe
(PID) Process:(6692) WinLocker.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Uninstall
Operation:writeName:NoAddRemovePrograms
Value:
1
(PID) Process:(6692) WinLocker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:HideFastUserSwitching
Value:
1
(PID) Process:(6692) WinLocker.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Advanced
Operation:writeName:NoClose
Value:
1
(PID) Process:(6692) WinLocker.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:DisableLockWorkstation
Value:
1
(PID) Process:(6692) WinLocker.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:DisableChangePassword
Value:
1
Executable files
2
Suspicious files
13
Text files
152
Unknown types
0

Dropped files

PID
Process
Filename
Type
6692WinLocker.exeC:\Users\admin\AppData\Local\Temp\Time2.initext
MD5:97ABE1980F4EA3804340CCA16CD914EC
SHA256:DCBF287018F6ACDF68B133E4DBC9A910F8078C7A425FE6CDA2322307FE86E305
4892TiWorker.exeC:\Windows\Logs\CBS\CBS.logtext
MD5:3C59445785D7107AD887453F665BDDB5
SHA256:DD36690DDAF032984FBBC87B921A0169E7481FFD6A312AF8112B4B682488F0E7
3144SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\5Y734AMR\64\CYGXBN1kkA_ojDY5vKbCoG4Zy0E[1].csstext
MD5:DF25912CCFEE50A9E57BC97B4D05B5C0
SHA256:3CA3D1262A62E919C72A641F7491B38769CFB8149704E69CB6C960836DD9C6F8
3144SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\5Y734AMR\64\UOY0_NvaNmYOaPCm0BTcnmMvX60[1].csstext
MD5:0FF1F38355538E225067A8B7C2BB1A05
SHA256:E4F9D9E92CB3B6C0C44514EEF214F436ED3D5EB048FA2480DE059A82BD1B00D1
3144SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\Q84V0JUH\Btu7tBP0vQIHDIMxag4vCxAtQuY[1].jsbinary
MD5:311DCE82D58535DF1732613BB3B11B03
SHA256:86AA6BBA01160BB5E841A87C3417AC6065F765870011EA8FA46E19B86386A5A6
3144SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\5Y734AMR\64\4-xJy3tX6bM2BGl5zKioiEcQ1TU[1].csstext
MD5:B8C89E50D1A8DF3954C30836B80AFA47
SHA256:F63656D5FE0A12D00F9FD662236FE996E18F036435781B1824F51C5B2BA935EC
3144SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\NLQCMX2T\th[1].svgimage
MD5:B409BCADB06CDE7215DC938A007A6D28
SHA256:DBBEC14B5DF25FEEE73FFC8B0A7843C21C9B76FE0B22D7FF7A43D4145A8EF4B6
3144SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\Q84V0JUH\-UAIppANYxiGpRWJy2NDph4qOEw.gz[1].jstext
MD5:9E527B91C2D8B31B0017B76049B5E4E3
SHA256:38EDF0F961C1CCB287880B88F12F370775FC65B2E28227EEE215E849CDBE9BBC
3144SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbresbinary
MD5:62BF9D1C01828E67205F66113C0C50F3
SHA256:D22E2CB2E03C2ACA9A59F7F5C83EB3D89115C9B3872EE20BD5D370BF31D0C91A
3144SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\5Y734AMR\64\4bnLx4S3ZRMpYV30k3R5vRy8JVg[1].jss
MD5:97540BC45CFB7C7C4D859A7E1CE839BA
SHA256:4AE944B4A382D05A8A5B657105ADD88DD8B8F59D6309567E179CA64DF19F6075
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
27
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
812
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5876
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5876
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3144
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
1344
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1432
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1432
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3260
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
812
svchost.exe
20.190.160.14:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
  • 20.73.194.208
whitelisted
google.com
  • 142.250.74.206
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 20.190.160.14
  • 20.190.160.20
  • 40.126.32.138
  • 40.126.32.140
  • 40.126.32.68
  • 40.126.32.76
  • 20.190.160.17
  • 40.126.32.72
whitelisted
r.bing.com
  • 92.123.104.9
  • 92.123.104.7
  • 92.123.104.62
  • 92.123.104.65
  • 92.123.104.63
  • 92.123.104.8
  • 92.123.104.5
  • 92.123.104.6
  • 92.123.104.67
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.bing.com
  • 92.123.104.9
  • 92.123.104.6
  • 92.123.104.67
  • 92.123.104.5
  • 92.123.104.17
  • 92.123.104.12
  • 92.123.104.10
  • 92.123.104.8
  • 92.123.104.7
whitelisted
slscr.update.microsoft.com
  • 52.165.165.26
whitelisted
th.bing.com
  • 92.123.104.30
  • 92.123.104.22
  • 92.123.104.26
  • 92.123.104.23
  • 92.123.104.21
  • 92.123.104.29
  • 92.123.104.32
  • 92.123.104.31
  • 92.123.104.18
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WinLocker.exe