URL:

https://aws.ipswitch.com/?SERIAL=659B9G553NY7U2K&UAP=RD3AI1SX&PATH=/ft/WS_FTP/Client/12.7.0/wsftp_12.7.0_English.exe

Full analysis: https://app.any.run/tasks/7f07a64a-872c-4ff3-9161-ede5ca1c520e
Verdict: Malicious activity
Analysis date: February 23, 2021, 11:03:46
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

9D32216290FCF270E5346319999CAFF2

SHA1:

983991C042A45878ECF1963297715E43B77505D7

SHA256:

1B423C7CBD30AD2186FA5E613DFABBE8D9C0B1DB29B9D5A578624E4DF699B1E4

SSDEEP:

3:N844VWEqXKJhSwk1rlDuhYIUuRKUzNrriA:244VEXZTrlUYmh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • wsftp_12.7.0_English_SN659B9G553NY7U2KRD3AI1SX.exe (PID: 1692)
      • wsftp_12.7.0_English_SN659B9G553NY7U2KRD3AI1SX.exe (PID: 1952)
      • vcredist2012_x86.exe (PID: 2640)
      • vcredist2012_x86.exe (PID: 3456)
      • vcredist2017_x86.exe (PID: 2284)
      • vcredist2017_x86.exe (PID: 2628)
      • ipsactive.exe (PID: 1340)
      • wsftpgui.exe (PID: 3168)
      • WsftpCOMHelper.exe (PID: 2916)

    • Drops executable file immediately after starts

      • wsftpEnglish.exe (PID: 2784)

    • Loads dropped or rewritten executable

      • wsftpEnglish.exe (PID: 2784)
      • vcredist2012_x86.exe (PID: 3456)
      • ipsactive.exe (PID: 1340)
      • WsftpCOMHelper.exe (PID: 2916)
      • regsvr32.exe (PID: 1724)
      • regsvr32.exe (PID: 3704)
      • wsftpgui.exe (PID: 3168)

    • Changes the autorun value in the registry

      • vcredist2012_x86.exe (PID: 2640)

    • Actions looks like stealing of personal data

      • WsftpCOMHelper.exe (PID: 2916)
      • ipsactive.exe (PID: 1340)
      • regsvr32.exe (PID: 3704)
      • wsftpEnglish.exe (PID: 2784)
      • regsvr32.exe (PID: 1724)
      • wsftpgui.exe (PID: 3168)

    • Registers / Runs the DLL via REGSVR32.EXE

      • wsftpEnglish.exe (PID: 2784)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • wsftpEnglish.exe (PID: 2784)
      • chrome.exe (PID: 3568)
      • vcredist2012_x86.exe (PID: 3456)
      • vcredist2012_x86.exe (PID: 2640)
      • vcredist2017_x86.exe (PID: 2628)

    • Drops a file with too old compile date

      • chrome.exe (PID: 3568)
      • wsftpEnglish.exe (PID: 2784)

    • Drops a file that was compiled in debug mode

      • chrome.exe (PID: 3568)
      • vcredist2012_x86.exe (PID: 3456)
      • wsftpEnglish.exe (PID: 2784)
      • vcredist2012_x86.exe (PID: 2640)
      • vcredist2017_x86.exe (PID: 2628)

    • Searches for installed software

      • wsftpEnglish.exe (PID: 2784)
      • vcredist2012_x86.exe (PID: 3456)
      • vcredist2012_x86.exe (PID: 2640)
      • vcredist2017_x86.exe (PID: 2628)

    • Application launched itself

      • vcredist2012_x86.exe (PID: 2640)
      • vcredist2017_x86.exe (PID: 2284)

    • Creates a software uninstall entry

      • vcredist2012_x86.exe (PID: 2640)
      • wsftpEnglish.exe (PID: 2784)

    • Creates files in the program directory

      • vcredist2012_x86.exe (PID: 2640)
      • wsftpEnglish.exe (PID: 2784)
      • ipsactive.exe (PID: 1340)
      • regsvr32.exe (PID: 1724)

    • Creates a directory in Program Files

      • wsftpEnglish.exe (PID: 2784)

    • Low-level read access rights to disk partition

      • ipsactive.exe (PID: 1340)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 3704)
      • regsvr32.exe (PID: 1724)

    • Changes default file association

      • regsvr32.exe (PID: 3704)

    • Starts Internet Explorer

      • wsftpEnglish.exe (PID: 2784)

    • Creates files in the user directory

      • wsftpgui.exe (PID: 3168)
      • regsvr32.exe (PID: 1724)
      • filezilla.exe (PID: 1140)

    • Reads internet explorer settings

      • wsftpgui.exe (PID: 3168)

  • INFO

    • Application launched itself

      • chrome.exe (PID: 3568)
      • iexplore.exe (PID: 916)

    • Reads the hosts file

      • chrome.exe (PID: 464)
      • chrome.exe (PID: 3568)

    • Changes internet zones settings

      • iexplore.exe (PID: 916)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3888)
      • iexplore.exe (PID: 916)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3888)
      • iexplore.exe (PID: 916)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3888)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 916)
      • iexplore.exe (PID: 3888)

    • Creates files in the user directory

      • iexplore.exe (PID: 916)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
68
Monitored processes
25
Malicious processes
10
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start drop and start drop and start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs wsftp_12.7.0_english_sn659b9g553ny7u2krd3ai1sx.exe no specs wsftp_12.7.0_english_sn659b9g553ny7u2krd3ai1sx.exe wsftpenglish.exe vcredist2012_x86.exe vcredist2012_x86.exe vcredist2017_x86.exe no specs vcredist2017_x86.exe wsftpcomhelper.exe ipsactive.exe regsvr32.exe regsvr32.exe iexplore.exe wsftpgui.exe iexplore.exe filezilla.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
464"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1000,3001298969906949362,292003369264785875,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=1248412613387897580 --mojo-platform-channel-handle=1456 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
916"C:\Program Files\Internet Explorer\iexplore.exe" http://www.ipswitch.com/ftp127rnenC:\Program Files\Internet Explorer\iexplore.exe
wsftpEnglish.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1140"C:\Program Files\FileZilla FTP Client\filezilla.exe" C:\Program Files\FileZilla FTP Client\filezilla.exe—wsftpgui.exe
User:
admin
Company:
FileZilla Project
Integrity Level:
HIGH
Description:
FileZilla FTP Client
Exit code:
0
Version:
3, 36, 0, 0
Modules
Images
c:\program files\filezilla ftp client\filezilla.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\filezilla ftp client\libfilezilla-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
1340"C:\Program Files\Ipswitch\WS_FTP 12\ipsactive.exe" /a /s /sn 659B9G553NY7U2KRD3AI1SX /pd "WS_FTP 12" /rrn 1426 /lo "C:\ProgramData\Ipswitch\WS_FTP\license.txt"C:\Program Files\Ipswitch\WS_FTP 12\ipsactive.exe
wsftpEnglish.exe
User:
admin
Company:
Ipswitch Incorporated
Integrity Level:
HIGH
Description:
Ipswitch Activation Application
Exit code:
0
Version:
3.3.0.2
Modules
Images
c:\program files\ipswitch\ws_ftp 12\ipsactive.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1692"C:\Users\admin\Downloads\wsftp_12.7.0_English_SN659B9G553NY7U2KRD3AI1SX.exe" C:\Users\admin\Downloads\wsftp_12.7.0_English_SN659B9G553NY7U2KRD3AI1SX.exe—chrome.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\downloads\wsftp_12.7.0_english_sn659b9g553ny7u2krd3ai1sx.exe
c:\systemroot\system32\ntdll.dll
1724C:\Windows\system32\regsvr32 -s "C:\Program Files\Ipswitch\WS_FTP 12\wsbho2k0.dll"C:\Windows\system32\regsvr32.exe
wsftpEnglish.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1744"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1000,3001298969906949362,292003369264785875,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=8499434432377347484 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2152 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1952"C:\Users\admin\Downloads\wsftp_12.7.0_English_SN659B9G553NY7U2KRD3AI1SX.exe" C:\Users\admin\Downloads\wsftp_12.7.0_English_SN659B9G553NY7U2KRD3AI1SX.exe
chrome.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\downloads\wsftp_12.7.0_english_sn659b9g553ny7u2krd3ai1sx.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
2284C:\Users\admin\AppData\Local\Temp\{01EC24A2-E7E5-4961-9027-3B06C128630D}\{AD88355B-A4E0-4DA1-BAC3-EA4FEA930691}\vcredist2017_x86.exe /Q /norestartC:\Users\admin\AppData\Local\Temp\{01EC24A2-E7E5-4961-9027-3B06C128630D}\{AD88355B-A4E0-4DA1-BAC3-EA4FEA930691}\vcredist2017_x86.exe—wsftpEnglish.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2017 Redistributable (x86) - 14.11.25325
Exit code:
1638
Version:
14.11.25325.0
Modules
Images
c:\users\admin\appdata\local\temp\{01ec24a2-e7e5-4961-9027-3b06c128630d}\{ad88355b-a4e0-4da1-bac3-ea4fea930691}\vcredist2017_x86.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2508"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6bd3a9d0,0x6bd3a9e0,0x6bd3a9ecC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
Total events
3 596
Read events
3 098
Write events
493
Delete events
5

Modification events

(PID) Process:(3568) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3568) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3568) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(3568) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(3568) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(4000) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:3568-13258551842756750
Value:
259
(PID) Process:(3568) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(3568) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(3568) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3252-13245750958665039
Value:
0
(PID) Process:(3568) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
56
Suspicious files
63
Text files
324
Unknown types
28

Dropped files

PID
Process
Filename
Type
3568chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-6034E123-DF0.pma —
MD5:—
SHA256:—
3568chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\eb7a71e0-fbab-437e-aa62-00e113588f0d.tmp —
MD5:—
SHA256:—
3568chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000048.dbtmp —
MD5:—
SHA256:—
3568chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF1d50e2.TMPtext
MD5:—
SHA256:—
3568chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RF1d50f1.TMPtext
MD5:—
SHA256:—
3568chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.oldtext
MD5:—
SHA256:—
3568chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:—
SHA256:—
3568chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG.oldtext
MD5:—
SHA256:—
3568chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old —
MD5:—
SHA256:—
3568chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old~RF1d52e5.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
37
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3888
iexplore.exe
GET
301
50.56.3.118:80
http://www.ipswitch.com/ftp127rnen
US
—
—
suspicious
3888
iexplore.exe
GET
200
151.101.2.133:80
http://ocsp.globalsign.com/gsrsaovsslca2018/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBRrcGT%2BanRD3C1tW3nsrKeuXC7DPwQU%2BO9%2F8s14Z6jeb48kjYjxhwMCs%2BsCDFxVWUp9CMRfDlEL9A%3D%3D
US
der
1.49 Kb
whitelisted
3888
iexplore.exe
GET
200
151.101.2.133:80
http://ocsp.globalsign.com/gsrsaovsslca2018/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBRrcGT%2BanRD3C1tW3nsrKeuXC7DPwQU%2BO9%2F8s14Z6jeb48kjYjxhwMCs%2BsCDFxVWUp9CMRfDlEL9A%3D%3D
US
der
1.49 Kb
whitelisted
3888
iexplore.exe
GET
200
142.250.74.195:80
http://ocsp.pki.goog/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEHfxzezXp%2BeIAwAAAADLQEM%3D
US
der
471 b
whitelisted
1340
ipsactive.exe
POST
200
156.21.20.106:80
http://license.ipswitch.com/pla/activation.aspx
US
flc
1.11 Kb
unknown
3888
iexplore.exe
GET
200
151.101.2.133:80
http://ocsp.globalsign.com/gsrsaovsslca2018/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBRrcGT%2BanRD3C1tW3nsrKeuXC7DPwQU%2BO9%2F8s14Z6jeb48kjYjxhwMCs%2BsCDBsrzrO%2BaIK2McyZcA%3D%3D
US
der
1.49 Kb
whitelisted
916
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
3888
iexplore.exe
GET
200
151.101.2.133:80
http://ocsp2.globalsign.com/rootr3/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCDQHuXyId%2FGI71DM6hVc%3D
US
der
1.48 Kb
whitelisted
3888
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
916
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
464
chrome.exe
79.125.112.214:443
aws.ipswitch.com
Amazon.com, Inc.
IE
suspicious
3888
iexplore.exe
131.239.30.181:443
docs.ipswitch.com
Progress Software Corp - CSG
US
unknown
3888
iexplore.exe
151.101.2.133:80
ocsp2.globalsign.com
Fastly
US
malicious
3888
iexplore.exe
142.250.185.200:443
www.googletagmanager.com
Google Inc.
US
suspicious
916
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3888
iexplore.exe
142.250.74.195:80
ocsp.pki.goog
Google Inc.
US
whitelisted
3888
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
916
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
3888
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
916
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
aws.ipswitch.com
  • 79.125.112.214
suspicious
accounts.google.com
  • 142.250.74.205
shared
ssl.gstatic.com
  • 172.217.18.99
whitelisted
sb-ssl.google.com
  • 172.217.23.110
whitelisted
clients1.google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 2.16.186.74
  • 2.16.186.120
whitelisted
license.ipswitch.com
  • 156.21.20.106
unknown
www.ipswitch.com
  • 50.56.3.118
suspicious
ocsp2.globalsign.com
  • 151.101.2.133
  • 151.101.66.133
  • 151.101.130.133
  • 151.101.194.133
whitelisted
ocsp.globalsign.com
  • 151.101.2.133
  • 151.101.66.133
  • 151.101.130.133
  • 151.101.194.133
whitelisted

Threats

No threats detected
Process
Message
ipsactive.exe
getmacs() ENTER
ipsactive.exe
Checkhw:getmacs() Enumeration start
ipsactive.exe
Checkhw:getmacs() EXIT
regsvr32.exe
MAC Address: 12:03:33:4a:04:af
regsvr32.exe
MAC Address: 12:03:33:4a:04:af
regsvr32.exe
MAC Address: 12:03:33:4a:04:af
wsftpgui.exe
MAC Address: 12:03:33:4a:04:af
wsftpgui.exe
MAC Address: 12:03:33:4a:04:af
wsftpgui.exe
MAC Address: 12:03:33:4a:04:af
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://aws.ipswitch.com/?SERIAL=659B9G553NY7U2K&UAP=RD3AI1SX&PATH=/ft/WS_FTP/Client/12.7.0/wsftp_12.7.0_English.exe