File name:

FileZilla_Client_(64bit)_v3.32.0.exe

Full analysis: https://app.any.run/tasks/08b0fb6e-05aa-474c-90f0-46387bf16a6d
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: February 21, 2025, 21:38:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

7FA9C8F1577DB957C8AFB5B592D975B0

SHA1:

035B6911C8A58D240132671A507C76FCFCDB3EB7

SHA256:

DA2F1A0EE94F0CD1CD5367718FB9292A7B6EEB5567388540B7444F611DBC7983

SSDEEP:

98304:MyJKh9vpPx1QzXfO5GZtcdLbCMYTk2sVbRZy2QPbesAJMRinRzXR9bAeMn3Hea7d:AmMQ8frO51f9Ik

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Changes the autorun value in the registry

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 1252)
      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 1252)
      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Application launched itself

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 1252)
      • NSIS.Library.RegTool.v3.{E4A2F159-3687-4128-AC30-0EFE01B18436}.exe (PID: 2080)

    • The process creates files with name similar to system file names

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 1252)
      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • There is functionality for taking screenshot (YARA)

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 1252)
      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Reads the Internet Settings

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)
      • sipnotify.exe (PID: 1472)
      • runonce.exe (PID: 2056)

    • Checks Windows Trust Settings

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Reads the BIOS version

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Reads Internet Explorer settings

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Reads Microsoft Outlook installation path

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Searches for installed software

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Reads settings of System Certificates

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)
      • sipnotify.exe (PID: 1472)

    • Reads security settings of Internet Explorer

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Creates a software uninstall entry

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • The process executes via Task Scheduler

      • ctfmon.exe (PID: 1468)
      • sipnotify.exe (PID: 1472)

    • Creates/Modifies COM task schedule object

      • NSIS.Library.RegTool.v3.{E4A2F159-3687-4128-AC30-0EFE01B18436}.exe (PID: 2088)

  • INFO

    • Reads the computer name

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 1252)
      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)
      • wmpnscfg.exe (PID: 3112)
      • IMEKLMG.EXE (PID: 2172)
      • wmpnscfg.exe (PID: 2440)
      • wmpnscfg.exe (PID: 2464)
      • IMEKLMG.EXE (PID: 2184)

    • Checks supported languages

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 1252)
      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)
      • wmpnscfg.exe (PID: 3112)
      • NSIS.Library.RegTool.v3.{E4A2F159-3687-4128-AC30-0EFE01B18436}.exe (PID: 2088)
      • NSIS.Library.RegTool.v3.{E4A2F159-3687-4128-AC30-0EFE01B18436}.exe (PID: 2080)
      • IMEKLMG.EXE (PID: 2172)
      • IMEKLMG.EXE (PID: 2184)
      • wmpnscfg.exe (PID: 2464)
      • wmpnscfg.exe (PID: 2440)

    • Create files in a temporary directory

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 1252)
      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • FileZilla executable

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 1252)

    • Reads the machine GUID from the registry

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • The sample compiled with english language support

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 1252)
      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Checks proxy server information

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Reads the software policy settings

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)
      • sipnotify.exe (PID: 1472)

    • Reads Environment values

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Reads product name

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Process checks whether UAC notifications are on

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)
      • IMEKLMG.EXE (PID: 2172)
      • IMEKLMG.EXE (PID: 2184)

    • Reads Windows Product ID

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Reads CPU info

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Creates files in the program directory

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3112)
      • IMEKLMG.EXE (PID: 2172)
      • IMEKLMG.EXE (PID: 2184)
      • runonce.exe (PID: 2056)
      • wmpnscfg.exe (PID: 2440)
      • wmpnscfg.exe (PID: 2464)

    • Creates files or folders in the user directory

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Reads security settings of Internet Explorer

      • sipnotify.exe (PID: 1472)
      • runonce.exe (PID: 2056)

    • Reads the time zone

      • runonce.exe (PID: 2056)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:12:11 21:50:48+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 25088
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x344a
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.32.0.0
ProductVersionNumber: 3.32.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Tim Kosse
FileDescription: FileZilla FTP Client
FileVersion: 3.32.0
LegalCopyright: Tim Kosse
OriginalFileName: FileZilla_3.32.0_win32-setup.exe
ProductName: FileZilla
ProductVersion: 3.32.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
93
Monitored processes
13
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start filezilla_client_(64bit)_v3.32.0.exe filezilla_client_(64bit)_v3.32.0.exe wmpnscfg.exe no specs ctfmon.exe no specs sipnotify.exe runonce.exe nsis.library.regtool.v3.{e4a2f159-3687-4128-ac30-0efe01b18436}.exe no specs nsis.library.regtool.v3.{e4a2f159-3687-4128-ac30-0efe01b18436}.exe no specs imeklmg.exe no specs imeklmg.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
1108C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1252"C:\Users\admin\AppData\Local\Temp\FileZilla_Client_(64bit)_v3.32.0.exe" C:\Users\admin\AppData\Local\Temp\FileZilla_Client_(64bit)_v3.32.0.exe
explorer.exe
User:
admin
Company:
Tim Kosse
Integrity Level:
MEDIUM
Description:
FileZilla FTP Client
Exit code:
0
Version:
3.32.0
Modules
Images
c:\users\admin\appdata\local\temp\filezilla_client_(64bit)_v3.32.0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1468C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CTF Loader
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1472C:\Windows\system32\sipnotify.exe -LogonOrUnlockC:\Windows\System32\sipnotify.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
sipnotify
Exit code:
0
Version:
6.1.7602.20480 (win7sp1_ldr_escrow.191010-1716)
Modules
Images
c:\windows\system32\sipnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2056runonce.exe /ExplorerC:\Windows\System32\runonce.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Run Once Wrapper
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\runonce.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2080"C:\Program Files\FileZilla FTP Client\NSIS.Library.RegTool.v3.{E4A2F159-3687-4128-AC30-0EFE01B18436}.exe" /SC:\Program Files\FileZilla FTP Client\NSIS.Library.RegTool.v3.{E4A2F159-3687-4128-AC30-0EFE01B18436}.exe—runonce.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\filezilla ftp client\nsis.library.regtool.v3.{e4a2f159-3687-4128-ac30-0efe01b18436}.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2088"C:\Program Files\FileZilla FTP Client\NSIS.Library.RegTool.v3.{E4A2F159-3687-4128-AC30-0EFE01B18436}.exe" /DC:\Program Files\FileZilla FTP Client\fzshellext.dllC:\Program Files\FileZilla FTP Client\NSIS.Library.RegTool.v3.{E4A2F159-3687-4128-AC30-0EFE01B18436}.exe—NSIS.Library.RegTool.v3.{E4A2F159-3687-4128-AC30-0EFE01B18436}.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\filezilla ftp client\nsis.library.regtool.v3.{e4a2f159-3687-4128-ac30-0efe01b18436}.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2172"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /JPN /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
2184"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /KOR /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
2292"C:\Users\admin\AppData\Local\Temp\FileZilla_Client_(64bit)_v3.32.0.exe" /UAC:501B4 /NCRC C:\Users\admin\AppData\Local\Temp\FileZilla_Client_(64bit)_v3.32.0.exe
FileZilla_Client_(64bit)_v3.32.0.exe
User:
admin
Company:
Tim Kosse
Integrity Level:
HIGH
Description:
FileZilla FTP Client
Exit code:
0
Version:
3.32.0
Modules
Images
c:\users\admin\appdata\local\temp\filezilla_client_(64bit)_v3.32.0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
Total events
14 940
Read events
14 742
Write events
171
Delete events
27

Modification events

(PID) Process:(1108) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache\Intranet
Operation:writeName:{4040CF00-1B3E-486A-B407-FA14C56B6FC0}
Value:
525400363EFF
(PID) Process:(2292) FileZilla_Client_(64bit)_v3.32.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2292) FileZilla_Client_(64bit)_v3.32.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyServer
Value:
(PID) Process:(2292) FileZilla_Client_(64bit)_v3.32.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyOverride
Value:
(PID) Process:(2292) FileZilla_Client_(64bit)_v3.32.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoConfigURL
Value:
(PID) Process:(2292) FileZilla_Client_(64bit)_v3.32.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoDetect
Value:
(PID) Process:(2292) FileZilla_Client_(64bit)_v3.32.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005F010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2292) FileZilla_Client_(64bit)_v3.32.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2292) FileZilla_Client_(64bit)_v3.32.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2292) FileZilla_Client_(64bit)_v3.32.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
Executable files
17
Suspicious files
78
Text files
778
Unknown types
1

Dropped files

PID
Process
Filename
Type
2292FileZilla_Client_(64bit)_v3.32.0.exeC:\Users\admin\AppData\Local\Temp\nso9A8E.tmp\System.dllexecutable
MD5:17ED1C86BD67E78ADE4712BE48A7D2BD
SHA256:BD046E6497B304E4EA4AB102CAB2B1F94CE09BDE0EEBBA4C59942A732679E4EB
2292FileZilla_Client_(64bit)_v3.32.0.exeC:\Users\admin\AppData\Local\Temp\nso9A8E.tmp\UAC.dllexecutable
MD5:ADB29E6B186DAA765DC750128649B63D
SHA256:2F7F8FC05DC4FD0D5CDA501B47E4433357E887BBFED7292C028D99C73B52DC08
2292FileZilla_Client_(64bit)_v3.32.0.exeC:\Users\admin\AppData\Local\Temp\nso9A8E.tmp\INetC.dllexecutable
MD5:640BFF73A5F8E37B202D911E4749B2E9
SHA256:C1E568E25EC111184DEB1B87CFDA4BFEC529B1ABEAB39B66539D998012F33502
2292FileZilla_Client_(64bit)_v3.32.0.exeC:\Users\admin\AppData\Local\Temp\nsd110379620413\css\sdk-ui\browse.csstext
MD5:6009D6E864F60AEA980A9DF94C1F7E1C
SHA256:5EF48A8C8C3771B4F233314D50DD3B5AFDCD99DD4B74A9745C8FE7B22207056D
2292FileZilla_Client_(64bit)_v3.32.0.exeC:\Users\admin\AppData\Local\Temp\nso9A8E.tmp\modern-wizard.bmpimage
MD5:CBE40FD2B1EC96DAEDC65DA172D90022
SHA256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
1252FileZilla_Client_(64bit)_v3.32.0.exeC:\Users\admin\AppData\Local\Temp\nse75C0.tmp\UAC.dllexecutable
MD5:ADB29E6B186DAA765DC750128649B63D
SHA256:2F7F8FC05DC4FD0D5CDA501B47E4433357E887BBFED7292C028D99C73B52DC08
2292FileZilla_Client_(64bit)_v3.32.0.exeC:\Users\admin\AppData\Local\Temp\nso9A8E.tmp\UserInfo.dllexecutable
MD5:1B446B36F5B4022D50FFDC0CF567B24A
SHA256:2862C7BC7F11715CEBDEA003564A0D70BF42B73451E2B672110E1392EC392922
2292FileZilla_Client_(64bit)_v3.32.0.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:77B20B5CD41BC6BB475CCA3F91AE6E3C
SHA256:5511A9B9F9144ED7BDE4CCB074733B7C564D918D2A8B10D391AFC6BE5B3B1509
2292FileZilla_Client_(64bit)_v3.32.0.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:F09878243F06586566D5FFDFF6A5EB77
SHA256:91416BD917AC4A1B1B1440A148B5F0F260B05443E8610B057ACFA0FC353F343F
2292FileZilla_Client_(64bit)_v3.32.0.exeC:\Users\admin\AppData\Local\Temp\nso9A8E.tmp\nsDialogs.dllexecutable
MD5:42B064366F780C1F298FA3CB3AEAE260
SHA256:C13104552B8B553159F50F6E2CA45114493397A6FA4BF2CBB960C4A2BBD349AB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
17
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1472
sipnotify.exe
HEAD
200
23.212.215.38:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133846476273430000
unknown
—
—
whitelisted
2292
FileZilla_Client_(64bit)_v3.32.0.exe
GET
200
193.108.153.18:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?fc087454a766a79c
unknown
—
—
whitelisted
2292
FileZilla_Client_(64bit)_v3.32.0.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
1108
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2292
FileZilla_Client_(64bit)_v3.32.0.exe
49.12.121.47:443
offers.filezilla-project.org
Hetzner Online GmbH
DE
whitelisted
2292
FileZilla_Client_(64bit)_v3.32.0.exe
193.108.153.18:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
whitelisted
2292
FileZilla_Client_(64bit)_v3.32.0.exe
69.192.161.44:80
x1.c.lencr.org
AKAMAI-AS
DE
whitelisted
1096
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
1472
sipnotify.exe
23.212.215.38:80
query.prod.cms.rt.microsoft.com
AKAMAI-AS
AU
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.181.238
whitelisted
offers.filezilla-project.org
  • 49.12.121.47
whitelisted
ctldl.windowsupdate.com
  • 193.108.153.18
  • 193.108.153.12
whitelisted
x1.c.lencr.org
  • 69.192.161.44
whitelisted
rp.tourtodaylaboratory.com
  • —
malicious
os.tourtodaylaboratory.com
  • —
unknown
os2.tourtodaylaboratory.com
  • —
unknown
query.prod.cms.rt.microsoft.com
  • 23.212.215.38
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
FileZilla_Client_(64bit)_v3.32.0.exe