File name:

FileZilla_Client_(64bit)_v3.32.0.exe

Full analysis: https://app.any.run/tasks/08b0fb6e-05aa-474c-90f0-46387bf16a6d
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: February 21, 2025, 21:38:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

7FA9C8F1577DB957C8AFB5B592D975B0

SHA1:

035B6911C8A58D240132671A507C76FCFCDB3EB7

SHA256:

DA2F1A0EE94F0CD1CD5367718FB9292A7B6EEB5567388540B7444F611DBC7983

SSDEEP:

98304:MyJKh9vpPx1QzXfO5GZtcdLbCMYTk2sVbRZy2QPbesAJMRinRzXR9bAeMn3Hea7d:AmMQ8frO51f9Ik

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Changes the autorun value in the registry

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 1252)
      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • The process creates files with name similar to system file names

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 1252)
      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 1252)
      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Application launched itself

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 1252)
      • NSIS.Library.RegTool.v3.{E4A2F159-3687-4128-AC30-0EFE01B18436}.exe (PID: 2080)

    • There is functionality for taking screenshot (YARA)

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 1252)
      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Reads the Internet Settings

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)
      • sipnotify.exe (PID: 1472)
      • runonce.exe (PID: 2056)

    • Reads security settings of Internet Explorer

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Checks Windows Trust Settings

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Reads Internet Explorer settings

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Reads the BIOS version

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Reads Microsoft Outlook installation path

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Reads settings of System Certificates

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)
      • sipnotify.exe (PID: 1472)

    • Creates a software uninstall entry

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • The process executes via Task Scheduler

      • ctfmon.exe (PID: 1468)
      • sipnotify.exe (PID: 1472)

    • Creates/Modifies COM task schedule object

      • NSIS.Library.RegTool.v3.{E4A2F159-3687-4128-AC30-0EFE01B18436}.exe (PID: 2088)

    • Searches for installed software

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

  • INFO

    • Reads the computer name

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 1252)
      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)
      • wmpnscfg.exe (PID: 3112)
      • IMEKLMG.EXE (PID: 2172)
      • IMEKLMG.EXE (PID: 2184)
      • wmpnscfg.exe (PID: 2440)
      • wmpnscfg.exe (PID: 2464)

    • Checks supported languages

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 1252)
      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)
      • NSIS.Library.RegTool.v3.{E4A2F159-3687-4128-AC30-0EFE01B18436}.exe (PID: 2088)
      • NSIS.Library.RegTool.v3.{E4A2F159-3687-4128-AC30-0EFE01B18436}.exe (PID: 2080)
      • wmpnscfg.exe (PID: 3112)
      • IMEKLMG.EXE (PID: 2184)
      • wmpnscfg.exe (PID: 2440)
      • wmpnscfg.exe (PID: 2464)
      • IMEKLMG.EXE (PID: 2172)

    • The sample compiled with english language support

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 1252)
      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • FileZilla executable

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 1252)

    • Create files in a temporary directory

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 1252)
      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Checks proxy server information

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Reads the machine GUID from the registry

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Reads the software policy settings

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)
      • sipnotify.exe (PID: 1472)

    • Creates files or folders in the user directory

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Reads product name

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Process checks whether UAC notifications are on

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)
      • IMEKLMG.EXE (PID: 2172)
      • IMEKLMG.EXE (PID: 2184)

    • Reads Environment values

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Reads CPU info

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Reads Windows Product ID

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Creates files in the program directory

      • FileZilla_Client_(64bit)_v3.32.0.exe (PID: 2292)

    • Manual execution by a user

      • IMEKLMG.EXE (PID: 2172)
      • runonce.exe (PID: 2056)
      • wmpnscfg.exe (PID: 3112)
      • IMEKLMG.EXE (PID: 2184)
      • wmpnscfg.exe (PID: 2440)
      • wmpnscfg.exe (PID: 2464)

    • Reads security settings of Internet Explorer

      • sipnotify.exe (PID: 1472)
      • runonce.exe (PID: 2056)

    • Reads the time zone

      • runonce.exe (PID: 2056)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:12:11 21:50:48+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 25088
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x344a
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.32.0.0
ProductVersionNumber: 3.32.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Tim Kosse
FileDescription: FileZilla FTP Client
FileVersion: 3.32.0
LegalCopyright: Tim Kosse
OriginalFileName: FileZilla_3.32.0_win32-setup.exe
ProductName: FileZilla
ProductVersion: 3.32.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
93
Monitored processes
13
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start filezilla_client_(64bit)_v3.32.0.exe filezilla_client_(64bit)_v3.32.0.exe wmpnscfg.exe no specs ctfmon.exe no specs sipnotify.exe runonce.exe nsis.library.regtool.v3.{e4a2f159-3687-4128-ac30-0efe01b18436}.exe no specs nsis.library.regtool.v3.{e4a2f159-3687-4128-ac30-0efe01b18436}.exe no specs imeklmg.exe no specs imeklmg.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
1108C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1252"C:\Users\admin\AppData\Local\Temp\FileZilla_Client_(64bit)_v3.32.0.exe" C:\Users\admin\AppData\Local\Temp\FileZilla_Client_(64bit)_v3.32.0.exe
explorer.exe
User:
admin
Company:
Tim Kosse
Integrity Level:
MEDIUM
Description:
FileZilla FTP Client
Exit code:
0
Version:
3.32.0
Modules
Images
c:\users\admin\appdata\local\temp\filezilla_client_(64bit)_v3.32.0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1468C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CTF Loader
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1472C:\Windows\system32\sipnotify.exe -LogonOrUnlockC:\Windows\System32\sipnotify.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
sipnotify
Exit code:
0
Version:
6.1.7602.20480 (win7sp1_ldr_escrow.191010-1716)
Modules
Images
c:\windows\system32\sipnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2056runonce.exe /ExplorerC:\Windows\System32\runonce.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Run Once Wrapper
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\runonce.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2080"C:\Program Files\FileZilla FTP Client\NSIS.Library.RegTool.v3.{E4A2F159-3687-4128-AC30-0EFE01B18436}.exe" /SC:\Program Files\FileZilla FTP Client\NSIS.Library.RegTool.v3.{E4A2F159-3687-4128-AC30-0EFE01B18436}.exe—runonce.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\filezilla ftp client\nsis.library.regtool.v3.{e4a2f159-3687-4128-ac30-0efe01b18436}.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2088"C:\Program Files\FileZilla FTP Client\NSIS.Library.RegTool.v3.{E4A2F159-3687-4128-AC30-0EFE01B18436}.exe" /DC:\Program Files\FileZilla FTP Client\fzshellext.dllC:\Program Files\FileZilla FTP Client\NSIS.Library.RegTool.v3.{E4A2F159-3687-4128-AC30-0EFE01B18436}.exe—NSIS.Library.RegTool.v3.{E4A2F159-3687-4128-AC30-0EFE01B18436}.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\filezilla ftp client\nsis.library.regtool.v3.{e4a2f159-3687-4128-ac30-0efe01b18436}.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2172"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /JPN /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
2184"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /KOR /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
2292"C:\Users\admin\AppData\Local\Temp\FileZilla_Client_(64bit)_v3.32.0.exe" /UAC:501B4 /NCRC C:\Users\admin\AppData\Local\Temp\FileZilla_Client_(64bit)_v3.32.0.exe
FileZilla_Client_(64bit)_v3.32.0.exe
User:
admin
Company:
Tim Kosse
Integrity Level:
HIGH
Description:
FileZilla FTP Client
Exit code:
0
Version:
3.32.0
Modules
Images
c:\users\admin\appdata\local\temp\filezilla_client_(64bit)_v3.32.0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
Total events
14 940
Read events
14 742
Write events
171
Delete events
27

Modification events

(PID) Process:(1108) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache\Intranet
Operation:writeName:{4040CF00-1B3E-486A-B407-FA14C56B6FC0}
Value:
525400363EFF
(PID) Process:(2292) FileZilla_Client_(64bit)_v3.32.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2292) FileZilla_Client_(64bit)_v3.32.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyServer
Value:
(PID) Process:(2292) FileZilla_Client_(64bit)_v3.32.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyOverride
Value:
(PID) Process:(2292) FileZilla_Client_(64bit)_v3.32.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoConfigURL
Value:
(PID) Process:(2292) FileZilla_Client_(64bit)_v3.32.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoDetect
Value:
(PID) Process:(2292) FileZilla_Client_(64bit)_v3.32.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005F010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2292) FileZilla_Client_(64bit)_v3.32.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2292) FileZilla_Client_(64bit)_v3.32.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2292) FileZilla_Client_(64bit)_v3.32.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
Executable files
17
Suspicious files
78
Text files
778
Unknown types
1

Dropped files

PID
Process
Filename
Type
2292FileZilla_Client_(64bit)_v3.32.0.exeC:\Users\admin\AppData\Local\Temp\nso9A8E.tmp\INetC.dllexecutable
MD5:640BFF73A5F8E37B202D911E4749B2E9
SHA256:C1E568E25EC111184DEB1B87CFDA4BFEC529B1ABEAB39B66539D998012F33502
2292FileZilla_Client_(64bit)_v3.32.0.exeC:\Users\admin\AppData\Local\Temp\nso9A8E.tmp\nsDialogs.dllexecutable
MD5:42B064366F780C1F298FA3CB3AEAE260
SHA256:C13104552B8B553159F50F6E2CA45114493397A6FA4BF2CBB960C4A2BBD349AB
1252FileZilla_Client_(64bit)_v3.32.0.exeC:\Users\admin\AppData\Local\Temp\nse75C0.tmp\UAC.dllexecutable
MD5:ADB29E6B186DAA765DC750128649B63D
SHA256:2F7F8FC05DC4FD0D5CDA501B47E4433357E887BBFED7292C028D99C73B52DC08
2292FileZilla_Client_(64bit)_v3.32.0.exeC:\Users\admin\AppData\Local\Temp\nso9A8E.tmp\UAC.dllexecutable
MD5:ADB29E6B186DAA765DC750128649B63D
SHA256:2F7F8FC05DC4FD0D5CDA501B47E4433357E887BBFED7292C028D99C73B52DC08
2292FileZilla_Client_(64bit)_v3.32.0.exeC:\Users\admin\AppData\Local\Temp\nso9A8E.tmp\System.dllexecutable
MD5:17ED1C86BD67E78ADE4712BE48A7D2BD
SHA256:BD046E6497B304E4EA4AB102CAB2B1F94CE09BDE0EEBBA4C59942A732679E4EB
2292FileZilla_Client_(64bit)_v3.32.0.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:77B20B5CD41BC6BB475CCA3F91AE6E3C
SHA256:5511A9B9F9144ED7BDE4CCB074733B7C564D918D2A8B10D391AFC6BE5B3B1509
2292FileZilla_Client_(64bit)_v3.32.0.exeC:\Users\admin\AppData\Local\Temp\nso9A8E.tmp\UserInfo.dllexecutable
MD5:1B446B36F5B4022D50FFDC0CF567B24A
SHA256:2862C7BC7F11715CEBDEA003564A0D70BF42B73451E2B672110E1392EC392922
2292FileZilla_Client_(64bit)_v3.32.0.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751binary
MD5:E192462F281446B5D1500D474FBACC4B
SHA256:F1BA9F1B63C447682EBF9DE956D0DA2A027B1B779ABEF9522D347D3479139A60
2292FileZilla_Client_(64bit)_v3.32.0.exeC:\Users\admin\AppData\Local\Temp\nsd110379620413\css\ie6_main.csstext
MD5:74F08D5A243AE79F1DE64DFFDAF846CB
SHA256:15590060BFD227F656E569031113A080E0D45621A5C944DFC352F869EADAFEF2
2292FileZilla_Client_(64bit)_v3.32.0.exeC:\Users\admin\AppData\Local\Temp\nsd110379620413\csshover3.htcbinary
MD5:52FA0DA50BF4B27EE625C80D36C67941
SHA256:E37E99DDFC73AC7BA774E23736B2EF429D9A0CB8C906453C75B14C029BDD5493
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
17
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1472
sipnotify.exe
HEAD
200
23.212.215.38:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133846476273430000
unknown
—
—
whitelisted
2292
FileZilla_Client_(64bit)_v3.32.0.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
2292
FileZilla_Client_(64bit)_v3.32.0.exe
GET
200
193.108.153.18:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?fc087454a766a79c
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
1108
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2292
FileZilla_Client_(64bit)_v3.32.0.exe
49.12.121.47:443
offers.filezilla-project.org
Hetzner Online GmbH
DE
whitelisted
2292
FileZilla_Client_(64bit)_v3.32.0.exe
193.108.153.18:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
whitelisted
2292
FileZilla_Client_(64bit)_v3.32.0.exe
69.192.161.44:80
x1.c.lencr.org
AKAMAI-AS
DE
whitelisted
1096
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
1472
sipnotify.exe
23.212.215.38:80
query.prod.cms.rt.microsoft.com
AKAMAI-AS
AU
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.181.238
whitelisted
offers.filezilla-project.org
  • 49.12.121.47
whitelisted
ctldl.windowsupdate.com
  • 193.108.153.18
  • 193.108.153.12
whitelisted
x1.c.lencr.org
  • 69.192.161.44
whitelisted
rp.tourtodaylaboratory.com
  • —
malicious
os.tourtodaylaboratory.com
  • —
unknown
os2.tourtodaylaboratory.com
  • —
unknown
query.prod.cms.rt.microsoft.com
  • 23.212.215.38
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
FileZilla_Client_(64bit)_v3.32.0.exe