26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 62:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T511,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious PUABundler_Win32_FileZilla_BundleInstaller Sample dbde8a4bd71b… — Score 35/100 — Hybrid Analysis","description":"Malicious verdict for sample dbde8a4bd71b…. Malware family: PUABundler_Win32_FileZilla_BundleInstaller. Threat score 35/100. 7/27 AV engines flagged this file. 4 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/dbde8a4bd71bb1fbc0511cdb657dfeffdaedc513aa425f856043532a7cba6fce","keywords":["Malicious","PUABundler_Win32_FileZilla_BundleInstaller","malware analysis","sandbox report","threat intelligence","dbde8a4bd71bb1fbc0511cdb657dfeffdaedc513aa425f856043532a7cba6fce"],"about":{"@type":"SoftwareApplication","name":"FileZilla_3.66.5_win64_sponsored2-setup.exe","applicationCategory":["peexe","executable"],"identifier":"dbde8a4bd71bb1fbc0511cdb657dfeffdaedc513aa425f856043532a7cba6fce","additionalType":"Malicious sample"},"threatScore":35,"malwareFamily":"PUABundler_Win32_FileZilla_BundleInstaller","antivirusDetections":{"malicious":7,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Teb5,Found reference to "IHDRIDATx1-uv\VBIKymw)/gi !aee,xTWR8lwHm" (Indicator: "SHA512"; Source: "00000000-00006040.00000000.78218.47B61000.00000020.mdmp"), Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp"), Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp 00000000-00006040.00000000.78218.639C7000.00000002.mdmp"), Found reference to "length <= SHA512_DIGEST_SIZE" (Indicator: "SHA512"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp 00000000-00006040.00000000.78218.48134000.00000002.mdmp"), Found reference to "error extracting HKDF: MAC-%s" (Indicator: "HKDF"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp"), Found reference to "HKDF extract: MAC-%s test vector failed!" (Indicator: "HKDF"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp"), Found reference to "HKDF expand: MAC-%s test vector failed!" (Indicator: "HKDF"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp"), Found reference to "HKDF: MAC-%s self check succeeded" (Indicator: "HKDF"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp"), Found reference to "PKCS12-RC2-40-SHA1" (Indicator: "RC2"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp"), Found reference to "SUITEB: certificate is not signed using ECDSA-SHA256 or ECDSA-SHA384" (Indicator: "SHA384"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp"), Found reference to "RC2-40" (Indicator: "RC2"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp"), Found reference to "GNUTLS_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp"), Found reference to "TLS_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp"), Found reference to "GNUTLS_RSA_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp"), Found reference to "TLS_RSA_WITH_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp"), Found reference to "GNUTLS_RSA_CAMELLIA_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp"), Found reference to "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp"), Found reference to "GNUTLS_DHE_DSS_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp"), Found reference to "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp"), Found reference to "GNUTLS_DHE_DSS_CAMELLIA_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp"), Found reference to "TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp"), Found reference to "GNUTLS_DHE_RSA_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp"), Found reference to "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp"), Found reference to "GNUTLS_DHE_RSA_CAMELLIA_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp")28:T19b5,Assembly shows XOR instruction xor r8d 01h in Stream UID: 31564-2-0000000120001180 Assembly shows XOR instruction xor eax 01h in Stream UID: 31564-2-0000000120001180 Assembly shows XOR instruction xor r8d 01h in Stream UID: 41961-8-0000000120001180 Assembly shows XOR instruction xor eax 01h in Stream UID: 41961-8-0000000120001180 Assembly shows XOR instruction xor byte ptr [rdi] cl in Stream UID: 41961-80-0000000120060A50 Assembly shows XOR instruction xor rdi rax in Stream UID: 41961-18-0000000120041680 Assembly shows XOR instruction xor edi eax in Stream UID: 41961-18-0000000120041680 Assembly shows XOR instruction xor r8d 30h in Stream UID: 41961-18-0000000120041680 Assembly shows XOR instruction xor eax 30h in Stream UID: 41961-18-0000000120041680 Assembly shows XOR instruction xor edx r9d in Stream UID: 41961-18-0000000120041680 Assembly shows XOR instruction xor edx ecx in Stream UID: 41961-18-0000000120041680 Assembly shows XOR instruction xor r9d edx in Stream UID: 41961-18-0000000120041680 Assembly shows XOR instruction xor ecx edx in Stream UID: 41961-18-0000000120041680 Assembly shows XOR instruction xor byte ptr [rax+r10] dl in Stream UID: 41961-18-0000000120041680 Assembly shows XOR instruction xor byte ptr [rax+rdx] dl in Stream UID: 41961-18-0000000120041680 Assembly shows XOR instruction xor r8d 01h in Stream UID: 46590-8-0000000120001180 Assembly shows XOR instruction xor eax 01h in Stream UID: 46590-8-0000000120001180 Assembly shows XOR instruction xor r8d 01h in Stream UID: 49495-8-0000000120001180 Assembly shows XOR instruction xor eax 01h in Stream UID: 49495-8-0000000120001180 Assembly shows XOR instruction xor eax 01010000h in Stream UID: 49495-91-000000012002E750 Assembly shows XOR instruction xor rax rdx in Stream UID: 49495-91-000000012002E750 Assembly shows XOR instruction xor eax edx in Stream UID: 49495-91-000000012002E750 Assembly shows XOR instruction pxor xmm0 xmm3 in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor r9 rcx in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor rax rdx in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor eax edx in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor r9 r13 in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor ecx ebp in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor rax rdi in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor eax edi in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor rax r8 in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor rcx rdx in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor ecx edx in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor rax rbp in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor eax ebp in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor rcx rbx in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor ecx ebx in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor rax rbx in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor eax ebx in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor r8 rdx in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor rax rsi in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor eax esi in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor r8 r12 in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor eax esp in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor rdx rbx in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor edx ebx in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor rdx r13 in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor edx ebp in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor rcx r12 in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor ecx esp in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor r9 rdx in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor r8 rcx in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor eax ecx in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor rdi rcx in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor edi ecx in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor rdx rcx in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor edx ecx in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor rax rcx in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor rsi rdx in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor esi edx in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor rax qword ptr [r8+rdx] in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor eax dword ptr [rax+rdx] in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor rax qword ptr [r10-08h] in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor eax dword ptr [rdx-08h] in Stream UID: 49495-93-000000012002CF00 Assembly shows XOR instruction xor rdi rax in Stream UID: 49495-35-00000001200068F0 Assembly shows XOR instruction xor edi eax in Stream UID: 49495-35-00000001200068F0 Assembly shows XOR instruction xor r8d 30h in Stream UID: 49495-35-00000001200068F0 Assembly shows XOR instruction xor eax 30h in Stream UID: 49495-35-00000001200068F0 Assembly shows XOR instruction xor edx r9d in Stream UID: 49495-35-00000001200068F0 Assembly shows XOR instruction xor edx ecx in Stream UID: 49495-35-00000001200068F0 Assembly shows XOR instruction xor r9d edx in Stream UID: 49495-35-00000001200068F0 Assembly shows XOR instruction xor ecx edx in Stream UID: 49495-35-00000001200068F0 Assembly shows XOR instruction xor byte ptr [rax+r10] dl in Stream UID: 49495-35-00000001200068F0 Assembly shows XOR instruction xor byte ptr [rax+rdx] dl in Stream UID: 49495-35-00000001200068F0 Assembly shows XOR instruction xor byte ptr [rdi] cl in Stream UID: 49495-77-0000000120024E1029:Tfc5,Found string "An unknown public key algorithm was encountered." (Indicator: "public key"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "Public key decryption has failed." (Indicator: "public key"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "Public key encryption has failed." (Indicator: "public key"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "Public key signing has failed." (Indicator: "public key"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "Public key signature verification has failed." (Indicator: "public key"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "Error in the private key verification; seed doesn't match." (Indicator: "private key"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "Error in public key generation." (Indicator: "public key"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "The public key is invalid." (Indicator: "public key"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "The public key parameters are invalid." (Indicator: "public key"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "The private key is invalid." (Indicator: "private key"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "The signature is incompatible with the public key." (Indicator: "public key"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "Gost28147-89-EncryptedKey" (Indicator: "encryptedkey"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp, 00000000-00006040.00000000.78218.78F70000.00000004.mdmp") Found string "encryptedKey" (Indicator: "encryptedkey"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp, 00000000-00006040.00000000.78218.78F70000.00000004.mdmp") Found string "sessionEncryptedKey" (Indicator: "encryptedkey"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp, 00000000-00006040.00000000.78218.78F70000.00000004.mdmp") Found string "PUBLIC KEY" (Indicator: "public key"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "-----BEGIN PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "-----END PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") file/memory contains long string with (Indicator: "private key"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "-----BEGIN EC PRIVATE KEY-----MGgCAQEEHOKWJFdWdrR/CgVrUeTeawOrJ9GozE9KKx2a8PmgBwYFK4EEACGhPAM6AAQKQj3YpenWT7lFR41SnBvmj/+Bj+kgzQnaF65qWAtPRJsZXFlLTu3/IUNqSRu9DqPsk8xBHAB7pA==-----END EC PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "-----BEGIN EC PRIVATE KEY-----MF8CAQEEGLjezFcbgDMeApVrdtZHvu/k1a8/tVZ41KAKBggqhkjOPQMBAaE0AzIABO1lciKdgxeRH8k64vxcaV1OYIK9akVrW02Dw21MXhRLP0l0wzCw6LGSr5rS6AaLFg==-----END EC PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "-----BEGIN EC PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "-----END EC PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "-----BEGIN DSA PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "-----END DSA PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "-----BEGIN RSA PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp")2a:T463,"FileZilla_3.66.5_win64_sponsored2-setup.exe" called "GetWindowTextW" with parameter "I &Agree" - (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "GetWindowTextW" with parameter "Cancel" - (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "GetWindowTextW" with parameter "Nullsoft Install System v3.09" - (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "GetWindowTextW" with parameter "License Agreement" - (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "GetWindowTextW" with parameter "Please review the license terms before installing FileZilla Client 3.66.5." - (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "GetWindowTextW" with parameter "Press Page Down to see the rest of the agreement." - (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "GetWindowTextW" with parameter "If you accept the terms of the agreement, click I Agree to continue. You must accept the agreement to install FileZilla Client 3.6" - (UID: 00000000-00009624)2b:T14b6,"FileZilla_3.66.5_win64_sponsored2-setup.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000084f319006820657703000000000000006e0ea911109ab17300000000c4f31900201b6a77ffffffffd4f31900581065773c1065773e0ea911109ab173d445b173d845b173b4f31900b0f319000d0000000d0000009003b373dc54b573000000006cacb273d858b57348f41900608d6877a2e8c166feffffffe0f31900900f65779003b373f0f3190084d4b273dc54b5739003b373fcf31900a4d4b2739003b37318f419001a9ab1739003b373528b6477010000000100000017d4b27358f4190086cab273000000004acab273ded72a4d010000000100000000000000000000000000000028f419003dba19f498f41900f0ccb2733e0f863efeffffff (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000004f00320000000000000000005200ac0b4f007b23718f483c1d300000040030df4b8970d41900b0e8847790c58a47feffffff80d41900a87b52000000b37630fa4174d4478177c5478177f83c1d300000000080c342749f2a5e2c74d4190004d71900b0ac5674ffffffffb4d4190072fa417404d719007cce337472fa41740100000000000000020000007cce3374e8d419000000000080c3427480fa41740000000010d719007c0bc87610aad4766b2a5e2c (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000001900705dbf722d6d1f3cfeffffffecd01900ce32be7280d01900919fc74effffffff000000003733be7201000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffff4f2e5e2cc4d0190010d41900b0ac5674ffffffff04d1190072fa4174b1ca81777cce337472fa41740100000000000000020000007cce337430d119006cd719003ce35e0080fa417444d1190060000000d0074f00000000001b2e5e2c (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000005200030000005c00500040000000d0074f0000004f004400610000000000d0074f00a89f54000000000000000000660074000200000040000000d8014f00000000000800000000004f003200000000000000000052008f2d5e2c84d3190018d41900b0ac5674ffffffffc0d3190072fa4174320000007cce337472fa41740100000000000000020000007cce3374ecd3190024fb5e000000000080fa417430000000fcffffff00000000c0d31900 (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000004f00580000000800140000005200b40d4f0000000000b00d4f00f0d21900feba8177080014000000000008000000050000003cd31900f0bdc5760000520008001400580000008b3777ef008000002c00000005000000df2d5e2c34d31900c4d51900b0ac5674ffffffff74d3190072fa417468d319007cce337472fa41740100000000000000020000007cce3374a8d319000000000080c3427480fa4174880f5f003cda19003eda1900b7e46eefab2d5e2c (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000001900705dbf722d6d1f3cfeffffffaccf1900ce32be7240cf1900d180c74effffffff000000003733be7201000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffff8f315e2c84cf1900d0d21900b0ac5674ffffffffc4cf190072fa4174b1ca81777cce337472fa41740100000000000000020000007cce3374f0cf19002cd619004c005f0080fa417404d0190088000000d0074f00000000005b315e2c (UID: 00000000-00009624)2c:T779,"FileZilla_3.66.5_win64_sponsored2-setup.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000074f0000004f00880000000000000000000000b05252000000000000000000dfe981770200000010000000c0014f00000000000200000000004f00010000000800000000005200740a4f0000000000700a4f00f0f11900feba81770800000000000000080000000100000034f41900da91a972000052000800000001000000 (UID: 00000000-00009624) "filezilla.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000000100005000000000000000c00ceb78b90100000000000000000000000000000000000048000000000000000000000000000000500000000000000000000000000000000500000000000000000000000000000099f01f151f0000000000f678b9010000aac7c081ff7f00000000eb78b9010000000000000000000000000000 (UID: 00000000-00006040) "filezilla.exe" called "GetVersionExA" with parameter 9c0000000a000000000000005d58000002000000000000009817497fff7f000048432e00b901000001006663ff7f000000006663ff7f00000400000000000000001000000000000004000000000000000000000000000000873b6663ff7f000000005900b9010000002000000000000000000000416e00000000000000000000b0989c63ff7f00001b426663ff7f000020899c63 (UID: 00000000-00006040) "filezilla.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000020899c63ff7f000000000000000000000774e4aafbb300009c0000000a000000000000005d58000002000000000000009817497fff7f000048432e00b901000001006663ff7f000000006663ff7f00000400000000000000001000000000000004000000000000000000000000000000873b6663ff7f000000005900 (UID: 00000000-00006040) "filezilla.exe" called "GetVersionExA" with parameter 9c0000000a000000000000005d58000002000000000000009817497fff7f000048432e00b901000001006663ff7f000000006663ff7f00000400000000000000001000000000000004000000000000000000000000000000873b6663ff7f000000005900b9010000002000000000000087c67ef4fd7ada01000000000000000020899c63ff7f000087566663ff7f000020899c63 (UID: 00000000-00006040)2d:T8e1,"filezilla.exe" called "GetLocaleInfoW" with parameter "2051" - (UID: 00000000-00006040) "filezilla.exe" called "GetLocaleInfoW" with parameter "66567" - (UID: 00000000-00006040) "filezilla.exe" called "GetLocaleInfoW" with parameter "3153" - (UID: 00000000-00006040) "filezilla.exe" called "GetLocaleInfoW" with parameter "19465" - (UID: 00000000-00006040) "filezilla.exe" called "GetLocaleInfoW" with parameter "22538" - (UID: 00000000-00006040) "filezilla.exe" called "GetLocaleInfoW" with parameter "23562" - (UID: 00000000-00006040) "filezilla.exe" called "GetLocaleInfoW" with parameter "2151" - (UID: 00000000-00006040) "filezilla.exe" called "GetLocaleInfoW" with parameter "66574" - (UID: 00000000-00006040) "filezilla.exe" called "GetLocaleInfoW" with parameter "263185" - (UID: 00000000-00006040) "filezilla.exe" called "GetLocaleInfoW" with parameter "66615" - (UID: 00000000-00006040) "filezilla.exe" called "GetLocaleInfoW" with parameter "1170" - (UID: 00000000-00006040) "filezilla.exe" called "GetLocaleInfoW" with parameter "3152" - (UID: 00000000-00006040) "filezilla.exe" called "GetLocaleInfoW" with parameter "2121" - (UID: 00000000-00006040) "filezilla.exe" called "GetLocaleInfoW" with parameter "2098" - (UID: 00000000-00006040) "filezilla.exe" called "GetLocaleInfoW" with parameter "4191" - (UID: 00000000-00006040) "filezilla.exe" called "GetLocaleInfoW" with parameter "2080" - (UID: 00000000-00006040) "filezilla.exe" called "GetLocaleInfoW" with parameter "65663" - (UID: 00000000-00006040) "filezilla.exe" called "GetLocaleInfoW" with parameter "329732" - (UID: 00000000-00006040) "filezilla.exe" called "GetLocaleInfoW" with parameter "133124" - (UID: 00000000-00006040) "filezilla.exe" called "GetLocaleInfoW" with parameter "265220" - (UID: 00000000-00006040) "filezilla.exe" called "GetLocaleInfoW" with parameter "267268" - (UID: 00000000-00006040) "filezilla.exe" called "GetLocaleInfoW" with parameter "136196" - (UID: 00000000-00006040) "filezilla.exe" called "GetLocaleInfoW" with parameter "331780" - (UID: 00000000-00006040) "filezilla.exe" called "GetLocaleInfoW" with parameter "135172" - (UID: 00000000-00006040) "filezilla.exe" called "GetLocaleInfoW" with parameter "197636" - (UID: 00000000-00006040)2e:T858,Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") file/memory contains long string with (Indicator: "GetWindowText"; File: "StartMenu.dll") Found reference to API "_Z15wxGetWindowTextP6HWND__" (Indicator: "GetWindowText"; Source: "00000000-00006040.00000000.78218.3E421000.00000002.mdmp") Found reference to API "_Z17wxGetActiveWindowv" (Indicator: "GetActiveWindow"; Source: "00000000-00006040.00000000.78218.3E421000.00000002.mdmp") Found reference to API "_Z18wxFindWindowByNameRK8wxStringP8wxWindow" (Indicator: "FindWindow"; Source: "00000000-00006040.00000000.78218.3E421000.00000002.mdmp") Found reference to API "_Z19wxFindWindowAtPointRK7wxPoint" (Indicator: "FindWindow"; Source: "00000000-00006040.00000000.78218.3E421000.00000002.mdmp") Found reference to API "_Z19wxFindWindowByLabelRK8wxStringP8wxWindow" (Indicator: "FindWindow"; Source: "00000000-00006040.00000000.78218.3E421000.00000002.mdmp") Found reference to API "_Z21wxFindWindowAtPointerR7wxPoint" (Indicator: "FindWindow"; Source: "00000000-00006040.00000000.78218.3E421000.00000002.mdmp") Found reference to API "_Z26wxGenericFindWindowAtPointRK7wxPoint" (Indicator: "FindWindow"; Source: "00000000-00006040.00000000.78218.3E421000.00000002.mdmp") Found reference to API "_ZN12wxWindowBase14FindWindowByIdElPK8wxWindow" (Indicator: "FindWindow"; Source: "00000000-00006040.00000000.78218.3E421000.00000002.mdmp") Found reference to API "_ZN12wxWindowBase16FindWindowByNameERK8wxStringPK8wxWindow" (Indicator: "FindWindow"; Source: "00000000-00006040.00000000.78218.3E421000.00000002.mdmp") Found reference to API "_ZN12wxWindowBase17FindWindowByLabelERK8wxStringPK8wxWindow" (Indicator: "FindWindow"; Source: "00000000-00006040.00000000.78218.3E421000.00000002.mdmp") Found reference to API "_ZNK12wxWindowBase10FindWindowERK8wxString" (Indicator: "FindWindow"; Source: "00000000-00006040.00000000.78218.3E421000.00000002.mdmp") Found reference to API "_ZNK12wxWindowBase10FindWindowEl" (Indicator: "FindWindow"; Source: "00000000-00006040.00000000.78218.3E421000.00000002.mdmp")2f:T94f,"FileZilla_3.66.5_win64_sponsored2-setup.exe" queries volume information of "C:\" at 00000000-00009624-00000C15-206303118 "FileZilla_3.66.5_win64_sponsored2-setup.exe" queries volume information of "C:\" at 00000000-00009624-00000C15-206483142 "filezilla.exe" queries volume information of "C:\" at 00000000-00006040-00000C15-220398539 "filezilla.exe" queries volume information of "C:\share" at 00000000-00006040-00000C15-220726091 "filezilla.exe" queries volume information of "C:\Users" at 00000000-00006040-00000C15-221222918 "filezilla.exe" queries volume information of "C:\ProgramData" at 00000000-00006040-00000C15-221779348 "filezilla.exe" queries volume information of "C:\ProgramData" at 00000000-00006040-00000C15-221781004 "filezilla.exe" queries volume information of "C:\Users\Default" at 00000000-00006040-00000C15-221787940 "filezilla.exe" queries volume information of "C:\Users\%OSUSER%" at 00000000-00006040-00000C15-221792509 "filezilla.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming" at 00000000-00006040-00000C15-221803800 "filezilla.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" at 00000000-00006040-00000C15-221804224 "filezilla.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local" at 00000000-00006040-00000C15-221804628 "filezilla.exe" queries volume information of "C:\Users\%OSUSER%\Documents" at 00000000-00006040-00000C15-221804958 "filezilla.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Network Shortcuts" at 00000000-00006040-00000C15-221805336 "filezilla.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Printer Shortcuts" at 00000000-00006040-00000C15-221805833 "filezilla.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent" at 00000000-00006040-00000C15-221806284 "filezilla.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\SendTo" at 00000000-00006040-00000C15-221806732 "filezilla.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu" at 00000000-00006040-00000C15-221813333 "filezilla.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Templates" at 00000000-00006040-00000C15-22181417130:T528,"filezilla.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "filezilla.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "filezilla.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "filezilla.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "filezilla.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\PROTECTEDROOTS"; Key: "CERTIFICATES") "filezilla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0119E81BE9A14CD8E22F40AC118C687ECBA3F4D8"; Key: "BLOB") "filezilla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"; Key: "BLOB") "filezilla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\06F1AA330B927B753A40E68CDF22E34BCBEF3352"; Key: "BLOB") "filezilla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\18F7C1FCC3090203FD5BAA2F861A754976C8DD25"; Key: "BLOB") "filezilla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\245C97DF7514E7CF2DF8BE72AE957B9E04741E85"; Key: "BLOB") "filezilla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\2B45CA4F1FAC7F93EC09EABC096123B1E95C0108"; Key: "BLOB")31:T734,"FileZilla_3.66.5_win64_sponsored2-setup.exe" called "CreateDirectoryW" with parameter %TEMP%\ (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "CreateDirectoryW" with parameter C:\Users (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "CreateDirectoryW" with parameter %TEMP%\nsnFE8D.tmp (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "CreateDirectoryW" with parameter C:\Program Files (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\FileZilla FTP Client (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\FileZilla FTP Client\resources (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\FileZilla FTP Client\resources\xrc (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\FileZilla FTP Client\resources\16x16 (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\FileZilla FTP Client\resources\20x20 (UID: 00000000-00009624)32:T191c,"FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\UXTHEME.dll (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USERENV.dll (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SETUPAPI.dll (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.dll (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.dll (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NTMARTA.dll (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHLWAPI.dll (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter %TEMP%\nsnFE8D.tmp\System.dll (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter psapi (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter %TEMP%\nsnFE8D.tmp\UserInfo.dll (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter %TEMP%\nsnFE8D.tmp\UAC.dll (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter ADVAPI32 (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter ShlWAPI (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter SECUR32 (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RichEd20.dll (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter %TEMP%\nsnFE8D.tmp\nsDialogs.dll (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter %TEMP%\nsm1F89.tmp (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter %TEMP%\nsnFE8D.tmp\StartMenu.dll (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter %TEMP%\nsnFE8D.tmp\nsis_appid.dll (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\FileZilla FTP Client\fzshellext.dll (UID: 00000000-00009624) "filezilla.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006040) "filezilla.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006040) "filezilla.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006040) "filezilla.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006040) "filezilla.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006040) "filezilla.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006040) "filezilla.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00006040) "filezilla.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00006040) "filezilla.exe" called "LoadLibrary" with a parameter msftedit (UID: 00000000-00006040) "filezilla.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf (UID: 00000000-00006040) "filezilla.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00006040) "filezilla.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\MICROS~2\Office14\1033\GrooveIntlResource.dll (UID: 00000000-00006040) "filezilla.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006040)33:T24fc,"FileZilla_3.66.5_win64_sponsored2-setup.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "GetProcAddress" with a parameter Alloc (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "GetProcAddress" with a parameter Call (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "GetProcAddress" with a parameter QueryFullProcessImageName (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "GetProcAddress" with a parameter QueryFullProcessImageNameW (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "GetProcAddress" with a parameter GetProcessImageFileName (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "GetProcAddress" with a parameter GetProcessImageFileNameW (UID: 00000000-00009624) "filezilla.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter NtQueryDirectoryFile (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter GetWindowDpiAwarenessContext (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter AreDpiAwarenessContextsEqual (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter GetDpiForWindow (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter ChangeWindowMessageFilter (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter SystemParametersInfoForDpi (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter SetLayout (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter GetSystemMetricsForDpi (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter DllGetVersion (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter AlphaBlend (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter _localtime64_s (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter NtOpenFile (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter GrooveChainGetGlobalInterfacePtrAddress (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter GrooveChainCoCreateInstance (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter EnumDateFormatsExEx (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter _TrackMouseEvent (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter GradientFill (UID: 00000000-00006040) "filezilla.exe" called "GetProcAddress" with a parameter _gmtime64_s (UID: 00000000-00006040)34:T40c7,Found reference to API (Indicator: "RegEnumValueW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "RegEnumKeyW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "RegSetValueExW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "RegCloseKey"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "RegDeleteValueW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "RegDeleteKeyW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "RegCreateKeyExW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "SHFileOperationW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "SHGetFileInfoW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "ShellExecuteExW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "IIDFromString"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "OleUninitialize"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "OleInitialize"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "FillRect"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GetClientRect"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "BeginPaint"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "InvalidateRect"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "EnableWindow"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "ReleaseDC"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GetDC"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "LoadImageW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "IsWindow"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "wsprintfW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "ShowWindow"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "PostQuitMessage"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "SetWindowTextW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "SetTimer"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "DestroyWindow"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "CharNextW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "CreateWindowExW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "SystemParametersInfoW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "RegisterClassW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "ScreenToClient"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GetWindowRect"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "EnableMenuItem"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GetSystemMenu"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "IsWindowEnabled"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "SetWindowPos"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GetSysColor"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "SetCursor"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "LoadCursorW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "IsWindowVisible"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "CloseClipboard"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "SetClipboardData"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "EmptyClipboard"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "OpenClipboard"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "TrackPopupMenu"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "AppendMenuW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "CreatePopupMenu"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "CharPrevW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "CharNextA"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "wsprintfA"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "DispatchMessageW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "PeekMessageW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "SelectObject"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "CreateFontIndirectW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "DeleteObject"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "MulDiv"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "DeleteFileW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "FindNextFileW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "FindClose"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "SetFilePointer"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "ReadFile"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "lstrlenA"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GetPrivateProfileStringW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "WritePrivateProfileStringW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "FreeLibrary"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GlobalFree"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "lstrcmpW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "lstrcmpiW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "CloseHandle"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "SetFileTime"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "CompareFileTime"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "SearchPathW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GetShortPathNameW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "MoveFileW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "Sleep"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GetTickCount"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "CreateFileW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GetFileSize"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "ExitProcess"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "CopyFileW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GetTempPathW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GetVersionExW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "SetErrorMode"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "lstrlenW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "lstrcpynW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GlobalLock"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "CreateThread"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GetLastError"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "CreateProcessW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "lstrcmpiA"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GetTempFileNameW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "WriteFile"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "lstrcpyA"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "MoveFileExW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "lstrcatW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GetProcAddress"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "VerQueryValueW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GetFileVersionInfoW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "SHGetFolderPathW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "SHGetKnownFolderPath"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "RegDeleteKeyExW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "SetDefaultDllDirectories"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00006040.00000000.78218.00450000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00006040.00000000.78218.00450000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleCommandHistory"; Source: "00000000-00006040.00000000.78218.3E2B7000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCommandHistoryLength"; Source: "00000000-00006040.00000000.78218.3E2B7000.00000002.mdmp") Found reference to API (Indicator: "LoadIcon"; Source: "00000000-00006040.00000000.78218.3E2B7000.00000002.mdmp") Found reference to API (Indicator: "GetProcessUserModeExceptionPolicy"; Source: "00000000-00006040.00000000.78218.3E2B7000.00000002.mdmp") Found reference to API (Indicator: "SetProcessUserModeExceptionPolicy"; Source: "00000000-00006040.00000000.78218.3E2B7000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp, 00000000-00006040.00000000.78218.48287000.00000002.mdmp")35:T8f8,"filezilla.exe" contains export function called "WinMain" at ordinal 1 "libgnutls-30.dll" contains export function called "_dsa_generate_dss_g" at ordinal 1 "libgnutls-30.dll" contains export function called "_dsa_generate_dss_pq" at ordinal 2 "libgnutls-30.dll" contains export function called "_dsa_validate_dss_g" at ordinal 3 "libgnutls-30.dll" contains export function called "_dsa_validate_dss_pq" at ordinal 4 "libgnutls-30.dll" contains export function called "_gnutls13_psk_ext_iter_next_binder" at ordinal 5 "libgnutls-30.dll" contains export function called "_gnutls13_psk_ext_iter_next_identity" at ordinal 6 "libgnutls-30.dll" contains export function called "_gnutls13_psk_ext_parser_init" at ordinal 7 "libgnutls-30.dll" contains export function called "_gnutls_anti_replay_check" at ordinal 8 "libgnutls-30.dll" contains export function called "_gnutls_bin2hex" at ordinal 9 "libgnutls-30.dll" contains export function called "_gnutls_buffer_append_str" at ordinal 10 "libgnutls-30.dll" contains export function called "_gnutls_buffer_clear" at ordinal 11 "libgnutls-30.dll" contains export function called "_gnutls_buffer_init" at ordinal 12 "libgnutls-30.dll" contains export function called "_gnutls_buffer_pop_datum" at ordinal 13 "libgnutls-30.dll" contains export function called "_gnutls_buffer_to_datum" at ordinal 14 "libgnutls-30.dll" contains export function called "_gnutls_buffer_unescape" at ordinal 15 "libgnutls-30.dll" contains export function called "_gnutls_cidr_to_string" at ordinal 16 "libgnutls-30.dll" contains export function called "_gnutls_cipher_get_iv" at ordinal 17 "libgnutls-30.dll" contains export function called "_gnutls_cipher_to_entry" at ordinal 18 "libgnutls-30.dll" contains export function called "_gnutls_crypto_register_cipher" at ordinal 19 "libgnutls-30.dll" contains export function called "_gnutls_decode_ber_rs_raw" at ordinal 20 "libgnutls-30.dll" contains export function called "_gnutls_default_priority_string" at ordinal 21 "libgnutls-30.dll" contains export function called "_gnutls_digest_exists" at ordinal 22 "libgnutls-30.dll" contains export function called "_gnutls_ecc_curve_is_supported" at ordinal 23 "libgnutls-30.dll" contains export function called "_gnutls_encode_ber_rs_raw" at ordinal 2436:T508,"Software\Microsoft\Windows\CurrentVersion" in Source: FileZilla_3.66.5_win64_sponsored2-setup.exe "gra\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{99FD978C-D" in Source: 00000000-00006040.00000000.78218.00450000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{4E77131D-3629-431C-9818-C5679DC83E81}" in Source: 00000000-00006040.00000000.78218.00450000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00006040.00000000.78218.00450000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node" in Source: 00000000-00006040.00000000.78218.00450000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Clas" in Source: 00000000-00006040.00000000.78218.00450000.00000004.mdmp "REGISTRY\MACHINE\Software\WOW6432Node\FileZilla Client" in Source: 00000000-00006040.00000000.78218.00450000.00000004.mdmp "Software\Policies\Microsoft\Control Panel" in Source: 00000000-00006040.00000000.78218.3E2B7000.00000002.mdmp "Software\Policies\Microsoft\Windows\Control Panel" in Source: 00000000-00006040.00000000.78218.3E2B7000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00006040.00000000.78218.3E2B7000.00000002.mdmp37:T764,"Local\SM0:9624:64:WilError_03" "Local\SM0:9624:168:WilStaging_02" "Local\ZonesLockedCacheCounterMutex" "SM0:9624:64:WilError_03" "Local\ZonesCacheCounterMutex" "Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults" "\Sessions\1\BaseNamedObjects\Global\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex" "\Sessions\1\BaseNamedObjects\Global\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer" "\Sessions\1\BaseNamedObjects\Global\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer" "\Sessions\1\BaseNamedObjects\Global\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer" "\Sessions\1\BaseNamedObjects\Global\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer" "\Sessions\1\BaseNamedObjects\Global\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer" "\Sessions\1\BaseNamedObjects\Global\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer" "\Sessions\1\BaseNamedObjects\Global\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer" "\Sessions\1\BaseNamedObjects\Global\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer" "\Sessions\1\BaseNamedObjects\Global\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer" "\Sessions\1\BaseNamedObjects\Global\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer" "\Sessions\1\BaseNamedObjects\Global\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer" "\Sessions\1\BaseNamedObjects\Global\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer"38:Tfb5,"FileZilla_3.66.5_win64_sponsored2-setup.exe" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "filezilla.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "libgnutls-30.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "libstdc_-6.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "wxbase32u_gcc_custom.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "libfzclient-private-3-66-5.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "libfilezilla-42.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "wxmsw32u_xrc_gcc_custom.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "fzsftp.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "libgmp-10.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "libfzclient-commonui-private-3-66-5.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "wxmsw32u_aui_gcc_custom.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "fzputtygen.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "libnettle-8.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "libhogweed-6.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "libpng16-16.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "wxbase32u_xml_gcc_custom.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "zlib1.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "libgcc_s_seh-1.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "uninstall.exe" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "fzshellext.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "fzshellext_64.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "System.dll" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "nsDialogs.dll" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "StartMenu.dll" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT39:T2a1f,"FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76b30000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76b30000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76b30000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "KERNEL32" at base 761a0000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72b80000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 749b0000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%WINDIR%\SYSTEM32\USERENV.DLL" at base 74ca0000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%WINDIR%\SYSTEM32\SETUPAPI.DLL" at base 764f0000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "NTDLL.DLL" at base 777d0000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 741d0000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74a40000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 72af0000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 72ae0000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 73b10000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 76930000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%WINDIR%\SYSTEM32\NTMARTA.DLL" at base 737a0000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 753f0000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 72ad0000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%WINDIR%\SYSTEM32\SHLWAPI.DLL" at base 77770000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "KERNEL32.DLL" at base 761a0000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%TEMP%\NSNFE8D.TMP\SYSTEM.DLL" at base 72ac0000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "PSAPI" at base 77510000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%TEMP%\NSNFE8D.TMP\USERINFO.DLL" at base 72ab0000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "RPCRT4.DLL" at base 75d20000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "SSPICLI.DLL" at base 73070000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%TEMP%\NSNFE8D.TMP\UAC.DLL" at base 10000000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "ADVAPI32" at base 75a70000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "SHLWAPI" at base 77770000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "SECUR32" at base 72ab0000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "COMCTL32.DLL" at base 751c0000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%TEMP%\NSNFE8D.TMP\USERINFO.DLL" at base 72aa0000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%WINDIR%\SYSTEM32\RICHED20.DLL" at base 72a30000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "COMCTL32" at base 751c0000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75930000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 754e0000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 76290000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 76290000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 75a70000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 75f70000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%TEMP%\NSNFE8D.TMP\NSDIALOGS.DLL" at base 725d0000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76b30000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76b30000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76b30000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%TEMP%\NSM1F89.TMP" at base 72200000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "SECUR32.DLL" at base 72ab0000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "IPHLPAPI.DLL" at base 74c70000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 72690000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 75400000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 725e0000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 721a0000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 76b30000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 72110000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76e10000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%PROGRAMFILES%\(X86)\COMMON FILES\MICROSOFT SHARED\INK\TIPTSF.DLL" at base 72090000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%TEMP%\NSNFE8D.TMP\STARTMENU.DLL" at base 725c0000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.STORAGE.DLL" at base 742e0000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "CSCAPI.DLL" at base 72ec0000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%TEMP%\NSNFE8D.TMP\NSIS_APPID.DLL" at base 8e0000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 738c0000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 742e0000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%PROGRAMFILES%\FILEZILLA FTP CLIENT\FZSHELLEXT.DLL" at base 0 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "KERNELBASE" at base 76b30000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "USER32.DLL" at base 76290000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73440000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 76b30000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "VIRTDISK.DLL" at base 73050000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%WINDIR%\SYSWOW64\WINTYPES.DLL" at base 74b10000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 74b10000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "SHELL32.DLL" at base 76e10000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%WINDIR%\SYSWOW64\APPRESOLVER.DLL" at base 71fc0000 "FileZilla_3.66.5_win64_sponsored2-setup.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 73b70000 "filezilla.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7f430000 "filezilla.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7f430000 "filezilla.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7f430000 "filezilla.exe" loaded module "KERNEL32" at base 7fb50000 "filezilla.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 47ec0000 "filezilla.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7c620000 "filezilla.exe" loaded module "NTDLL.DLL" at base 81bd0000 "filezilla.exe" loaded module "KERNEL32.DLL" at base 7fb50000 "filezilla.exe" loaded module "USER32.DLL" at base 819b0000 "filezilla.exe" loaded module "COMCTL32.DLL" at base 66620000 "filezilla.exe" loaded module "GDI32.DLL" at base 81b60000 "filezilla.exe" loaded module "MSIMG32.DLL" at base 7c520000 "filezilla.exe" loaded module "COMCTL32" at base 66620000 "filezilla.exe" loaded module "RPCRT4.DLL" at base 7f9d0000 "filezilla.exe" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base 65630000 "filezilla.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 81120000 "filezilla.exe" loaded module "MSFTEDIT" at base 60d00000 "filezilla.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.GLOBALIZATION.DLL" at base 6dc40000 "filezilla.exe" loaded module "%WINDIR%\SYSTEM32\THUMBCACHE.DLL" at base 6a570000 "filezilla.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSCODECS.DLL" at base 7aa90000 "filezilla.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7cff0000 "filezilla.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 777a0000 "filezilla.exe" loaded module "SHELL32.DLL" at base 81120000 "filezilla.exe" loaded module "%WINDIR%\SYSTEM32\EHSTORSHELL.DLL" at base 64280000 "filezilla.exe" loaded module "%PROGRAMFILES%\MICROS~2\OFFICE14\GROOVEEX.DLL" at base 63660000 "filezilla.exe" loaded module "%PROGRAMFILES%\COMMON~1\MICROS~1\OFFICE14\CULTURES\OFFICE.ODF" at base 6d0000 "filezilla.exe" loaded module "%PROGRAMFILES%\MICROS~2\OFFICE14\1033\GROOVEINTLRESOURCE.DLL" at base af0000 "filezilla.exe" loaded module "%WINDIR%\SYSTEM32\CSCUI.DLL" at base 63580000 "filezilla.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 6e1a0000 "filezilla.exe" loaded module "SSPICLI.DLL" at base 7e290000 "filezilla.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7f430000 "filezilla.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7e4b0000 "filezilla.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 771b0000 "filezilla.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 782b0000 "filezilla.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7af20000 "filezilla.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 7fc50000 "filezilla.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 819b0000 "filezilla.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 819b0000 "filezilla.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 80e60000 "filezilla.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ff800003a:T1137,"FileZilla_3.66.5_win64_sponsored2-setup.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "FileZilla_3.66.5_win64_sponsored2-setup.exe" was detected as "Microsoft Linker" and name: "Linker" "filezilla.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "filezilla.exe" was detected as "Microsoft Linker" and name: "Linker" "libgnutls-30.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "libgnutls-30.dll" was detected as "Microsoft Linker" and name: "Linker" "libstdc_-6.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "libstdc_-6.dll" was detected as "Microsoft Linker" and name: "Linker" "wxbase32u_gcc_custom.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "wxbase32u_gcc_custom.dll" was detected as "Microsoft Linker" and name: "Linker" "libfzclient-private-3-66-5.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "libfzclient-private-3-66-5.dll" was detected as "Microsoft Linker" and name: "Linker" "libsqlite3-0.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "libsqlite3-0.dll" was detected as "Microsoft Linker" and name: "Linker" "libfilezilla-42.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "libfilezilla-42.dll" was detected as "Microsoft Linker" and name: "Linker" "wxmsw32u_xrc_gcc_custom.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "wxmsw32u_xrc_gcc_custom.dll" was detected as "Microsoft Linker" and name: "Linker" "fzsftp.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "fzsftp.exe" was detected as "Microsoft Linker" and name: "Linker" "libgmp-10.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "libgmp-10.dll" was detected as "Microsoft Linker" and name: "Linker" "libfzclient-commonui-private-3-66-5.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "libfzclient-commonui-private-3-66-5.dll" was detected as "Microsoft Linker" and name: "Linker" "wxmsw32u_aui_gcc_custom.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "wxmsw32u_aui_gcc_custom.dll" was detected as "Microsoft Linker" and name: "Linker" "fzputtygen.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "fzputtygen.exe" was detected as "Microsoft Linker" and name: "Linker" "libnettle-8.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "libnettle-8.dll" was detected as "Microsoft Linker" and name: "Linker" "libhogweed-6.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "libhogweed-6.dll" was detected as "Microsoft Linker" and name: "Linker" "libpng16-16.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "libpng16-16.dll" was detected as "Microsoft Linker" and name: "Linker" "wxbase32u_xml_gcc_custom.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "wxbase32u_xml_gcc_custom.dll" was detected as "Microsoft Linker" and name: "Linker" "zlib1.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "zlib1.dll" was detected as "Microsoft Linker" and name: "Linker" "libgcc_s_seh-1.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "libgcc_s_seh-1.dll" was detected as "Microsoft Linker" and name: "Linker" "uninstall.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "uninstall.exe" was detected as "Microsoft Linker" and name: "Linker" "fzshellext.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "fzshellext.dll" was detected as "Microsoft Linker" and name: "Linker" "fzshellext_64.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "fzshellext_64.dll" was detected as "Microsoft Linker" and name: "Linker" "UAC.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "UAC.dll" was detected as "Microsoft Linker" and name: "Linker" "System.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "System.dll" was detected as "Microsoft Linker" and name: "Linker"3b:Tda8,"FileZilla_3.66.5_win64_sponsored2-setup.exe" touched "Activation Layout Preferences" (Path: "HKCU\WOW6432NODE\CLSID\{0DC1AB8B-A52D-4BA8-BD76-E2819386FB2F}\TREATAS") "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched "Microsoft Multiple AutoComplete List Container" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\TREATAS") "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched "Microsoft Shell Folder AutoComplete List" (Path: "HKCU\WOW6432NODE\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TREATAS") "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched "Microsoft AutoComplete" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TREATAS") "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched "Microsoft TipAutoCompleteClient Control" (Path: "HKCU\WOW6432NODE\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\TREATAS") "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched "Start Menu Cache" (Path: "HKCU\WOW6432NODE\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "filezilla.exe" touched "Local Icon Cache" (Path: "HKCU\CLSID\{2155FEE3-2419-4373-B102-6843707EB41F}") "filezilla.exe" touched "ShellFolder for CD Burning" (Path: "HKCU\CLSID\{FBEB8A05-BEEE-4442-804E-409D6C4515E9}\INSTANCE") "filezilla.exe" touched "Shell Drag and Drop helper" (Path: "HKCU\CLSID\{4657278A-411B-11D2-839A-00C04FD918D0}\TREATAS") "filezilla.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "filezilla.exe" touched "Enhanced Storage Icon Overlay Handler Class" (Path: "HKCU\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\INSTANCE") "filezilla.exe" touched "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" (Path: "HKCU\CLSID\{99FD978C-D287-4F50-827F-B2C658EDA8E7}\INSTANCE") "filezilla.exe" touched "Groove Explorer Icon Overlay 2 (GFS Stub)" (Path: "HKCU\CLSID\{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}\INSTANCE") "filezilla.exe" touched "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" (Path: "HKCU\CLSID\{920E6DB1-9907-4370-B3A0-BAFC03D81399}\INSTANCE") "filezilla.exe" touched "Groove Explorer Icon Overlay 3 (GFS Folder)" (Path: "HKCU\CLSID\{16F3DD56-1AF5-4347-846D-7C10C4192619}\INSTANCE") "filezilla.exe" touched "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" (Path: "HKCU\CLSID\{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}\INSTANCE")3c:T61d,"FileZilla_3.66.5_win64_sponsored2-setup.exe" has an executable section named ".text" "filezilla.exe" has an executable section named ".text" "libgnutls-30.dll" has an executable section named ".text" "libstdc_-6.dll" has an executable section named ".text" "wxbase32u_gcc_custom.dll" has an executable section named ".text" "libfzclient-private-3-66-5.dll" has an executable section named ".text" "libsqlite3-0.dll" has an executable section named ".text" "libfilezilla-42.dll" has an executable section named ".text" "wxmsw32u_xrc_gcc_custom.dll" has an executable section named ".text" "fzsftp.exe" has an executable section named ".text" "libgmp-10.dll" has an executable section named ".text" "libfzclient-commonui-private-3-66-5.dll" has an executable section named ".text" "wxmsw32u_aui_gcc_custom.dll" has an executable section named ".text" "fzputtygen.exe" has an executable section named ".text" "libnettle-8.dll" has an executable section named ".text" "libhogweed-6.dll" has an executable section named ".text" "libpng16-16.dll" has an executable section named ".text" "wxbase32u_xml_gcc_custom.dll" has an executable section named ".text" "zlib1.dll" has an executable section named ".text" "libgcc_s_seh-1.dll" has an executable section named ".text" "uninstall.exe" has an executable section named ".text" "fzshellext.dll" has an executable section named ".text" "fzshellext_64.dll" has an executable section named ".text" "UAC.dll" has an executable section named ".text" "System.dll" has an executable section named ".text"3d:T5f9,"FileZilla_3.66.5_win64_sponsored2-setup.exe" has an writable section named ".data" "FileZilla_3.66.5_win64_sponsored2-setup.exe" has an writable section named ".ndata" "filezilla.exe" has an writable section named ".data" "filezilla.exe" has an writable section named ".bss" "filezilla.exe" has an writable section named ".idata" "filezilla.exe" has an writable section named ".CRT" "filezilla.exe" has an writable section named ".tls" "filezilla.exe" has an writable section named ".rsrc" "libgnutls-30.dll" has an writable section named ".data" "libgnutls-30.dll" has an writable section named ".bss" "libgnutls-30.dll" has an writable section named ".idata" "libgnutls-30.dll" has an writable section named ".CRT" "libgnutls-30.dll" has an writable section named ".tls" "libstdc_-6.dll" has an writable section named ".data" "libstdc_-6.dll" has an writable section named ".bss" "libstdc_-6.dll" has an writable section named ".idata" "libstdc_-6.dll" has an writable section named ".CRT" "libstdc_-6.dll" has an writable section named ".tls" "wxbase32u_gcc_custom.dll" has an writable section named ".data" "wxbase32u_gcc_custom.dll" has an writable section named ".bss" "wxbase32u_gcc_custom.dll" has an writable section named ".idata" "wxbase32u_gcc_custom.dll" has an writable section named ".CRT" "wxbase32u_gcc_custom.dll" has an writable section named ".tls" "wxbase32u_gcc_custom.dll" has an writable section named ".rsrc" "libfzclient-private-3-66-5.dll" has an writable section named ".data"3e:T30b9,"FileZilla_3.66.5_win64_sponsored2-setup.exe" file has an entrypoint instructions - "sub esp, 0x3f8,push ebp,push esi,push edi,push 0x20,pop edi,xor ebp, ebp,push 0x8001,mov dword ptr [esp + 0x20], ebp,mov dword ptr [esp + 0x18], 0x40a230,mov dword ptr [esp + 0x14], ebp,call dword ptr [0x4080a0],mov esi, dword ptr [0x4080a4],lea eax, [esp + 0x34],push eax,mov dword ptr [esp + 0x4c], ebp,mov dword ptr [esp + 0x14c], ebp,mov dword ptr [esp + 0x150], ebp,mov dword ptr [esp + 0x38], 0x11c,call esi,test eax, eax,jne 0x4036d1,lea eax, [esp + 0x34],mov dword ptr [esp + 0x34], 0x114,push eax,call esi," "filezilla.exe" file has an entrypoint instructions - "sub rsp, 0x28,mov rax, qword ptr [rip + 0x31e7c5],mov dword ptr [rax], 1,call 0x120001180,nop ,nop ,add rsp, 0x28,ret ,nop dword ptr [rax],sub rsp, 0x28,mov rax, qword ptr [rip + 0x31e7a5],mov dword ptr [rax], 0,call 0x120001180,nop ,nop ,add rsp, 0x28,ret ,nop dword ptr [rax],sub rsp, 0x28,call 0x12000d158,cmp rax, 1,sbb eax, eax,add rsp, 0x28,ret ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ," "libgnutls-30.dll" file has an entrypoint instructions - "mov rax, qword ptr [rip + 0x1dcde9],mov dword ptr [rax], 0,jmp 0x2d35611d0,nop word ptr cs:[rax + rax],nop dword ptr [rax],mov rdx, rcx,lea rcx, [rip + 0x1efcb6],jmp 0x2d36891a0,nop ,lea rcx, [rip + 9],jmp 0x2d3561340,nop dword ptr [rax],ret ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,sub rsp, 0x48,mov rax, qword ptr [rcx + 0xf8],test rax, rax,je 0x2d35613d0,cmp byte ptr [rax + 0x1f], 0," "libstdc_-6.dll" file has an entrypoint instructions - "mov rax, qword ptr [rip + 0x12ea09],mov dword ptr [rax], 0,jmp 0x3be9611d0,nop word ptr cs:[rax + rax],nop dword ptr [rax],mov rdx, rcx,lea rcx, [rip + 0x188cb6],jmp 0x3be974db0,nop ,lea rcx, [rip + 9],jmp 0x3be961340,nop dword ptr [rax],ret ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,mov r10, rcx,cmp edx, 0x31,ja 0x3be9613e0,cmp edx, 0x28,ja 0x3be961410,mov ecx, edx," "wxbase32u_gcc_custom.dll" file has an entrypoint instructions - "mov rax, qword ptr [rip + 0x157819],mov dword ptr [rax], 0,jmp 0x24b2511d0,nop word ptr cs:[rax + rax],nop dword ptr [rax],mov rdx, rcx,lea rcx, [rip + 0x196cb6],jmp 0x24b265e30,nop ,lea rcx, [rip + 9],jmp 0x24b251340,nop dword ptr [rax],ret ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,push rdi,push rsi,push rbx,sub rsp, 0x40,movups xmmword ptr [rsp + 0x20], xmm6,movups xmmword ptr [rsp + 0x30], xmm7,movzx edi, byte ptr [rcx]," "libfzclient-private-3-66-5.dll" file has an entrypoint instructions - "mov rax, qword ptr [rip + 0x123109],mov dword ptr [rax], 0,jmp 0x1200011d0,nop word ptr cs:[rax + rax],nop dword ptr [rax],mov rdx, rcx,lea rcx, [rip + 0x146cb6],jmp 0x12000d6a0,nop ,lea rcx, [rip + 9],jmp 0x120001340,nop dword ptr [rax],ret ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,jmp qword ptr [rip + 0x153d8a],nop ,nop ,jmp qword ptr [rip + 0x153d7a],nop ,nop ," "libsqlite3-0.dll" file has an entrypoint instructions - "mov rax, qword ptr [rip + 0x123ad9],mov dword ptr [rax], 0,jmp 0x66381200,nop word ptr cs:[rax + rax],nop dword ptr [rax],mov rdx, rcx,lea rcx, [rip + 0x131c86],jmp 0x6648a420,nop ,lea rcx, [rip + 9],jmp 0x66381370,nop dword ptr [rax],ret ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,mov rax, qword ptr [rcx + 0x1c0],mov r10, rdx,mov r9, rcx,xor edx, edx,test rax, rax,je 0x663813c3," "libfilezilla-42.dll" file has an entrypoint instructions - "mov rax, qword ptr [rip + 0xaec19],mov dword ptr [rax], 0,jmp 0x1200011d0,nop word ptr cs:[rax + rax],nop dword ptr [rax],mov rdx, rcx,lea rcx, [rip + 0xc5cb6],jmp 0x12000d960,nop ,lea rcx, [rip + 9],jmp 0x120001340,nop dword ptr [rax],ret ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,jmp qword ptr [rip + 0xd925a],nop ,nop ,jmp qword ptr [rip + 0xd8fa2],nop ,nop ," "wxmsw32u_xrc_gcc_custom.dll" file has an entrypoint instructions - "mov rax, qword ptr [rip + 0x821b9],mov dword ptr [rax], 0,jmp 0x1d33811d0,nop word ptr cs:[rax + rax],nop dword ptr [rax],mov rdx, rcx,lea rcx, [rip + 0x9bcb6],jmp 0x1d338b320,nop ,lea rcx, [rip + 9],jmp 0x1d3381340,nop dword ptr [rax],ret ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,jmp qword ptr [rip + 0xa94da],nop ,nop ,jmp qword ptr [rip + 0xa94ca],nop ,nop ," "fzsftp.exe" file has an entrypoint instructions - "sub rsp, 0x28,mov rax, qword ptr [rip + 0x90535],mov dword ptr [rax], 0,call 0x120001180,nop ,nop ,add rsp, 0x28,ret ,nop dword ptr [rax],sub rsp, 0x28,call 0x120078080,cmp rax, 1,sbb eax, eax,add rsp, 0x28,ret ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,lea rcx, [rip + 9],jmp 0x1200014f0,nop dword ptr [rax],ret ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,push r12,push rbp,push rdi," "libgmp-10.dll" file has an entrypoint instructions - "mov rax, qword ptr [rip + 0x900a9],mov dword ptr [rax], 0,jmp 0x2599e11d0,nop word ptr cs:[rax + rax],nop dword ptr [rax],mov rdx, rcx,lea rcx, [rip + 0x96cb6],jmp 0x259a611c0,nop ,lea rcx, [rip + 9],jmp 0x2599e1340,nop dword ptr [rax],ret ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,sub rsp, 0x38,mov qword ptr [rsp + 0x50], r8,lea r8, [rsp + 0x50],mov qword ptr [rsp + 0x58], r9," "libfzclient-commonui-private-3-66-5.dll" file has an entrypoint instructions - "mov rax, qword ptr [rip + 0x7e2c9],mov dword ptr [rax], 0,jmp 0x1200011d0,nop word ptr cs:[rax + rax],nop dword ptr [rax],mov rdx, rcx,lea rcx, [rip + 0x8bcb6],jmp 0x120007b00,nop ,lea rcx, [rip + 9],jmp 0x120001340,nop dword ptr [rax],ret ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,jmp qword ptr [rip + 0x92ef2],nop ,nop ,jmp qword ptr [rip + 0x92ee2],nop ,nop ," "wxmsw32u_aui_gcc_custom.dll" file has an entrypoint instructions - "mov rax, qword ptr [rip + 0x53bc9],mov dword ptr [rax], 0,jmp 0x1d8c011d0,nop word ptr cs:[rax + rax],nop dword ptr [rax],mov rdx, rcx,lea rcx, [rip + 0x66cb6],jmp 0x1d8c03660,nop ,lea rcx, [rip + 9],jmp 0x1d8c01340,nop dword ptr [rax],ret ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,jmp qword ptr [rip + 0x736ea],nop ,nop ,jmp qword ptr [rip + 0x736da],nop ,nop ," "fzputtygen.exe" file has an entrypoint instructions - "sub rsp, 0x28,mov rax, qword ptr [rip + 0x4d095],mov dword ptr [rax], 0,call 0x120001180,nop ,nop ,add rsp, 0x28,ret ,nop dword ptr [rax],sub rsp, 0x28,call 0x120040ce0,cmp rax, 1,sbb eax, eax,add rsp, 0x28,ret ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,lea rcx, [rip + 9],jmp 0x1200014f0,nop dword ptr [rax],ret ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,push rsi,push rbx," "libnettle-8.dll" file has an entrypoint instructions - "mov rax, qword ptr [rip + 0x44c99],mov dword ptr [rax], 0,jmp 0x2975411d0,nop word ptr cs:[rax + rax],nop dword ptr [rax],mov rdx, rcx,lea rcx, [rip + 0x49cb6],jmp 0x297570e90,nop ,lea rcx, [rip + 9],jmp 0x297541340,nop dword ptr [rax],ret ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,push rdi,mov rdi, rcx,push rsi,mov rsi, rdx,mov rdx, r8,mov rcx, r9,mov r8, qword ptr [rsp + 0x38]," "libhogweed-6.dll" file has an entrypoint instructions - "mov rax, qword ptr [rip + 0x3a399],mov dword ptr [rax], 0,jmp 0x3241e11d0,nop word ptr cs:[rax + rax],nop dword ptr [rax],mov rdx, rcx,lea rcx, [rip + 0x3ecb6],jmp 0x3241f4410,nop ,lea rcx, [rip + 9],jmp 0x3241e1340,nop dword ptr [rax],ret ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,push rsi,push rbx,mov r9, rcx,mov rcx, qword ptr [rcx + 0x18],mov rsi, rdx,mov r10, qword ptr [r9],cmp rcx, r10,je 0x3241e13e1," "libpng16-16.dll" file has an entrypoint instructions - "mov rax, qword ptr [rip + 0x32a69],mov dword ptr [rax], 0,jmp 0x68b41200,nop word ptr cs:[rax + rax],nop dword ptr [rax],mov rdx, rcx,lea rcx, [rip + 0x36c86],jmp 0x68b6d1f0,nop ,lea rcx, [rip + 9],jmp 0x68b41370,nop dword ptr [rax],ret ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,xor r9d, r9d,mov r10, rdx,mov r11, rcx,mov edx, dword ptr [rcx + 0x18],mov eax, dword ptr [r10 + 0x18],mov ecx, eax," "wxbase32u_xml_gcc_custom.dll" file has an entrypoint instructions - "mov rax, qword ptr [rip + 0x32509],mov dword ptr [rax], 0,jmp 0x3292411d0,nop word ptr cs:[rax + rax],nop dword ptr [rax],mov rdx, rcx,lea rcx, [rip + 0x36cb6],jmp 0x329262490,nop ,lea rcx, [rip + 9],jmp 0x329241340,nop dword ptr [rax],ret ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,push rsi,push rbx,sub rsp, 0x28,mov rsi, rcx,mov rbx, rdx,test rdx, rdx,jne 0x32924138b,jmp 0x3292413c9," "zlib1.dll" file has an entrypoint instructions - "mov rax, qword ptr [rip + 0x1de69],mov dword ptr [rax], 0,jmp 0x62e81200,nop word ptr cs:[rax + rax],nop dword ptr [rax],mov rdx, rcx,lea rcx, [rip + 0x20c86],jmp 0x62e98970,nop ,lea rcx, [rip + 9],jmp 0x62e81370,nop dword ptr [rax],ret ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,push r15,push r14,push r13,push r12,push rbp,push rdi,push rsi,push rbx,sub rsp, 0x28,mov eax, ecx," "libgcc_s_seh-1.dll" file has an entrypoint instructions - "mov rax, qword ptr [rip + 0x16999],mov dword ptr [rax], 0,jmp 0x1e01411d0,nop word ptr cs:[rax + rax],nop dword ptr [rax],mov rdx, rcx,lea rcx, [rip + 0x19cb6],jmp 0x1e0154420,nop ,lea rcx, [rip + 9],jmp 0x1e0141340,nop dword ptr [rax],ret ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,mov rax, rcx,nop ,pop r11,mov r10, rsp,cmp rax, 0x1000,jb 0x1e014139a," "uninstall.exe" file has an entrypoint instructions - "sub esp, 0x3f8,push ebp,push esi,push edi,push 0x20,pop edi,xor ebp, ebp,push 0x8001,mov dword ptr [esp + 0x20], ebp,mov dword ptr [esp + 0x18], 0x40a230,mov dword ptr [esp + 0x14], ebp,call dword ptr [0x4080a0],mov esi, dword ptr [0x4080a4],lea eax, [esp + 0x34],push eax,mov dword ptr [esp + 0x4c], ebp,mov dword ptr [esp + 0x14c], ebp,mov dword ptr [esp + 0x150], ebp,mov dword ptr [esp + 0x38], 0x11c,call esi,test eax, eax,jne 0x4036d1,lea eax, [esp + 0x34],mov dword ptr [esp + 0x34], 0x114,push eax,call esi," "fzshellext.dll" file has an entrypoint instructions - "sub esp, 0xc,mov dword ptr [0x67287048], 0,mov ecx, dword ptr [esp + 0x18],mov edx, dword ptr [esp + 0x14],mov eax, dword ptr [esp + 0x10],call 0x67281200,add esp, 0xc,ret 0xc,lea esi, [esi],lea esi, [esi],nop ,sub esp, 0x1c,mov eax, dword ptr [esp + 0x20],mov dword ptr [esp], 0x67287000,mov dword ptr [esp + 4], eax,call 0x67282230,add esp, 0x1c,ret ,nop ,nop ,nop ,nop ,nop ,push ebp,mov ebp, esp,push edi,push esi,push ebx,sub esp, 0x1c,mov dword ptr [esp], 0x67285000," "fzshellext_64.dll" file has an entrypoint instructions - "mov rax, qword ptr [rip + 0x41a9],mov dword ptr [rax], 0,jmp 0x3a5d811d0,nop word ptr cs:[rax + rax],nop dword ptr [rax],mov rdx, rcx,lea rcx, [rip + 0x6cb6],jmp 0x3a5d82160,nop ,lea rcx, [rip + 9],jmp 0x3a5d81340,nop dword ptr [rax],ret ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,sub rsp, 0x28,mov rax, qword ptr [rip + 0x2c85],mov rax, qword ptr [rax],test rax, rax,je 0x3a5d813a5," "UAC.dll" file has an entrypoint instructions - "cmp dword ptr [esp + 8], 1,jne 0x100029b2,mov eax, dword ptr [esp + 4],push edi,push 0x38,mov dword ptr [0x10004014], eax,xor al, al,pop ecx,mov edi, 0x1000401c,rep stosb byte ptr es:[edi], al,call dword ptr [0x10001030],call dword ptr [0x10001098],pop edi,xor eax, eax,inc eax,ret 0xc,push ebp,mov ebp, esp,sub esp, 0x208,lea eax, [ebp - 0x208],push esi,mov cl, byte ptr [edx],movsx si, cl,mov word ptr [eax], si,inc eax,inc eax,inc edx,test cl, cl,jne 0x100029c8,lea eax, [ebp - 0x208],push eax,push 0,push 0xc,push dword ptr [ebp + 0xc],push dword ptr [ebp + 8]," "System.dll" file has an entrypoint instructions - "mov eax, dword ptr [esp + 4],cmp dword ptr [esp + 8], 1,mov dword ptr [0x10005048], eax,jne 0x10002acf,push 0x1000504c,push 0x40,push 4,push 0x1000505c,call dword ptr [0x10004038],xor eax, eax,mov byte ptr [0x1000505c], 0xc2,mov dword ptr [0x1000504c], eax,mov dword ptr [0x10005054], eax,mov dword ptr [0x10005068], eax,mov dword ptr [0x10005058], eax,mov dword ptr [0x10005050], eax,mov dword ptr [0x10005060], eax,mov byte ptr [0x1000505e], al,xor eax, eax,inc eax,ret 0xc,mov eax, 0x10000,ret ,mov eax, dword ptr [esp + 4],"3f:T4a2,"filezilla.exe" has high imagebase "0x120000000" "libgnutls-30.dll" has high imagebase "0x2d3560000" "libstdc_-6.dll" has high imagebase "0x3be960000" "wxbase32u_gcc_custom.dll" has high imagebase "0x24b250000" "libfzclient-private-3-66-5.dll" has high imagebase "0x120000000" "libsqlite3-0.dll" has high imagebase "0x66380000" "libfilezilla-42.dll" has high imagebase "0x120000000" "wxmsw32u_xrc_gcc_custom.dll" has high imagebase "0x1d3380000" "fzsftp.exe" has high imagebase "0x120000000" "libgmp-10.dll" has high imagebase "0x2599e0000" "libfzclient-commonui-private-3-66-5.dll" has high imagebase "0x120000000" "wxmsw32u_aui_gcc_custom.dll" has high imagebase "0x1d8c00000" "fzputtygen.exe" has high imagebase "0x120000000" "libnettle-8.dll" has high imagebase "0x297540000" "libhogweed-6.dll" has high imagebase "0x3241e0000" "libpng16-16.dll" has high imagebase "0x68b40000" "wxbase32u_xml_gcc_custom.dll" has high imagebase "0x329240000" "zlib1.dll" has high imagebase "0x62e80000" "libgcc_s_seh-1.dll" has high imagebase "0x1e0140000" "fzshellext.dll" has high imagebase "0x67280000" "fzshellext_64.dll" has high imagebase "0x3a5d80000"40:T8fa,"FileZilla_3.66.5_win64_sponsored2-setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\USER PROFILE"; Key: "LANGUAGES") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\GEO"; Key: "NAME") "filezilla.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "filezilla.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "filezilla.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA-ES-VALENCIA") "filezilla.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA-ES-VALENCIA") "filezilla.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DE-DE") "filezilla.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "DE-DE") "filezilla.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DZ-BT") "filezilla.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "DZ-BT") "filezilla.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-AE") "filezilla.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-AE") "filezilla.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ES-419") "filezilla.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ES-419") "filezilla.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ES-CU") "filezilla.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ES-CU") "filezilla.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "FF-LATN-SN") "filezilla.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "FF-LATN-SN") "filezilla.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "HU-HU") "filezilla.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "HU-HU")41:T6e2,Observed system executable string:"%WINDIR%\system32\UXTHEME.dll" [Source: 00000000-00009624-00000C25-48756897] Observed system executable string:"%WINDIR%\system32\USERENV.dll" [Source: 00000000-00009624-00000C25-48775825] Observed system executable string:"%WINDIR%\system32\SETUPAPI.dll" [Source: 00000000-00009624-00000C25-48797233] Observed system executable string:"%WINDIR%\system32\APPHELP.dll" [Source: 00000000-00009624-00000C25-48897030] Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00009624-00000C25-48933182] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00009624-00000C25-48958351] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00009624-00000C25-48977788] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00009624-00000C25-49001599] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00009624-00000C25-49029837] Observed system executable string:"%WINDIR%\system32\NTMARTA.dll" [Source: 00000000-00009624-00000C25-49050631] Observed system executable string:"%WINDIR%\system32\VERSION.dll" [Source: 00000000-00009624-00000C25-49071886] Observed system executable string:"%WINDIR%\system32\SHFOLDER.dll" [Source: 00000000-00009624-00000C25-49093841] Observed system executable string:"%WINDIR%\system32\SHLWAPI.dll" [Source: 00000000-00009624-00000C25-49116155] Observed system executable string:"%WINDIR%\system32\RichEd20.dll" [Source: 00000000-00009624-00000C25-49926741] Observed system executable string:""%WINDIR%\system32\regsvr32.exe" /s "%PROGRAMFILES%\FileZilla FTP Client\fzshellext_64.dll"" [Source: 00000000-00009624-00000C41-385835680212]42:T671,The input sample is signed with a certificate issued by "CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB" (SHA1: E5:7C:E0:1F:6A:5E:1D:4C:52:2B:C6:84:88:AF:53:D9:BA:D1:3A:B7; see report for more information) The input sample is signed with a certificate issued by "CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: D1:EB:23:A4:6D:17:D6:8F:D9:25:64:C2:F1:F1:60:17:64:D8:E3:49; see report for more information) The input sample is signed with a certificate issued by "CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: 32:9B:78:A5:C9:EB:C2:04:32:42:DE:90:CE:1B:7C:6B:1B:A6:C6:92; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Code Signing Root R46, O=Sectigo Limited, C=GB" (SHA1: 0B:C5:E7:67:73:D2:E4:4F:C9:90:3D:4D:FE:FE:45:15:53:BB:EC:4A; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: A9:9D:5B:79:E9:F1:CD:A5:9C:DA:B6:37:31:69:D5:35:3F:58:74:C6; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B6:C8:AF:83:4D:4E:53:B6:73:C7:68:72:AA:8C:95:0C:7C:54:DF:5F; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA, O="DigiCert Inc.", C=US" (SHA1: 66:F0:2B:32:C2:C2:C9:0F:82:5D:CE:AA:8A:C9:C6:4F:19:9C:CF:40; see report for more information)43:T7e0,"dialogs.xrc" has type "XML 1.0 document ASCII text with very long lines" - Location: [%PROGRAMFILES%\FileZilla FTP Client\resources\xrc\dialogs.xrc] "netconfwizard.xrc" has type "XML 1.0 document ASCII text with very long lines" - Location: [%PROGRAMFILES%\FileZilla FTP Client\resources\xrc\netconfwizard.xrc] "fzdefaults.xml.example" has type "XML 1.0 document ASCII text" - Location: [%PROGRAMFILES%\FileZilla FTP Client\docs\fzdefaults.xml.example] "defaultfilters.xml" has type "XML 1.0 document ASCII text with very long lines" - Location: [%PROGRAMFILES%\FileZilla FTP Client\resources\defaultfilters.xml] "layout.xml" has type "XML 1.0 document ASCII text" - Location: [%APPDATA%\FileZilla\layout.xml] "theme.xml" has type "XML 1.0 document ASCII text" - Location: [%PROGRAMFILES%\FileZilla FTP Client\resources\opencrystal\theme.xml] "theme.xml" has type "XML 1.0 document ASCII text" - Location: [%PROGRAMFILES%\FileZilla FTP Client\resources\tango\theme.xml] "theme.xml" has type "XML 1.0 document ASCII text" - Location: [%PROGRAMFILES%\FileZilla FTP Client\resources\flatzilla\theme.xml] "theme.xml" has type "XML 1.0 document ASCII text" - Location: [%PROGRAMFILES%\FileZilla FTP Client\resources\lone\theme.xml] "theme.xml" has type "XML 1.0 document UTF-8 Unicode text" - Location: [%PROGRAMFILES%\FileZilla FTP Client\resources\minimal\theme.xml] "theme.xml" has type "XML 1.0 document ASCII text" - Location: [%PROGRAMFILES%\FileZilla FTP Client\resources\blukis\theme.xml] "theme.xml" has type "XML 1.0 document ASCII text" - Location: [%PROGRAMFILES%\FileZilla FTP Client\resources\classic\theme.xml] "theme.xml" has type "XML 1.0 document ASCII text" - Location: [%PROGRAMFILES%\FileZilla FTP Client\resources\default\theme.xml] "theme.xml" has type "XML 1.0 document ASCII text" - Location: [%PROGRAMFILES%\FileZilla FTP Client\resources\sun\theme.xml] "theme.xml" has type "XML 1.0 document ASCII text" - Location: [%PROGRAMFILES%\FileZilla FTP Client\resources\cyril\theme.xml]44:T54d,"FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: ""; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\DNSCLIENT"; Key: ""; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEM\DNSCLIENT"; Key: ""; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES"; Key: ""; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: ""; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNS"; Key: ""; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME"; Key: ""; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID"; Key: ""; Value: "")45:T9a1,"FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "7E32A1C4-D502-5B7C-39E8-2B7B0B5F0424"; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "703FCC13-B66F-5868-DDD9-E2DB7F381FFB"; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "9CA335ED-C0A6-4B4D-B084-9C9B5143AFF0"; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "")46:T517,"FileZilla_3.66.5_win64_sponsored2-setup.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.1635_none_6ebca75c88023f94\comctl32.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" trying to touch file "C:\Windows\SysWOW64\imm32.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" trying to touch file "C:\Windows\SysWOW64\oleaut32.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" trying to touch file "C:\Windows\WindowsShell.Manifest" "FileZilla_3.66.5_win64_sponsored2-setup.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" trying to touch file "C:\Windows\SysWOW64\fltLib.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" trying to touch file "C:\Windows\SysWOW64\uxtheme.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" trying to touch file "C:\Windows\SysWOW64\userenv.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" trying to touch file "C:\Windows\SysWOW64\propsys.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" trying to touch file "C:\Windows\SysWOW64\dwmapi.dll"47:Tb80,"FileZilla_3.66.5_win64_sponsored2-setup.exe" touched file "C:\Program Files\FileZilla FTP Client\filezilla.exe" "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched file "C:\Program Files\FileZilla FTP Client\fzsftp.exe" "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched file "C:\Program Files\FileZilla FTP Client\fzputtygen.exe" "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched file "C:\Program Files\FileZilla FTP Client\fzstorj.exe" "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched file "C:\Program Files\FileZilla FTP Client\GPL.html" "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched file "C:\Program Files\FileZilla FTP Client\NEWS" "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched file "C:\Program Files\FileZilla FTP Client\AUTHORS" "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched file "C:\Program Files\FileZilla FTP Client\libgmp-10.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched file "C:\Program Files\FileZilla FTP Client\libnettle-8.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched file "C:\Program Files\FileZilla FTP Client\libhogweed-6.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched file "C:\Program Files\FileZilla FTP Client\zlib1.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched file "C:\Program Files\FileZilla FTP Client\libgcc_s_seh-1.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched file "C:\Program Files\FileZilla FTP Client\libgnutls-30.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched file "C:\Program Files\FileZilla FTP Client\libstdc++-6.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched file "C:\Program Files\FileZilla FTP Client\libfilezilla-42.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched file "C:\Program Files\FileZilla FTP Client\libfzclient-private-3-66-5.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched file "C:\Program Files\FileZilla FTP Client\libfzclient-commonui-private-3-66-5.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched file "C:\Program Files\FileZilla FTP Client\wxbase32u_gcc_custom.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched file "C:\Program Files\FileZilla FTP Client\libpng16-16.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched file "C:\Program Files\FileZilla FTP Client\wxmsw32u_core_gcc_custom.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched file "C:\Program Files\FileZilla FTP Client\wxmsw32u_aui_gcc_custom.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched file "C:\Program Files\FileZilla FTP Client\wxbase32u_xml_gcc_custom.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched file "C:\Program Files\FileZilla FTP Client\wxmsw32u_xrc_gcc_custom.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched file "C:\Program Files\FileZilla FTP Client\libsqlite3-0.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched file "C:\Program Files\FileZilla FTP Client"48:T4ec,"FileZilla_3.66.5_win64_sponsored2-setup.exe" touched file "C:\ProgramData\Microsoft\Windows\Start Menu" "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs" "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client\Uninstall.lnk" "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client\FileZilla.lnk" "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client\~ileZilla.tmp" "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client\FileZilla.lnk~RF1265d6.TMP" "FileZilla_3.66.5_win64_sponsored2-setup.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "filezilla.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Explorer" "filezilla.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "filezilla.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Explorer" "filezilla.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches"49:T704,"FileZilla_3.66.5_win64_sponsored2-setup.exe" trying to access non-existent file "C:\Program Files\FileZilla FTP Client\filezilla.exe" "FileZilla_3.66.5_win64_sponsored2-setup.exe" trying to access non-existent file "C:\Program Files\FileZilla FTP Client\fzsftp.exe" "FileZilla_3.66.5_win64_sponsored2-setup.exe" trying to access non-existent file "C:\Program Files\FileZilla FTP Client\fzputtygen.exe" "FileZilla_3.66.5_win64_sponsored2-setup.exe" trying to access non-existent file "C:\Program Files\FileZilla FTP Client\fzstorj.exe" "FileZilla_3.66.5_win64_sponsored2-setup.exe" trying to access non-existent file "C:\Program Files\FileZilla FTP Client\libgmp-10.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" trying to access non-existent file "C:\Program Files\FileZilla FTP Client\libnettle-8.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" trying to access non-existent file "C:\Program Files\FileZilla FTP Client\libhogweed-6.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" trying to access non-existent file "C:\Program Files\FileZilla FTP Client\zlib1.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" trying to access non-existent file "C:\Program Files\FileZilla FTP Client\libgcc_s_seh-1.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" trying to access non-existent file "C:\Program Files\FileZilla FTP Client\libgnutls-30.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" trying to access non-existent file "C:\Program Files\FileZilla FTP Client\libstdc++-6.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" trying to access non-existent file "C:\Program Files\FileZilla FTP Client\libfilezilla-42.dll" "FileZilla_3.66.5_win64_sponsored2-setup.exe" trying to access non-existent file "C:\Program Files\FileZilla FTP Client\libfzclient-private-3-66-5.dll"4a:T124e,Heuristic match: "3m.ng" Heuristic match: "mO.NO" Heuristic match: ":H.bR" Pattern match: "http://nsis.sf.net/NSIS_Error" Pattern match: "https://sectigo.com/CPS0B0@0" Pattern match: "http://ip.filezilla-project.org/ip.phpDelay" Pattern match: "early.Date/time" Pattern match: "http://ip.filezilla-project.org/ip.phpDeleting" Pattern match: "http://ip.filezilla-project.org/ip.phpDelete" Pattern match: "https://trac.filezilla-project.org/PO-Revision-Date" Pattern match: "http://www.gnu.org/home.html" Pattern match: "X.Xp/6:-`_uW]1`_uZ:A`Zu?A`[0UoyIEND" Pattern match: "IHDRIDATx.MUw/Y$:7P7@N" Pattern match: "KW.pEKl/IEND" Heuristic match: "api.playanext.com" Heuristic match: "offers.playanext.com" Heuristic match: "update.filezilla-project.org" Pattern match: "https://filezilla-project.org/" Heuristic match: "%PROGRAMFILES%\FileZilla FTP Client\locales\ar_EG\filezilla.mo" Heuristic match: "%PROGRAMFILES%\FileZilla FTP Client\locales\bg\filezilla.mo" Heuristic match: "%PROGRAMFILES%\FileZilla FTP Client\locales\ca_ES\filezilla.mo" Heuristic match: "%PROGRAMFILES%\FileZilla FTP Client\locales\cs\filezilla.mo" Heuristic match: "%PROGRAMFILES%\FileZilla FTP Client\locales\da_DK\filezilla.mo" Heuristic match: "%PROGRAMFILES%\FileZilla FTP Client\locales\de_DE\filezilla.mo" Heuristic match: "%PROGRAMFILES%\FileZilla FTP Client\locales\el_GR\filezilla.mo" Heuristic match: "%PROGRAMFILES%\FileZilla FTP Client\locales\es_ES\filezilla.mo" Heuristic match: "%PROGRAMFILES%\FileZilla FTP Client\locales\et_EE\filezilla.mo" Heuristic match: "%PROGRAMFILES%\FileZilla FTP Client\locales\eu_ES\filezilla.mo" Heuristic match: "%PROGRAMFILES%\FileZilla FTP Client\locales\fi\filezilla.mo" Heuristic match: "%PROGRAMFILES%\FileZilla FTP Client\locales\fr_CA\filezilla.mo" Heuristic match: "%PROGRAMFILES%\FileZilla FTP Client\locales\fr_FR\filezilla.mo" Heuristic match: "%PROGRAMFILES%\FileZilla FTP Client\locales\gl\filezilla.mo" Heuristic match: "%PROGRAMFILES%\FileZilla FTP Client\locales\gr\filezilla.mo" Heuristic match: "%PROGRAMFILES%\FileZilla FTP Client\locales\hu\filezilla.mo" Heuristic match: "%PROGRAMFILES%\FileZilla FTP Client\locales\it_IT\filezilla.mo" Heuristic match: "%PROGRAMFILES%\FileZilla FTP Client\locales\km\filezilla.mo" Heuristic match: "%PROGRAMFILES%\FileZilla FTP Client\locales\lt\filezilla.mo" Heuristic match: "%PROGRAMFILES%\FileZilla FTP Client\locales\lv\filezilla.mo" Heuristic match: "%PROGRAMFILES%\FileZilla FTP Client\locales\mk\filezilla.mo" Heuristic match: "%PROGRAMFILES%\FileZilla FTP Client\locales\nl_NL\filezilla.mo" Heuristic match: "%PROGRAMFILES%\FileZilla FTP Client\locales\ru_RU\filezilla.mo" Heuristic match: "%PROGRAMFILES%\FileZilla FTP Client\locales\sk\filezilla.mo" Heuristic match: "%PROGRAMFILES%\FileZilla FTP Client\locales\sl\filezilla.mo" Heuristic match: "%PROGRAMFILES%\FileZilla FTP Client\locales\sv_SE\filezilla.mo" Heuristic match: "%PROGRAMFILES%\FileZilla FTP Client\locales\tr_TR\filezilla.mo" Heuristic match: "ystem.ActivityHistory.Id" Heuristic match: "ystem.AppUserModel.ID" Heuristic match: "ystem.IdentityProvider.Name" Heuristic match: "ystem.Protocol.Name" Heuristic match: "ystem.SAM.Name" Heuristic match: "ystem.StructuredQuery.Is" Heuristic match: "ystem.StructuredQuery.Virtual.Cc" Heuristic match: "ystem.StructuredQuery.Virtual.To" Heuristic match: "System.ActivityHistory.Id" Heuristic match: "System.IdentityProvider.Name" Heuristic match: "System.SAM.Name" Heuristic match: "System.StructuredQuery.Virtual.Cc" Heuristic match: "System.StructuredQuery.Virtual.To" Heuristic match: "System.StructuredQuery.Is" Heuristic match: "System.Protocol.Name" Heuristic match: "System.AppUserModel.ID" Heuristic match: "System.StructuredQueryType.Implicit.Is" Pattern match: "https://welcome.filezilla-project.org/welcome?type=client&&category=documentation_more&&version=3.66.5" Pattern match: "https://welcome.filezilla-project.org/welcome?type=client&&category=support_forum&&version=3.66.5" Pattern match: "https://welcome.filezilla-project.org/welcome?type=client&category=support_forum&version=3.66.5" Pattern match: "https://welcome.filezilla-project.org/welcome?type=client&&category=documentation_network&&version=3.66.5" Pattern match: "https://welcome.filezilla-project.org/welcome?type=client&category=documentation_basic&version=3.66.5" Pattern match: "t.org/welcome?type=client&category=documentation_more&version=3.66.5" Pattern match: "https://welcome.filezilla-project.org/welcome?type=client&category=documentation_more&version=3.66.5" Pattern match: "http://www.w3.org/2000/svg" Heuristic match: "PKIX1.Name"4b:T2ec8,Found URL "https://welcome.filezilla-project.org/welcome?type=client&&category=documentation_more&&version=3.66.5" - Source: "00000000-00006040.00000000.78218.00450000.00000004.mdmp") Found URL "https://welcome.filezilla-project.org/welcome?type=client&&category=support_forum&&version=3.66.5" - Source: "00000000-00006040.00000000.78218.00450000.00000004.mdmp") Found URL "https://welcome.filezilla-project.org/welcome?type=client&category=support_forum&version=3.66.5" - Source: "00000000-00006040.00000000.78218.00450000.00000004.mdmp") Found URL "https://welcome.filezilla-project.org/welcome?type=client&&category=documentation_network&&version=3.66.5" - Source: "00000000-00006040.00000000.78218.00450000.00000004.mdmp") Found URL "https://welcome.filezilla-project.org/welcome?type=client&category=documentation_basic&version=3.66.5" - Source: "00000000-00006040.00000000.78218.00450000.00000004.mdmp") Found URL "https://welcome.filezilla-project.org/welcome?type=client&&cdry=documentation_more&&version=3.66.5" - Source: "00000000-00006040.00000000.78218.00450000.00000004.mdmp") Found URL "https://welcome.filezilla-project.org/welcome?type=client&category=documentation_more&version=3.66.5" - Source: "00000000-00006040.00000000.78218.00450000.00000004.mdmp") Found URL "http://www.w3.org/2000/svg" - Source: "00000000-00006040.00000000.78218.3E2B7000.00000002.mdmp") Found URL "https://hport" - Source: "00000000-00006040.00000000.78218.48161000.00000020.mdmp") Found URL "https://ht$hhl$" - Source: "00000000-00006040.00000000.78218.48161000.00000020.mdmp") Found URL "http://www.microsoft.com/whdc/ddk/debugging/please" - Source: "00000000-00006040.00000000.78218.48493000.00000002.mdmp") Found URL "http://www.w3.org/2000/xmlns/http://www.w3.org/xml/1998/namespacenotation(nmtokensnmtokenentitiesentityidrefsidrefcdataxml=http://www.w3.org/xml/1998/namespacesystemrequiredpublicpcdatanotationnmtokensnmtokenndataincludeimpliedignoreidrefsidreffixedentityentitiesemptyelementdoctypecdataattlistcdata[@)yh@)yh" - Source: "00000000-00006040.00000000.78218.4858D000.00000002.mdmp") Found URL "http://ip.filezilla-project.org/ip.phpcommand" - Source: "00000000-00006040.00000000.78218.4D5B4000.00000002.mdmp") Found URL "http://basic_string::appendbasic_string_view::substr%s:" - Source: "00000000-00006040.00000000.78218.4D5B4000.00000002.mdmp") Found URL "https://update.filezilla-project.org/update.phpunknown%u.%upackagecpuidinitialmanualfzupdatetestcannot" - Source: "00000000-00006040.00000000.78218.4D679000.00000002.mdmp") Found URL "http://schemas.xmlsoap.org/soap/envelope/accept-languagehttp://schemas.xmlsoap.org/soap/encoding/http://www.w3.org/2001/xmlschema-instancesoap:bodyhttp://www.w3.org/2001/xmlschemapostsoapactioncontent-typesoap:envelopesoap:headertruefalseyyyy-mm-dd't'hh:mm:ss'z'yyyy-mm-dd't'hh:mm:ssselectionlanguagexpathurn:groove.net:cert_accountguid_digest_origrootfolderpath_path_rootfolderpath_sessionid_shareobjectid_shareobjectname_stubfilepath_userguid_watermarkepubkeyepkalgoencryptedkeycsmkeykeyidencalgospubkeyspkalgosigalgourn:groove.net:auth" - Source: "00000000-00006040.00000000.78218.639C7000.00000002.mdmp") Found URL "ftp://)" - Source: "00000000-00006040.00000000.78218.78D60000.00000004.mdmp") Found URL "https://welcome.filezilla-project.org/welcome?type=client&category=documentation_network&version=3.66.5" - Source: "00000000-00006040.00000000.78218.78D60000.00000004.mdmp") Found URL "https://welcome.filezilla-project.org/welcome?type=client&category=support_more&version=3.66.5" - Source: "00000000-00006040.00000000.78218.78D60000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006040.00000000.78218.78D60000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0root" - Source: "00000000-00006040.00000000.78218.78D60000.00000004.mdmp") Found URL "https://update.filezilla-project.org/update.phpcloseversionh" - Source: "00000000-00006040.00000000.78218.78F70000.00000004.mdmp") Found URL "https://welcome.filezilla-project.org/welcome?type=client&category=documentation_network&version=3.66.5" - Source: "00000000-00006040.00000000.78218.78F70000.00000004.mdmp") Found URL "https://welcome.filezilla-project.org/welcome?type=client&category=documentation_basic&version=3.66.5" - Source: "00000000-00006040.00000000.78218.78F70000.00000004.mdmp") Found URL "https://update.filezilla-project.org/update.phpresolving" - Source: "00000000-00006040.00000000.78218.78F70000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm^0\00b0@4http://www.microsoft.com/pkiops/docs/repository.htm^0\00b0@4http://www.microsoft.com/pkiops/docs/repository.htmbmoz8xjz.m4;/6nwhc." - Source: "00000000-00006040.00000000.78218.78F70000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gift^0\00b0@4http://www.microsoft.com/pkiops/docs/repository.htm" - Source: "00000000-00006040.00000000.78218.78F70000.00000004.mdmp") Found URL "https://www.verisign.com/cpsedefault" - Source: "00000000-00006040.00000000.78218.78F70000.00000004.mdmp") Found URL "http://ip.filezilla-project.org/ip.phpsettingnamelast" - Source: "00000000-00006040.00000000.78218.78F70000.00000004.mdmp") Found URL "https://welcome.filezilla-project.org/welcome?type=client&category=support_forum&version=3.66.5" - Source: "00000000-00006040.00000000.78218.79400000.00000002.mdmp") Found URL "https://welcome.filezilla-project.org/welcome?type=client&category=support_more&version=3.66.5" - Source: "00000000-00006040.00000000.78218.79400000.00000002.mdmp") Found URL "https://welcome.filezilla-project.org/welcome?type=client&category=documentation_basic&version=3.66.5" - Source: "00000000-00006040.00000000.78218.79400000.00000002.mdmp") Found URL "https://welcome.filezilla-project.org/welcome?type=client&category=documentation_network&version=3.66.5" - Source: "00000000-00006040.00000000.78218.79400000.00000002.mdmp") Found URL "https://welcome.filezilla-project.org/welcome?type=client&category=documentation_more&version=3.66.5" - Source: "00000000-00006040.00000000.78218.79400000.00000002.mdmp") Found URL "https://welcome.filezilla-project.org/welcome?type=client&&category=documentation_basic&&version=3.66.5" - Source: "00000000-00006040.00000000.78218.7B130000.00000004.mdmp") Found URL "https://welcome.filezilla-project.org/welcome?type=client&category=documentation_basic&version=3.66.5" - Source: "00000000-00006040.00000000.78218.7B130000.00000004.mdmp") Found URL "https://welcome.filezilla-project.org/welcome?type=client&&category=support_more&&version=3.66.5" - Source: "00000000-00006040.00000000.78218.7B130000.00000004.mdmp") Found URL "https://welcome.filezilla-project.org/welcome?type=client&category=support_more&version=3.66.5" - Source: "00000000-00006040.00000000.78218.7B130000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006040.00000000.78218.7B130000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00006040.00000000.78218.7B130000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00006040.00000000.78218.7B130000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl" - Source: "00000000-00006040.00000000.78218.7B130000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00006040.00000000.78218.7B130000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crlhhhnnp" - Source: "00000000-00006040.00000000.78218.7B130000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnB&ypass proxyBeing editedBinaryBookmarkBookmark:BookmarksBuild date:Build informationC&ancel current operationC&lear allC&ustomC&ustom filetype associations:CancelCancel current operationCancels the current operationCannot access '%s', no media inserted or drive not ready.Cannot add server to Site ManagerCannot compare directories, different filters for local and remote directories are enabledCannot create new filterCannot edit fileCannot edit file, remote path unknown.Cannot establish FTP connection to an SFTP server. Please select proper protocol.Cannot rename entryCannot rename fileCannot save filtersetCannot select filterCannot set file associationCannot show dialogCannot view/edit selected fileCertificate and session data are not available yet.Challenge:Change file attributesChange the file permissions.Changing logfile settings requires restart of FileZilla.Character encoding issueCharsetCheck for &updates...Check for newer versions of FileZillaCheck for updates failedChecking for correct external IP addressChoose the default local directoryChoose the local directoryCipher:ClassicClear &layout cacheClear historyClear private dataClear quickconnect barClick on Finish to save your configuration.Client to server MAC:Client to server cipher:Close FileZillaClose all running instances of FileZillaCo&mments:Column propertiesColumn setupCommand failedCommand not supportedCommand not supported by this protocolCommand:CommentCommon name:Communication tainted by router or firewallCompare &modification timeCompare file&sizeComparison &threshold (in minutes):Comparison threshold needs to be between 0 and 1440 minutes.Compiled for:Compiled on:Compiled with:Compiler flags:CompressedConcurrent transfersConditions are c&ase sensitiveConfiguration testConfigure passive modeConfigure port rangeConfirmation neededCongratulations, your configuration seems to be working.Connect bypassing proxy settingsConnect to specified Site Manager siteConnectingConnecting to %sConnecting to %s...ConnectionConnection attempt failedConnection attempt failed with "%s", trying next address.Connection attempt failed with "%s".Connection attempt interrupted by userConnection closedConnection closed by serverConnection established, initializing TLS...Connection established, waiting for welcome message...Connection lostConnection not allowed by rulesetConnection refusedConnection timed out.Connection with proxy established, performing handshake...Connection with server got closed prematurely.Connection with the test server failed.Copy (%d) of %sCopy of %sCould not accept connection: %sCould not add connection to Site ManagerCould not connect to serverCould not connect to server: %sCould not convert command to server encodingCould not convert private keyCould not establish connection to serverCould not get full remote path.Could not get reply from fzputtygen.Could not get temporary directory to download file into.Could not load private keyCould not open log file: %sCould not parse remote path.Could not parse server address:Could not read from socket: %sCould not send command to fzputtygen.Could not start transferCould not write "%s", any changes to the Site Manager could not be saved: %sCould not write "%s", the selected sites could not be exported: %sCould not write to local fileCould not write to log file: %sCould not write to socket: %sCountry:Create a new subdirectory in the current directoryCreate directoryCreating directoryCreating directory '%s'...Critical errorCurrent transfer type is set to ASCII.Current transfer type is set to automatic detection.Current transfer type is set to binary.Cus&tomCustom filter setCustom serverD&ata typeD&ecimal prefixes using SI symbols (e.g. 1 KB = 1000 bytes)D&efaultD&eleteD&isable allDOS-like with virtual pathsDataData socket closed too early.Date formattingDate/time formatDate/time unknownDebugDebugging settingsDefault &local directory:Default (Autodetect)Default editor not properly quoted.Default file exists actionDefault r&emote directory:Default system languageDefault transfer mode:Default transfer type:Default: http://ip.filezilla-project.org/ip.phpDelay between failed connection attempts has to be between 1 and 999 seconds.Delete selected directoryDelete selected files and directoriesDesktopDetailsDetails for new key:Dire&ctoriesDirectionDirectoryDirectory comparisonDirectory comparison failedDirectory listing aborted by userDirectory listing failedDirectory listing filtersDirectory listing successfulDisa&ble allDisconnect from serverDisconnected from serverDisconnected from server: %sDisconnecting from previous serverDisconnects from the currently visible serverDisplay about dialogDo ¬ use default editorDo you really want to close FileZilla?Do you really want to delete all Site Manager entries and the transfer queue?Do you really want to delete all Site Manager entries?Do you really want to delete the transfer queue?Do you really want to send '%s' to the server?Don't use external IP address on &local connections.Dotfiles are filenames starting with a dot, e.g. .htaccessDouble-click actionDownloadDownload &limit:Download selected directoryDownload selected files and directoriesDownloadingDownloading %sE&nable allE&nter directoryE&xecuteE&xitE-Mail:Each filter needs at least one condition.Edit filtersEditing failedEmail:Empty commandEmpty directory listingEmpty directory.Empty filter names are not allowed.Empty nameEn&able allEncryptedEncryptionEncryption detailsEnter &custom command...Enter commandEnter custom commandEnter directoryEnter filter nameEnter name for filtersetEnter new name for filtersetEnter passwordEnter selected directoryEnter username and passwordError exporting settingsError importingError loading xml fileError starting programError writing xml fileError:Example: png "c:\program files\viewer\viewer.exe" -openExamplesExe&cuteExplorerExport &QueueExport &SettingsExport settingsF&ilter name:FTP Keep-aliveFTP ProxyFTP URLFailed to change directoryFailed to change languageFailed to copy or move sitesFailed to create backup copy of xml fileFailed to create listening socket for active mode transferFailed to get 'My Documents' pathFailed to get desktop pathFailed to load panels, invalid resource files?Failed to load private key: %sFailed to receive dataFailed to retrieve directory listingFailed to retrieve the external IP address.Failed to send command.Failed to set language to %s (%s), using default system languageFailed to set language to %s, using default system languageFailed to validate settingsFailed to write xml fileFailed transfersFall back to active modeFil&e:Fil&esFileFile does not contain any importable data.File editingFile existsFile exists actionFile has changedFile listsFile not foundFile transfer successfulFile transfers still in progress.FileZilla ErrorFilelist status &barsFilenameFilename invalidFilename unchangedFilename:Filenames may not contain any of the following characters: / * ? < > |Filenames may not contain any of the following characters: / \ : * ? " < > |Files currently being editedFilesizeFilesize formatFiletypeFiletype associationsFilter applies to:Filter name already existsFilter set already existsFilter the directory listingsFingerprint (SHA-1):Firewall and router configuration wizardFor more detailed information about what these options do please run the network configuration wizard.For reliability you should specify a range of at least 10 ports.Force &UTF-8Force showing &hidden filesForce showing hidden filesFormat specifications:Format: Extension followed by properly quoted command and arguments.GeneralGeneral SOCKS server failureGeneric proxyGiven filterset name already exists overwrite filter set?Global bookmarksGroup permissionsH&ighHash:HiddenHighHighestHighest available port has to be a number between 1024 and 65535.Homepage:Host key mismatchHost unreachableHost:Hours I&SO 8601 (example: 15:47)If you click on test FileZilla will connect to probe.filezilla-project.org and will perform some simple tests.If you close FileZilla your changes will be lost.If you enter the wrong filetypes those files may get corrupted when transferred.If you get any errors your configuration is not correct.Import settingsImport successfulIncorrect passwordInitializing TLS...InteractiveInterfaceInterrupted by userInvalid data receivedInvalid dateInvalid filenameInvalid inputInvalid port given. The port has to be a value from 1 to 65535.Invalid site pathInvalid size in conditionInvalid username given.Keep directories on topKey exchangeL&owestLanguageLanguage changedLast modifiedLayoutLimit for concurrent &downloads:Limit for concurrent &uploads:Limit local portsListing:Lo&west available port:LocalLocal fileLocal file does not exist.Local file is a directory instead of a regular file.Local filters:Local site:Locality:Log fileLoggingLowestLowest available port has to be a number between 1024 and 65535.Manual transferMatch all of the followingMaximum simultaneous &transfers:Message logMinutesMove &downMove &upMy ComputerMy DocumentsMy SitesNameName already existsName of bookmark already exists.Name:Need to enter filter nameNeed to specify a character encodingNetwork unreachableNew Book&markNew bookmarkNew directoryNew filterNew folderNew siteNext to the transfer queueNo category to export selectedNo command given aborting.No external IP address set trying default.No filter name givenNo host given please enter a host.No images availableNo sites availableNo username given.NoneNone selected yetNormalNot connected to any serverNot connected to any server.Note that this feature is only supported using the FTP protocol.Note: This only works with plain unencrypted FTP connections.Note: Using a generic proxy forces passive mode on FTP connections.Number of decimal places:Number of retries has to be between 0 and 99.OnceOpen the Site ManagerOpen the file.Open the settings dialog of FileZillaOpened as:Opening failedOpens the Site ManagerOrganization:Other:OverviewOverwrite &if source newerOwner permissionsOwner/GroupP&roxy host:PORT command tainted by router or firewall.Pa&ssive (recommended)Parameter not a valid URLPass&word:Passive (recommended)Passive modePassive mode has been set as default transfer mode.Password requiredPathPath cannot be constructed for directory %s and subdir %sPathsPending removalPermissionPermissionsPlease enter a custom time format.Please enter a name for the new filter.Please enter a new name for the copied filter.Please enter a new name for the filter.Please enter a password for this server:Please enter a unique name for this filter setPlease enter a username for this server:Please enter a valid portrange.Please enter raw FTP command.Using ra" (Indicator: " sftp ") in Source: filezilla.mo4f:Tb65,"FileZilla_3.66.5_win64_sponsored2-setup.exe" called "FindFirstFileW" with parameter %TEMP%\nsnFE8D.tmp (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\FileZilla FTP Client (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "FindFirstFileW" with parameter C:\Program Files (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "FindFirstFileW" with parameter %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\*.* (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "FindNextFileW" with parameter Accessibility (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "FindNextFileW" with parameter Accessories (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "FindNextFileW" with parameter Administrative Tools (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "FindNextFileW" with parameter Adobe Reader XI.lnk (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "FindNextFileW" with parameter AutoIt v3 (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "FindNextFileW" with parameter desktop.ini (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "FindNextFileW" with parameter Firefox Private Browsing.lnk (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "FindNextFileW" with parameter Firefox.lnk (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "FindNextFileW" with parameter Google Chrome.lnk (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "FindNextFileW" with parameter Java (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "FindNextFileW" with parameter Maintenance (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "FindNextFileW" with parameter Microsoft Edge.lnk (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "FindNextFileW" with parameter Microsoft Office (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "FindNextFileW" with parameter mitmproxy (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "FindNextFileW" with parameter SharePoint (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "FindNextFileW" with parameter Startup (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "FindNextFileW" with parameter System Tools (UID: 00000000-00009624) "FileZilla_3.66.5_win64_sponsored2-setup.exe" called "FindNextFileW" with parameter VMware (UID: 00000000-00009624)50:Td68,file/memory contains long string with (Indicator: "base32"; File: "wxbase32u_xml_gcc_custom.dll") file/memory contains long string with (Indicator: "ecdsa"; File: "libfilezilla.mo") file/memory contains long string with (Indicator: "aes"; File: "libfilezilla.mo") Found string "ystem.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00006040.00000000.78218.00040000.00000002.mdmp") Found string "ystem.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00006040.00000000.78218.00040000.00000002.mdmp") Found string "ystem.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00006040.00000000.78218.00040000.00000002.mdmp") Found string "ystem.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00006040.00000000.78218.00040000.00000002.mdmp") Found string "System.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00006040.00000000.78218.000A0000.00000002.mdmp") Found string "System.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00006040.00000000.78218.000A0000.00000002.mdmp") Found string "System.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00006040.00000000.78218.000A0000.00000002.mdmp") Found string "System.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00006040.00000000.78218.000A0000.00000002.mdmp") Found string "_ZNK12wxWindowBase32IsTransparentBackgroundSupportedEP8wxString" (Indicator: "base32"; Source: "00000000-00006040.00000000.78218.3E421000.00000002.mdmp") Found string "_ZNK18wxNumValidatorBase32GetCurrentValueAndInsertionPointER8wxStringRi" (Indicator: "base32"; Source: "00000000-00006040.00000000.78218.3E421000.00000002.mdmp") Found string "Vector Permutation AES for x86_64/SSSE3, Mike Hamburg (Stanford University)" (Indicator: "aes"; Source: "00000000-00006040.00000000.78218.47B61000.00000020.mdmp") Found string "AES-NI GCM module for x86_64, CRYPTOGAMS by " (Indicator: "aes"; Source: "00000000-00006040.00000000.78218.47B61000.00000020.mdmp") Found string "AES for Intel AES-NI, CRYPTOGAMS by " (Indicator: "aes"; Source: "00000000-00006040.00000000.78218.47B61000.00000020.mdmp") Found string "ECDSA_P256" (Indicator: "ecdsa"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "ECDSA_P384" (Indicator: "ecdsa"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "ECDSA_P521" (Indicator: "ecdsa"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "aes-gcm-x86-ssse3.c" (Indicator: "aes"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "The Diffie-Hellman prime sent by the server is not acceptable (not long enough)." (Indicator: "diffie-hellman"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "Base64 decoding error." (Indicator: "base64"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "GNUTLS_E_BASE64_DECODING_ERROR" (Indicator: "base64"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "Base64 unexpected header error." (Indicator: "base64"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "GNUTLS_E_BASE64_UNEXPECTED_HEADER_ERROR" (Indicator: "base64"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp")51:T475,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "FileZilla_3.66.5_win64_sponsored2-setup.exe") file/memory contains long string with (Indicator: "SHGetSpecialFolderLocation"; File: "StartMenu.dll")52:Te72,Found string "r secretH9F" (Indicator: "secret"; Source: "00000000-00006040.00000000.78218.47B61000.00000020.mdmp") Found string "password != NULL" (Indicator: "password"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "Error in password/key file." (Indicator: "password"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "Parsing error in password/key file." (Indicator: "password"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "The given password contains invalid characters." (Indicator: "password"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "Error in provided SRK password for TPM." (Indicator: "password"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "Error in provided password for key to be loaded in TPM." (Indicator: "password"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "master secret" (Indicator: "secret"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "extended master secret" (Indicator: "secret"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "_gnutls_call_secret_func" (Indicator: "secret"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "secretTypeId" (Indicator: "secret"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp, 00000000-00006040.00000000.78218.78F70000.00000004.mdmp") Found string "secretValue" (Indicator: "secret"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp, 00000000-00006040.00000000.78218.78F70000.00000004.mdmp") Found string "gnutls_utf8_password_normalize" (Indicator: "password"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp, 00000000-00006040.00000000.78218.47D55000.00000002.mdmp") Found string "_gnutls_dh_set_secret_bits" (Indicator: "secret"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "gnutls_privkey_derive_secret" (Indicator: "secret"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp, 00000000-00006040.00000000.78218.47D55000.00000002.mdmp") Found string "gnutls_dh_get_secret_bits" (Indicator: "secret"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp, 00000000-00006040.00000000.78218.47D55000.00000002.mdmp") Found string "passwordPASSWORDpassword" (Indicator: "password"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "secrets.c" (Indicator: "secret"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "_tls13_expand_secret" (Indicator: "secret"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "_tls13_expand_secret2" (Indicator: "secret"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "_tls13_derive_secret" (Indicator: "secret"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "_tls13_derive_secret2" (Indicator: "secret"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "_tls13_init_secret2" (Indicator: "secret"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp") Found string "gnutls_x509_crq_set_challenge_password" (Indicator: "password"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp, 00000000-00006040.00000000.78218.47D55000.00000002.mdmp") Found string "gnutls_x509_crq_get_challenge_password" (Indicator: "password"; Source: "00000000-00006040.00000000.78218.47C8D000.00000002.mdmp, 00000000-00006040.00000000.78218.47D55000.00000002.mdmp")53:Tfd2,Observed import api "AddAccessAllowedAce" which can "Adds an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: libfilezilla-42.dll] Observed import api "AddAccessAllowedAceEx" which can "Adds an access-allowed access control entry (ACE) to the end of a discretionary access control list (DACL)" [Source: libfilezilla-42.dll] Observed import api "CreateWellKnownSid" which can "Creates a SID for predefined aliases" [Source: libfilezilla-42.dll] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: libfilezilla-42.dll] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: libfilezilla-42.dll] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: libfilezilla-42.dll] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: libfilezilla-42.dll] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: libfilezilla-42.dll] Observed import api "SetSecurityDescriptorControl" which can "Sets the control bits of a security descriptor" [Source: libfilezilla-42.dll] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: libfilezilla-42.dll] Observed import api "SetSecurityDescriptorGroup" which can "Sets the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: libfilezilla-42.dll] Observed import api "SetSecurityDescriptorOwner" which can "Sets the owner information of an absolute-format security descriptor" [Source: libfilezilla-42.dll] Observed import api "SetSecurityDescriptorSacl" which can "Sets information in a system access control list (SACL)" [Source: libfilezilla-42.dll] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: fzsftp.exe] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: fzsftp.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: fzsftp.exe] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: fzsftp.exe] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: fzsftp.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: fzsftp.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: fzsftp.exe] Observed import api "SetSecurityDescriptorOwner" which can "Sets the owner information of an absolute-format security descriptor" [Source: fzsftp.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: UAC.dll] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: UAC.dll] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: UserInfo.dll] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: UserInfo.dll] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: UserInfo.dll] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: UserInfo.dll] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: UserInfo.dll]54:Ta34,"FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "")55:T443,"UAC.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsnFE8D.tmp\UAC.dll]- [targetUID: 00000000-00009624] "System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsnFE8D.tmp\System.dll]- [targetUID: 00000000-00009624] "nsDialogs.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsnFE8D.tmp\nsDialogs.dll]- [targetUID: 00000000-00009624] "StartMenu.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsnFE8D.tmp\StartMenu.dll]- [targetUID: 00000000-00009624] "UserInfo.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsnFE8D.tmp\UserInfo.dll]- [targetUID: 00000000-00009624] "nsis_appid.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsnFE8D.tmp\nsis_appid.dll]- [targetUID: 00000000-00009624] "nsm1F89.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsm1F89.tmp]- [targetUID: 00000000-00009624]56:Tdaf,Dropped file: "queue.sqlite3-journal" - Location: [%APPDATA%\FileZilla\queue.sqlite3-journal]- [targetUID: 00000000-00006040] Dropped file: "default_leds24x24.png" - Location: [%LOCALAPPDATA%\FileZilla\default_leds24x24.png]- [targetUID: 00000000-00006040] Dropped file: "default_processqueue20x20.png" - Location: [%LOCALAPPDATA%\FileZilla\default_processqueue20x20.png]- [targetUID: 00000000-00006040] Dropped file: "default_cancel24x24.png" - Location: [%LOCALAPPDATA%\FileZilla\default_cancel24x24.png]- [targetUID: 00000000-00006040] Dropped file: "default_sitemanager20x20.png" - Location: [%LOCALAPPDATA%\FileZilla\default_sitemanager20x20.png]- [targetUID: 00000000-00006040] Dropped file: "default_refresh20x20.png" - Location: [%LOCALAPPDATA%\FileZilla\default_refresh20x20.png]- [targetUID: 00000000-00006040] Dropped file: "default_compare20x20.png" - Location: [%LOCALAPPDATA%\FileZilla\default_compare20x20.png]- [targetUID: 00000000-00006040] Dropped file: "default_cancel20x20.png" - Location: [%LOCALAPPDATA%\FileZilla\default_cancel20x20.png]- [targetUID: 00000000-00006040] Dropped file: "default_synchronize20x20.png" - Location: [%LOCALAPPDATA%\FileZilla\default_synchronize20x20.png]- [targetUID: 00000000-00006040] Dropped file: "default_speedlimits16x16.png" - Location: [%LOCALAPPDATA%\FileZilla\default_speedlimits16x16.png]- [targetUID: 00000000-00006040] Dropped file: "default_find20x20.png" - Location: [%LOCALAPPDATA%\FileZilla\default_find20x20.png]- [targetUID: 00000000-00006040] Dropped file: "default_disconnect20x20.png" - Location: [%LOCALAPPDATA%\FileZilla\default_disconnect20x20.png]- [targetUID: 00000000-00006040] Dropped file: "default_queueview20x20.png" - Location: [%LOCALAPPDATA%\FileZilla\default_queueview20x20.png]- [targetUID: 00000000-00006040] Dropped file: "default_logview20x20.png" - Location: [%LOCALAPPDATA%\FileZilla\default_logview20x20.png]- [targetUID: 00000000-00006040] Dropped file: "default_reconnect20x20.png" - Location: [%LOCALAPPDATA%\FileZilla\default_reconnect20x20.png]- [targetUID: 00000000-00006040] Dropped file: "default_filter20x20.png" - Location: [%LOCALAPPDATA%\FileZilla\default_filter20x20.png]- [targetUID: 00000000-00006040] Dropped file: "layout.xml" - Location: [%APPDATA%\FileZilla\layout.xml]- [targetUID: 00000000-00006040] Dropped file: "default_server16x16.png" - Location: [%LOCALAPPDATA%\FileZilla\default_server16x16.png]- [targetUID: 00000000-00006040] Dropped file: "default_close12x12.png" - Location: [%LOCALAPPDATA%\FileZilla\default_close12x12.png]- [targetUID: 00000000-00006040] Dropped file: "default_localtreeview20x20.png" - Location: [%LOCALAPPDATA%\FileZilla\default_localtreeview20x20.png]- [targetUID: 00000000-00006040] Dropped file: "default_remotetreeview20x20.png" - Location: [%LOCALAPPDATA%\FileZilla\default_remotetreeview20x20.png]- [targetUID: 00000000-00006040] Dropped file: "default_folder16x16.png" - Location: [%LOCALAPPDATA%\FileZilla\default_folder16x16.png]- [targetUID: 00000000-00006040] Dropped file: "default_sort_up_dark12x12.png" - Location: [%LOCALAPPDATA%\FileZilla\default_sort_up_dark12x12.png]- [targetUID: 00000000-00006040] Dropped file: "default_sort_down_dark12x12.png" - Location: [%LOCALAPPDATA%\FileZilla\default_sort_down_dark12x12.png]- [targetUID: 00000000-00006040] Dropped file: "default_dropdown12x12.png" - Location: [%LOCALAPPDATA%\FileZilla\default_dropdown12x12.png]- [targetUID: 00000000-00006040]57:Ta2a,"leds.png" has type "PNG image data 479 x 480 8-bit/color RGBA non-interlaced" and extension "png" "modern-wizard.bmp" has type "PC bitmap Windows 3.x format 164 x 314 x 4 image size 26376 resolution 2834 x 2834 px/m cbSize 26494 bits offset 118" and extension "bmp" "binary.png" has type "PNG image data 480 x 480 8-bit colormap non-interlaced" and extension "png" "speedlimits.png" has type "PNG image data 480 x 480 8-bit colormap non-interlaced" and extension "png" "auto.png" has type "PNG image data 480 x 480 8-bit colormap non-interlaced" and extension "png" "ascii.png" has type "PNG image data 480 x 480 8-bit colormap non-interlaced" and extension "png" "refresh.png" has type "PNG image data 480 x 480 8-bit colormap non-interlaced" and extension "png" "compare.png" has type "PNG image data 480 x 480 8-bit colormap non-interlaced" and extension "png" "filezilla.png" has type "PNG image data 480 x 480 8-bit colormap non-interlaced" and extension "png" "showhidden.png" has type "PNG image data 480 x 480 8-bit colormap non-interlaced" and extension "png" "cancel.png" has type "PNG image data 480 x 480 8-bit colormap non-interlaced" and extension "png" "processqueue.png" has type "PNG image data 480 x 480 8-bit colormap non-interlaced" and extension "png" "synctransfer.png" has type "PNG image data 480 x 480 8-bit colormap non-interlaced" and extension "png" "find.png" has type "PNG image data 480 x 480 8-bit colormap non-interlaced" and extension "png" "synchronize.png" has type "PNG image data 480 x 480 8-bit colormap non-interlaced" and extension "png" "help.png" has type "PNG image data 480 x 480 8-bit colormap non-interlaced" and extension "png" "bookmark.png" has type "PNG image data 480 x 480 8-bit colormap non-interlaced" and extension "png" "folderback.png" has type "PNG image data 480 x 480 8-bit colormap non-interlaced" and extension "png" "folderup.png" has type "PNG image data 480 x 480 8-bit colormap non-interlaced" and extension "png" "lock.png" has type "PNG image data 480 x 480 8-bit colormap non-interlaced" and extension "png" "close.png" has type "PNG image data 480 x 480 8-bit gray+alpha non-interlaced" and extension "png" "help.png" has type "PNG image data 48 x 48 8-bit/color RGBA non-interlaced" and extension "png" "logview.png" has type "PNG image data 480 x 480 8-bit colormap non-interlaced" and extension "png" "compare.png" has type "PNG image data 48 x 48 8-bit/color RGBA non-interlaced" and extension "png" "disconnect.png" has type "PNG image data 480 x 480 8-bit colormap non-interlaced" and extension "png"58:T36d9,"!This program cannot be run in DOS mode..text`.data.rdata@.pdata@.xdata@.bss.edata@.idata.CRT.tls.rsrc.relocAUATUWVSH([^_]A\A]ATUWVSH [^_]A\AWAVAUATUWVSHl$8LD$8HD$ AD$8HH[^_]A\A]A^A_ATUWVSHl$pHF Lc [^_]A\F Lct?H9ttLcFN IcD$xH([^HWVSHD$PLD$PLL$XLUWVSHt$@Hl$0I|$ Ht$@HX[^_]AWAVAUATUWVSHl$`DL$|Il$XHd$PL|$HHD$0D[^_]A\A]A^A_AWAVAUATUWVSHA9l$,L$ Il$(Hc t#H8[^_]A\A]A^A_D$/1$vJE1]t"HATUWVSH [^_]A\]u[H>uBH [^_]A\ATUWVSH [^_]A\ATUWVSH [^_]A\ [^_]A\ATUWVSHD$pH [^_]A\D$pHAUATUWVSH([^_]A\A]]tgHt$<$t<@u0HUWVS1[^_]t$8I\$(I\$(I\$(LWVSL\$@M)\$8Ht?L9WVSL\$@M)\$8HtGL9u"8BATUWVSHd$pHs/L9 [^_]A\WVSID$@IL$HL9[^_I[^_HL$(ID$ E1L$(ID$ AL$(ID$ E1L$(ID$ AtUHD$,ID$,HD$,H>tTHD$,ID$0LD$0HD$0LD$0HWVSHwrI)0[^_L$ LL$ L0[^_0[^_0[^_WVSHwrI)0[^_L$ LL$ L0[^_0[^_0[^_UWVSH8[^_]8[^_]~|E19@888[^_]8[^_]T$(HD$(HD$(HD$(HT$(ML$(HT$(HD$(HD$(HD$(HT$(HD$(AD$(AUWVSH8[^_]8[^_]~|E19@8x8[^_]8[^_]T$(HD$(HD$(HD$(HT$(ML$(HT$(HD$(HD$(HD$(HT$(HD$(AD$(AAUATUWVSHD$pLT$pH\$pL([^_]A\A]l$pL([^_]A\A]AVAUATUWVSH0[^_]A\A]A^0[^_]A\A]A^AWAVAUATUWVSH([^_]A\A]A^A_D$PHL$ MD$HHD$@HD$8HD$0HD$PHL$ MD$HHD$@HD$8HD$0HT$XLD$`LL$hHWVSHPHc5T$ HP[^_L$ HT$8AUAWAVAUATWVSHl$@D[^_A\A]A^A_]D$0H(D;%6t$ IATUWVSH [^_]A\HWVSH [^_9MZuHcQHD$>Ld$(ID$ L@[^_]A\AVAUATUWVSHtoE1l$(Id$ M)@[^_]A\A]A^|$>E1l$(Ld$ HUWVSHl$(ID$ HL$>HH[^_]AWAVAUATUWVSHl$PH|$pLl$@HD$01D$PHD$pLt$@LD$H1D$xH|$pL|$pfAl$ ML$pL9L$@L9D$PH@ H9[^_]A\A]A^A_tAI;HxuAVAUATUWVSH:ubLH+D$HL9H+D$HL9T$ HD$p1D$8fD|$pHD$xHT$pHH+D$HL9L$@L9D$PH[^_]A\A]A^A_T$ HD$p1D$8L|$pHD$xHT$pHH+D$HL9L$pL9H+D$HL9"u:LH+D$HL9H+D$HL9L$8HCpH9C@H9D$ LAWAVAUATUWVSH[^_]A\A]A^A_Ht$`H|$@H|$0HL$0L9D$@HL$`L9D$pH[^_]A\A]A^A_[^_]A\A]A^A_IAWAVAUATUWVSHl$pH|$@Ht$@Ht$@fAt$PLt$@Ml$pfD$(Hl$pHL$(HL$@L9D$PHL$pL9[^_]A\A]A^A_L$8Hl$pHAWAVAUATUWVSHD$hE1D$pHD$XLT$HML$XID$ HT$`1@hL9L$HID$PHD$xHL$PLL$HHD$xH9L$X1D$pH9D$hH9[^_]A\A]A^A_D$@HD$41D$PLD$8HL$4HL$HHD$8H9D$@H9T$`ICPH9C H9L$HHD$`HL$HHL$HHATUWVSHt$ Hp[^_]A\WVSHN@H9NpH9 [^_AWAVAUATUWVSHCPH9C H9t$`H|$@H|$0HL$0L9D$@HL$`L9D$pH[^_]A\A]A^A_AWAVAUATUWVSHt$0fspE1l$`HCpfDl$PHL$`Ht$ HT$0HT$PHD$XLL$@HL$ H9D$0HL$PL9D$`H[^_]A\A]A^A_FPH9F H9AWAVAUATUWVSHt$0fspE1l$`HCpfDl$PHL$`Ht$ HT$0HT$PHD$XLL$@HL$ H9D$0HL$PL9D$`Ht?E1[^_]A\A]A^A_FPH9F H9AVAUATUWVSHt$0fd$`HCpfDd$PHL$`Ht$ HT$0HT$PHD$XLL$@HL$ H9D$0HL$PL9D$`H[^_]A\A]A^AWAVAUATUWVSHt$01CpE1l$`HL$`LD$0Il$PHt$ HT$PHD$XLL$@HL$ H9D$0HL$PH9D$`H[^_]A\A]A^A_FPH9F H9CPH9C H9FPH9F H9CPH9C H9WVSHCPH9C H9 [^_WVSH [^_CHH9CHH9WVSH [^_WVSH [^_WVSH [^_CHH9AUATUWVSH|$@Hl$(H|$0Hl$`HL$`HD$pH9D$pHL$0H9D$@H[^_]A\A]ATUWVSHt*f. [^_]A\ [^_]A\tQI9HxutTH9WVSH [^_CHH9FHH9 [^_t)I;HxuAUATUWVSHT$@HN@H9\$pH@0H9([^_]A\A]ATUWVSHCPH9C H9CHH9 [^_]A\WVSHD$`f [^_UWVSH|$pHD$xH([^_]([^_]CPH9C H9CPH9C H9AWAVAUATUWVSHd$@Hl$0Hd$0HD$@Hd$0HD$@HL$0L9D$@H[^_]A\A]A^A_D$0H|$8Ht$PL9D$@HH+D$8L9H+D$8L9H+D$8L9L$pL|$pL|$`H|$`HL$`H9D$pHH+D$8L9D$ "D$hAD$ T$8E1D$hHT$`HH+D$8L9H+D$8L9D$hHT$`HH+D$8L9L$`H9D$pHD$ 'L$@HL$ HD$0H9D$0HAWAVAUATUWVSHD$8L|$XLD$@Ht$`IL$xL|$xLL$0HD$PHL$pHL$pAL$PMD$HHD$@H9D$8H9T$HI[^_]A\A]A^A_l$`HD$hMl$0Ll$XID$8H9D$@H9l$(Id$ HL$XHUWVSHt$ HX[^_]UWVSH([^_]S8H9([^_]UWVSHl$ Ht$0LD$0It$ HD$ H9D$0H|$(Ht$ HD$0HL$ H9D$0HX[^_]|$(IWVSH [^_ [^_UWVSHl$(HD$(18[^_]T$(E1D$(HUWVSHl$(HD$(18[^_]T$(E1D$(Hbasic_string::append 0x%0*lx (%lu bytes)fallback(4)out of memorysyntax errorno element foundnot well-formed (invalid token)unclosed tokenpartial charactermismatched tagduplicate attributejunk after document elementillegal parameter entity referenceundefined entityrecursive entity referenceasynchronous entityreference to invalid character numberreference to binary entityreference to external entity in attributeXML or text declaration not at start of entityunknown encodingencoding specified in XML declaration is incorrectunclosed CDATA sectionerror in processing external entity referencedocument is not standaloneunexpected parser state - please send a bug reportentity declared in parameter entityrequested feature requires XML_DTD support in Expatcannot change setting once parsing has begununbound prefixmust not undeclare prefixincomplete markup in parameter entityXML declaration not well-formedtext declaration not well-formedillegal character(s) in public idparser suspendedparser not suspendedparsing abortedparsing finishedcannot suspend in external parameter entityreserved prefix (xml) must not be undeclared or bound to another namespace namereserved prefix (xmlns) must not be declared or undeclaredprefix must not be bound to one of the reserved namespace namesinvalid argumenta successful prior call to function XML_GetBuffer is requiredlimit on input amplification factor (from DTD and entities) breachedexpat_2.4.8\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1A\x1B\x1C\x1D\x1E\x1F\x7F\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8A\x8B\x8C\x8D\x8E\x8F\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9A\x9B\x9C\x9D\x9E\x9F\xA0\xA1\xA2\xA3\xA4\xA5\xA6\xA7\xA8\xA9\xAA\xAB\xAC\xAD\xAE\xAF\xB0\xB1\xB2\xB3\xB4\xB5\xB6\xB7\xB8\xB9\xBA\xBB\xBC\xBD\xBE\xBF\xC0\xC1\xC2\xC3\xC4\xC5\xC6\xC7\xC8\xC9\xCA\xCB\xCC\xCD\xCE\xCF\xD0\xD1\xD2\xD3\xD4\xD5\xD6\xD7\xD8\xD9\xDA\xDB\xDC\xDD\xDE\xDF\xE0\xE1\xE2\xE3\xE4\xE5\xE6\xE7\xE8\xE9\xEA\xEB\xEC\xED\xEE\xEF\xF0\xF1\xF2\xF3\xF4\xF5\xF6\xF7\xF8\xF9\xFA\xFB\xFC\xFD\xFE\xFFdead code (+%6d bytes %s|%d, xmlparse.c:%d) %*s" ABORTINGCLOSEsizeof(XML_Char)sizeof(XML_LChar)XML_DTDXML_CONTEXT_BYTESXML_NSXML_BLAP_MAX_AMPXML_BLAP_ACT_THREShttp://www.w3.org/2000/xmlns/http://www.w3.org/XML/1998/namespaceNOTATION(NMTOKENSNMTOKENENTITIESENTITYIDREFSIDREFCDATAxml=http://www.w3.org/XML/1998/namespaceSYSTEMREQUIREDPUBLICPCDATANOTATIONNMTOKENSNMTOKENNDATAINCLUDEIMPLIEDIGNOREIDREFSIDREFFIXEDENTITYENTITIESEMPTYELEMENTDOCTYPECDATAATTLISTCDATA[@)')@)')`'')`'')UTF-16LEUTF-16BEUTF-16UTF-8US-ASCIIISO-8859-1standaloneencodingversion`U%)@!%)pR%)`N%) %)Pa%) !"#`U%)@!%)pR%)`N%) %)Pa%) !"#0o%) N%)pk%)@Q%)pb%) !"#0o%) N%)pk%)@Q%)pb%) !"#0o%) N%)pk%)@Q%)pb%) !"#0o%) N%)pk%)@Q%)pb%) !"# /%)@'%)`(%) !"# /%)@'%)`(%) !"# /%)@'%)`(%) !"# /%)@'%)`(%) !"# /%)@'%)`(%) !"# /%)@'%)`(%) !"# /%)@'%)`(%) !"# /%)@'%)`(%) !"# !"#$%Mingw-w64 runtime failure:Address %p has no image-section VirtualQuery failed for %d bytes at address %p VirtualProtect failed with code 0x%x Unknown pseudo relocation protocol version %d. Unknown pseudo relocation bit size %d.%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.(null)Infinity?aCoc<2ZGUvH7BW4vC[%CoO8M2rand_sSystemFunction036@2')@6')h)&)P9')`9') :')0:')13wxXmlDocument14wxEventFunctor14wxXmlAttribute20wxObjectEventFunctor20wxThreadHelperThread8wxObject8wxThread9wxXmlNode09')p9')wxbase32u_xml_gcc_custom.dll_ZN12wxXmlDoctype5ClearEv_ZN13wxXmlDocument10DetachRootEv_ZN13wxXmlDocument11SetFileTypeE14wxTextFileType_ZN13wxXmlDocument12ms_classInfoE_ZN13wxXmlDocument14AppendToPrologEP9wxXmlNode_ZN13wxXmlDocument21GetLibraryVersionInfoEv_ZN13wxXmlDocument4LoadER13wxInputStreamRK8wxStringi_ZN13wxXmlDocument4LoadERK8wxStringS2_i_ZN13wxXmlDocument6DoCopyERKS__ZN13wxXmlDocument7SetRootEP9wxXmlNode_ZN13wxXmlDocumentC1ER13wxInp"59:T182b,"fzstorj.exe" has type "PE32+ executable (console) x86-64 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\FileZilla FTP Client\fzstorj.exe]- [targetUID: 00000000-00009624] "wxmsw32u_core_gcc_custom.dll" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\FileZilla FTP Client\wxmsw32u_core_gcc_custom.dll]- [targetUID: 00000000-00006040] "filezilla.exe" has type "PE32+ executable (GUI) x86-64 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\FileZilla FTP Client\filezilla.exe]- [targetUID: 00000000-00009624] "libgnutls-30.dll" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\FileZilla FTP Client\libgnutls-30.dll]- [targetUID: 00000000-00006040] "libstdc_-6.dll" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows"- [targetUID: N/A] "wxbase32u_gcc_custom.dll" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\FileZilla FTP Client\wxbase32u_gcc_custom.dll]- [targetUID: 00000000-00006040] "libfzclient-private-3-66-5.dll" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\FileZilla FTP Client\libfzclient-private-3-66-5.dll]- [targetUID: 00000000-00006040] "libsqlite3-0.dll" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\FileZilla FTP Client\libsqlite3-0.dll]- [targetUID: 00000000-00006040] "libfilezilla-42.dll" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\FileZilla FTP Client\libfilezilla-42.dll]- [targetUID: 00000000-00006040] "wxmsw32u_xrc_gcc_custom.dll" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\FileZilla FTP Client\wxmsw32u_xrc_gcc_custom.dll]- [targetUID: 00000000-00006040] "fzsftp.exe" has type "PE32+ executable (console) x86-64 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\FileZilla FTP Client\fzsftp.exe]- [targetUID: 00000000-00009624] "libgmp-10.dll" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\FileZilla FTP Client\libgmp-10.dll]- [targetUID: 00000000-00006040] "libfzclient-commonui-private-3-66-5.dll" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\FileZilla FTP Client\libfzclient-commonui-private-3-66-5.dll]- [targetUID: 00000000-00006040] "wxmsw32u_aui_gcc_custom.dll" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\FileZilla FTP Client\wxmsw32u_aui_gcc_custom.dll]- [targetUID: 00000000-00006040] "fzputtygen.exe" has type "PE32+ executable (console) x86-64 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\FileZilla FTP Client\fzputtygen.exe]- [targetUID: 00000000-00009624] "libnettle-8.dll" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\FileZilla FTP Client\libnettle-8.dll]- [targetUID: 00000000-00006040] "libhogweed-6.dll" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\FileZilla FTP Client\libhogweed-6.dll]- [targetUID: 00000000-00006040] "libpng16-16.dll" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\FileZilla FTP Client\libpng16-16.dll]- [targetUID: 00000000-00006040] "wxbase32u_xml_gcc_custom.dll" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\FileZilla FTP Client\wxbase32u_xml_gcc_custom.dll]- [targetUID: 00000000-00006040] "zlib1.dll" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\FileZilla FTP Client\zlib1.dll]- [targetUID: 00000000-00006040] "libgcc_s_seh-1.dll" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\FileZilla FTP Client\libgcc_s_seh-1.dll]- [targetUID: 00000000-00006040] "uninstall.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive"- Location: [%PROGRAMFILES%\FileZilla FTP Client\uninstall.exe]- [targetUID: 00000000-00009624] "fzshellext.dll" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\FileZilla FTP Client\fzshellext.dll]- [targetUID: 00000000-00009624] "fzshellext_64.dll" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\FileZilla FTP Client\fzshellext_64.dll]- [targetUID: 00000000-00009624] "UAC.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsnFE8D.tmp\UAC.dll]- [targetUID: 00000000-00009624] "System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsnFE8D.tmp\System.dll]- [targetUID: 00000000-00009624] "nsDialogs.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsnFE8D.tmp\nsDialogs.dll]- [targetUID: 00000000-00009624] "StartMenu.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsnFE8D.tmp\StartMenu.dll]- [targetUID: 00000000-00009624] "UserInfo.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsnFE8D.tmp\UserInfo.dll]- [targetUID: 00000000-00009624] "nsis_appid.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsnFE8D.tmp\nsis_appid.dll]- [targetUID: 00000000-00009624] "nsm1F89.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsm1F89.tmp]- [targetUID: 00000000-00009624]5a:T4f1,"FileZilla_3.66.5_win64_sponsored2-setup.exe" wrote 16384 bytes starting with PE header signature to file "C:\Program Files\FileZilla FTP Client\filezilla.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "FileZilla_3.66.5_win64_sponsored2-setup.exe" wrote 16384 bytes starting with PE header signature to file "C:\Program Files\FileZilla FTP Client\fzsftp.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "FileZilla_3.66.5_win64_sponsored2-setup.exe" wrote 16384 bytes starting with PE header signature to file "C:\Program Files\FileZilla FTP Client\fzputtygen.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...5b:T798,"FileZilla_3.66.5_win64_sponsored2-setup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nshFE1D.tmp" with delete access "FileZilla_3.66.5_win64_sponsored2-setup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsnFE8D.tmp" with delete access "FileZilla_3.66.5_win64_sponsored2-setup.exe" opened "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client\FileZilla.lnk" with delete access "FileZilla_3.66.5_win64_sponsored2-setup.exe" opened "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client\~ileZilla.tmp" with delete access "FileZilla_3.66.5_win64_sponsored2-setup.exe" opened "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client\FileZilla.lnk~RF1265d6.TMP" with delete access "FileZilla_3.66.5_win64_sponsored2-setup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsm1F89.tmp" with delete access "FileZilla_3.66.5_win64_sponsored2-setup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsnFE8D.tmp\modern-wizard.bmp" with delete access "FileZilla_3.66.5_win64_sponsored2-setup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsnFE8D.tmp\nsDialogs.dll" with delete access "FileZilla_3.66.5_win64_sponsored2-setup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsnFE8D.tmp\nsis_appid.dll" with delete access "FileZilla_3.66.5_win64_sponsored2-setup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsnFE8D.tmp\StartMenu.dll" with delete access "FileZilla_3.66.5_win64_sponsored2-setup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsnFE8D.tmp\System.dll" with delete access "FileZilla_3.66.5_win64_sponsored2-setup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsnFE8D.tmp\UAC.dll" with delete access "FileZilla_3.66.5_win64_sponsored2-setup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsnFE8D.tmp\UserInfo.dll" with delete access "filezilla.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\FileZilla\queue.sqlite3-journal" with delete access5c:T688,"filezilla.exe" claimed CRC 4150812 while the actual is CRC 12831271 "libgnutls-30.dll" claimed CRC 2172861 while the actual is CRC 4150812 "libstdc_-6.dll" claimed CRC 2033781 while the actual is CRC 2172861 "wxbase32u_gcc_custom.dll" claimed CRC 1883680 while the actual is CRC 2033781 "libfzclient-private-3-66-5.dll" claimed CRC 1448248 while the actual is CRC 1883680 "libsqlite3-0.dll" claimed CRC 1299824 while the actual is CRC 1448248 "libfilezilla-42.dll" claimed CRC 937231 while the actual is CRC 1299824 "wxmsw32u_xrc_gcc_custom.dll" claimed CRC 802819 while the actual is CRC 937231 "fzsftp.exe" claimed CRC 723349 while the actual is CRC 802819 "libgmp-10.dll" claimed CRC 702221 while the actual is CRC 723349 "libfzclient-commonui-private-3-66-5.dll" claimed CRC 679178 while the actual is CRC 702221 "wxmsw32u_aui_gcc_custom.dll" claimed CRC 529165 while the actual is CRC 679178 "fzputtygen.exe" claimed CRC 365878 while the actual is CRC 529165 "libnettle-8.dll" claimed CRC 391865 while the actual is CRC 365878 "libhogweed-6.dll" claimed CRC 283241 while the actual is CRC 391865 "libpng16-16.dll" claimed CRC 293288 while the actual is CRC 283241 "wxbase32u_xml_gcc_custom.dll" claimed CRC 304972 while the actual is CRC 293288 "zlib1.dll" claimed CRC 170761 while the actual is CRC 304972 "libgcc_s_seh-1.dll" claimed CRC 167521 while the actual is CRC 170761 "uninstall.exe" claimed CRC 12831271 while the actual is CRC 167521 "fzshellext.dll" claimed CRC 66765 while the actual is CRC 122231 "fzshellext_64.dll" claimed CRC 80100 while the actual is CRC 66765 "nsis_appid.dll" claimed CRC 15454 while the actual is CRC 476885d:T604,RegCreateKeyExW RegDeleteValueW RegCloseKey OpenProcessToken RegEnumKeyW RegOpenKeyExW RegDeleteKeyW CopyFileW GetModuleFileNameW GetVersionExW GetFileAttributesW GetFileSize GetCommandLineW LoadLibraryExW CreateDirectoryW DeleteFileW GetProcAddress GetTempFileNameW GetModuleHandleA CreateThread GetSystemDirectoryW FindNextFileW GetTempPathW FindFirstFileW GetModuleHandleW WriteFile CreateFileW CreateProcessW Sleep GetTickCount ShellExecuteExW FindWindowExW VirtualProtect GetStartupInfoA CreateFileMappingW MapViewOfFile NetShareEnum CertDeleteCertificateFromStore LoadLibraryA FindFirstFileA CreateFileA WSASend send connect recv LoadLibraryW GetFileSizeEx GetModuleHandleExW GetUserNameW GetDriveTypeW LockResource GetThreadContext OutputDebugStringW IsDebuggerPresent TerminateProcess CreateToolhelp32Snapshot OpenProcess GetComputerNameW GetNativeSystemInfo GetSystemInfo Process32NextW Process32FirstW FindResourceW GetWindowThreadProcessId GetFileAttributesA GetVersionExA DeleteFileA GetTempPathA CreateFileMappingA OutputDebugStringA GetFileAttributesExW SetSecurityDescriptorDacl SleepConditionVariableCS CreateProcessAsUserW accept WSAStartup listen closesocket socket bind RegDeleteKeyA RegOpenKeyA RegDeleteValueA GetUserNameA RegEnumKeyA RegCreateKeyExA RegCreateKeyA FindNextFileA GetSystemDirectoryA ConnectNamedPipe GetFileAttributesExA GetCursorPos FindWindowA RegCreateKeyW OpenFileMappingW SetWindowsHookExW VirtualAlloc5e:Tdd2,"FileZilla_3.66.5_win64_sponsored2-setup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "FILEZILLA_3.66.5_WIN64_SPONSORED2-SETUP.EXE") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\FILEZILLA_3.66.5_WIN64_SPONSORED2-SETUP.EXE") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "FILEZILLA_3.66.5_WIN64_SPONSORED2-SETUP") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELLCOMPATIBILITY\APPLICATIONS\FILEZILLA_3.66.5_WIN64_SPONSORED2-SETUP.EXE") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\FILEZILLA CLIENT") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Path: "HKCU\SOFTWARE\FILEZILLA CLIENT") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CTF\COMPATIBILITY\FILEZILLA_3.66.5_WIN64_SPONSORED2-SETUP.EXE") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP\FILEZILLA_3.66.5_WIN64_SPONSORED2-SETUP.EXE") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN"; Key: "FILEZILLA_3.66.5_WIN64_SPONSORED2-SETUP.EXE") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN"; Key: "FILEZILLA_3.66.5_WIN64_SPONSORED2-SETUP.EXE") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_PROTOCOL_LOCKDOWN"; Key: "FILEZILLA_3.66.5_WIN64_SPONSORED2-SETUP.EXE") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\FILEZILLA.EXE") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\FILEZILLA.EXE"; Key: "APPENDPATH") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\FILEZILLA.EXE"; Key: "PATH") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\FILEZILLA.EXE") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\PROGRAM FILES\FILEZILLA FTP CLIENT\FILEZILLA.EXE") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\LAYERS"; Key: "C:\PROGRAM FILES\FILEZILLA FTP CLIENT\FILEZILLA.EXE") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Path: "HKCU\APPLICATIONS\FILEZILLA.EXE") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Path: "HKLM\SOFTWARE\CLASSES\APPLICATIONS\FILEZILLA.EXE") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FILEZILLA CLIENT") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\FILEZILLA_3.66.5_WIN64_SPONSORED2-SETUP.EXE") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Path: "HKCU\APPID\FILEZILLA_3.66.5_WIN64_SPONSORED2-SETUP.EXE") "FileZilla_3.66.5_win64_sponsored2-setup.exe" (Path: "HKLM\SOFTWARE\CLASSES\APPID\FILEZILLA_3.66.5_WIN64_SPONSORED2-SETUP.EXE")5f:T586,Contains base64 string in header "POST" in header "POST /httpapi HTTP/1.1Host: api.playanext.comAccept: */*Content-Length: 420Content-Type: application/x-www-form-urlencoded" Contains base64 string in header "/httpapi" in header "POST /httpapi HTTP/1.1Host: api.playanext.comAccept: */*Content-Length: 420Content-Type: application/x-www-form-urlencoded" Contains base64 string in header "Type" in header "POST /httpapi HTTP/1.1Host: api.playanext.comAccept: */*Content-Length: 420Content-Type: application/x-www-form-urlencoded" Contains base64 string in header "form" in header "POST /httpapi HTTP/1.1Host: api.playanext.comAccept: */*Content-Length: 420Content-Type: application/x-www-form-urlencoded" Contains base64 string in header "POST" in header "POST /httpapi HTTP/1.1Host: api.playanext.comAccept: */*Content-Length: 686Content-Type: application/x-www-form-urlencoded" Contains base64 string in header "/httpapi" in header "POST /httpapi HTTP/1.1Host: api.playanext.comAccept: */*Content-Length: 686Content-Type: application/x-www-form-urlencoded" Contains base64 string in header "Type" in header "POST /httpapi HTTP/1.1Host: api.playanext.comAccept: */*Content-Length: 686Content-Type: application/x-www-form-urlencoded" Contains base64 string in header "form" in header "POST /httpapi HTTP/1.1Host: api.playanext.comAccept: */*Content-Length: 686Content-Type: application/x-www-form-urlencoded"60:Ta72,"POST /httpapi HTTP/1.1 Host: api.playanext.com Accept: */* Content-Length: 420 Content-Type: application/x-www-form-urlencoded" with payload::==> "api_key=dLTYPK8mJQ36EJnC7sk0B39O8osO6B6G8SoKLvsL&event=%5b%7b%22event_properties%22%3a%7b%22distributor%22%3a%22%22%2c%22distributor_product%22%3a%22%22%2c%22method_used%22%3a%22Initialize%22%2c%22offer_product%22%3a%22%22%2c%22source%22%3a%22PlayaSDK%20C%2b%2b%20v1.6.15%22%2c%22user_country%22%3a%22%22%7d%2c%22event_type%22%3a%22cpp_sdk_startup%22%2c%22ip%22%3a%22%24remote%22%2c%22session_id%22%3a1707395572334%7d%5d" HTTP/1.1 200 OK Content-Type: application/json Content-Length: 0 Connection: keep-alive Date: Thu 08 Feb 2024 12:32:53 GMT x-amzn-RequestId: 2dfe6282-1a64-4cec-94ee-04370e9fcc5b x-amz-apigw-id: S0R-WG6ZIAMEqtw= X-Amzn-Trace-Id: Root=1-65c4c9f5-4fcf246f3b54e861228cde8a;Parent=26430c735e4d346a;Sampled=0;lineage=d7502c8f:0 Via: 1.1 3fa44d644afdb8749d0c126169e4edfc.cloudfront.net (CloudFront) 1.1 9525a1adf6d0a16da3bb7589fe5684a4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO53-P5 X-Cache: Miss from cloudfront X-Amz-Cf-Pop: SFO5-P1 X-Amz-Cf-Id: aVFVspQjC_6oxuVNIiPgqO0p8fs3LBsXAHr914xPW1yGcHJnJQutUA== with response body ==>....... "POST /httpapi HTTP/1.1 Host: api.playanext.com Accept: */* Content-Length: 686 Content-Type: application/x-www-form-urlencoded" with payload::==> "api_key=dLTYPK8mJQ36EJnC7sk0B39O8osO6B6G8SoKLvsL&event=%5b%7b%22event_properties%22%3a%7b%22distributor%22%3a%22%22%2c%22distributor_product%22%3a%22%22%2c%22error_code%22%3a%22OFFER_API_FAILURE%22%2c%22error_description%22%3a%22Code%3a%2035%3b%20Error%20string%3a%20schannel%3a%20next%20InitializeSecurityContext%20failed%3a%20Unknown%20error%20%280x80092012%29%20-%20The%20revocation%20function%20was%20unable%20to%20check%20revocation%20for%20the%20certificate.%22%2c%22offer_product%22%3a%22%22%2c%22source%22%3a%22PlayaSDK%20C%2b%2b%20v1.6.15%22%2c%22user_country%22%3a%22%22%7d%2c%22event_type%22%3a%22error%22%2c%22ip%22%3a%22%24remote%22%2c%22session_id%22%3a1707395572334%7d%5d" HTTP/1.1 200 OK Content-Type: application/json Content-Length: 0 Connection: keep-alive Date: Thu 08 Feb 2024 12:32:53 GMT x-amzn-RequestId: aa1c7304-3a5f-4cb4-9426-8f7fbbcb631f x-amz-apigw-id: S0R-dGswoAMEcVw= X-Amzn-Trace-Id: Root=1-65c4c9f5-375e72132d5f345f243ed840;Parent=50ac3160cb0cb5bd;Sampled=0;lineage=d7502c8f:0 Via: 1.1 527e9fded303586b3afb7046c6793516.cloudfront.net (CloudFront) 1.1 6f00b57bff6c033d9351d367b6c1fa7e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO53-P5 X-Cache: Miss from cloudfront X-Amz-Cf-Pop: SFO5-P1 X-Amz-Cf-Id: PsLF1e3fDpLxBoA2JjRC4jrvWjyR1nw2W2Zi4uIYn8s7vwbnTT_zIw== with response body ==>.......61:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AARAREREBEQEQERAREREBEBERERERERERERERERERERERERERERERERERERERERERAREREREREREREREREREREBERERERERdxF3iIcREREREREREREREf//////+BEREREREXd3ERj///////9xERERERH//xEX////iI//gRERERER//8REX//9xERGPEREREREY//cREX//9xEREREREQERGP/3EREX//9xERERERARERf/+BEREX//9xEREREREREX//8REREX//+BEREREREREf//EREREX//+BEREREBERH//3EREREX//+BEREQERERj/+Hd3d3d4//+BEREREREX////////////9xEREBEREf////////////gREQERERGP///////////4ERERERERj/9xEREREREREREREREREY//gRERERERERERERARERF//4EREREREREREREBERERn//xERERERERERERERERER/////////xEREREREREREY////////+RERERERERERF/////////cRERERERERERn////////4ERERERERERERmZmZmZmZkREREREREREREREREREREREREREREREREREREREREREREREREREREREREREREREREREREREQERERERAREBEBEQERERARAAAgAIAAAAAAAAAACAAAAAAAAAAAAAAACAAAAAgAAAAAAAAACAAAAAgAAAAAAAAAAAAAAAgAAAAIAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAIAAAACAAAAAAAAAAAAAAACAAAAAgAAAAAAAAACAAAAAgAAAAAAAAAAAAAAAmzJmyA==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"dbde8a4bd71bb1fbc0511cdb657dfeffdaedc513aa425f856043532a7cba6fce","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":35,"unified_at_epoch_ms":1790946993732,"unified_at":"2026-10-02T13:16:33.732Z","metadata":{"hashes":{"sha256":"dbde8a4bd71bb1fbc0511cdb657dfeffdaedc513aa425f856043532a7cba6fce","sha1":"71a32e0d99f6d6a36770bf60686c4ac04eb9d70c","md5":"861c54a22491b35880f4ec629cfd699f","sha512":"e34d2a9769bc03f87851b81a88bdb1edbff17725170f6b50bde12a3eb092b221b685160b3b979ca77d249172d2137e7ac9463f2fd8b86296bdd1fa0841a9783c","ssdeep":"393216:TAJ8PZ1g/3inKFsdoSpsK1RVryLx9FPeN:TAJ8P8/yKF+oSpsKPtux9teN","ssdeep_chunks":["393216:TAJ8PZ1","393216:AJ8PZ1g","393216:J8PZ1g/","393216:8PZ1g/3","393216:PZ1g/3i","393216:Z1g/3in","393216:1g/3inK","393216:g/3inKF","393216:/3inKFs","393216:3inKFsd","393216:inKFsdo","393216:nKFsdoS","393216:KFsdoSp","393216:FsdoSps","393216:sdoSpsK","393216:doSpsK1","393216:oSpsK1R","393216:SpsK1RV","393216:psK1RVr","393216:sK1RVry","393216:K1RVryL","393216:1RVryLx","393216:RVryLx9","393216:VryLx9F","393216:ryLx9FP","393216:yLx9FPe","393216:Lx9FPeN","786432:TAJ8PZ1","786432:AJ8PZ1g","786432:J8PZ1g/","786432:8PZ1g/3","786432:PZ1g/3i","786432:Z1g/3in","786432:1g/3inK","786432:g/3inKF","786432:/3inKFs","786432:3inKFsd","786432:inKFsdo","786432:nKFsdoS","786432:KFsdoSp","786432:FsdoSps","786432:sdoSpsK","786432:doSpsK1","786432:oSpsK1R","786432:SpsK1RV","786432:psK1RVr","786432:sK1RVry","786432:K1RVryL","786432:1RVryLx","786432:RVryLx9","786432:VryLx9F","786432:ryLx9FP","786432:yLx9FPe","786432:Lx9FPeN","393216:TAJ8P8/","393216:AJ8P8/y","393216:J8P8/yK","393216:8P8/yKF","393216:P8/yKF+","393216:8/yKF+o","393216:/yKF+oS","393216:yKF+oSp","393216:KF+oSps","393216:F+oSpsK","393216:+oSpsKP","393216:oSpsKPt","393216:SpsKPtu","393216:psKPtux","393216:sKPtux9","393216:KPtux9t","393216:Ptux9te","393216:tux9teN"],"imphash":"9dda1a1d1f8a1d13ae0297b47046b26e"},"file_info":{"file_name":"FileZilla_3.66.5_win64_sponsored2-setup.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":12800080,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1707395230000,"last_seen":1766203178000,"last_multi_scan":1766203178000}},"detections":{"summary":{"verdict":"malicious","score":35,"tags":["filezilla_bundleinstaller"]},"stats":{"av":{"malicious_count":7,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":77},"sandbox_signatures":{"informative_count":186,"suspicious_count":19,"malicious_count":4,"total":209},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"GrayWare[AdWare]/Win32.FileZilla_BundleInstaller","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"PUABundler_Win32_FileZilla_BundleInstaller","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/grayware_confidence_60% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Deceptor.FileZillaBd.EEV","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"ApplicUnwnt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"PUABundler_Win32_FileZilla_BundleInstaller","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Email Accounts","attack_id":"T1585.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1585/002","identifiers":[{"type":"informative","value":"Found email domains (string)"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"PE file contains large number of import functions"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve class object from a DLL object handler"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"tactic":"Persistence","technique":"DLL Search Order Hijacking","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Contains ability to register hotkeys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"},{"type":"informative","value":"PE file contains zero-size sections"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"suspicious","value":"Contains escaped byte string (often part of obfuscated shellcode)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"},{"type":"informative","value":"The input sample is signed with a valid certificate"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Defense Evasion","technique":"Regsvr32","attack_id":"T1218.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/010","identifiers":[{"type":"malicious","value":"Detected regsvr32 execution"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect sandbox (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"},{"type":"informative","value":"Found strings related to file managers"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"informative","value":"Sets a windows hook"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Contains ability to find open windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the windows installation date"},{"type":"suspicious","value":"Calls an API typically used to determine the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Queries volume information of an entire harddrive"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"malicious","value":"Reads FTP client related registry keys"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve default language settings"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Contains the ability to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Imports windows networking related APIs"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to transfer files remotely using SFTP"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Drops files with image extension"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops XML files"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Command and Control","technique":"Steganography","attack_id":"T1001.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1001/002","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"suspicious","value":"YARA signature match -: Public Private Key"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"suspicious","value":"Contains ability to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to use AES encryption instructions"},{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Shows ability to use asymmetric encryption algorithm"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"The input sample dropped very many files"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"filezilla.exe\" called \"FindResourceW\" with parameter \"789\" - (UID: 00000000-00006040)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"filezilla.exe\" called \"LoadResource with parameter {'hModule': '1894087720960', 'hResInfo': '1894087729280'}\" (UID: 00000000-00006040)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to remove a directory","description":"\"FileZilla_3.66.5_win64_sponsored2-setup.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\nsnFE8D.tmp\\ (UID: 00000000-00009624)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n file/memory contains long string with (Indicator: \"OpenProcessToken\"; File: \"UserInfo.dll\")\n file/memory contains long string with (Indicator: \"OpenThreadToken\"; File: \"UserInfo.dll\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n file/memory contains long string with (Indicator: \"VirtualAlloc\"; File: \"System.dll\")\n file/memory contains long string with (Indicator: \"VirtualFree\"; File: \"System.dll\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n file/memory contains long string with (Indicator: \"FreeLibrary\"; File: \"System.dll\")\n file/memory contains long string with (Indicator: \"LoadLibrary\"; File: \"System.dll\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n file/memory contains long string with (Indicator: \"CallWindowProc\"; File: \"StartMenu.dll\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$27","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00009624.00000001.69261.0040A000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".ndata\" is zero\n Raw size of \".bss\" is zero\n Raw size of \".data\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$28","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to use AES encryption instructions","description":"Found string \"AESNI acceleration requested but not available\" (Indicator: \"AESNI\"; Source: \"00000000-00006040.00000000.78218.47C8D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.001","relevance":3,"id":"string-584","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$29","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"Found string \"! \" # $ % & ' ( ) * + \n - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z [ \\ ] ^ _ ` a b c d e f g h i j k l m n o p q r s t u v w x y z { | } ~\" (Indicator: \" ^ \"; Source: \"00000000-00006040.00000000.78218.3E421000.00000002.mdmp\n 00000000-00006040.00000000.78218.47C8D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to import cryptographic keys (seen in ransomware)\n Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Drops image files with high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES Encryption\n Matched sigs: References bcrypt module and functions (used for encryption/decryption)\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Possibly contains Public/Private key (encryption)\n Matched sigs: Contains ability to use AES encryption instructions","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use asymmetric encryption algorithm","description":"The analysis found public/private key which shows ability to use asymmetric encryption algorithm. Matched sigs: Possibly contains Public/Private key (encryption)","origin":"Indicator Combinations","mitre_attack_id":"T1573.002","relevance":1,"id":"summary-33","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES Encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Spawned process connects to a network\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Contacts server","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"FileZilla_3.66.5_win64_sponsored2-setup.exe\" called \"GetForegroundWindow\" (UID: 00000000-00009624)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"FileZilla_3.66.5_win64_sponsored2-setup.exe\" called \"IsWow64Process\" with parameter \"9624\" - (UID: 00000000-00009624)\n \"filezilla.exe\" called \"IsWow64Process\" with parameter \"6040\" - (UID: 00000000-00006040)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"$2a","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"FileZilla_3.66.5_win64_sponsored2-setup.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00009624)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"FileZilla_3.66.5_win64_sponsored2-setup.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00009624)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"$2d","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n Found reference to API \"_Z19wxFindWindowAtPointRK7wxPoint\" (Indicator: \"FindWindowA\"; Source: \"00000000-00006040.00000000.78218.3E421000.00000002.mdmp\")\n Found reference to API \"_Z21wxFindWindowAtPointerR7wxPoint\" (Indicator: \"FindWindowA\"; Source: \"00000000-00006040.00000000.78218.3E421000.00000002.mdmp\")\n Found reference to API \"_Z26wxGenericFindWindowAtPointRK7wxPoint\" (Indicator: \"FindWindowA\"; Source: \"00000000-00006040.00000000.78218.3E421000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"_Z14wxGetLocalTimev\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00006040.00000000.78218.3E485000.00000004.mdmp, 00000000-00006040.00000000.78218.484E9000.00000002.mdmp\")\n Found reference to API \"_Z20wxGetLocalTimeMillisv\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00006040.00000000.78218.3E485000.00000004.mdmp, 00000000-00006040.00000000.78218.484E9000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006040.00000000.78218.47C8D000.00000002.mdmp, 00000000-00006040.00000000.78218.48287000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"FileZilla_3.66.5_win64_sponsored2-setup.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"FileZilla_3.66.5_win64_sponsored2-setup.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"filezilla.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"_Z14wxGetLocalTimev\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00006040.00000000.78218.3E485000.00000004.mdmp, 00000000-00006040.00000000.78218.484E9000.00000002.mdmp\")\n Found reference to API \"_Z20wxGetLocalTimeMillisv\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00006040.00000000.78218.3E485000.00000004.mdmp, 00000000-00006040.00000000.78218.484E9000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006040.00000000.78218.47C8D000.00000002.mdmp, 00000000-00006040.00000000.78218.48287000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n file/memory contains long string with (Indicator: \"GetVersion\"; File: \"UserInfo.dll\")\n Found reference to API \"DllGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00006040.00000000.78218.3E2B7000.00000002.mdmp, 00000000-00006040.00000000.78218.639C7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2f","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"FileZilla_3.66.5_win64_sponsored2-setup.exe\" queries volume information of \"C:\\\" at 00000000-00009624-00000C15-206303118\n \"FileZilla_3.66.5_win64_sponsored2-setup.exe\" queries volume information of \"C:\\\" at 00000000-00009624-00000C15-206483142\n \"filezilla.exe\" queries volume information of \"C:\\\" at 00000000-00006040-00000C15-220398539","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"FileZilla_3.66.5_win64_sponsored2-setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"filezilla.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"FileZilla_3.66.5_win64_sponsored2-setup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\FILEZILLA.EXE\")\n \"FileZilla_3.66.5_win64_sponsored2-setup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\FILEZILLA.EXE\"; Key: \"APPENDPATH\")\n \"FileZilla_3.66.5_win64_sponsored2-setup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\FILEZILLA.EXE\"; Key: \"PATH\")\n \"FileZilla_3.66.5_win64_sponsored2-setup.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\FILEZILLA CLIENT\")\n \"FileZilla_3.66.5_win64_sponsored2-setup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\FILEZILLA_3.66.5_WIN64_SPONSORED2-SETUP.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"FileZilla_3.66.5_win64_sponsored2-setup.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA UDPv4 invalid checksum\" (SID: 2200075, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"ET POLICY Windows Update P2P Activity\" (SID: 2027766, Rev: 2, Severity: 3) categorized as \"Not Suspicious Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$30","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$31","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"FileZilla_3.66.5_win64_sponsored2-setup.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\system32\\regsvr32.exe\" /s \"%PROGRAMFILES%\\FileZilla FTP Client\\fzshellext_64.dll\"\" - (UID: 00000000-00009624)\n \"FileZilla_3.66.5_win64_sponsored2-setup.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\FileZilla FTP Client\\filezilla.exe\"\" - (UID: 00000000-00009624)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$32","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$33","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"18.172.134.106:80\"\n \"18.64.183.48:443\"\n \"49.12.121.47:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: libgnutls-30.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: fzsftp.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: fzputtygen.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: fzshellext.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: UAC.dll)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$34","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"_ZN10wxGDIImage12FreeResourceEb\" (Indicator: \"FreeResource\"; Source: \"00000000-00006040.00000000.78218.3E421000.00000002.mdmp\")\n Found reference to API \"_ZN5wxPen12FreeResourceEb\" (Indicator: \"FreeResource\"; Source: \"00000000-00006040.00000000.78218.3E421000.00000002.mdmp\")\n Found reference to API \"_ZN6wxFont12FreeResourceEb\" (Indicator: \"FreeResource\"; Source: \"00000000-00006040.00000000.78218.3E421000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys (API string)","description":"Found reference to API \"_ZN12wxWindowBase14RegisterHotKeyEiii\" (Indicator: \"RegisterHotKey\"; Source: \"00000000-00006040.00000000.78218.3E421000.00000002.mdmp\")\n Found reference to API \"_ZN8wxWindow14RegisterHotKeyEiii\" (Indicator: \"RegisterHotKey\"; Source: \"00000000-00006040.00000000.78218.3E421000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.009","relevance":1,"id":"string-545","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n file/memory contains long string with (Indicator: \"OpenThread\"; File: \"UserInfo.dll\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"UserInfo.dll\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n file/memory contains long string with (Indicator: \"GetLastError\"; File: \"System.dll\")\n file/memory contains long string with (Indicator: \"GetLastError\"; File: \"UserInfo.dll\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n file/memory contains long string with (Indicator: \"ShowWindow\"; File: \"StartMenu.dll\")\n Found reference to API \"_ZN12wxDialogBase15ShowWindowModalEv\" (Indicator: \"ShowWindow\"; Source: \"00000000-00006040.00000000.78218.3E421000.00000002.mdmp\")\n Found reference to API \"_ZN19wxTopLevelWindowMSW12DoShowWindowEi\" (Indicator: \"ShowWindow\"; Source: \"00000000-00006040.00000000.78218.3E421000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$35","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$36","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$37","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"FileZilla_3.66.5_win64_sponsored2-setup.exe\" failed to load missing module \"%PROGRAMFILES%\\FileZilla FTP Client\\fzshellext.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$38","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$39","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"FileZilla_3.66.5_win64_sponsored2-setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 72A30000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"FileZilla_3.66.5_win64_sponsored2-setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75DE0000\n \"regsvr32.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 7F950000\n \"filezilla.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 7E8D0000\n \"filezilla.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 7F950000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"FileZilla_3.66.5_win64_sponsored2-setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75D20000\n \"regsvr32.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 7F9D0000\n \"filezilla.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 7F9D0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000020426a7fff7f0000@ntdll.dll\"\n \"220023000000000040426a7fff7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$3a","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"$3c","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"PE file contains large number of import functions","description":"Observed large number of imported APIs from \"libfzclient-private-3-66-5.dll\" : \"209\" [Source: filezilla.exe]\n Observed large number of imported APIs from \"wxmsw32u_core_gcc_custom.dll\" : \"1500\" [Source: filezilla.exe]\n Observed large number of imported APIs from \"libnettle-8.dll\" : \"201\" [Source: libgnutls-30.dll]\n Observed large number of imported APIs from \"wxmsw32u_core_gcc_custom.dll\" : \"732\" [Source: wxmsw32u_xrc_gcc_custom.dll]\n Observed large number of imported APIs from \"wxmsw32u_core_gcc_custom.dll\" : \"587\" [Source: wxmsw32u_aui_gcc_custom.dll]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-145","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$3d","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$3e","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x2fc600\" greater than 0x100000\n Raw size of \".text\" is \"0x128c00\" greater than 0x100000\n Raw size of \".text\" is \"0x121c00\" greater than 0x100000\n Raw size of \".text\" is \"0x13d200\" greater than 0x100000\n Raw size of \".text\" is \"0x110e00\" greater than 0x100000\n Raw size of \".text\" is \"0x109a00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x2fc588\" greater than 0x100000\n Virtual size of \".text\" is \"0x128bc8\" greater than 0x100000\n Virtual size of \".text\" is \"0x121bd8\" greater than 0x100000\n Virtual size of \".text\" is \"0x13d098\" greater than 0x100000\n Virtual size of \".text\" is \"0x110c40\" greater than 0x100000\n Virtual size of \".text\" is \"0x1099e8\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"$3f","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"\"%WINDIR%\\system32\\regsvr32.exe\" /s \"%PROGRAMFILES%\\FileZilla FTP Client\\fzshellext_64.dll\"\" [Source: 00000000-00009624-00000C41-385835680212]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"regsvr32.exe\" (UID: 00000000-00007068) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"regsvr32.exe\" (UID: 00000000-00007068) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"filezilla.exe\" (UID: 00000000-00006040) was launched with modified environment variables: \"Path\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"api.playanext.com\"\n \"offers.playanext.com\"\n \"update.filezilla-project.org\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$40","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"FileZilla_3.66.5_win64_sponsored2-setup.exe\" searching for class \"#32770\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Sets a windows hook","description":"\"filezilla.exe\" sets a windows hook with filter \"WH_KEYBOARD\" for thread ID 8552","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-71","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"regsvr32.exe\" with commandline \"/s \"%PROGRAMFILES%\\\\FileZilla FTP Client\\\\fzshellext_64.dll\"\" (UID: 00000000-00007068)\n Spawned process \"filezilla.exe\" (UID: 00000000-00006040)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"regsvr32.exe\" with commandline \"/s \"%PROGRAMFILES%\\\\FileZilla FTP Client\\\\fzshellext_64.dll\"\" (UID: 00000000-00007068)\n Spawned process \"filezilla.exe\" (UID: 00000000-00006040)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$42","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"FileZilla_3.66.5_win64_sponsored2-setup.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"uninstall.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"fzshellext.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"UAC.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"System.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"nsDialogs.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"StartMenu.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"UserInfo.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"nsis_appid.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"FileZilla_3.66.5_win64_sponsored2-setup.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsxFE7C.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n file/memory contains long string with (Indicator: \"LoadLibrary\"; File: \"System.dll\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"FileZilla_3.66.5_win64_sponsored2-setup.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"filezilla.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"details too long to display","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"$43","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"nsxFE7C.tmp\" has type \"data\" - Location: [%TEMP%\\nsxFE7C.tmp]\n \"nsm1F89.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\" - Location: [%TEMP%\\nsm1F89.tmp]\n \"~ileZilla.tmp\" has type \"MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Archive ctime=Wed Feb 7 10:13:18 2024 mtime=Wed Mar 20 16:02:06 2024 atime=Wed Feb 7 10:13:18 2024 length=4145736 window=hide\" - Location: [%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\FileZilla FTP Client\\~ileZilla.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$44","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"FileZilla_3.66.5_win64_sponsored2-setup.exe\" queries basic process information of the \"C:\\FileZilla_3.66.5_win64_sponsored2-setup.exe\" (UID: 9624)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$45","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"FileZilla_3.66.5_win64_sponsored2-setup.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nsxfe7c.tmp\"\n \"FileZilla_3.66.5_win64_sponsored2-setup.exe\" reads file \"c:\\filezilla_3.66.5_win64_sponsored2-setup.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to detect sandbox (imports API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$46","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"$47","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$48","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"FileZilla_3.66.5_win64_sponsored2-setup.exe\" trying to access LNK file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\FileZilla FTP Client\\Uninstall.lnk\"\n \"FileZilla_3.66.5_win64_sponsored2-setup.exe\" trying to access LNK file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\FileZilla FTP Client\\FileZilla.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$49","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"FileZilla_3.66.5_win64_sponsored2-setup.exe\" trying to access non-existent file \"C:\\Windows\\SystemResources\\USER32.dll.mun\"\n \"FileZilla_3.66.5_win64_sponsored2-setup.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\UXTHEME.dll.Config\"\n \"FileZilla_3.66.5_win64_sponsored2-setup.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\en-US\\KERNELBASE.dll.mui\"\n \"FileZilla_3.66.5_win64_sponsored2-setup.exe\" trying to access non-existent file \"C:\\Program Files\\FileZilla FTP Client\"\n \"FileZilla_3.66.5_win64_sponsored2-setup.exe\" trying to access non-existent file \"C:\\ProgramData\\Microsoft\\desktop.ini\"\n \"FileZilla_3.66.5_win64_sponsored2-setup.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"FileZilla_3.66.5_win64_sponsored2-setup.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nsxfe7c.tmp\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Network Related","name":"Found email domains (string)","description":"file/memory contains long string with (Indicator: \"@gmail.\"; File: \"filezilla.mo\")\n file/memory contains long string with (Indicator: \"@gmail.\"; File: \"libfilezilla.mo\")\n file/memory contains long string with (Indicator: \"@yahoo.\"; File: \"libfilezilla.mo\")\n file/memory contains long string with (Indicator: \"@gmail.\"; File: \"theme.xml\")\n Found reference to API \"DefaultMartins Svarcswtastudio@gmail.com480x480\" (Indicator: \"@gmail.\"; File: \"theme.xml\")\n Found reference to API \"SuNMr.Silencersilencer.guard@yahoo.com48x48\" (Indicator: \"@yahoo.\"; File: \"theme.xml\")","origin":"File/Memory","mitre_attack_id":"T1585.002","relevance":1,"id":"string-235","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.4.3\"\n \"2.5.4.6\"\n \"2.5.4.9\"\n \"2.5.4.12\"\n \"2.5.4.10\"\n \"2.5.4.11\"\n \"2.5.4.7\"\n \"2.5.4.8\"\n \"2.5.4.13\"\n \"2.5.4.5\"\n \"2.5.4.20\"\n \"2.5.4.4\"\n \"2.5.4.43\"\n \"2.5.4.44\"\n \"2.5.4.42\"\n \"2.5.4.65\"\n \"2.5.4.46\"\n \"2.5.4.17\"\n \"2.5.4.41\"\n \"2.5.4.15\"\n \"2.5.29.35\"\n \"2.5.29.20\"\n \"2.5.29.16\"\n \"2.5.29.15\"\n \"2.5.29.19\"\n \"2.5.29.17\"\n \"2.5.29.37\"\n \"2.5.29.14\"\n \"2.5.29.32\"\n \"2.5.29.54\"\n \"2.5.29.18\"\n \"2.5.29.31\"\n \"2.5.29.30\"\n \"1.3.101.110\"\n \"1.3.101.112\"\n \"1.3.101.111\"\n \"1.3.101.113\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4b","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"$4c","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking related APIs","description":"Observed import api \"WNetGetConnection\" which can \"retrieves the name of the network resource associated with a local device\" [Source: filezilla.exe]","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"$4d","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"18.64.183.48\" on port \"443\"\n HTTPS traffic to \"49.12.121.47\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on process \"00000000-00006040\"\n YARA signature for AES encryption matched on file \"libnettle-8.dll\"\n YARA signature for AES encryption matched on file \"fzstorj.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to transfer files remotely using SFTP","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-578","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"FileZilla_3.66.5_win64_sponsored2-setup.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"16845615\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"FileZilla_3.66.5_win64_sponsored2-setup.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"67177229\"\n \"cx\": \"75\"\n \"cy\": \"23\"}\n \"FileZilla_3.66.5_win64_sponsored2-setup.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"68406\"\n \"cx\": \"17\"\n \"cy\": \"147\"}\n \"FileZilla_3.66.5_win64_sponsored2-setup.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"33622789\"\n \"cx\": \"17\"\n \"cy\": \"113\"}\n \"FileZilla_3.66.5_win64_sponsored2-setup.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"16845582\"\n \"cx\": \"17\"\n \"cy\": \"113\"}\n \"FileZilla_3.66.5_win64_sponsored2-setup.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"33622789\"\n \"cx\": \"75\"\n \"cy\": \"23\"}\n \"FileZilla_3.66.5_win64_sponsored2-setup.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"68427\"\n \"cx\": \"75\"\n \"cy\": \"23\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"FileZilla_3.66.5_win64_sponsored2-setup.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"filezilla.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"FileZilla_3.66.5_win64_sponsored2-setup.exe\" called \"GetComputerNameW\" (UID: 00000000-00009624)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"FileZilla_3.66.5_win64_sponsored2-setup.exe\" called \"GetUserNameW\" (UID: 00000000-00009624)\n \"FileZilla_3.66.5_win64_sponsored2-setup.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"FileZilla_3.66.5_win64_sponsored2-setup.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$4f","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$50","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n Found reference to API \"wxOpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00006040.00000000.78218.3E2B7000.00000002.mdmp\")\n Found reference to API \"_Z15wxOpenClipboardv\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00006040.00000000.78218.3E421000.00000002.mdmp\")\n Found reference to API \"_Z24wxGetClipboardFormatName12wxDataFormatPwi\" (Indicator: \"GetClipboardFormatName\"; Source: \"00000000-00006040.00000000.78218.3E421000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n file/memory contains long string with (Indicator: \"GetDC\"; File: \"StartMenu.dll\")\n Found reference to API \"GdipGetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00006040.00000000.78218.3E2B7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: fzsftp.exe)\n Found GetCursorPos() in an import section (Source: fzputtygen.exe)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n file/memory contains long string with (Indicator: \"FindFirstFile\"; File: \"StartMenu.dll\")\n file/memory contains long string with (Indicator: \"FindNextFile\"; File: \"StartMenu.dll\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n file/memory contains long string with (Indicator: \"GetModuleHandle\"; File: \"System.dll\")\n file/memory contains long string with (Indicator: \"GetModuleHandle\"; File: \"StartMenu.dll\")\n file/memory contains long string with (Indicator: \"GetModuleHandle\"; File: \"UserInfo.dll\")\n file/memory contains long string with (Indicator: \"GetCurrentProcess\"; File: \"UserInfo.dll\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegEnumValueW\" (Indicator: \"RegEnumValue\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n Found reference to API \"RegEnumKeyW\" (Indicator: \"RegEnumKey\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n file/memory contains long string with (Indicator: \"GetModuleHandle\"; File: \"System.dll\")\n file/memory contains long string with (Indicator: \"GetModuleHandle\"; File: \"StartMenu.dll\")\n file/memory contains long string with (Indicator: \"GetModuleHandle\"; File: \"UserInfo.dll\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n file/memory contains long string with (Indicator: \"GetProcAddress\"; File: \"System.dll\")\n file/memory contains long string with (Indicator: \"GetProcAddress\"; File: \"UserInfo.dll\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve class object from a DLL object handler","description":"\"fzshellext.dll\" contains export function called \"DllGetClassObject\" at ordinal 2\n \"fzshellext_64.dll\" contains export function called \"DllGetClassObject\" at ordinal 2","origin":"Static Parser","mitre_attack_id":"T1559.001","relevance":1,"id":"static-177","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"11369259104,8552,104,,GetKeyState,user32.dll,\"00:20:22.031\",RX=0,PX=0\" (Indicator: \"GetKeyState\"; Source: \"00000000-00006040.00000000.78218.00450000.00000004.mdmp\")\n Found reference to API \"_Z13wxGetKeyState9wxKeyCode\" (Indicator: \"GetKeyState\"; Source: \"00000000-00006040.00000000.78218.3E421000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n Found reference to API \"GetSystemMetricsForDpi\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00006040.00000000.78218.3E2B7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"file/memory contains long string with (Indicator: \"CheckTokenMembership\"; File: \"UserInfo.dll\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n file/memory contains long string with (Indicator: \"GetUserName\"; File: \"UserInfo.dll\")\n file/memory contains long string with (Indicator: \"GetTokenInformation\"; File: \"UserInfo.dll\")\n file/memory contains long string with (Indicator: \"OpenProcessToken\"; File: \"UserInfo.dll\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$52","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DriverStore\\FileRepository\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00006040.00000000.78218.00450000.00000004.mdmp\")\n Found string \"DriverData=C:\\Windows\\System32\\Drivers\\DriverData\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00006040.00000000.78218.005E0000.00000004.mdmp, 00000000-00006040.00000000.78218.006C0000.00000004.mdmp, 00000000-00006040.00000000.78218.78D60000.00000004.mdmp, 00000000-00006040.00000000.78218.78F60000.00000004.mdmp\")\n Found string \"DriverData=C:\\Windows\\System32\\Drivers\\DriverData\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00006040.00000000.78218.005E0000.00000004.mdmp, 00000000-00006040.00000000.78218.006C0000.00000004.mdmp, 00000000-00006040.00000000.78218.78D60000.00000004.mdmp, 00000000-00006040.00000000.78218.78F60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n Found reference to API \"RegDeleteKeyExW\" (Indicator: \"RegDeleteKey\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n file/memory contains long string with (Indicator: \"CheckTokenMembership\"; File: \"UserInfo.dll\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n Found reference to API \"SystemParametersInfoForDpi\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00006040.00000000.78218.3E2B7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"file/memory contains long string with (Indicator: \"AllocateAndInitializeSid\"; File: \"UserInfo.dll\")\n file/memory contains long string with (Indicator: \"EqualSid\"; File: \"UserInfo.dll\")\n file/memory contains long string with (Indicator: \"FreeSid\"; File: \"UserInfo.dll\")\n file/memory contains long string with (Indicator: \"GetTokenInformation\"; File: \"UserInfo.dll\")\n file/memory contains long string with (Indicator: \"InitializeSid\"; File: \"UserInfo.dll\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"FileZilla_3.66.5_win64_sponsored2-setup.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"filezilla.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$53","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$54","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")\n Found reference to API \"InitiateShutdownW\" (Indicator: \"InitiateShutdown\"; File: \"FileZilla_3.66.5_win64_sponsored2-setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$55","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$56","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"$57","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"FileZilla_3.66.5_win64_sponsored2-setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rdata with unusual entropies 7.07669000824","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Contains escaped byte string (often part of obfuscated shellcode)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1140","relevance":10,"id":"string-15","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/grayware_confidence_60% (D)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"filezilla.exe\" reads file \"C:\\Users\\desktop.ini\"\n \"filezilla.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"filezilla.exe\" reads file \"C:\\Program Files\\desktop.ini\"\n \"filezilla.exe\" reads file \"C:\\Program Files (x86)\\desktop.ini\"\n \"filezilla.exe\" reads file \"C:\\Users\\Public\\desktop.ini\"\n \"filezilla.exe\" reads file \"C:\\Users\\%OSUSER%\\Contacts\\desktop.ini\"\n \"filezilla.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$59","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$5a","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 18.172.134.106 on port 80 is sent without HTTP header\n TCP traffic to 18.64.183.48 on port 443 is sent without HTTP header\n TCP traffic to 49.12.121.47 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match -: Public Private Key","description":"YARA signature for Public Private Key used in file \"fzputtygen.exe\"\n YARA signature for Public Private Key used in process \"00000000-00006040\"\n YARA signature for Public Private Key used in file \"fzsftp.exe\"\n YARA signature for Public Private Key used in file \"libgnutls-30.dll\"","origin":"YARA Signature","mitre_attack_id":"T1573","relevance":2,"id":"yara-122","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 863 files (often an indicator for ransomware)","origin":"Binary File","mitre_attack_id":"T1491.001","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"FileZilla_3.66.5_win64_sponsored2-setup.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"16\"}\n \"FileZilla_3.66.5_win64_sponsored2-setup.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"1\"}\n \"FileZilla_3.66.5_win64_sponsored2-setup.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"2\"}\n \"FileZilla_3.66.5_win64_sponsored2-setup.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"4\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to determine the valid logical drives on the computer","description":"\"filezilla.exe\" called \"GetLogicalDriveStringsW\" with parameters {\"nBufferLength\": \"2000\"\n \"lpBuffer\": \"C:\\\\\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-109","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"A heartbeat ping message was received.\" (Indicator: \"ping\"; Source: \"00000000-00006040.00000000.78218.47C8D000.00000002.mdmp\")\n Found string \"unable to convert hostname %s to IDNA format\" (Indicator: \"hostname\"; Source: \"00000000-00006040.00000000.78218.47C8D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$5b","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"FileZilla_3.66.5_win64_sponsored2-setup.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")\n \"filezilla.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"$5c","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$5d","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"FileZilla_3.66.5_win64_sponsored2-setup.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\FileZilla FTP Client\\filezilla.exe\"\" - (UID: 00000000-00009624)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Detected regsvr32 execution","description":"Process \"regsvr32.exe\" with commandline \"/s \"%PROGRAMFILES%\\\\FileZilla FTP Client\\\\fzshellext_64.dll\"\" (UID: 00000000-00007068)","origin":"Monitored Target","mitre_attack_id":"T1218.010","relevance":10,"id":"target-112","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Reads FTP client related registry keys","description":"$5e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-31","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00007944.00000001.69752.10001000.00000020.mdmp, 00000000-00007944.00000002.71672.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00007944.00000000.67834.02F00000.00000004.mdmp, 00000000-00007944.00000001.69752.02F00000.00000004.mdmp, 00000000-00007944.00000002.71672.02F00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$5f","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"kernel32::IsWow64Process2(ps,*i0s,*i)\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00007944.00000000.67834.02F00000.00000004.mdmp, 00000000-00007944.00000001.69752.02F00000.00000004.mdmp, 00000000-00007944.00000002.71672.02F00000.00000004.mdmp\")\n Found reference to API \"kernel32::IsWow64Process(p-1,*i0s)\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00007944.00000000.67834.02F00000.00000004.mdmp, 00000000-00007944.00000001.69752.02F00000.00000004.mdmp, 00000000-00007944.00000002.71672.02F00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"api.playanext.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00007944.00000001.69752.10001000.00000020.mdmp, 00000000-00007944.00000002.71672.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"Contains the ability to enumerate service (API string)","description":"Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00007944.00000001.69752.10001000.00000020.mdmp, 00000000-00007944.00000002.71672.0040A000.00000004.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00007944.00000001.69752.10001000.00000020.mdmp, 00000000-00007944.00000002.71672.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"nsx9E6E.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"POST /httpapi\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"Where we act as a processor of personal information on behalf of a business partner, we process the personal information pursuant to our contract with the business partner and our legal obligations.\" (Indicator: \"where \"; Source: \"00000000-00007944.00000000.67834.02F00000.00000004.mdmp, 00000000-00007944.00000001.69752.02F00000.00000004.mdmp, 00000000-00007944.00000002.71672.02F00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\FileZilla Client\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00007944.00000000.67834.02F00000.00000004.mdmp\n 00000000-00007944.00000001.69752.02F00000.00000004.mdmp\n 00000000-00007944.00000002.71672.02F00000.00000004.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\filezilla.exe\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: 00000000-00007944.00000000.67834.02F00000.00000004.mdmp\n 00000000-00007944.00000001.69752.02F00000.00000004.mdmp\n 00000000-00007944.00000002.71672.02F00000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to file managers","description":"\"??\\C:\\WINDOWS\\win.ini\" (Indicator: \"\\win.ini\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":3,"id":"string-136","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: nsx9E6E.tmp]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcessWithLogon\"; Source: \"00000000-00007944.00000001.69752.10001000.00000020.mdmp, 00000000-00007944.00000002.71672.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00007944.00000001.69752.10001000.00000020.mdmp, 00000000-00007944.00000002.71672.0040A000.00000004.mdmp\")\n Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00007944.00000001.69752.10001000.00000020.mdmp, 00000000-00007944.00000002.71672.0040A000.00000004.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00007944.00000001.69752.10001000.00000020.mdmp, 00000000-00007944.00000002.71672.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"nsx9E6E.tmp\" was detected as \"Borland Delphi 3.0 (???)\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains ability to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; Source: \"00000000-00007944.00000000.67834.02F00000.00000004.mdmp, 00000000-00007944.00000001.69752.02F00000.00000004.mdmp, 00000000-00007944.00000002.71672.02F00000.00000004.mdmp\")\n Found api reference \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00007944.00000000.67834.02F00000.00000004.mdmp, 00000000-00007944.00000001.69752.02F00000.00000004.mdmp, 00000000-00007944.00000002.71672.02F00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":2,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"$60","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"FileZilla_3.66.5_win64_sponsored2-setup.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsv204B.tmp\" for deletion\n \"FileZilla_3.66.5_win64_sponsored2-setup.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsq20CA.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"level":"malicious","category":"Environment Awareness","name":"Found a Wine emulator related string","description":"\"wine_get_version\" (Indicator: \"wine_get_version\")","origin":"File/Memory","relevance":2,"id":"string-62","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]}],"incidents":[{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Reads FTP client related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"Contains escaped byte string (often part of obfuscated shellcode)"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a webserver"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"Found a Wine emulator related string"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":77,"imported_dlls_count":141,"dropped_files_count":0,"extracted_files_count":52,"files_written_count":53,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":5,"dns_resolutions_count":3,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["filezilla_bundleinstaller"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"sandbox_reports":[{"id":"65faa404d87fa8e86501943e","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":35,"contacted_countries":["DEU","USA"],"submit_name":"FileZilla_3.66.5_win64_sponsored2-setup.exe","analysis_start_time":"2024-03-20T08:57:20+00:00","indicators_count":{"informative":169,"suspicious":45,"malicious":3},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"65c4c89c958f8b4437077cb1","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":35,"contacted_countries":["USA"],"submit_name":"FileZilla_3.66.5_win64_sponsored2-setup.exe","analysis_start_time":"2024-02-08T12:27:10+00:00","indicators_count":{"informative":139,"suspicious":28,"malicious":2},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"18.172.134.106","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"address":"18.64.183.48","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"address":"49.12.121.47","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"address":"108.138.246.17","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"address":"18.239.199.78","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]}],"dns_resolutions":[{"domain":"api.playanext.com","address":"18.172.134.106","ttl":164,"country":"United States","registrar_name":"GoDaddy.com, LLC","registrar_organization":"Domains By Proxy, LLC","registrar_name_servers":"NS59.DOMAINCONTROL.COM","registrar_creation_date":"2017-07-05T18:57:51+00:00","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"domain":"offers.playanext.com","address":"18.64.183.48","ttl":300,"country":"United States","registrar_name":"GoDaddy.com, LLC","registrar_organization":"Domains By Proxy, LLC","registrar_name_servers":"NS59.DOMAINCONTROL.COM","registrar_creation_date":"2017-07-05T18:57:51+00:00","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"domain":"update.filezilla-project.org","address":"49.12.121.47","ttl":15436,"country":"Germany","registrar_name":"Key-Systems GmbH","registrar_organization":"FileZilla","registrar_name_servers":"NS1.DOMAINDISCOUNT24.NET","registrar_creation_date":"2005-01-12T15:22:02+00:00","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]}],"http_requests":[{"host":"api.playanext.com","host_ip":"108.138.246.17:80","url":"/httpapi","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /httpapi HTTP/1.1\nHost: api.playanext.com\nAccept: */*\nContent-Length: 420\nContent-Type: application/x-www-form-urlencoded","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}],"processes":[{"pid":9624,"ppid":0,"name":"FileZilla_3.66.5_win64_sponsored2-setup.exe","command_line":"","sha256":"dbde8a4bd71bb1fbc0511cdb657dfeffdaedc513aa425f856043532a7cba6fce","normalized_path":"C:\\FileZilla_3.66.5_win64_sponsored2-setup.exe","uid":"00000000-00009624","icon":"$61"},{"pid":7068,"ppid":9624,"name":"regsvr32.exe","command_line":"/s \"%PROGRAMFILES%\\FileZilla FTP Client\\fzshellext_64.dll\"","sha256":"02779144af756aab953f13f9e4d28ab3d01a77eb3962756d74099c06babf21b1","normalized_path":"%WINDIR%\\system32\\regsvr32.exe","parent_uid":"00000000-00009624","uid":"00000000-00007068"},{"pid":6040,"ppid":9624,"name":"filezilla.exe","command_line":"","sha256":"f23586077288f615dbc1bacf7b1ebbe4ae266d2e0e1e2b4bc2961762102719f7","normalized_path":"%PROGRAMFILES%\\FileZilla FTP Client\\filezilla.exe","parent_uid":"00000000-00009624","uid":"00000000-00006040"}],"all_imported_dlls":["dnsapi.dll","Windows.StateRepositoryPS.dll","msasn1.dll","libsqlite3-0.dll","libstdc++-6.dll","wow64con.dll","gdi32.dll","combase.dll","clbcatq.dll","TextShaping.dll","normaliz.dll","srvcli.dll","msftedit.dll","oleacc.dll","windows.storage.dll","CoreUIComponents.dll","mswsock.dll","BCP47Langs.dll","thumbcache.dll","ATL90.dll","UserInfo.dll","FWPUCLNT.DLL","urlmon.dll","msvcp_win.dll","fltLib.dll","bcryptprimitives.dll","UAC.dll","schannel.dll","uxtheme.dll","fzshellext_64.dll","libgcc_s_seh-1.dll","libgmp-10.dll","WindowsCodecs.dll","wow64base.dll","msimg32.dll","kernel.appcore.dll","rasadhlp.dll","user32.dll","libfzclient-commonui-private-3-66-5.dll","libnettle-8.dll","bcrypt.dll","VxSSL64.dll","msctf.dll","riched20.dll","zlib1.dll","VxSSL32.dll","WinTypes.dll","CoreMessaging.dll","mpr.dll","libhogweed-6.dll","wow64win.dll","comctl32.dll","psapi.dll","crypt32.dll","libpng16-16.dll","kernel32.dll","rpcrt4.dll","imm32.dll","cryptbase.dll","shfolder.dll","System.dll","advapi32.dll","userenv.dll","netutils.dll","netapi32.dll","ncrypt.dll","ntasn1.dll","version.dll","StartMenu.dll","twinapi.appcore.dll","GROOVEEX.DLL","GrooveIntlResource.dll","win32u.dll","ws2_32.dll","shlwapi.dll","cscapi.dll","globinputhost.dll","ntdll.dll","gdi32full.dll","usp10.dll","IPHLPAPI.DLL","linkinfo.dll","virtdisk.dll","wldp.dll","wxmsw32u_core_gcc_custom.dll","ole32.dll","nsDialogs.dll","Wldap32.dll","winmm.dll","msvcrt.dll","ucrtbase.dll","oleaut32.dll","msls31.dll","nsi.dll","nsis_appid.dll","libfzclient-private-3-66-5.dll","Windows.Globalization.dll","secur32.dll","cfgmgr32.dll","fzshellext.dll","DataExchange.dll","cscui.dll","edputil.dll","libgnutls-30.dll","policymanager.dll","msvcr90.dll","msvcp90.dll","shell32.dll","TextInputFramework.dll","tiptsf.dll","profapi.dll","sechost.dll","iertutil.dll","AcLayers.dll","umpdc.dll","msvcp110_win.dll","KernelBase.dll","setupapi.dll","propsys.dll","dwmapi.dll","comdlg32.dll","wow64.dll","AppResolver.dll","OneCoreUAPCommonProxyStub.dll","EhStorShell.dll","apphelp.dll","sspicli.dll","wxmsw32u_xrc_gcc_custom.dll","ntshrui.dll","wxbase32u_gcc_custom.dll","wxmsw32u_aui_gcc_custom.dll","wxbase32u_xml_gcc_custom.dll","wow64cpu.dll","ntmarta.dll","libfilezilla-42.dll","powrprof.dll","samcli.dll","SHCore.dll","cldapi.dll","aepic.dll","cryptsp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"fzshellext_64.dll","sha256":"63b1cd78f95ded9ce7f686d1bcc32b99756526c179a79425a0e565a38743a13e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"FileZilla.lnk","sha256":"30395c89b1bd68f44570f8d440be4e6f12aae4086f3eacacefaddc341ac7a082","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"Uninstall.lnk","sha256":"5e9aa98f843e67a57eaa0d0de6cf292e4458b1e703475cb3ec14f65c362f441e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"~ileZilla.tmp","sha256":"ba0082a5ae5c54ba6b9922dc88a1036696df5afce8408705204aba68d2177df3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"layout.xml","sha256":"bdf3305712cd7c7aa7620fa49773e1531a80ea3726c8a4e048ad53e4aecb3a21","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"queue.sqlite3-journal","sha256":"cd9fd32ca857d427888b83113f28624670898f5f94e51611afecff01adbccc59","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"default_cancel20x20.png","sha256":"16de9e9b70d7972b3a23116ea4d32e3e6f289a2b1516b5d8ce66883680ccf6fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"default_cancel24x24.png","sha256":"da37aa17497c5f6be0a61b08b687a6bfb6765a069d997592b32aa347542e1213","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"default_close12x12.png","sha256":"13ceaf1e781db57fcdcbc30882763fcce095edcc99af0afcb2d2b227183a85ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"default_compare20x20.png","sha256":"45a3de04caa4f2829aaf8aa3997d7514ab7a71def54510d78847779e7767acdc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"default_disconnect20x20.png","sha256":"b8ae6364c0e09631e8585ecc9ccbd18fc4a34aa5e46c3c5f7b9b94d0b02470a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"default_dropdown12x12.png","sha256":"f57c54809c6f56867d167bfcf4763d6a4abe4e27fdb9c4421cefd6fcfa68cf1e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"default_file16x16.png","sha256":"7bdc9afd55536992299c1c92e0e4a74edd7c9819641b613f012e9ab1086e417d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"default_filter20x20.png","sha256":"fd5a5a39708d3890b2d118a523f19d8fcbba814d4e9d30732f1b67e385836b5c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"default_find20x20.png","sha256":"9bd6dbc93cb0eaf8628d176f2e92a47de39d1e76ff89d71e20a0adfcde91cef0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"default_folder16x16.png","sha256":"2e5e33b852ef77a4aecee518b56629d344afe40f8dd7dc0cb604480108293cce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"default_leds24x24.png","sha256":"cb735a026430d839f9d8381be8b936d4ff368e13558d0b9284be7a0d3c95fe13","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"default_localtreeview20x20.png","sha256":"c0b2f0998b11bfbc0d5ee0fbca3320cc79a5af5df16800f7edaab99c7af0949f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"default_logview20x20.png","sha256":"682ada4732a0d9282ba25b65c17d5c487dea484a95e04e5c50e5c3fb2550f0f6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"default_processqueue20x20.png","sha256":"fdf9033e11e9a2573320a4012154d4014ad288c3f6528079f22379566be75d55","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"default_queueview20x20.png","sha256":"281c277f9144f6e43bffcef5ad6888e9b8356aacad75292db364ea23bf2818c1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"filezilla.exe","sha256":"f23586077288f615dbc1bacf7b1ebbe4ae266d2e0e1e2b4bc2961762102719f7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"fzputtygen.exe","sha256":"e71cf3010e46db0922f0c25251885d1317f2e695e3f7e4fecc035f0d3d987fe5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"fzsftp.exe","sha256":"311488e3c21f1b3573bbe049f94d82135bb049a97128c26f2edded9ec6892adf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"fzshellext.dll","sha256":"b425a8e076dfccf9245d724d3a228500bf128aea9fb24795ee3c6020d2e9df6a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"fzstorj.exe","sha256":"f3bddaca805a6f6978ee17b9549a3025363dca80e0569e5a4a028408d34d29a5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"libfilezilla-42.dll","sha256":"5a48633810356d16d96004f343df8b5ae361f2a170de9bf92cb94578e034533c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"libfzclient-commonui-private-3-66-5.dll","sha256":"44b1d3616ad095d7d9ca23b3cc77e76c372ce65e5f568fe619990d34ccaaaead","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"libfzclient-private-3-66-5.dll","sha256":"1bec025816c78a1c672e912f2ce218ea5c8140acbd3b5b2836491260faeecf91","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"libgcc_s_seh-1.dll","sha256":"00cdff6714f939ff105174138eaa40bb82f6ef7b68b7901bf1736dd921fb7eea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"libgmp-10.dll","sha256":"a6027787b19d797917c5124a7546bd3025c2d51f3ddc13edd44ed4c42ba3d0cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"libgnutls-30.dll","sha256":"7111a50b040da45681733c63fd993a613771d2e51a1418ca688c2722e39eab2a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"libhogweed-6.dll","sha256":"a4f248e6d3e0bd8e1a9875c1e3bf997abf6a9330da58b6dcb960dbd50cb88536","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"libnettle-8.dll","sha256":"3349497c7b523192e090734f3001b034687b0fbfa5640e0f37e5836205b2288b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"libpng16-16.dll","sha256":"f57d4802b66961121b681618f2eda4e08f6205655b0e8f215137a055f41e033e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"libsqlite3-0.dll","sha256":"02716be5069a813438bd53a0daf653828eb71461fb8a1d12476f1db21caf909d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"uninstall.exe","sha256":"d63a012f3145e5b36b75b02ab1cc4004d4a388a2b78a720290249f4fe46b217c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"wxbase32u_gcc_custom.dll","sha256":"98ff3bad4501473ed90cdc3f8b5fa08b0bb24f10a76e0fab652685fae1b6bafd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"wxbase32u_xml_gcc_custom.dll","sha256":"cd2775c27240df51a0788f96a74fcca1833962ff352576a20ed56dbf498607fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"wxmsw32u_aui_gcc_custom.dll","sha256":"42176cea5d61778e838c791b7d10e3c497662ed5e016ad20cc16613835cbbd24","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"wxmsw32u_core_gcc_custom.dll","sha256":"64c130da4bbcf563113ec697b44dd6a574c65d8010a656254c6fd9ddba285f4c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"wxmsw32u_xrc_gcc_custom.dll","sha256":"6f32d24290caa13caa3e656cf281f6d3ca87d00edcf66cf8098e4570b8758d9c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"zlib1.dll","sha256":"ae731d47be35246d9c0f8f6058e635879e4a9df0544917405dd468fd9e57cabb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"StartMenu.dll","sha256":"110545415a59402635e1c9439acba15b44bab268ed02ad2a262ce12604a47855","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"name":"System.dll","sha256":"9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"name":"UAC.dll","sha256":"2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"name":"UserInfo.dll","sha256":"4913d4cccf84cd0534069107cff3e8e2f427160cad841547db9019310ac86cc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"name":"nsDialogs.dll","sha256":"4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"name":"nsis_appid.dll","sha256":"e9e1ba410636698d666b328eea71346b8287248d262e44da07ce8b5fa24c5e5f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"libstdc_-6.dll","sha256":"e53b48e963266ab21d235067fd06edd774d0c608f0102dec10c6e4a1d0d925c2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"modern-wizard.bmp","sha256":"3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"name":"nsx9E6E.tmp","sha256":"6872cf401483b46c9b0456f676cc6f7e810fe11b7831567b187c6228ec4c0857","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"path":"%TEMP%\\nshFE1D.tmp","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%TEMP%\\nsxFE7C.tmp","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%TEMP%\\nsnFE8D.tmp","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"path":"%TEMP%\\nsnFE8D.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%TEMP%\\nsnFE8D.tmp\\UserInfo.dll","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%TEMP%\\nsnFE8D.tmp\\UAC.dll","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%TEMP%\\nsnFE8D.tmp\\modern-wizard.bmp","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%TEMP%\\nsnFE8D.tmp\\nsDialogs.dll","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%TEMP%\\nsm1F89.tmp","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%TEMP%\\nsnFE8D.tmp\\StartMenu.dll","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"path":"%APPDATA%\\FileZilla\\layout.xml","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\default_leds24x24.png","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\default_speedlimits16x16.png","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\default_sitemanager20x20.png","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\default_logview20x20.png","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\default_localtreeview20x20.png","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\default_remotetreeview20x20.png","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\default_queueview20x20.png","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\default_refresh20x20.png","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\default_processqueue20x20.png","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\default_cancel20x20.png","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\default_disconnect20x20.png","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\default_reconnect20x20.png","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\default_filter20x20.png","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\default_compare20x20.png","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\default_synchronize20x20.png","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\default_find20x20.png","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\default_dropdown12x12.png","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\default_close12x12.png","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\default_sort_up_dark12x12.png","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\default_sort_down_dark12x12.png","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\default_server16x16.png","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\default_file16x16.png","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\default_folder16x16.png","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%APPDATA%\\FileZilla\\queue.sqlite3","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%APPDATA%\\FileZilla\\queue.sqlite3-journal","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Explorer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\default_cancel24x24.png","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%TEMP%\\sslkey.txt","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"path":"%TEMP%\\nsv204B.tmp","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"path":"%TEMP%\\nsb20BA.tmp","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"path":"%TEMP%\\nsq20CA.tmp","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"path":"%TEMP%\\nsq20CA.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"path":"%TEMP%\\nsq20CA.tmp\\UserInfo.dll","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"path":"%TEMP%\\nsq20CA.tmp\\UAC.dll","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"path":"%TEMP%\\nsq20CA.tmp\\modern-wizard.bmp","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"path":"%TEMP%\\nsq20CA.tmp\\nsDialogs.dll","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"},{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:9624:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"Local\\SM0:9624:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"SM0:9624:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\BaseNamedObjects\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"Global\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"Global\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"Local\\SM0:6040:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"Global\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"Global\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"Global\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"Global\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"Global\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"Local\\SM0:6040:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"Global\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"Global\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"Global\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"Global\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"Global\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"Global\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"Global\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"FileZilla 3 Mutex Type 4","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"Global\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"Global\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"Global\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"FileZilla 3 Mutex Type 9","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"FileZilla 3 Mutex Type 6","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"SM0:6040:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"FileZilla 3 Mutex Type 5","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"FileZilla 3 Mutex Type 1","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\FileZilla 3 Mutex Type 1","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\FileZilla 3 Mutex Type 6","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\FileZilla 3 Mutex Type 5","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\FileZilla 3 Mutex Type 9","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6040:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6040:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6040:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\FileZilla 3 Mutex Type 4","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\BaseNamedObjects\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\BaseNamedObjects\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\BaseNamedObjects\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\BaseNamedObjects\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\BaseNamedObjects\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\BaseNamedObjects\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\BaseNamedObjects\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\BaseNamedObjects\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\BaseNamedObjects\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\BaseNamedObjects\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\BaseNamedObjects\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\BaseNamedObjects\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\BaseNamedObjects\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\BaseNamedObjects\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\BaseNamedObjects\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\BaseNamedObjects\\C::Users:e0MVCEW:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65faa404d87fa8e86501943e"}]},{"name":"Local\\SM0:7944:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]},{"name":"SM0:7944:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"65c4c89c958f8b4437077cb1"}]}]}},"report_ids":{"sandbox_job_ids":["65faa404d87fa8e86501943e","65c4c89c958f8b4437077cb1"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious PUABundler_Win32_FileZilla_BundleInstaller Sample dbde8a4bd71b… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample dbde8a4bd71b…. Malware family: PUABundler_Win32_FileZilla_BundleInstaller. Threat score 35/100. 7/27 AV engines flagged this file. 4 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/dbde8a4bd71bb1fbc0511cdb657dfeffdaedc513aa425f856043532a7cba6fce"}],["$","meta","4",{"property":"og:title","content":"Malicious PUABundler_Win32_FileZilla_BundleInstaller Sample dbde8a4bd71b… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample dbde8a4bd71b…. Malware family: PUABundler_Win32_FileZilla_BundleInstaller. Threat score 35/100. 7/27 AV engines flagged this file. 4 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/dbde8a4bd71bb1fbc0511cdb657dfeffdaedc513aa425f856043532a7cba6fce"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious PUABundler_Win32_FileZilla_BundleInstaller Sample dbde8a4bd71b… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample dbde8a4bd71b…. Malware family: PUABundler_Win32_FileZilla_BundleInstaller. Threat score 35/100. 7/27 AV engines flagged this file. 4 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L62","11",{}]]