Analysis
- max time kernel
38s - max time network
40s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
21/08/2026, 18:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fo-wsftp605.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
fo-wsftp605.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target fo-wsftp605.exe
- Size 1.9MB
- Sample260821-wtw42sam21
- SHA256 2d19814d33cf0770b925104b91418bf364c78e59b1d94a45a62a5fe6a2c157c1
- MD5 2d80c1c3948f95797bbe14e8fc5e2652
- SHA1 a4bdd27bb12c7428d0d16e605cc2ed5032becb02
- SHA512 6586d54166cbc8a788c20ed841e010a7fa422b1d1e433885396d617ab3c3660818c93c1c88d5f69fde3866ca41c43b85852ea53266da1a1f3f4634c68f388194
- SSDEEP 49152:tMCvNprR5Fovc9rZaj6BYA+lCv7GIK/b32mheB:2ClxR5FokraHlCjfKz32mc
- TLSH T17C951221FFB8C260F2B29036AD715764883BBCB0B7335443E694369EDAB368145D1B5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 10 IoCs
pid Process 2804 fo-wsftp605.exe 2804 fo-wsftp605.exe 2804 fo-wsftp605.exe 2804 fo-wsftp605.exe 2804 fo-wsftp605.exe 2804 fo-wsftp605.exe 2804 fo-wsftp605.exe 2804 fo-wsftp605.exe 2804 fo-wsftp605.exe 2804 fo-wsftp605.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 36 IoCs
description ioc Process File created C:\Program Files\WS_FTP Pro\WS_FTP.ini fo-wsftp605.exe File created C:\Program Files\WS_FTP Pro\antiviru.ini fo-wsftp605.exe File created C:\Program Files\WS_FTP Pro\software.ini fo-wsftp605.exe File created C:\Program Files\WS_FTP Pro\ftpsync.exe fo-wsftp605.exe File created C:\Program Files\WS_FTP Pro\syncdll.dll fo-wsftp605.exe File created C:\Program Files\WS_FTP Pro\ftpsync.hlp fo-wsftp605.exe File created C:\Program Files\WS_FTP Pro\connect.wav fo-wsftp605.exe File created C:\Program Files\WS_FTP Pro\complete.wav fo-wsftp605.exe File created C:\Program Files\WS_FTP Pro\hardware.ini fo-wsftp605.exe File created C:\Program Files\WS_FTP Pro\ftppro32.dll fo-wsftp605.exe File created C:\Program Files\WS_FTP Pro\ftpproex.dll fo-wsftp605.exe File created C:\Program Files\WS_FTP Pro\ftpfind.cnt fo-wsftp605.exe File created C:\Program Files\WS_FTP Pro\ftpfind.hlp fo-wsftp605.exe File created C:\Program Files\WS_FTP Pro\WhatsNew.txt fo-wsftp605.exe File opened for modification C:\Program Files\WS_FTP Pro\WS_FTP.INI fo-wsftp605.exe File created C:\Program Files\WS_FTP Pro\ftp95pro.exe fo-wsftp605.exe File created C:\Program Files\WS_FTP Pro\ftpscrpt.hlp fo-wsftp605.exe File created C:\Program Files\WS_FTP Pro\ftppro32.pdf fo-wsftp605.exe File created C:\Program Files\WS_FTP Pro\ipswitch.ini fo-wsftp605.exe File created C:\Program Files\WS_FTP Pro\onlinese.ini fo-wsftp605.exe File created C:\Program Files\WS_FTP Pro\usgovern.ini fo-wsftp605.exe File created C:\Program Files\WS_FTP Pro\nsftp.cnt fo-wsftp605.exe File created C:\Program Files\WS_FTP Pro\ftpfind.exe fo-wsftp605.exe File created C:\Program Files\WS_FTP Pro\remove32.exe fo-wsftp605.exe File created C:\Program Files\WS_FTP Pro\FtpPro32.cnt fo-wsftp605.exe File created C:\Program Files\WS_FTP Pro\ftppro32.hlp fo-wsftp605.exe File created C:\Program Files\WS_FTP Pro\nsftpch.dll fo-wsftp605.exe File created C:\Program Files\WS_FTP Pro\archives.ini fo-wsftp605.exe File created C:\Program Files\WS_FTP Pro\games.ini fo-wsftp605.exe File created C:\Program Files\WS_FTP Pro\nsftp.hlp fo-wsftp605.exe File created C:\Program Files\WS_FTP Pro\ftpscrpt.exe fo-wsftp605.exe File created C:\Program Files\WS_FTP Pro\ftpsync.cnt fo-wsftp605.exe File created C:\Program Files\WS_FTP Pro\ftplink.exe fo-wsftp605.exe File created C:\Program Files\WS_FTP Pro\ftpstub.dll fo-wsftp605.exe File created C:\Program Files\WS_FTP Pro\error.wav fo-wsftp605.exe File created C:\Program Files\WS_FTP Pro\ftpscrpt.cnt fo-wsftp605.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\win.ini fo-wsftp605.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fo-wsftp605.exe - Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "201" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.WSFTPStub\CurVer\ = "Ipswitch.WSFTPStub.20000112" fo-wsftp605.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A02}\ProgID\ = "Ipswitch.NSFTPCH.981110" fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A02}\VersionIndependentProgID fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\CopyHookHandlers\NSFTPCH fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\* fo-wsftp605.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A01}\VersionIndependentProgID\ = "Ipswitch.NSFTP" fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A0A}\Shell\open\Command fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A0A}\Shell\open fo-wsftp605.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A0A}\Shell\Delete\Command\ = "\"C:\\Program Files\\WS_FTP Pro\\ftplink.exe\" /d classic" fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.WSFTPStub.20000112 fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.NSFTPCH.981110\ClsID fo-wsftp605.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A01}\InprocServer32\ = "C:\\Program Files\\WS_FTP Pro\\ftpproex.dll" fo-wsftp605.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.NSFTP\DefaultIcon\ = "C:\\Program Files\\WS_FTP Pro\\ftpproex.dll,0" fo-wsftp605.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.NSFTP.20000117\ClsID\ = "{49707377-6974-6368-2E4A-756E6F644A01}" fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID fo-wsftp605.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A0A}\ = "WS_FTP Pro" fo-wsftp605.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A02}\InprocServer32\ = "C:\\Program Files\\WS_FTP Pro\\nsftpch.dll" fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.NSFTPCH\ClsID fo-wsftp605.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A01}\ProgID\ = "Ipswitch.NSFTP.20000117" fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.NSFTP.20000117\ClsID fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A01}\Shell\Delete fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A0A}\Shell\Delete fo-wsftp605.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A01}\ = "WS_FTP Pro Explorer" fo-wsftp605.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A02}\ = "WS_FTP Pro Explorer CopyHookHandler" fo-wsftp605.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.NSFTPCH\CurVer\ = "Ipswitch.NSFTPCH.981110" fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A01}\ShellFolder fo-wsftp605.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A01}\Shell\Delete\Command\ = "\"C:\\Program Files\\WS_FTP Pro\\ftplink.exe\" /d exp" fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A02}\InprocServer32 fo-wsftp605.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A02}\InprocServer32\ThreadingModel = "Apartment" fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.NSFTPCH\CurVer fo-wsftp605.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A0A}\DefaultIcon\ = "C:\\Program Files\\WS_FTP Pro\\ftp95pro.exe,0" fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.NSFTPCH.981110 fo-wsftp605.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\NSFTPCH\ = "{49707377-6974-6368-2E4A-756E6F644A02}" fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A01} fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A0A}\Shell fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.WSFTPStub.20000112\ClsID fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.WSFTPStub.20000112\DefaultIcon fo-wsftp605.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.NSFTPCH.981110\ = "WS_FTP Pro Explorer CopyHookHandler" fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A01}\DefaultIcon fo-wsftp605.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A0A}\ShellFolder\Attributes = 00000008 fo-wsftp605.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A0A}\ProgID\ = "Ipswitch.WSFTPStub.20000112" fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.WSFTPStub\ClsID fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.NSFTPCH fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A01}\InprocServer32 fo-wsftp605.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.NSFTP\CurVer\ = "Ipswitch.NSFTP.20000117" fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A0A}\ShellFolder fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\directory\shellex\CopyHookHandlers\NSFTPCH fo-wsftp605.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A01}\InprocServer32\ThreadingModel = "Apartment" fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A01}\ProgID fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A01}\VersionIndependentProgID fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.NSFTP.20000117 fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A0A}\DefaultIcon fo-wsftp605.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A02}\VersionIndependentProgID\ = "Ipswitch.NSFTPCH" fo-wsftp605.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.NSFTPCH.981110\ClsID\ = "{49707377-6974-6368-2E4A-756E6F644A02}" fo-wsftp605.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A0A}\InprocServer32\ThreadingModel = "Apartment" fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A0A}\ProgID fo-wsftp605.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A0A}\Shell\open\Command\ = "\"C:\\Program Files\\WS_FTP Pro\\ftp95pro.exe\"" fo-wsftp605.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.WSFTPStub\ClsID\ = "{49707377-6974-6368-2E4A-756E6F644A0A}" fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.WSFTPStub\CurVer fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A02} fo-wsftp605.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\CopyHookHandlers\NSFTPCH\ = "{49707377-6974-6368-2E4A-756E6F644A02}" fo-wsftp605.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.NSFTP\ClsID\ = "{49707377-6974-6368-2E4A-756E6F644A01}" fo-wsftp605.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A10}\InProcServer32 fo-wsftp605.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 2804 fo-wsftp605.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2800 LogonUI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fo-wsftp605.exe"C:\Users\Admin\AppData\Local\Temp\fo-wsftp605.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2804
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4656
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3943055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2800
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\WS_FTP Pro\ftppro32.dll
- Size 300KB
- SHA256 a7ee486f49f7145f7171c210955b710bd2944f0a2adf4448c51e1817e129c90e
- MD5 5e07a770dd0093ca8bd05b50214ee7b6
- SHA1 91dbd854ae4f9e6be08c01308902cf8522810847
- SHA512 6078eafa0e9cba4d54ac572504b774ffffdd6af66a0f8ce13a447c982c8e2f0494e75268935b1428a1513ef809f812fa5fdae7336f9e6d69c18781889933b236
- SSDEEP 6144:D+z+Tnv8JRDU+PcqYWPth5VM6ZVNMVRR9iEtUC:D+zEv8nDiW1h5VMCVNc9i
- TLSH T19564F922A5D0C07AE1B64638D51243F219363FBA5BF0B4DBEAD43E1D7F76582962130B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WS_FTP Pro\ftpproex.dll
- Size 560KB
- SHA256 240bc27914f0df384df691ef271e41a9741f65584f86b8d60a74c25a4e2d5696
- MD5 79df2c92b70ee1f58f17d1dbb47821d2
- SHA1 9263bd162fb61a1dd8fa3e5ceb3f2ae57c87a7b0
- SHA512 3ba669f5b99c5a68e478ceb22a6e6b1e174a69ba8b5d70e07e0e31818af061313d011e8177c9c7121eb43b4989964bf9ada69e8b709fa16a13ed7e4c16cbccfb
- SSDEEP 12288:7tb9bnhGHS78yTZJnwXS7/aU97Sz2ROck:DlwE7SqRw
- TLSH T1ADC4086261D5C07AE0BA4A30A9DA43F32A34AF710F1068DBE7907D797FB15D2993131B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WS_FTP Pro\ftpstub.dll
- Size 36KB
- SHA256 2d0d3f47407f1d7f81f5b3b9a8c5c35e6b3d1ff840edc21b8b6b62827d5647e2
- MD5 4ae223d22e596e76bdd826df60656479
- SHA1 fd5826c479a0a0b4dffe90e24d34ae281c602de8
- SHA512 b0340a9222cdc5bad4798a32ee51c85a7ff116d1762985505ac64302fe7209618e65d27be10fd5a3ad5c2d2bb8115560b28c61b716ade8057532b9c63b668df9
- SSDEEP 768:gvYPsyo/YcAQwcTr7AmikTM3SDLTDoOb+NDG:gQPsLGcT3ACZjDoLD
- TLSH T137F25C2030CA85B7F75A993534D52F1737BEB9302AE150C3DF65669A2D312E0B53A34B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WS_FTP Pro\nsftpch.dll
- Size 40KB
- SHA256 7983c8a2c04dd2b141b1970cc47a380edffbd1dc4ba2028cb1cac65b3c9e4917
- MD5 a3acd258ecf26a8fb84f91a69d2cbaad
- SHA1 fd9052de695abd79b657980d47ad19ed140fea40
- SHA512 0fc5bb942ef414c04044ef853067eed55034d487e190b12300c510f828ca095f0facdaf0f034fc00d42e318ef818c6d28ce18acab5b48add1f554f49400b4778
- SSDEEP 768:g4/JOyw33X7mktDTEdU1UwjSaBnI65lGJdob7VN6666666ZC:I9DTEdU1UwZnp2HofVA
- TLSH T1CE035C21798541B3D35F123A28956F3AA63F6D101FF44883AF659EEE1D325E0E23A347
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Install.ini
- Size 967B
- SHA256 aa1a183349c7fcd0aee6308571f1b46f127006bdf53ee8999a484383e797db77
- MD5 2463398b8d5584ad7b3baffd63b9bf93
- SHA1 973d7da774ec11431e6191214b71325a7148f54f
- SHA512 efbd0c394eca8c328638b007e367e4e0e90b61d8296c53d156e8c3fb7cc506af6451bfde327555b9b8fb38b5e7e9b22ec4989ae30c3178f1acae31829750706b
- TLSH T14C1102AE1705D3717487C227122DA182A133E19CB172327531EAC0115B75EB61AF75EB
- MD5 SHA1 SHA512 TLSH