Report - uupdump.net/misc/uup-converter-wimlib.7z

Report Overview

Visited public
2025-05-02 03:20:56
Tags
Submit Tags
URL
uupdump.net/misc/uup-converter-wimlib.7z
Finishing URL
about:privatebrowsing
IP / ASN
104.21.49.32
#13335 CLOUDFLARENET
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
uupdump.net	117905	2021-01-09	2021-01-09	2025-05-01	508 B	1.7 MB	172.67.140.132

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
uupdump.net/misc/uup-converter-wimlib.7z
IP
172.67.140.132
ASN
#13335 CLOUDFLARENET

File type
7-zip archive data, version 0.4
Size
1.7 MB (1687085 bytes)
Hash
94652777a56202f88612364dc2060c46
961aabbac86c865b5fc19556f2c83c6d4cfc6c80
fac68bb096948115ddb7f95c99e6fb146834e458aecc2eebee97186dba8692de

Archive (34)

Filename

Md5

File type

APAP.txt

8290f63c28641077804a56feb823dfba

ASCII text, with CRLF line terminators

bootmui.txt

a003f367d4f62cf15d4fdcb7edfe4d37

ASCII text, with CRLF line terminators

bootwim.txt

61eecc514db0594057cb77ac667aea99

ASCII text, with CRLF line terminators

CompDB_App.txt

01c712a8097b4adfa69836054bcfec20

ASCII text, with very long lines (306), with CRLF line terminators

PSFExtractor.exe.config

ef32e2b99b3ac0aaa4a1ade65a87bead

XML 1.0 document, ASCII text, with CRLF line terminators

psfx.txt

deb1aa95db4872d8f9654519ab268d65

ASCII text, with CRLF line terminators

tiTkn.txt

8b22c9f8809c4c6caa00ba96e5b615a0

ASCII text, with CRLF line terminators

Updates.bat

964be95db8fc4b0cc11bba08f07da0d2

DOS batch file, ASCII text, with CRLF line terminators

veData.cmd

9272fe6dccfcb4c25bc0c7f8e614df2b

ASCII text, with very long lines (2568), with CRLF line terminators

convert-UUP.cmd

598069d4828295be08697913fb819924

exported SGML document, ASCII text, with CRLF line terminators

ConvertConfig.ini

f4898d72d7658a1033c8784787504a70

Generic INItialization configuration [Store_Apps]

create_virtual_editions.cmd

7e2fc2bb4886102fb0ec714e7d827171

exported SGML document, ASCII text, with CRLF line terminators

CustomAppsList.txt

9f223cbd12372e4fdcb863b6d9d1d407

ASCII text, with CRLF line terminators

multi_arch_iso.cmd

3978a26b0fb93c67ccb10cb90c51ac8d

exported SGML document, ASCII text, with CRLF line terminators

ReadMe.html

0fb89cfbf88e285bf29b1d1259719efb

HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

Remove_Failure_MountDir_TempDir.cmd

91bd5b3d939aeb8beb083f425d8bcc9d

ASCII text, with CRLF line terminators

.README

c013ca3a8da389fbdecb49c6b0a5e913

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

7z.dll

0dce103b0102adec3279797665b7a4ae

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 6 sections

7z.exe

7187ae605f4dce14bb23ea2623956335

PE32 executable (console) Intel 80386, for MS Windows, 6 sections

APAP.exe

0ae0b18480a3aae780ed7ca6b44b073c

PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

bcdedit.exe

e48eee77a8a6390b89781ccd1d7bccc5

PE32 executable (console) Intel 80386, for MS Windows, 6 sections

bfi.exe

edbdd5893d753fa68865ec3ad7dfe06d

PE32 executable (console) Intel 80386, for MS Windows, UPX compressed, 3 sections

libwim-15.dll

e00fa5e9967055c31a62410fa4a758a2

PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows, 12 sections

wimlib-imagex.exe

c297992a7e8a207508fe30c71bf2691c

PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows, 11 sections

cabarc.exe

a02a8702c6c539bd8648ccbb1869a604

PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections

cdimage.exe

faaca366b14a036ff0fdd52654cb0798

PE32 executable (console) Intel 80386, for MS Windows, 5 sections

imagex.exe

a452fd6f47c7f603c2c2034dacc8cac4

PE32 executable (console) Intel 80386, for MS Windows, 5 sections

libwim-15.dll

cb5fce32bb4559e6c078f68257b8cf03

PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows, 10 sections

Microsoft.Dism.dll

4a1fecccb25d0a97bdf7152d2f5768ef

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

offlinereg.exe

6dc5ad65078eb5229fbbd1f06f61cf0b

PE32 executable (console) Intel 80386, for MS Windows, 8 sections

offreg.dll

163db46b803e4c83c444a026ff17d269

PE32 executable (DLL) (console) Intel 80386, for MS Windows, 5 sections

PSFExtractor.exe

cdc246981d3c7d79133ba55f2e8e5cd5

PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

SxSExpand.exe

ca13105c6b1a532b8aeec611ec6459ef

PE32 executable (console) Intel 80386, for MS Windows, 8 sections

wimlib-imagex.exe

c0605496fa0a86bcc78dbe13bd7aa29c

PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, 9 sections

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	Qakbot New Campaign ISO

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

	URL	IP	Response	Size
	GET uupdump.net/misc/uup-converter-wimlib.7z	172.67.140.132	200 OK	1.7 MB
URL User Request GET uupdump.net/misc/uup-converter-wimlib.7z IP 172.67.140.132:443 ASN #13335 CLOUDFLARENET Certificate IssuerGoogle Trust Services Subjectuupdump.net Fingerprint5B:A0:0F:70:C1:B4:07:A9:08:EA:AB:80:2F:79:51:41:A9:B5:13:15 ValidityThu, 06 Mar 2025 17:07:23 GMT - Wed, 04 Jun 2025 18:04:28 GMT File type 7-zip archive data, version 0.4 Size 1.7 MB (1687085 bytes) Hash 94652777a56202f88612364dc2060c46 961aabbac86c865b5fc19556f2c83c6d4cfc6c80 fac68bb096948115ddb7f95c99e6fb146834e458aecc2eebee97186dba8692de HTTP Headers `GET /misc/uup-converter-wimlib.7z HTTP/1.1 Host: uupdump.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache` HTTP/2 200 OK date: Fri, 02 May 2025 03:20:23 GMT content-type: application/x-7z-compressed content-length: 1687085 server: cloudflare x-content-type-options: nosniff cf-ray: 939461e7f8a30b51-OSL accept-ranges: bytes etag: "6813d096-19be2d" last-modified: Thu, 01 May 2025 19:50:46 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload cache-control: max-age=14400 cf-cache-status: HIT report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1f94qPyCEhs4NIjdECBb9FkO0aXMZRlONnlJYcuBwad0wIXRwYXlTipZKID6k8kw66vh3IxioL2pJaTXUAb3dBsphxidO40msbCDL53M6nOuSrE72lBvSqND4mw3UQ%3D%3D"}],"group":"cf-nel","max_age":604800} nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} vary: Accept-Encoding alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5698&min_rtt=439&rtt_var=10527&sent=7&recv=11&lost=0&retrans=0&sent_bytes=3200&recv_bytes=1142&delivery_rate=7743315&cwnd=254&unsent_bytes=0&cid=6216e6c3ec91b180&ts=100&x=0" X-Firefox-Spdy: h2

GET uupdump.net/misc/uup-converter-wimlib.7z

172.67.140.132

200 OK

1.7 MB

URL User Request GET
uupdump.net/misc/uup-converter-wimlib.7z
IP
172.67.140.132:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services
Subjectuupdump.net
Fingerprint5B:A0:0F:70:C1:B4:07:A9:08:EA:AB:80:2F:79:51:41:A9:B5:13:15
ValidityThu, 06 Mar 2025 17:07:23 GMT - Wed, 04 Jun 2025 18:04:28 GMT

File type
7-zip archive data, version 0.4
Size
1.7 MB (1687085 bytes)
Hash
94652777a56202f88612364dc2060c46
961aabbac86c865b5fc19556f2c83c6d4cfc6c80
fac68bb096948115ddb7f95c99e6fb146834e458aecc2eebee97186dba8692de

HTTP Headers

GET /misc/uup-converter-wimlib.7z HTTP/1.1
Host: uupdump.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 02 May 2025 03:20:23 GMT
content-type: application/x-7z-compressed
content-length: 1687085
server: cloudflare
x-content-type-options: nosniff
cf-ray: 939461e7f8a30b51-OSL
accept-ranges: bytes
etag: "6813d096-19be2d"
last-modified: Thu, 01 May 2025 19:50:46 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=14400
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1f94qPyCEhs4NIjdECBb9FkO0aXMZRlONnlJYcuBwad0wIXRwYXlTipZKID6k8kw66vh3IxioL2pJaTXUAb3dBsphxidO40msbCDL53M6nOuSrE72lBvSqND4mw3UQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=5698&min_rtt=439&rtt_var=10527&sent=7&recv=11&lost=0&retrans=0&sent_bytes=3200&recv_bytes=1142&delivery_rate=7743315&cwnd=254&unsent_bytes=0&cid=6216e6c3ec91b180&ts=100&x=0"
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (34)

Detections

JavaScript (0)

HTTP Transactions (1)

URL User Request GET

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers