Report Overview
Visitedpublic
2024-10-18 16:06:43
Tags
Submit Tags
URL
west-wind.com/files/wwclient.zip
Finishing URL
about:privatebrowsing
IP / ASN
149.28.15.235
#20473 AS-CHOOPA
Title
about:privatebrowsing

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
7

Host Summary

HostRankRegisteredFirst SeenLast Seen
west-wind.com
5733651995-10-042012-08-312024-10-15

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected


OpenPhish

No alerts detected


PhishTank

No alerts detected


Mnemonic Secure DNS

No alerts detected


Quad9 DNS

No alerts detected


ThreatFox

No alerts detected


File detected

URL
west-wind.com/files/wwclient.zip
IP / ASN
149.28.15.235
#20473 AS-CHOOPA
File Overview
File TypeZip archive data, at least v2.0 to extract, compression method=store
Size6.5 MB (6459990 bytes)
MD56b5954bd5c2b87179bc83e1d5442dca6
SHA148f8030a8593160d3aa8d21d18dd18a6a8a162d8
Archive (104)
FilenameMD5File type
wwbusiness.VCTf5407fbd1817e65d04571373581b8aa0Adobe Photoshop Color swatch, version 1, 924 colors; 1st RGB space (0), w 0x1, x 0, y 0, z 0; 2nd RGB space (0), w 0, x 0, y 0, z 0
wwbusiness.vcx9de5ab462819551a65364f5e5b9e3dd8Visual FoxPro DBF, 5 records * 109, update-date 18-11-8, codepage ID=0x3, with memo .FPT, at offset 1032 1st record "COMMENT Class "
wwbusinessobject.PRGf1aa5a2a2777d5c7a2d991b9fa40c14fASCII text, with CRLF line terminators
config.fpw9d1b3e5fea17d7e3fc11ea2cd105b8bcASCII text, with CRLF line terminators
dunzip32.dllc76d8e6eaefdfb62d0ddf7a670c2e5edPE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 7 sections
dzip32.dll0a4cc328ae0bcb13e9056c9afcf3a9c5PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 8 sections
FluentFTP.dll8ba7cbafc584cc3183d5d21aa22a98caPE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
Markdig.dll3c06a7764b1ebdbe5274847f42e772fcPE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
Newtonsoft.Json.dll195ffb7167db3219b217c4fd439eedd6PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
Renci.SshNet.dlla8a17572df9dcbe2946d2d5cfd66c655PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
load_wwipstuff.PRG11dc671c838db9dd25d1afb9119a2767ASCII text, with CRLF line terminators
smtp.SCT48425a3e694ddb2f3e8b93f5f03ecffadata
smtp.scx39c7bf5f4e77e5638bd3a9fd861c5ecfVisual FoxPro DBF, 29 records * 109, update-date 16-5-26, codepage ID=0x3, with memo .FPT, at offset 1032 1st record "COMMENT Screen "
AspNetJsonSerializer.PRGb906c256b00643c7f2090302efd33991ASCII text, with CRLF line terminators
asyncmethod_webclient.PRG18988da81396d8d2900042e98bdee7afASCII text, with CRLF line terminators
collectiontests.prg482097b87fe77a7cac91cb12f79851c3ASCII text, with CRLF line terminators
dataset.PRGc8bf89e60a1d1551cfb15822839ae05cASCII text, with CRLF line terminators
datasetraw.prgb717b626b3e8c893793316bf85df118fASCII text, with CRLF line terminators
dotnetcore.prg1d46ef29cd456225a0fb0ba5fbdb5bd9ASCII text, with CRLF line terminators
dotnetCore_LiveReloadServer.PRG86c03af23509b3a51c641d110afb949dASCII text, with CRLF line terminators
eventlog.prg39e82f3a0124eda1b5ae2514be614417ASCII text, with CRLF line terminators
filewatcher_events.PRG557fcd82729a98d12357bca2ccd3c161ASCII text, with CRLF line terminators
getIpFromDomain.PRG46a4d69e1566482fe5b64acc7aeda80eASCII text, with CRLF line terminators
GetSslCertificates.PRG56702f56f7565f4e61e1ac754be7c896ASCII text, with CRLF line terminators
InteropExamples.dll8bdadc4d22a50207da65e236c3756b48PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
networkstatus.PRG9fbd3f5fb6bc4a225f4821ddace12dacASCII text, with CRLF line terminators
OpenPop.dll10ee863dfd9ef54be574f73fe52f2769PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
openpop.PRGa9b415ee956f2b97ac83b657e65e7c42ASCII text, with CRLF line terminators
Pass20Parameters.prgb41569d3ee20e2617c45e5b6c61e68a1ASCII text, with CRLF line terminators
PassEnumArray.prg5148161c8c072e78470a9949299e1e90ASCII text, with CRLF line terminators
persons.prg73f7b878bab111198285e0b48da2b50eASCII text, with CRLF line terminators
processes.PRG56075822388116b1c1e6ee7735a49d17ASCII text, with CRLF line terminators
resizeImage.PRGb758457d13e9a4e4b229264c10eaf725ASCII text, with CRLF line terminators
SailBig.jpg90a1edc4b55f38ee2cc374561283b9d1JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, progressive, precision 8, 1401x1050, components 3
License_DotNetReflector6.rtf1960cb0b28356e0cdc6f13e8f1fe6ebeRich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
log4net.dll5f3bd963f02108c36592b5728fa725c5PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
log4net_LICENSE.txt74ae3e8ad4267784fca1593fcbe3d091ASCII text, with CRLF line terminators
Reflector.cfgd39f4f7e555e41e635831486a0331fdaGeneric INItialization configuration [AssemblyCache]
Reflector.exe143f2dea68a725eab4f51c7c433847f5PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
Reflector.exe.configb8b115a63c9368a5ff56f0bead67be64XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
typepassingtests.prg3562fbfcdf0ed4d617a73d8bba3c7905ASCII text, with CRLF line terminators
config.fpw231e07bfc6ddac6df9b91b60e829c797ASCII text, with CRLF line terminators
Readme.md7b0ff9c852c7642c597ace0609dcf727Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
wwDotNetBridge.dlla841ffaaa14cd9c3d790e11b774965b0PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
wwdotnetbridgetest.exebdf549e9ebd1b80e1b63968f7e2c6447PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
wwdotnetbridgetest.PJT73da2d4aa233324f8811fb4e3b95c617Adobe Photoshop Color swatch, version 0, 893 colors; 1st RGB space (0), w 0x21, x 0, y 0, z 0; 2nd RGB space (0), w 0, x 0, y 0, z 0
wwdotnetbridgetest.PJX33f81e1dabe6ddd84f12ab8a19d0d4daVisual FoxPro DBF, 3 records * 130, update-date 18-6-22, codepage ID=0x3, with memo .FPT, at offset 1192 1st record "�"
wwDotnetBridgeTest.PRG212a07ff56ecfa095dd3603419895f6eASCII text, with CRLF line terminators
wwipstuff.dllfc4857ea53daeb61c8207a66ff0e5d68PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections
wwEncryptionSample.PRGc57f324ee429b9eec27086eefcbf2864ASCII text, with CRLF line terminators
wwipstuff_samples.PRG2fdf326286774d1f830175c403faca1fASCII text, with CRLF line terminators
wwJsonServiceClient.prgcbbb02dab88d7bf8141450ed5c096208ASCII text, with CRLF line terminators
wwsmtp_sample.PRGbc382d2585cf18264cf230160ec9fdb9ASCII text, with CRLF line terminators
wws_id.dbf689becc1b6321d5b439b0a78c4beb788Visual FoxPro DBF, 1 record * 57, update-date 17-10-19, codepage ID=0x3, at offset 456 1st record "distfiles 2 "
FXUPersist.XML7fc4c535134a7d8b822f8c04284eceb6XML document, ASCII text, with CRLF line terminators
FXUPersistGetTemplate.XML70bab0f21dd867b555b8375dfa815ba0XML document, ASCII text, with CRLF line terminators
FXUResults.CDXef82aff0994c2193408edaef0683d911xBase compound index, index options (0xe0, compact format, structure), index signature 1, sort order 0, expression length 1
FXUResults.DBF51810ba0b676558d711385df4fa964b1Visual FoxPro DBF, 22 records * 393, update-date 21-8-27, codepage ID=0x3, with index file .MDX, with memo .FPT, at offset 616 1st record "WebConnectionConfigurationTests C:\webconnection\"
FXUResults.FPTe3813cfd75a6f4f4c96d46feb6b1c1e9Adobe Photoshop Color swatch, version 0, 64 colors; 1st RGB space (0), w 0x40, x 0, y 0, z 0; 2nd RGB space (0), w 0, x 0, y 0, z 0
markdownparserTests.PRGc289ded441e37b2a56d77876ce375074HTML document, ASCII text, with CRLF line terminators
SailBig.jpgd41d8cd98f00b204e9800998ecf8427e
SAILBIG_DOWNLOADED.JPGd41d8cd98f00b204e9800998ecf8427e
test.prga1b70189e17ec8cca3aee471365c9edfASCII text, with CRLF line terminators
test.wcsffacad16cb0261bfbd05d3f3a1e3747fASCII text, with CR line terminators
wwCollectionsTest.prga11e7ce11a35c1f39cd0fbd596201119ASCII text, with CRLF line terminators
wwHttpTests.prgfbf67e008efbbc3e3d7241769ade4cebASCII text, with CRLF line terminators
wwJsonSerializerTests.PRG2a671db8264fc079dee8e0751e3ed598ASCII text, with CRLF line terminators
wwScriptingTests.PRG0f00a9247e90eaa21a9f7ddb514a4a13ASCII text, with CRLF line terminators
wwSFTPTests.prg2d78fb5520d5f395fa4af94abdba186cdata
wwStreamTests.PRGbad1fa012ea9a5633db8de6adc7e3013ASCII text, with CRLF line terminators
wwUserSecurityTests.PRG88ffeb98c09f130daa67e589d806bf70ASCII text, with CRLF line terminators
wwUtilsTests.PRGc303e851b45279ede7161ac93ae8beaaASCII text, with CRLF line terminators
crt_dbf.prg6d90b74550f003457ea1c4e578a6e87eASCII text, with CRLF line terminators
crt_dbf.SCTd360210e45b64983831887d4a14702c8data
crt_dbf.SCX4d3ae5ad1f52c081249369f6578a078dVisual FoxPro DBF, 12 records * 109, update-date 06-10-26, codepage ID=0x3, with memo .FPT, at offset 1032 1st record "COMMENT Screen "
getconstants.exe84d0e93f77a1d6c24ce2647e45d94628PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
log4net.dll5f3bd963f02108c36592b5728fa725c5PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
readme.rtfa776c1e29e8ec3da2ec6f0c9df633533Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Reflector.exe143f2dea68a725eab4f51c7c433847f5PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
Reflector.exe.configb8b115a63c9368a5ff56f0bead67be64XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
wrapper.exee16174685f1d9a7e23ec252a4bc077cbPE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
wwDialogs.VCTe020a80d9be19e6704717fd66712a4a1data
wwdialogs.vcx38a2a89bf4f9afe116d3ea72ad660532Visual FoxPro DBF, 30 records * 109, update-date 09-5-26, codepage ID=0x3, with memo .FPT, at offset 1032 1st record "COMMENT Class "
wwResponse.PRG1fdc983dea4c7d9fd70916cd419b00deASCII text, with CRLF line terminators
wwResponseString.PRGdd8f68c85980d789cd035487af388ee6ASCII text, with CRLF line terminators
wwShowCursor.PRGea3967ec1b60b423bedf18ea34d71293ASCII text, with very long lines (309), with CRLF line terminators
wwTypeLib.VCT8164ae29355b612d12ea5e523d9e18ecdata
wwtypelib.vcxc2cdfa72f558ecf56bc66febdcbb1939Visual FoxPro DBF, 11 records * 109, update-date 02-1-10, codepage ID=0x3, with memo .FPT, at offset 1032 1st record "COMMENT Class "
wconnect.hf9993f9a3025b3db5cbaa66cdaaf9ae1ASCII text, with CRLF line terminators
wwclient.app8bfb8fd9463f2c5d780183b84da18a41data
wwclient.chmdb8ed3bb00563a46a5f4a65b8e8de779MS Windows HtmlHelp Data
wwClient_console.app53e81a0ed1a3570a2aa29040e7ca7a7fdata
wwDotNetBridge.dll6610cb2808ce5f5e0ea41fc8dc6223e0PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
wwDotNetBridge_XP.dll0df0dbbf03415fec9c8a3034b2e6d735PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
wwimaging.dllde5051e4cd58b1f439058fdc3c324073PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections
wwipstuff.dllfabb3b8b081a09adae66b1689d4b525ePE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections
zlib1.dllb8a9e91134e7c89440a0f95470d5e47bPE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows, 10 sections
_Getting Started with West Wind Client Tools.url50c61e853377284b5ac11ea228b3e931MS Windows 95 Internet shortcut text (URL=<https://client-tools.west-wind.com/docs/_0lh115ju8.htm>), ASCII text, with CRLF line terminators
_Open-VisualFoxPro-IDE-Here.ps185d7eb219c08827ddbbae0cb5cc7b8f6ASCII text, with CRLF line terminators
_Quick Start Internet Tools Examples.urlf0759b93179df71767578235c17b4ab4MS Windows 95 Internet shortcut text (URL=<https://client-tools.west-wind.com/docs/_s9001zxi9.htm>), ASCII text, with CRLF line terminators
_test-wwdotnetbridge.prg1ab6afa685b515b54e04b23356097d6bASCII text, with CRLF line terminators
_West WindClient Tools Documentation.url6733b194bd10b2dbd20e7c91098860b6MS Windows 95 Internet shortcut text (URL=<https://client-tools.west-wind.com/docs>), ASCII text, with CRLF line terminators
_What's new - West Wind Client Tools.urlc684c321ae86dd850db80946724b34a3MS Windows 95 Internet shortcut text (URL=<https://client-tools.west-wind.com/docs/_0su1f0xyd.htm>), ASCII text, with CRLF line terminators
__IMPORTANT_Shareware Version - PLEASE READ.urle4b02da6c179fc24b32f4bfc00ab1d2fMS Windows 95 Internet shortcut text (URL=<https://client-tools.west-wind.com/docs/_51f1bswlk.htm>), ASCII text, with CRLF line terminators

Detections

AnalyzerVerdictAlert
YARAhub by abuse.chmalware
files - file ~tmp01925d3f.exe
YARAhub by abuse.chmalware
pe_detect_tls_callbacks
YARAhub by abuse.chmalware
files - file ~tmp01925d3f.exe
YARAhub by abuse.chmalware
pe_detect_tls_callbacks
YARAhub by abuse.chmalware
pe_detect_tls_callbacks

JavaScript (0)

HTTP Transactions (1)

URLIPResponseSize
GET west-wind.com/files/wwclient.zip
149.28.15.235200 OK6.5 MB