Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
httrack_x64-3.49.2.exe

Overview

General Information

Sample name:httrack_x64-3.49.2.exe
Analysis ID:1467144
MD5:2e1d04910dfaa3170b66b94b9d44d56a
SHA1:019b8b956910529218e92f2a92b14cd159e82095
SHA256:ce12f0e0cd3a3807463c8c538808d613798b11d961a94eabf0ba9d67851106f3
Infos:

Detection

Score:6
Range:0 - 100
Whitelisted:false
Confidence:0%

Signatures

Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to launch a program with higher privileges
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query locales information (e.g. system language)
Contains functionality to record screenshots
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Detected potential crypto function
Drops PE files
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain (date check)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
PE file contains executable resources (Code or Archives)
Potential key logger detected (key state polling based)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • httrack_x64-3.49.2.exe (PID: 6432 cmdline: "C:\Users\user\Desktop\httrack_x64-3.49.2.exe" MD5: 2E1D04910DFAA3170B66B94B9D44D56A)
    • httrack_x64-3.49.2.tmp (PID: 6476 cmdline: "C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp" /SL5="$20412,4225024,60416,C:\Users\user\Desktop\httrack_x64-3.49.2.exe" MD5: BE92B50BF16F68E185DF0AD85936EE03)
      • WinHTTrack.exe (PID: 1396 cmdline: "C:\Program Files\WinHTTrack\WinHTTrack.exe" MD5: 1222165410734DB4A128E0B6F37EB89C)
      • notepad.exe (PID: 6104 cmdline: "C:\Windows\notepad.exe" C:\Program Files\WinHTTrack\history.txt MD5: 27F71B12CB585541885A31BE22F61C83)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: httrack_x64-3.49.2.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrackJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\unins000.datJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\is-G01MI.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\htmlJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-0PTKM.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-I623L.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-GOS7L.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-16PQ1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-61SD2.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-LJR0H.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-1UK74.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-HMR29.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-1THD9.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-5EDKI.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-K81A9.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-RRCD1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-OQNA2.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-J7N7G.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-0EDNS.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-OHOS2.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-G5TC6.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-TUS52.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-DH7AM.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-V9TL3.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-SCDGC.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-UB5T0.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-CCLHE.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-6NO1S.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-HJI7C.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-0G133.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-LTFET.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-H5JG7.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-GKSLV.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-A9RF2.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-91HPQ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-ONNHP.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-HFAKT.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-M41SM.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-E5KSU.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-MGLSD.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-KTCGT.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-H7UBN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-DG2N0.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\divJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\div\is-86O9O.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\imagesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\images\is-F0BAO.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\images\is-LKLVS.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\images\is-DOCQP.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\images\is-VQENL.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\imgJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-3GEN5.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-UG70T.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-OS2F1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-GTT7P.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-M22US.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-V16QJ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-C06EE.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-MT9VU.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-NFUUM.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-B1VSM.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-0G57R.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-NOB9S.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-1QA7B.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-8SFQT.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-39ATU.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-ESLJA.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-SB2TI.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-BV5D0.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-O3P7F.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-JH9E1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-9F3Q4.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-VQUEO.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-E7TF7.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-M31FO.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-7KA9O.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-IQ5VT.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-K16JT.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-O20I8.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-MSSD6.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-O0I46.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-UTR8A.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-9VVJ8.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-SNEP7.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-0423B.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-5BFJ5.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-2VRKH.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-7CAMJ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\serverJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-GES95.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-G0RF7.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-D63RQ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-QFK21.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-7QC5C.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-G4GB8.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-AQ7IS.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-M8FCA.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-8J0BM.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-G0F9U.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-V947E.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-IT7Q5.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-7L8JU.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-RIV24.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-FOJB9.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-HKL4A.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-7JJPQ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-6C1UG.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-MROK4.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-CS1NI.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-FLDT2.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-S8BTQ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-EOFRO.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-P2GKL.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\imagesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\images\is-LUU1F.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\images\is-IOOIR.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\images\is-TDQVS.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\sfxJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\sfx\is-FP3GA.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\sfx\is-SI4EP.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\templatesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\templates\is-O714A.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\templates\is-MBG29.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\templates\is-680JA.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\templates\is-8OOGN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\templates\is-67ID0.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\templates\is-DA78M.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\templates\is-P8OQC.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\langJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-476N1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-582RK.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-TL8SS.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-VLDM8.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-V8ELG.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-MB8IV.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-HKRCI.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-SSNBO.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-K313S.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-11F9P.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-T9H9H.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-LBAJH.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-I6TTS.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-AEEAO.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-88N9G.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-DPUQD.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-1KI38.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-3BUKN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-AA268.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-7GK14.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-LCLNP.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-2PGQC.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-5LSTG.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-IEOSD.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-CPA37.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-A932F.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-J4MH1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-N8GL1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-AVNH9.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-PON7P.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-QVG6I.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-28P7N.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtestJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtest\is-KBBHN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtest\is-098P1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtest\is-UHB7R.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtest\is-18H57.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtest\is-91MOA.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtest\is-V22P0.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtest\is-TPN2M.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtest\is-DATIA.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtest\is-SFASP.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtest\is-SHLUD.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtest\is-CFV8O.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtest\is-2EG7O.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtest\is-GTOQT.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtest\is-CREK1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtest\is-I7PFS.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtest\is-E3DI8.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtest\is-72EIE.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\srcJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-T2AOJ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-P6JHN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-6MIIJ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-OML73.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-N0FUS.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-MQ1C4.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-51QTG.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-U8F0K.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-QS1DK.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-1VB0O.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-1H6RN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-6KLAQ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-K8LVH.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-IBQLD.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-UD1A1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-GPMLD.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-O6E3E.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-C6AJR.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-GP5P6.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-UJKK4.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-1D9S1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-41J9P.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-1P6DT.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-0H1UN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-8LV02.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-E7P90.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-99I0V.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-1H0GV.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-UFEQA.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-L6R77.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-BTPV3.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-2PVAK.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-JHS9G.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-QDVU7.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-DJO91.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-UPOFD.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-5U20D.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-DC4BN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-IBLJI.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-IUF72.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-FQ85O.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-BV9HG.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-ELF7E.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-NODTC.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-TRQKA.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-852L9.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-H2T1C.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-ML423.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-QDUQR.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-LS30R.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-MENI5.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-L348T.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-359S1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-D6C1T.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-28TUG.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-KF29L.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-6GMEN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-JSRA8.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-SNRV5.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-E9H01.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-EMQTJ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-A3OFJ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-VUG0T.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-S60BP.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-7GV7D.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-TG3BN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-5NH4G.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-32RGM.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-KIIUU.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-EE1SB.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-FLKUL.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-1A6MG.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-LE3AT.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-QOE38.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-AOLO5.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-6RT8U.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-T6H63.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-9H465.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-O7ODN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-7GFNO.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-AU6V7.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-RAGER.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-D0IG3.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-U51MN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-OIEP2.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-AHTB1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-1BG43.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-107TJ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-TK8AC.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-FB1CG.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-I4Q2C.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-E0683.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-BDUTR.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-2CD8V.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-TARNO.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-V1DLV.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-G5VIA.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-2CPQ7.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-B194V.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-TEQB0.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-MEEQF.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\coucalJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\coucal\is-7HLTV.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\coucal\is-SP4UO.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\coucal\is-KAHEU.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\coucal\is-UHUT2.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\coucal\is-OEKM0.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\coucal\is-4E6DS.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\coucal\is-8VVDG.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\coucal\is-ND5KS.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\coucal\is-S5R81.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\coucal\is-C8VF2.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizipJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-9ELME.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-45IGK.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-CPETQ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-1M2J2.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-7U8TH.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-4D4J3.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-LU355.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-S28UL.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-3BEQG.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-S30J0.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-IU7FN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-1BOAJ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-3TS94.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-116R4.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-7ULJB.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-HO93J.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-RN395.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-R79A6.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-PJV9M.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-C0CAE.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-2AGUA.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-DI1IV.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-EOSGJ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-3VHJR.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-BEBGB.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-4G6S7.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-FLP9N.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-CPD8I.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-VLGB1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-G440K.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-U93QS.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-03U5C.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-72HU4.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-N2DF1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\proxyJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\proxy\is-B0QDQ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\proxy\is-K6JR1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\proxy\is-T3LTB.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\proxy\is-NTNA4.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\proxy\is-HKPG8.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\proxy\is-PUKE8.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\proxy\is-D7J0E.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\proxy\is-MFB8L.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\proxy\is-HI9JV.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\proxy\is-4O2NQ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_winJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\is-VRF36.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\is-QCULD.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\htsswfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\htsswf\is-T8DEM.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\htsswf\is-5C44E.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\htsswf\is-71T5B.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\htsswf\is-CR8F3.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\htsswf\is-45FQ6.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\htsswf\is-9K6KS.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\htsswf\is-2IRAK.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\htsswf\is-ADN8G.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\htsswf\swfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\htsswf\swf\is-2LHK6.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\InnoSetupJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\InnoSetup\is-Q26TT.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\InnoSetup\is-QKGQP.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\InnoSetup\is-7378B.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\libhttrackJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\libhttrack\is-BHNUF.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\libhttrack\is-NDM89.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\libhttrack\is-OTC1J.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\libhttrack\is-9FO9D.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\libhttrack\is-6GPUO.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\libhttrack\is-160GN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\libhttrack\is-FF0EQ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\libhttrack\is-B33QE.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\libhttrack\is-78EUQ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrackJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-MPI80.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-4Q4M4.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-ISIU4.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-8FSCC.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-D1UIR.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-4RGFC.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-7RKBA.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-UJ3P7.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-P55A0.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-U1QM8.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-0TICM.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-T7GR2.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-QROQ8.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-QCNAG.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-VO910.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-JH7BM.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-NC44B.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-BKLFT.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-C1RR1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-A9H8Q.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-UAGT0.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-ABTE7.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-CLC1G.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-NMCK7.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-QEDD0.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-F8EH5.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-44EF6.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-42PJK.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-NCIH2.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-M6T8F.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-U61IQ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-388GQ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-E69PU.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-2MH7U.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-3I3F5.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-DP7PG.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-HTJCE.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-4U37A.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-HQ7QV.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-DSHVF.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-TUC17.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-79R2A.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-SFE0U.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-R9ROE.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-FCJ53.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-JIDOM.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-54MVT.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-9N1U6.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-R7GOQ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-7CRE7.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-VURAI.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-L6NEE.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-QHRH3.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-NJDAL.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-2117L.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-07JAV.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-EEUMN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-9NJPN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-V6IHV.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-UKUPG.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-5506D.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-JD4B5.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-4PIO7.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-H833P.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-HK6GT.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-MTNIO.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-6MKT6.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-TANNK.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-FIUR0.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-SM787.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-SDHNJ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-JQG6M.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-KV2TE.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-GSC7B.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-JETI7.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-3DA6Q.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-QJV4U.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-KTSFS.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-4MUBP.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-P6RHL.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-DLOI9.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-S895H.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-251N2.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-RF052.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-31IQ6.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-JPSG2.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-QGIQQ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-HP82M.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-EIM5D.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-RRNR8.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-OAGHN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-MD5GB.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-7CLGN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-3KHMR.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-9S3AK.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-JVQNP.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-AQKCS.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-U4JMI.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-7IJ87.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-RE86N.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-NJCUJ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-FQOI5.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-M7U18.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-58QEU.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-2ILUL.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-SIA5D.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-AOD0G.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-PVO65.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-EN8PP.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-59VG2.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-SLB4M.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-50G65.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-PM7GN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-D3QLR.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-T4R0J.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-TK7CL.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-MJ2O8.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-4U6UG.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-FUCQU.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-PF6RE.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-OCVP4.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-5LMLQ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\resJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\is-BKKEG.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\is-419O7.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\is-LGUG2.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\is-801BH.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\is-ERVA1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\is-UNBCP.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\is-M0VDR.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\is-HG1JB.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\is-VUAG7.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\is-KTL6R.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinHTTrack Website Copier_is1Jump to behavior
Source: httrack_x64-3.49.2.exeStatic PE information: certificate valid
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_08e1c10da83fbc83\MSVCR90.dllJump to behavior
Source: Binary string: O:\HTTrack\httrack\x64\httrack.pdb source: is-SUP1E.tmp.1.dr
Source: Binary string: ProgramDatabaseFile="$(OutDir)/htsjava.pdb" source: is-TRQKA.tmp.1.dr
Source: Binary string: ProgramDatabaseFile="O:\HTTrack\httrack\htsjava.pdb" source: is-TRQKA.tmp.1.dr
Source: Binary string: ProgramDatabaseFile="O:\HTTrack\httrack\x64\proxytrack.pdb" source: is-MFB8L.tmp.1.dr
Source: Binary string: Source: "O:\HTTrack\httrack\*.*"; Excludes: "*.pdb,*.ncb"; DestDir: "{app}"; CopyMode: alwaysoverwrite source: is-QKGQP.tmp.1.dr
Source: Binary string: ProgramDatabaseFile=".\Release_avec_debug/httrack.pdb" source: is-D0IG3.tmp.1.dr
Source: Binary string: ProgramDatabaseFile="O:\HTTrack\httrack\proxytrack.pdb" source: is-MFB8L.tmp.1.dr
Source: Binary string: O:\HTTrack\httrack\x64\webhttrack.pdb source: is-7UNFS.tmp.1.dr
Source: Binary string: msvcr90.amd64.pdb source: is-C2PFI.tmp.1.dr
Source: Binary string: D:\CFILES\Projects\WinSSL\openssl-1.0.1j\out32dll\ssleay32.pdb! source: WinHTTrack.exe, 00000006.00000002.2899960031.000000000081C000.00000002.00000001.01000000.0000000D.sdmp, is-EGSJE.tmp.1.dr, is-NKRDO.tmp.1.dr
Source: Binary string: ProgramDatabaseFile="C:\temp\Debuglib/libhttrack.pdb" source: is-AHTB1.tmp.1.dr
Source: Binary string: O:\HTTrack\httrack\x64\libhttrack.pdb source: WinHTTrack.exe, 00000006.00000002.2901717260.000000018008D000.00000002.00000001.01000000.0000000A.sdmp, is-2D1ET.tmp.1.dr
Source: Binary string: ProgramDatabaseFile="O:\HTTrack\httrack\x64\httrack.pdb" source: is-D0IG3.tmp.1.dr
Source: Binary string: ProgramDatabaseFile="O:\HTTrack\httrack\libhttrack.pdb" source: is-AHTB1.tmp.1.dr
Source: Binary string: ProgramDatabaseFile=".\Debug/httrack.pdb" source: is-D0IG3.tmp.1.dr
Source: Binary string: ProgramDatabaseFile="O:\HTTrack\httrack\httrack.pdb" source: is-D0IG3.tmp.1.dr
Source: Binary string: O:\HTTrack\httrack\x64\proxytrack.pdb source: is-UUKLU.tmp.1.dr
Source: Binary string: ProgramDatabaseFile=".\Release/htsswf.pdb" source: is-45FQ6.tmp.1.dr
Source: Binary string: rm -f *.o *.obj *.so* *.dll *.exe *.pdb *.exp *.lib sample tests source: is-UHUT2.tmp.1.dr
Source: Binary string: mfc90.amd64.pdb source: httrack_x64-3.49.2.tmp, 00000001.00000003.1998064070.0000000005E4B000.00000004.00001000.00020000.00000000.sdmp, WinHTTrack.exe, 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmp, is-4BTMC.tmp.1.dr
Source: Binary string: ProgramDatabaseFile="O:\HTTrack\httrack\x64\htsjava.pdb" source: is-TRQKA.tmp.1.dr
Source: Binary string: D:\CFILES\Projects\WinSSL\openssl-1.0.1j\out32dll\ssleay32.pdb source: WinHTTrack.exe, 00000006.00000002.2899960031.000000000081C000.00000002.00000001.01000000.0000000D.sdmp, is-EGSJE.tmp.1.dr, is-NKRDO.tmp.1.dr
Source: Binary string: ProgramDatabaseFile="O:\HTTrack\httrack\x64\libhttrack.pdb" source: is-AHTB1.tmp.1.dr
Source: Binary string: ProgramDatabaseFile=".\Debug/htsswf.pdb" source: is-45FQ6.tmp.1.dr
Source: Binary string: D:\CFILES\Projects\WinSSL\openssl-1.0.1j\out32dll\libeay32.pdb source: WinHTTrack.exe, 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: O:\HTTrack\httrack\x64\WinHTTrack.pdb source: httrack_x64-3.49.2.tmp, 00000001.00000003.1998064070.0000000005DB0000.00000004.00001000.00020000.00000000.sdmp, WinHTTrack.exe, 00000006.00000000.1995929747.0000000140056000.00000002.00000001.01000000.00000009.sdmp, WinHTTrack.exe, 00000006.00000002.2901555496.0000000140056000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: ProgramDatabaseFile="$(OutDir)/proxytrack.pdb" source: is-MFB8L.tmp.1.dr
Source: Binary string: O:\HTTrack\httrack\x64\htsswf.pdb source: is-6RASL.tmp.1.dr
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_00452A60 FindFirstFileA,GetLastError,1_2_00452A60
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_0047531C FindFirstFileA,FindNextFileA,FindClose,1_2_0047531C
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_00464158 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,1_2_00464158
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_004985E4 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,1_2_004985E4
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_00462750 FindFirstFileA,FindNextFileA,FindClose,1_2_00462750
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_00463CDC SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,1_2_00463CDC
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00845300 _errno,_errno,malloc,memset,malloc,calloc,free,free,_errno,MultiByteToWideChar,FindFirstFileW,free,free,free,_errno,FindNextFileW,WideCharToMultiByte,_errno,6_2_00845300
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_66586124 GetFullPathNameA,_mbsnbcpy_s,strlen,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlenA,strcpy_s,strlen,6_2_66586124
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_66588BC4 lstrlenA,FindFirstFileA,FindClose,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,6_2_66588BC4
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008943E0 WSASetLastError,recv,WSAGetLastError,6_2_008943E0
Source: is-HMR29.tmp.1.drString found in binary or memory: ftp://ftp.shoesizes.com)
Source: is-1UK74.tmp.1.drString found in binary or memory: ftp://ftp.someweb.com
Source: httrack_x64-3.49.2.tmp, 00000001.00000003.1998064070.0000000005E4B000.00000004.00001000.00020000.00000000.sdmp, WinHTTrack.exe, 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmp, is-4BTMC.tmp.1.drString found in binary or memory: ftp://http://HTTP/1.0
Source: is-JSRA8.tmp.1.drString found in binary or memory: http://..
Source: is-1B14P.tmp.1.drString found in binary or memory: http://all.net/
Source: httrack_x64-3.49.2.exe, is-G01MI.tmp.1.dr, httrack_x64-3.49.2.tmp.0.dr, is-6RASL.tmp.1.dr, is-7UNFS.tmp.1.dr, is-UUKLU.tmp.1.drString found in binary or memory: http://crl.certum.pl/cscasha2.crl0q
Source: httrack_x64-3.49.2.exe, is-G01MI.tmp.1.dr, httrack_x64-3.49.2.tmp.0.dr, is-6RASL.tmp.1.dr, is-7UNFS.tmp.1.dr, is-UUKLU.tmp.1.drString found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: httrack_x64-3.49.2.exe, is-G01MI.tmp.1.dr, httrack_x64-3.49.2.tmp.0.dr, is-6RASL.tmp.1.dr, is-7UNFS.tmp.1.dr, is-UUKLU.tmp.1.drString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: httrack_x64-3.49.2.exe, is-G01MI.tmp.1.dr, httrack_x64-3.49.2.tmp.0.dr, is-6RASL.tmp.1.dr, is-7UNFS.tmp.1.dr, is-UUKLU.tmp.1.drString found in binary or memory: http://cscasha2.ocsp-certum.com04
Source: httrack_x64-3.49.2.exe, 00000000.00000003.1657471855.0000000002340000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.exe, 00000000.00000003.1657540599.0000000002111000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.exe, 00000000.00000003.2008106386.0000000002110000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1998064070.0000000005DB0000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1983777861.00000000022B4000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.2002783477.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1659068157.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1967871818.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1658998958.0000000003230000.00000004.00001000.00020000.00000000.sdmp, WinHTTrack.exe, WinHTTrack.exe, 00000006.00000000.1995929747.0000000140056000.00000002.00000001.01000000.00000009.sdmp, WinHTTrack.exe, 00000006.00000002.2901717260.000000018008D000.00000002.00000001.01000000.0000000A.sdmp, WinHTTrack.exe, 00000006.00000002.2901555496.0000000140056000.00000002.00000001.01000000.00000009.sdmp, is-T7GR2.tmp.1.dr, is-O7ODN.tmp.1.dr, is-2D1ET.tmp.1.dr, is-SUP1E.tmp.1.dr, is-61SD2.tmp.1.dr, is-QKGQP.tmp.1.drString found in binary or memory: http://forum.httrack.com
Source: httrack_x64-3.49.2.exe, 00000000.00000003.1657540599.0000000002111000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.exe, 00000000.00000003.2008106386.0000000002110000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1983777861.00000000022B4000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.2002783477.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1659068157.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1967871818.00000000022B8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://forum.httrack.com.
Source: httrack_x64-3.49.2.tmp, 00000001.00000003.2003755226.000000000079C000.00000004.00000020.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.2001107389.0000000000789000.00000004.00000020.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.2001063937.000000000076F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://forum.httrack.comy
Source: httrack_x64-3.49.2.exe, 00000000.00000003.1657471855.0000000002340000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.exe, 00000000.00000003.2008134065.0000000002118000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1888716917.0000000000785000.00000004.00000020.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.2002242297.000000000076E000.00000004.00000020.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1983777861.00000000022B4000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.2002783477.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1713705828.0000000000782000.00000004.00000020.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1659068157.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1967871818.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1658998958.0000000003230000.00000004.00001000.00020000.00000000.sdmp, is-V2QNV.tmp.1.dr, is-6KT95.tmp.1.dr, is-O26L8.tmp.1.dr, is-T3LTB.tmp.1.dr, is-BHNUF.tmp.1.drString found in binary or memory: http://fsf.org/
Source: is-UPOFD.tmp.1.drString found in binary or memory: http://gcc.gnu.org/wiki/Visibility
Source: is-HMR29.tmp.1.drString found in binary or memory: http://httrack.free.fr/HelpHtml/addurl.html
Source: is-T7GR2.tmp.1.drString found in binary or memory: http://jpassing.com/2008/03/12/walking-the-stack-of-the-current-thread/
Source: is-1B14P.tmp.1.drString found in binary or memory: http://kauler.com/
Source: is-T9H9H.tmp.1.drString found in binary or memory: http://koti.mbnet.fi/kahoset
Source: is-1B14P.tmp.1.drString found in binary or memory: http://nbenoit.tuxfamily.org/
Source: httrack_x64-3.49.2.exe, is-G01MI.tmp.1.dr, httrack_x64-3.49.2.tmp.0.dr, is-6RASL.tmp.1.dr, is-7UNFS.tmp.1.dr, is-UUKLU.tmp.1.drString found in binary or memory: http://ocsp.thawte.com0
Source: is-852L9.tmp.1.drString found in binary or memory: http://physics.nist.gov/cuu/Units/binary.html
Source: is-QVG6I.tmp.1.drString found in binary or memory: http://programy.com.ua
Source: is-1B14P.tmp.1.drString found in binary or memory: http://programy.com.ua)
Source: httrack_x64-3.49.2.exe, is-G01MI.tmp.1.dr, httrack_x64-3.49.2.tmp.0.dr, is-6RASL.tmp.1.dr, is-7UNFS.tmp.1.dr, is-UUKLU.tmp.1.drString found in binary or memory: http://repository.certum.pl/cscasha2.cer0
Source: httrack_x64-3.49.2.exe, is-G01MI.tmp.1.dr, httrack_x64-3.49.2.tmp.0.dr, is-6RASL.tmp.1.dr, is-7UNFS.tmp.1.dr, is-UUKLU.tmp.1.drString found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: is-LU355.tmp.1.dr, is-7ULJB.tmp.1.dr, is-03U5C.tmp.1.dr, is-3BEQG.tmp.1.dr, is-EOSGJ.tmp.1.dr, is-VLGB1.tmp.1.dr, is-U93QS.tmp.1.dr, is-1BOAJ.tmp.1.dr, is-1M2J2.tmp.1.dr, is-S30J0.tmp.1.dr, is-N2DF1.tmp.1.drString found in binary or memory: http://result42.com
Source: is-T7GR2.tmp.1.drString found in binary or memory: http://stackoverflow.com/questions/9355/programatically-select-multiple-files-in-windows-explorer
Source: httrack_x64-3.49.2.exe, is-G01MI.tmp.1.dr, httrack_x64-3.49.2.tmp.0.dr, is-6RASL.tmp.1.dr, is-7UNFS.tmp.1.dr, is-UUKLU.tmp.1.drString found in binary or memory: http://subca.ocsp-certum.com01
Source: httrack_x64-3.49.2.exe, is-G01MI.tmp.1.dr, httrack_x64-3.49.2.tmp.0.dr, is-6RASL.tmp.1.dr, is-7UNFS.tmp.1.dr, is-UUKLU.tmp.1.drString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: httrack_x64-3.49.2.exe, is-G01MI.tmp.1.dr, httrack_x64-3.49.2.tmp.0.dr, is-6RASL.tmp.1.dr, is-7UNFS.tmp.1.dr, is-UUKLU.tmp.1.drString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: httrack_x64-3.49.2.exe, is-G01MI.tmp.1.dr, httrack_x64-3.49.2.tmp.0.dr, is-6RASL.tmp.1.dr, is-7UNFS.tmp.1.dr, is-UUKLU.tmp.1.drString found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: is-QVG6I.tmp.1.drString found in binary or memory: http://vic-info.com.ua
Source: is-QVG6I.tmp.1.drString found in binary or memory: http://vic-info.com.ua)
Source: is-32RGM.tmp.1.drString found in binary or memory: http://www..)
Source: is-852L9.tmp.1.drString found in binary or memory: http://www.adr.dom
Source: is-HMR29.tmp.1.drString found in binary or memory: http://www.all.net/
Source: is-HMR29.tmp.1.drString found in binary or memory: http://www.all.net/bar/
Source: is-HMR29.tmp.1.drString found in binary or memory: http://www.all.net/bar/blue.jpg)
Source: is-HMR29.tmp.1.drString found in binary or memory: http://www.all.net/foo.cgi?id=1
Source: is-HMR29.tmp.1.drString found in binary or memory: http://www.all.net/foo/
Source: is-M41SM.tmp.1.drString found in binary or memory: http://www.awondefulsite.com/images/landscapes/bluewater.jpg
Source: is-M41SM.tmp.1.drString found in binary or memory: http://www.awondefulsite.com/mike/index/index.html
Source: httrack_x64-3.49.2.exe, is-G01MI.tmp.1.dr, httrack_x64-3.49.2.tmp.0.dr, is-6RASL.tmp.1.dr, is-7UNFS.tmp.1.dr, is-UUKLU.tmp.1.drString found in binary or memory: http://www.certum.pl/CPS0
Source: is-1B14P.tmp.1.drString found in binary or memory: http://www.ducrot.org/
Source: is-1B14P.tmp.1.drString found in binary or memory: http://www.ensicaen.fr/
Source: is-852L9.tmp.1.drString found in binary or memory: http://www.foo.com?bar=1
Source: is-1UK74.tmp.1.drString found in binary or memory: http://www.foobar.com/
Source: WinHTTrack.exe, WinHTTrack.exe, 00000006.00000002.2901717260.000000018008D000.00000002.00000001.01000000.0000000A.sdmp, is-IBLJI.tmp.1.dr, is-2D1ET.tmp.1.dr, is-K81A9.tmp.1.drString found in binary or memory: http://www.foobar.com/folder/foo.cgi?q=45
Source: WinHTTrack.exe, WinHTTrack.exe, 00000006.00000002.2901717260.000000018008D000.00000002.00000001.01000000.0000000A.sdmp, is-IBLJI.tmp.1.dr, is-2D1ET.tmp.1.dr, is-K81A9.tmp.1.drString found in binary or memory: http://www.foobar.com/folder/foo4B54.html?q=45
Source: is-1UK74.tmp.1.drString found in binary or memory: http://www.foobar.com/index.html
Source: is-BHNUF.tmp.1.dr, is-JHS9G.tmp.1.dr, is-1H0GV.tmp.1.dr, is-AOLO5.tmp.1.dr, is-FQ85O.tmp.1.dr, is-6RT8U.tmp.1.dr, is-99I0V.tmp.1.dr, is-4O2NQ.tmp.1.dr, is-QOE38.tmp.1.dr, is-1A6MG.tmp.1.dr, is-1VB0O.tmp.1.dr, is-LS30R.tmp.1.dr, is-QS1DK.tmp.1.dr, is-32RGM.tmp.1.dr, is-6MIIJ.tmp.1.dr, is-VUG0T.tmp.1.dr, is-LE3AT.tmp.1.dr, is-IBQLD.tmp.1.dr, is-852L9.tmp.1.drString found in binary or memory: http://www.gnu.org/licenses/
Source: is-1UK74.tmp.1.drString found in binary or memory: http://www.gnu.org/licenses/gpl.txt
Source: httrack_x64-3.49.2.exe, 00000000.00000003.1657471855.0000000002340000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.exe, 00000000.00000003.2008134065.0000000002118000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1713688230.000000000078E000.00000004.00000020.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1983777861.00000000022B4000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.2002783477.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.2001063937.000000000076F000.00000004.00000020.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1659068157.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1967871818.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1658998958.0000000003230000.00000004.00001000.00020000.00000000.sdmp, is-V2QNV.tmp.1.dr, is-6KT95.tmp.1.dr, is-O26L8.tmp.1.dr, is-T3LTB.tmp.1.dr, is-BHNUF.tmp.1.drString found in binary or memory: http://www.gnu.org/philosophy/why-not-lgpl.html
Source: is-1B14P.tmp.1.drString found in binary or memory: http://www.greyc.ensicaen.fr/~dcarre/
Source: is-GOS7L.tmp.1.drString found in binary or memory: http://www.gzip.org/zlib/
Source: is-UPOFD.tmp.1.dr, is-H2T1C.tmp.1.dr, is-IBLJI.tmp.1.dr, is-D7J0E.tmp.1.dr, is-PUKE8.tmp.1.dr, is-1P6DT.tmp.1.dr, is-GP5P6.tmp.1.dr, is-OML73.tmp.1.dr, is-A3OFJ.tmp.1.dr, is-9H465.tmp.1.dr, is-K8LVH.tmp.1.dr, is-O7ODN.tmp.1.dr, is-QDVU7.tmp.1.dr, is-U8F0K.tmp.1.dr, is-41J9P.tmp.1.dr, is-KF29L.tmp.1.dr, is-GPMLD.tmp.1.dr, is-28TUG.tmp.1.dr, is-UFEQA.tmp.1.dr, is-QDUQR.tmp.1.dr, is-MPI80.tmp.1.drString found in binary or memory: http://www.httrack.com
Source: httrack_x64-3.49.2.exe, is-G01MI.tmp.1.dr, is-1BG43.tmp.1.dr, httrack_x64-3.49.2.tmp.0.dr, is-61SD2.tmp.1.dr, is-OHOS2.tmp.1.dr, is-QKGQP.tmp.1.drString found in binary or memory: http://www.httrack.com/
Source: is-KAHEU.tmp.1.dr, is-P6JHN.tmp.1.dr, is-T2AOJ.tmp.1.dr, is-SP4UO.tmp.1.drString found in binary or memory: http://www.httrack.com/)
Source: is-K81A9.tmp.1.drString found in binary or memory: http://www.httrack.com/html/
Source: is-GOS7L.tmp.1.drString found in binary or memory: http://www.httrack.com/html/cache.html
Source: is-GOS7L.tmp.1.drString found in binary or memory: http://www.httrack.com/html/fade.gif
Source: is-K81A9.tmp.1.drString found in binary or memory: http://www.httrack.com/html/faq.html
Source: is-GOS7L.tmp.1.drString found in binary or memory: http://www.httrack.com/html/images/bg_rings.gif
Source: is-GOS7L.tmp.1.drString found in binary or memory: http://www.httrack.com/html/images/header_title_4.gif
Source: httrack_x64-3.49.2.exe, 00000000.00000003.1657471855.0000000002340000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.exe, 00000000.00000003.1657540599.0000000002111000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.exe, 00000000.00000003.2008106386.0000000002110000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1983777861.00000000022B4000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.2002783477.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1659068157.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1967871818.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1658998958.0000000003230000.00000004.00001000.00020000.00000000.sdmp, is-QKGQP.tmp.1.drString found in binary or memory: http://www.httrack.com/page/2/
Source: is-GOS7L.tmp.1.drString found in binary or memory: http://www.httrack.com/robots.txt
Source: is-UPOFD.tmp.1.drString found in binary or memory: http://www.httrack.com/update.php3?Product=HTTrack&Version=
Source: is-AQ7IS.tmp.1.drString found in binary or memory: http://www.httrack.com/update.php3?Product=HTTrack&Version=$
Source: WinHTTrack.exe, 00000006.00000002.2901555496.0000000140056000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.httrack.com/update.php3?Product=HTTrack&Version=3.49.2&VersionStr=3.49-2&Platform=%d&Lang
Source: is-7UNFS.tmp.1.drString found in binary or memory: http://www.httrack.comHTS_PLATFORMHTTRACK_AFF_VERSION3.xHTTRACK_VERSIONID3.49.2HTTRACK_VERSION3.49-2
Source: is-GOS7L.tmp.1.drString found in binary or memory: http://www.ietf.org/rfc/rfc2396.txt?number=2396
Source: is-GOS7L.tmp.1.drString found in binary or memory: http://www.ietf.org/rfc/rfc2616.txt?number=2616
Source: is-CPD8I.tmp.1.drString found in binary or memory: http://www.info-zip.org/pub/infozip/doc/
Source: is-CPD8I.tmp.1.drString found in binary or memory: http://www.info-zip.org/pub/infozip/doc/appnote-981119-iz.zip
Source: httrack_x64-3.49.2.tmp, httrack_x64-3.49.2.tmp, 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-G01MI.tmp.1.dr, httrack_x64-3.49.2.tmp.0.drString found in binary or memory: http://www.innosetup.com/
Source: is-P6JHN.tmp.1.dr, is-SP4UO.tmp.1.drString found in binary or memory: http://www.isthe.com/chongo/tech/comp/fnv/
Source: is-P6JHN.tmp.1.dr, is-SP4UO.tmp.1.drString found in binary or memory: http://www.it-c.dk/people/pagh/papers/cuckoo-jour.pdf
Source: httrack_x64-3.49.2.exeString found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline
Source: httrack_x64-3.49.2.exeString found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: is-1B14P.tmp.1.drString found in binary or memory: http://www.jrsoftware.org/isinfo.php
Source: is-2LHK6.tmp.1.drString found in binary or memory: http://www.macromedia.com/software/flash/download/search_engine/index.html
Source: is-2LHK6.tmp.1.drString found in binary or memory: http://www.macromedia.com/software/flash/download/search_engine/license2.html)
Source: is-V1DLV.tmp.1.dr, is-TARNO.tmp.1.drString found in binary or memory: http://www.nicemice.net/amc/
Source: is-V1DLV.tmp.1.dr, is-TARNO.tmp.1.drString found in binary or memory: http://www.nicemice.net/idn/
Source: WinHTTrack.exe, is-1B14P.tmp.1.drString found in binary or memory: http://www.openssl.org/
Source: WinHTTrack.exe, 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmp, WinHTTrack.exe, 00000006.00000002.2900249507.0000000000836000.00000002.00000001.01000000.0000000D.sdmp, is-EGSJE.tmp.1.dr, is-NKRDO.tmp.1.drString found in binary or memory: http://www.openssl.org/V
Source: WinHTTrack.exe, WinHTTrack.exe, 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpString found in binary or memory: http://www.openssl.org/support/faq.html
Source: WinHTTrack.exe, 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpString found in binary or memory: http://www.openssl.org/support/faq.html.
Source: is-GOS7L.tmp.1.drString found in binary or memory: http://www.pkware.com/products/enterprise/white_papers/appnote.txt
Source: httrack_x64-3.49.2.exe, 00000000.00000003.1657987229.0000000002124000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.exe, 00000000.00000003.1657848395.0000000002340000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, httrack_x64-3.49.2.tmp, 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-G01MI.tmp.1.dr, httrack_x64-3.49.2.tmp.0.drString found in binary or memory: http://www.remobjects.com/ps
Source: httrack_x64-3.49.2.exe, 00000000.00000003.1657987229.0000000002124000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.exe, 00000000.00000003.1657848395.0000000002340000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-G01MI.tmp.1.dr, httrack_x64-3.49.2.tmp.0.drString found in binary or memory: http://www.remobjects.com/psU
Source: is-HMR29.tmp.1.drString found in binary or memory: http://www.shoesizes.com
Source: is-HMR29.tmp.1.drString found in binary or memory: http://www.shoesizes.com/
Source: is-HMR29.tmp.1.drString found in binary or memory: http://www.shoesizes.com/bob/
Source: is-HMR29.tmp.1.drString found in binary or memory: http://www.shoesizes.com/othersites.html
Source: is-HMR29.tmp.1.drString found in binary or memory: http://www.somesite.com/~library/thing/thingmain.htm
Source: is-1UK74.tmp.1.drString found in binary or memory: http://www.someweb.com/bar/
Source: is-1UK74.tmp.1.drString found in binary or memory: http://www.someweb.com/bar/blue.jpg)
Source: is-1UK74.tmp.1.drString found in binary or memory: http://www.someweb.com/big/.
Source: is-1UK74.tmp.1.drString found in binary or memory: http://www.someweb.com/big/index.html
Source: is-1UK74.tmp.1.drString found in binary or memory: http://www.someweb.com/foo.asp?ts=2000/10/10
Source: is-1UK74.tmp.1.drString found in binary or memory: http://www.someweb.com/foo.cgi?id=1
Source: is-1UK74.tmp.1.drString found in binary or memory: http://www.someweb.com/foo/
Source: is-852L9.tmp.1.drString found in binary or memory: http://www.someweb.com/test.cgi?foo
Source: is-852L9.tmp.1.drString found in binary or memory: http://www.truc.fr/pub/index.html
Source: is-1P6DT.tmp.1.drString found in binary or memory: http://www.unicode.org/reports/tr28/tr28-3.html#conformance
Source: is-852L9.tmp.1.drString found in binary or memory: http://www.unicode.org/unicode/reports/tr28/
Source: is-UUKLU.tmp.1.drString found in binary or memory: http://www.winimage.com/zLibDll
Source: is-N2DF1.tmp.1.drString found in binary or memory: http://www.winimage.com/zLibDll/minizip.html
Source: is-CPD8I.tmp.1.drString found in binary or memory: http://www.winimage.com/zLibDll/unzip.htm
Source: WinHTTrack.exe, 00000006.00000002.2901717260.000000018008D000.00000002.00000001.01000000.0000000A.sdmp, is-2D1ET.tmp.1.drString found in binary or memory: http://www.winimage.com/zLibDll1.2.8
Source: is-45IGK.tmp.1.drString found in binary or memory: http://www.winzip.com/aes_info.htm
Source: is-1B14P.tmp.1.drString found in binary or memory: http://www.zlib.net/
Source: is-0PTKM.tmp.1.drString found in binary or memory: http://yourhost/email.php3?id="
Source: is-0PTKM.tmp.1.drString found in binary or memory: http://yourhost/email.php3?id=91ff1a48
Source: is-LU355.tmp.1.dr, is-S28UL.tmp.1.drString found in binary or memory: https://github.com/madler/zlib/commit/6c9bd474aa08312ef2e2e9655a80e18db24a1680#diff-d466aa66f7e453e0
Source: httrack_x64-3.49.2.exe, is-G01MI.tmp.1.dr, httrack_x64-3.49.2.tmp.0.dr, is-6RASL.tmp.1.dr, is-7UNFS.tmp.1.dr, is-UUKLU.tmp.1.drString found in binary or memory: https://www.certum.pl/CPS0
Source: httrack_x64-3.49.2.exe, is-G01MI.tmp.1.dr, httrack_x64-3.49.2.tmp.0.dr, is-6RASL.tmp.1.dr, is-7UNFS.tmp.1.dr, is-UUKLU.tmp.1.drString found in binary or memory: https://www.certum.pl/repository.0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0089CBC0 GetVersion,CreateDCW,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetObjectW,BitBlt,GetBitmapBits,SelectObject,DeleteObject,DeleteDC,DeleteDC,6_2_0089CBC0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_665BF228 GetPropA,GlobalLock,SendMessageA,GlobalUnlock,RemovePropA,GlobalFree,GlobalUnlock,GetAsyncKeyState,SendMessageA,6_2_665BF228
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_665A40C0 GetKeyState,GetKeyState,GetKeyState,GetParent,GetParent,SendMessageA,memset,ScreenToClient,memset,GetCursorPos,SendMessageA,memmove,SendMessageA,SendMessageA,SendMessageA,SetWindowPos,SendMessageA,SendMessageA,memset,memmove,free,GetParent,6_2_665A40C0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_665EE928 GetKeyState,GetKeyState,GetKeyState,6_2_665EE928
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_6664F028 GetKeyState,GetKeyState,GetKeyState,6_2_6664F028
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_665971E0 GetKeyState,GetKeyState,GetKeyState,SendMessageA,6_2_665971E0
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_00423B84 NtdllDefWindowProc_A,1_2_00423B84
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_004125D8 NtdllDefWindowProc_A,1_2_004125D8
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_00478E54 NtdllDefWindowProc_A,1_2_00478E54
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_0042F520 NtdllDefWindowProc_A,1_2_0042F520
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_00457594 PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A,1_2_00457594
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_0042E934: CreateFileA,DeviceIoControl,GetLastError,CloseHandle,SetLastError,1_2_0042E934
Source: C:\Users\user\Desktop\httrack_x64-3.49.2.exeCode function: 0_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,0_2_00409448
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_004555E4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,1_2_004555E4
Source: C:\Users\user\Desktop\httrack_x64-3.49.2.exeCode function: 0_2_0040840C0_2_0040840C
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_004707F81_2_004707F8
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_00480DD31_2_00480DD3
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_004673A41_2_004673A4
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_0043035C1_2_0043035C
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_0048E3601_2_0048E360
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_004444C81_2_004444C8
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_004345C41_2_004345C4
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_00444A701_2_00444A70
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_00430EE81_2_00430EE8
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_00486FAC1_2_00486FAC
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_0045F0C41_2_0045F0C4
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_004451681_2_00445168
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_0045B1741_2_0045B174
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_004352C81_2_004352C8
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_004694201_2_00469420
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_004455741_2_00445574
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_004519BC1_2_004519BC
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_0043DD501_2_0043DD50
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_00487F0C1_2_00487F0C
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008100006_2_00810000
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_007FA3B06_2_007FA3B0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_007F23806_2_007F2380
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_007F74A06_2_007F74A0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_007FD5806_2_007FD580
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_007F16606_2_007F1660
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008076E06_2_008076E0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008118806_2_00811880
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_007ED8C06_2_007ED8C0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_007F79306_2_007F7930
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_007FFBF06_2_007FFBF0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00815CA06_2_00815CA0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_007FDCE06_2_007FDCE0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_007E7DE06_2_007E7DE0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_007E6DC06_2_007E6DC0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_007EBE706_2_007EBE70
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_007F8E606_2_007F8E60
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_007FAEC06_2_007FAEC0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0089CE406_2_0089CE40
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0089BE006_2_0089BE00
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008460906_2_00846090
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0092E0C06_2_0092E0C0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008FA0606_2_008FA060
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008601806_2_00860180
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008F61806_2_008F6180
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008621906_2_00862190
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008481D06_2_008481D0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0085A1306_2_0085A130
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0084E1406_2_0084E140
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008521686_2_00852168
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0084E2F56_2_0084E2F5
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008562F36_2_008562F3
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008FC2F06_2_008FC2F0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008582106_2_00858210
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008702406_2_00870240
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008463E06_2_008463E0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008563F06_2_008563F0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008503006_2_00850300
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0085230F6_2_0085230F
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0091E3306_2_0091E330
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0085E4906_2_0085E490
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0092C4106_2_0092C410
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008604006_2_00860400
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0093044C6_2_0093044C
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0084C5D06_2_0084C5D0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008505D06_2_008505D0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0086E5506_2_0086E550
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008586F06_2_008586F0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008566406_2_00856640
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008726406_2_00872640
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0091C6406_2_0091C640
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008CC6606_2_008CC660
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008546706_2_00854670
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008787806_2_00878780
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0084E7026_2_0084E702
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008527166_2_00852716
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008507206_2_00850720
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008588976_2_00858897
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0084C8C06_2_0084C8C0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008488006_2_00848800
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008548176_2_00854817
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0084E8506_2_0084E850
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0091E8606_2_0091E860
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008508706_2_00850870
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008D29206_2_008D2920
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008FEAF06_2_008FEAF0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00850A136_2_00850A13
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008B0A206_2_008B0A20
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00874A306_2_00874A30
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00930A406_2_00930A40
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00858B936_2_00858B93
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00868BE06_2_00868BE0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00854B136_2_00854B13
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0091EC906_2_0091EC90
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00858C906_2_00858C90
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00854C106_2_00854C10
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0085AC706_2_0085AC70
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00874DA06_2_00874DA0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0092EDC06_2_0092EDC0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00850D036_2_00850D03
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0084CD706_2_0084CD70
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008C8D706_2_008C8D70
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008BAEB06_2_008BAEB0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00858EE06_2_00858EE0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00850E006_2_00850E00
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00916E006_2_00916E00
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00854E606_2_00854E60
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00850FBB6_2_00850FBB
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008F2F106_2_008F2F10
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00880F506_2_00880F50
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0092F0906_2_0092F090
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008D50806_2_008D5080
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0084F0906_2_0084F090
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008450006_2_00845000
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008491806_2_00849180
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008B11E06_2_008B11E0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008591106_2_00859110
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0086D1506_2_0086D150
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0084F2906_2_0084F290
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008512C36_2_008512C3
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008D32D06_2_008D32D0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008592E06_2_008592E0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008513876_2_00851387
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008513B06_2_008513B0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0084D3406_2_0084D340
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008534806_2_00853480
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0084F4A86_2_0084F4A8
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0084D5906_2_0084D590
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_009275C06_2_009275C0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008555F06_2_008555F0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008656006_2_00865600
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_009216006_2_00921600
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008536276_2_00853627
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0084F6306_2_0084F630
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008516306_2_00851630
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0086F6706_2_0086F670
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008457906_2_00845790
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0084F7906_2_0084F790
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_009297006_2_00929700
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008597306_2_00859730
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008617606_2_00861760
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008878A06_2_008878A0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0085F8C06_2_0085F8C0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0084D8406_2_0084D840
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008518406_2_00851840
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0089B9906_2_0089B990
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008B59C06_2_008B59C0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008479F06_2_008479F0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0084D9FD6_2_0084D9FD
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008539206_2_00853920
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0084F9706_2_0084F970
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00929A906_2_00929A90
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0085BAE06_2_0085BAE0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00851AF46_2_00851AF4
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00855A206_2_00855A20
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00853A206_2_00853A20
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0085FA406_2_0085FA40
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008E7BA06_2_008E7BA0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0090DB106_2_0090DB10
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0086DCD06_2_0086DCD0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00847CE06_2_00847CE0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0085FCE06_2_0085FCE0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008F9C206_2_008F9C20
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0085DC506_2_0085DC50
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00853C606_2_00853C60
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008B1C606_2_008B1C60
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00885DA06_2_00885DA0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0090DDC06_2_0090DDC0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00859D306_2_00859D30
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00857D406_2_00857D40
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00929D606_2_00929D60
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00863E106_2_00863E10
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00851E506_2_00851E50
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00855E506_2_00855E50
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00853E706_2_00853E70
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0084DFD86_2_0084DFD8
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00855FF76_2_00855FF7
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0085FF106_2_0085FF10
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0084FF406_2_0084FF40
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00851F406_2_00851F40
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008A1F506_2_008A1F50
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_008F3F506_2_008F3F50
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_665A2A786_2_665A2A78
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_665DF4886_2_665DF488
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_665BFF3C6_2_665BFF3C
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_665A40C06_2_665A40C0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_66594ED86_2_66594ED8
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_665D8C046_2_665D8C04
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_665DD7A06_2_665DD7A0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_66599A746_2_66599A74
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_665DA6506_2_665DA650
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_666067246_2_66606724
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_665D27E86_2_665D27E8
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_665AE7AC6_2_665AE7AC
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_6663600C6_2_6663600C
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_6660A1D06_2_6660A1D0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_66602CC46_2_66602CC4
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_665E6BC86_2_665E6BC8
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_666129586_2_66612958
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_666529186_2_66652918
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_665AB3086_2_665AB308
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_665E7FD86_2_665E7FD8
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_6661FCCC6_2_6661FCCC
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_665A7D686_2_665A7D68
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_66623D246_2_66623D24
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_6660FA306_2_6660FA30
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_665AFA8C6_2_665AFA8C
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_665A7BD86_2_665A7BD8
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_665AB9E86_2_665AB9E8
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_666544206_2_66654420
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_665A85586_2_665A8558
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_6665053C6_2_6665053C
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_666145B86_2_666145B8
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_666402686_2_66640268
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_6662021C6_2_6662021C
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_665D03086_2_665D0308
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_665DC3A06_2_665DC3A0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_666000386_2_66600038
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_66610F746_2_66610F74
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_665ACF406_2_665ACF40
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_665A4C486_2_665A4C48
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_665D0C346_2_665D0C34
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_666008606_2_66600860
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: String function: 00896D60 appears 135 times
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: String function: 0089EF20 appears 68 times
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: String function: 00842660 appears 259 times
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: String function: 0081A1CA appears 53 times
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: String function: 0081A25A appears 48 times
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: String function: 00841D10 appears 52 times
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: String function: 0081B320 appears 259 times
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: String function: 00841DA0 appears 143 times
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: String function: 00932430 appears 2373 times
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: String function: 0089FFF0 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: String function: 00408C0C appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: String function: 00406AC4 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: String function: 0040595C appears 117 times
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: String function: 00457F1C appears 77 times
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: String function: 00403400 appears 60 times
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: String function: 00445DD4 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: String function: 00457D10 appears 105 times
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: String function: 004344DC appears 32 times
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: String function: 004078F4 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: String function: 00403494 appears 83 times
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: String function: 00403684 appears 226 times
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: String function: 00453344 appears 98 times
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: String function: 004460A4 appears 59 times
Source: httrack_x64-3.49.2.tmp.0.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: httrack_x64-3.49.2.tmp.0.drStatic PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: httrack_x64-3.49.2.tmp.0.drStatic PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: is-G01MI.tmp.1.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-G01MI.tmp.1.drStatic PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-G01MI.tmp.1.drStatic PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: httrack_x64-3.49.2.exe, 00000000.00000003.1657987229.0000000002124000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameshfolder.dll~/ vs httrack_x64-3.49.2.exe
Source: httrack_x64-3.49.2.exe, 00000000.00000003.1657848395.0000000002340000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameshfolder.dll~/ vs httrack_x64-3.49.2.exe
Source: httrack_x64-3.49.2.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: httrack_x64-3.49.2.tmp, 00000001.00000003.1983855666.00000000022B0000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1983812141.00000000022AC000.00000004.00001000.00020000.00000000.sdmp, unins000.dat.1.drBinary or memory string: =C:\Program Files\WinHTTrack\src_win\WinHTTrack\WinHTTrack.sln
Source: httrack_x64-3.49.2.tmp, 00000001.00000003.1983777861.00000000022B4000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1659068157.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1967871818.00000000022B8000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: '{app}\src_win\WinHTTrack\WinHTTrack.slnZ(y-
Source: httrack_x64-3.49.2.tmp, 00000001.00000003.2002455180.00000000022D4000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1983777861.00000000022B4000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1659068157.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1967871818.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1658998958.0000000003230000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: {app}\src_win\WinHTTrack\WinHTTrack.sln
Source: unins000.dat.1.drBinary or memory string: C=C:\Program Files\WinHTTrack\src_win\WinHTTrack\WinHTTrack.sln
Source: httrack_x64-3.49.2.tmp, 00000001.00000003.1658998958.0000000003230000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: '{app}\src_win\WinHTTrack\WinHTTrack.sln
Source: classification engineClassification label: clean6.winEXE@7/1077@0/0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_665ECC40 GetLastError,_CxxThrowException,FormatMessageA,FormatMessageA,GetLastError,LocalAlloc,_mbsnbcpy_s,LocalFree,LocalFree,_mbsnbcpy_s,6_2_665ECC40
Source: C:\Users\user\Desktop\httrack_x64-3.49.2.exeCode function: 0_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,0_2_00409448
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_004555E4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,1_2_004555E4
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_00455E0C GetModuleHandleA,GetProcAddress,GetDiskFreeSpaceExA,GetDiskFreeSpaceA,1_2_00455E0C
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0089CE40 GetVersionExW,LoadLibraryW,LoadLibraryW,LoadLibraryExW,GetProcAddress,GetProcAddressForCaller,NetStatisticsGet,NetStatisticsGet,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateToolhelp32Snapshot,GetTickCount,Heap32ListFirst,Heap32First,Heap32Next,GetTickCount,Heap32ListNext,GetTickCount,GetTickCount,Process32First,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,6_2_0089CE40
Source: C:\Users\user\Desktop\httrack_x64-3.49.2.exeCode function: 0_2_00409C34 FindResourceA,SizeofResource,LoadResource,LockResource,0_2_00409C34
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\Program Files\WinHTTrackJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\Users\user\AppData\Local\ProgramsJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeMutant created: NULL
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeMutant created: \Sessions\1\BaseNamedObjects\WinHTTrack_RUN
Source: C:\Users\user\Desktop\httrack_x64-3.49.2.exeFile created: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile read: C:\Windows\win.iniJump to behavior
Source: C:\Users\user\Desktop\httrack_x64-3.49.2.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganizationJump to behavior
Source: httrack_x64-3.49.2.exeString found in binary or memory: need to be updated. /RESTARTAPPLICATIONS Instructs Setup to restart applications. /NORESTARTAPPLICATIONS Prevents Setup from restarting applications. /LOADINF="filename" Instructs Setup to load the settings from the specified file after having checked t
Source: WinHTTrack.exeString found in binary or memory: dry-add
Source: WinHTTrack.exeString found in binary or memory: hts-stop.lock
Source: WinHTTrack.exeString found in binary or memory: X-Addr
Source: WinHTTrack.exeString found in binary or memory: To pause the engine: create an empty file named 'hts-stop.lock'
Source: WinHTTrack.exeString found in binary or memory: To see the option list, enter a blank line or try httrack --help
Source: WinHTTrack.exeString found in binary or memory: To see the option list, enter a blank line or try httrack --help
Source: WinHTTrack.exeString found in binary or memory: /Added by HTTrack -->
Source: WinHTTrack.exeString found in binary or memory: " /><!-- /Added by HTTrack -->
Source: httrack_x64-3.49.2.exeString found in binary or memory: /LOADINF="filename"
Source: C:\Users\user\Desktop\httrack_x64-3.49.2.exeFile read: C:\Users\user\Desktop\httrack_x64-3.49.2.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\httrack_x64-3.49.2.exe "C:\Users\user\Desktop\httrack_x64-3.49.2.exe"
Source: C:\Users\user\Desktop\httrack_x64-3.49.2.exeProcess created: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp "C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp" /SL5="$20412,4225024,60416,C:\Users\user\Desktop\httrack_x64-3.49.2.exe"
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpProcess created: C:\Program Files\WinHTTrack\WinHTTrack.exe "C:\Program Files\WinHTTrack\WinHTTrack.exe"
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpProcess created: C:\Windows\System32\notepad.exe "C:\Windows\notepad.exe" C:\Program Files\WinHTTrack\history.txt
Source: C:\Users\user\Desktop\httrack_x64-3.49.2.exeProcess created: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp "C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp" /SL5="$20412,4225024,60416,C:\Users\user\Desktop\httrack_x64-3.49.2.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpProcess created: C:\Program Files\WinHTTrack\WinHTTrack.exe "C:\Program Files\WinHTTrack\WinHTTrack.exe"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpProcess created: C:\Windows\System32\notepad.exe "C:\Windows\notepad.exe" C:\Program Files\WinHTTrack\history.txtJump to behavior
Source: C:\Users\user\Desktop\httrack_x64-3.49.2.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\httrack_x64-3.49.2.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpSection loaded: rstrtmgr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpSection loaded: riched20.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpSection loaded: usp10.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpSection loaded: msls31.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpSection loaded: explorerframe.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpSection loaded: sfc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpSection loaded: sfc_os.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpSection loaded: linkinfo.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpSection loaded: ntshrui.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpSection loaded: cscapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpSection loaded: netutils.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: libhttrack.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: winmm.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: zlib1.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: ssleay32.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: libeay32.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: libeay32.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: mfc90eng.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: mfc90enu.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: mfc90eng.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: mfc90enu.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: mfc90loc.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: netutils.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: wldp.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: propsys.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: profapi.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: windowscodecs.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: dataexchange.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: d3d11.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: dcomp.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: dxgi.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: thumbcache.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: napinsp.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: pnrpnsp.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: wshbth.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: winrnr.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: mrmcorer.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: efswrt.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\notepad.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32Jump to behavior
Source: WinHTTrack Website Copier.lnk.1.drLNK file: ..\..\..\..\..\..\Program Files\WinHTTrack\WinHTTrack.exe
Source: Documentation.lnk.1.drLNK file: ..\..\..\..\..\..\Program Files\WinHTTrack\httrack-doc.html
Source: readme.lnk.1.drLNK file: ..\..\..\..\..\..\Windows\notepad.exe
Source: copying.lnk.1.drLNK file: ..\..\..\..\..\..\Windows\notepad.exe
Source: history.txt.lnk.1.drLNK file: ..\..\..\..\..\..\Windows\notepad.exe
Source: license.txt.lnk.1.drLNK file: ..\..\..\..\..\..\Windows\notepad.exe
Source: greetings.txt.lnk.1.drLNK file: ..\..\..\..\..\..\Windows\notepad.exe
Source: HTTrack Website Copier.lnk.1.drLNK file: ..\..\..\Program Files\WinHTTrack\WinHTTrack.exe
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwnerJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpWindow found: window name: TMainFormJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpAutomated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpAutomated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpAutomated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpAutomated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpAutomated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpAutomated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpAutomated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpAutomated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpAutomated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpAutomated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpAutomated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpAutomated click: Next >
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeAutomated click: OK
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeAutomated click: Next >
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeAutomated click: Next >
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeAutomated click: Next >
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeAutomated click: Next >
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeAutomated click: Next >
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeAutomated click: Next >
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeAutomated click: Next >
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeAutomated click: Next >
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeAutomated click: Next >
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeAutomated click: Next >
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeAutomated click: Next >
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeAutomated click: Next >
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeWindow detected: Number of UI elements: 41
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeWindow detected: Number of UI elements: 41
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrackJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\unins000.datJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\is-G01MI.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\htmlJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-0PTKM.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-I623L.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-GOS7L.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-16PQ1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-61SD2.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-LJR0H.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-1UK74.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-HMR29.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-1THD9.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-5EDKI.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-K81A9.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-RRCD1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-OQNA2.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-J7N7G.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-0EDNS.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-OHOS2.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-G5TC6.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-TUS52.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-DH7AM.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-V9TL3.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-SCDGC.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-UB5T0.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-CCLHE.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-6NO1S.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-HJI7C.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-0G133.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-LTFET.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-H5JG7.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-GKSLV.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-A9RF2.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-91HPQ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-ONNHP.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-HFAKT.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-M41SM.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-E5KSU.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-MGLSD.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-KTCGT.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-H7UBN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\is-DG2N0.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\divJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\div\is-86O9O.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\imagesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\images\is-F0BAO.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\images\is-LKLVS.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\images\is-DOCQP.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\images\is-VQENL.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\imgJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-3GEN5.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-UG70T.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-OS2F1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-GTT7P.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-M22US.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-V16QJ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-C06EE.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-MT9VU.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-NFUUM.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-B1VSM.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-0G57R.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-NOB9S.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-1QA7B.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-8SFQT.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-39ATU.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-ESLJA.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-SB2TI.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-BV5D0.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-O3P7F.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-JH9E1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-9F3Q4.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-VQUEO.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-E7TF7.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-M31FO.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-7KA9O.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-IQ5VT.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-K16JT.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-O20I8.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-MSSD6.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-O0I46.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-UTR8A.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-9VVJ8.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-SNEP7.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-0423B.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-5BFJ5.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-2VRKH.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\img\is-7CAMJ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\serverJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-GES95.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-G0RF7.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-D63RQ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-QFK21.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-7QC5C.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-G4GB8.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-AQ7IS.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-M8FCA.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-8J0BM.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-G0F9U.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-V947E.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-IT7Q5.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-7L8JU.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-RIV24.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-FOJB9.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-HKL4A.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-7JJPQ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-6C1UG.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-MROK4.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-CS1NI.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-FLDT2.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-S8BTQ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-EOFRO.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\is-P2GKL.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\imagesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\images\is-LUU1F.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\images\is-IOOIR.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\images\is-TDQVS.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\sfxJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\sfx\is-FP3GA.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\html\server\sfx\is-SI4EP.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\templatesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\templates\is-O714A.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\templates\is-MBG29.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\templates\is-680JA.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\templates\is-8OOGN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\templates\is-67ID0.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\templates\is-DA78M.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\templates\is-P8OQC.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\langJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-476N1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-582RK.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-TL8SS.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-VLDM8.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-V8ELG.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-MB8IV.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-HKRCI.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-SSNBO.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-K313S.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-11F9P.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-T9H9H.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-LBAJH.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-I6TTS.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-AEEAO.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-88N9G.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-DPUQD.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-1KI38.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-3BUKN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-AA268.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-7GK14.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-LCLNP.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-2PGQC.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-5LSTG.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-IEOSD.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-CPA37.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-A932F.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-J4MH1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-N8GL1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-AVNH9.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-PON7P.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-QVG6I.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\lang\is-28P7N.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtestJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtest\is-KBBHN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtest\is-098P1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtest\is-UHB7R.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtest\is-18H57.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtest\is-91MOA.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtest\is-V22P0.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtest\is-TPN2M.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtest\is-DATIA.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtest\is-SFASP.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtest\is-SHLUD.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtest\is-CFV8O.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtest\is-2EG7O.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtest\is-GTOQT.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtest\is-CREK1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtest\is-I7PFS.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtest\is-E3DI8.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\libtest\is-72EIE.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\srcJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-T2AOJ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-P6JHN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-6MIIJ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-OML73.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-N0FUS.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-MQ1C4.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-51QTG.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-U8F0K.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-QS1DK.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-1VB0O.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-1H6RN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-6KLAQ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-K8LVH.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-IBQLD.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-UD1A1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-GPMLD.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-O6E3E.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-C6AJR.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-GP5P6.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-UJKK4.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-1D9S1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-41J9P.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-1P6DT.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-0H1UN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-8LV02.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-E7P90.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-99I0V.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-1H0GV.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-UFEQA.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-L6R77.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-BTPV3.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-2PVAK.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-JHS9G.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-QDVU7.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-DJO91.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-UPOFD.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-5U20D.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-DC4BN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-IBLJI.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-IUF72.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-FQ85O.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-BV9HG.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-ELF7E.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-NODTC.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-TRQKA.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-852L9.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-H2T1C.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-ML423.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-QDUQR.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-LS30R.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-MENI5.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-L348T.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-359S1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-D6C1T.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-28TUG.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-KF29L.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-6GMEN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-JSRA8.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-SNRV5.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-E9H01.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-EMQTJ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-A3OFJ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-VUG0T.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-S60BP.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-7GV7D.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-TG3BN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-5NH4G.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-32RGM.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-KIIUU.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-EE1SB.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-FLKUL.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-1A6MG.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-LE3AT.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-QOE38.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-AOLO5.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-6RT8U.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-T6H63.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-9H465.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-O7ODN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-7GFNO.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-AU6V7.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-RAGER.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-D0IG3.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-U51MN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-OIEP2.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-AHTB1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-1BG43.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-107TJ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-TK8AC.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-FB1CG.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-I4Q2C.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-E0683.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-BDUTR.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-2CD8V.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-TARNO.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-V1DLV.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-G5VIA.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-2CPQ7.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-B194V.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-TEQB0.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\is-MEEQF.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\coucalJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\coucal\is-7HLTV.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\coucal\is-SP4UO.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\coucal\is-KAHEU.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\coucal\is-UHUT2.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\coucal\is-OEKM0.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\coucal\is-4E6DS.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\coucal\is-8VVDG.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\coucal\is-ND5KS.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\coucal\is-S5R81.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\coucal\is-C8VF2.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizipJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-9ELME.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-45IGK.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-CPETQ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-1M2J2.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-7U8TH.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-4D4J3.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-LU355.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-S28UL.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-3BEQG.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-S30J0.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-IU7FN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-1BOAJ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-3TS94.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-116R4.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-7ULJB.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-HO93J.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-RN395.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-R79A6.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-PJV9M.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-C0CAE.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-2AGUA.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-DI1IV.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-EOSGJ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-3VHJR.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-BEBGB.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-4G6S7.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-FLP9N.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-CPD8I.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-VLGB1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-G440K.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-U93QS.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-03U5C.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-72HU4.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\minizip\is-N2DF1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\proxyJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\proxy\is-B0QDQ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\proxy\is-K6JR1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\proxy\is-T3LTB.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\proxy\is-NTNA4.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\proxy\is-HKPG8.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\proxy\is-PUKE8.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\proxy\is-D7J0E.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\proxy\is-MFB8L.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\proxy\is-HI9JV.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src\proxy\is-4O2NQ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_winJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\is-VRF36.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\is-QCULD.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\htsswfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\htsswf\is-T8DEM.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\htsswf\is-5C44E.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\htsswf\is-71T5B.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\htsswf\is-CR8F3.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\htsswf\is-45FQ6.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\htsswf\is-9K6KS.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\htsswf\is-2IRAK.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\htsswf\is-ADN8G.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\htsswf\swfJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\htsswf\swf\is-2LHK6.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\InnoSetupJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\InnoSetup\is-Q26TT.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\InnoSetup\is-QKGQP.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\InnoSetup\is-7378B.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\libhttrackJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\libhttrack\is-BHNUF.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\libhttrack\is-NDM89.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\libhttrack\is-OTC1J.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\libhttrack\is-9FO9D.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\libhttrack\is-6GPUO.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\libhttrack\is-160GN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\libhttrack\is-FF0EQ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\libhttrack\is-B33QE.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\libhttrack\is-78EUQ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrackJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-MPI80.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-4Q4M4.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-ISIU4.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-8FSCC.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-D1UIR.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-4RGFC.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-7RKBA.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-UJ3P7.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-P55A0.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-U1QM8.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-0TICM.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-T7GR2.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-QROQ8.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-QCNAG.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-VO910.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-JH7BM.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-NC44B.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-BKLFT.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-C1RR1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-A9H8Q.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-UAGT0.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-ABTE7.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-CLC1G.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-NMCK7.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-QEDD0.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-F8EH5.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-44EF6.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-42PJK.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-NCIH2.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-M6T8F.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-U61IQ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-388GQ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-E69PU.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-2MH7U.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-3I3F5.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-DP7PG.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-HTJCE.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-4U37A.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-HQ7QV.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-DSHVF.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-TUC17.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-79R2A.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-SFE0U.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-R9ROE.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-FCJ53.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-JIDOM.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-54MVT.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-9N1U6.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-R7GOQ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-7CRE7.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-VURAI.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-L6NEE.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-QHRH3.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-NJDAL.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-2117L.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-07JAV.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-EEUMN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-9NJPN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-V6IHV.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-UKUPG.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-5506D.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-JD4B5.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-4PIO7.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-H833P.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-HK6GT.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-MTNIO.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-6MKT6.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-TANNK.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-FIUR0.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-SM787.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-SDHNJ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-JQG6M.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-KV2TE.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-GSC7B.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-JETI7.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-3DA6Q.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-QJV4U.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-KTSFS.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-4MUBP.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-P6RHL.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-DLOI9.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-S895H.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-251N2.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-RF052.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-31IQ6.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-JPSG2.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-QGIQQ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-HP82M.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-EIM5D.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-RRNR8.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-OAGHN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-MD5GB.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-7CLGN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-3KHMR.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-9S3AK.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-JVQNP.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-AQKCS.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-U4JMI.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-7IJ87.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-RE86N.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-NJCUJ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-FQOI5.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-M7U18.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-58QEU.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-2ILUL.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-SIA5D.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-AOD0G.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-PVO65.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-EN8PP.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-59VG2.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-SLB4M.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-50G65.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-PM7GN.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-D3QLR.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-T4R0J.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-TK7CL.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-MJ2O8.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-4U6UG.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-FUCQU.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-PF6RE.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-OCVP4.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-5LMLQ.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\resJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\is-BKKEG.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\is-419O7.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\is-LGUG2.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\is-801BH.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\is-ERVA1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\is-UNBCP.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\is-M0VDR.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\is-HG1JB.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\is-VUAG7.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDirectory created: C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\is-KTL6R.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinHTTrack Website Copier_is1Jump to behavior
Source: httrack_x64-3.49.2.exeStatic PE information: certificate valid
Source: httrack_x64-3.49.2.exeStatic file information: File size 4513224 > 1048576
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_08e1c10da83fbc83\MSVCR90.dllJump to behavior
Source: Binary string: O:\HTTrack\httrack\x64\httrack.pdb source: is-SUP1E.tmp.1.dr
Source: Binary string: ProgramDatabaseFile="$(OutDir)/htsjava.pdb" source: is-TRQKA.tmp.1.dr
Source: Binary string: ProgramDatabaseFile="O:\HTTrack\httrack\htsjava.pdb" source: is-TRQKA.tmp.1.dr
Source: Binary string: ProgramDatabaseFile="O:\HTTrack\httrack\x64\proxytrack.pdb" source: is-MFB8L.tmp.1.dr
Source: Binary string: Source: "O:\HTTrack\httrack\*.*"; Excludes: "*.pdb,*.ncb"; DestDir: "{app}"; CopyMode: alwaysoverwrite source: is-QKGQP.tmp.1.dr
Source: Binary string: ProgramDatabaseFile=".\Release_avec_debug/httrack.pdb" source: is-D0IG3.tmp.1.dr
Source: Binary string: ProgramDatabaseFile="O:\HTTrack\httrack\proxytrack.pdb" source: is-MFB8L.tmp.1.dr
Source: Binary string: O:\HTTrack\httrack\x64\webhttrack.pdb source: is-7UNFS.tmp.1.dr
Source: Binary string: msvcr90.amd64.pdb source: is-C2PFI.tmp.1.dr
Source: Binary string: D:\CFILES\Projects\WinSSL\openssl-1.0.1j\out32dll\ssleay32.pdb! source: WinHTTrack.exe, 00000006.00000002.2899960031.000000000081C000.00000002.00000001.01000000.0000000D.sdmp, is-EGSJE.tmp.1.dr, is-NKRDO.tmp.1.dr
Source: Binary string: ProgramDatabaseFile="C:\temp\Debuglib/libhttrack.pdb" source: is-AHTB1.tmp.1.dr
Source: Binary string: O:\HTTrack\httrack\x64\libhttrack.pdb source: WinHTTrack.exe, 00000006.00000002.2901717260.000000018008D000.00000002.00000001.01000000.0000000A.sdmp, is-2D1ET.tmp.1.dr
Source: Binary string: ProgramDatabaseFile="O:\HTTrack\httrack\x64\httrack.pdb" source: is-D0IG3.tmp.1.dr
Source: Binary string: ProgramDatabaseFile="O:\HTTrack\httrack\libhttrack.pdb" source: is-AHTB1.tmp.1.dr
Source: Binary string: ProgramDatabaseFile=".\Debug/httrack.pdb" source: is-D0IG3.tmp.1.dr
Source: Binary string: ProgramDatabaseFile="O:\HTTrack\httrack\httrack.pdb" source: is-D0IG3.tmp.1.dr
Source: Binary string: O:\HTTrack\httrack\x64\proxytrack.pdb source: is-UUKLU.tmp.1.dr
Source: Binary string: ProgramDatabaseFile=".\Release/htsswf.pdb" source: is-45FQ6.tmp.1.dr
Source: Binary string: rm -f *.o *.obj *.so* *.dll *.exe *.pdb *.exp *.lib sample tests source: is-UHUT2.tmp.1.dr
Source: Binary string: mfc90.amd64.pdb source: httrack_x64-3.49.2.tmp, 00000001.00000003.1998064070.0000000005E4B000.00000004.00001000.00020000.00000000.sdmp, WinHTTrack.exe, 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmp, is-4BTMC.tmp.1.dr
Source: Binary string: ProgramDatabaseFile="O:\HTTrack\httrack\x64\htsjava.pdb" source: is-TRQKA.tmp.1.dr
Source: Binary string: D:\CFILES\Projects\WinSSL\openssl-1.0.1j\out32dll\ssleay32.pdb source: WinHTTrack.exe, 00000006.00000002.2899960031.000000000081C000.00000002.00000001.01000000.0000000D.sdmp, is-EGSJE.tmp.1.dr, is-NKRDO.tmp.1.dr
Source: Binary string: ProgramDatabaseFile="O:\HTTrack\httrack\x64\libhttrack.pdb" source: is-AHTB1.tmp.1.dr
Source: Binary string: ProgramDatabaseFile=".\Debug/htsswf.pdb" source: is-45FQ6.tmp.1.dr
Source: Binary string: D:\CFILES\Projects\WinSSL\openssl-1.0.1j\out32dll\libeay32.pdb source: WinHTTrack.exe, 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: O:\HTTrack\httrack\x64\WinHTTrack.pdb source: httrack_x64-3.49.2.tmp, 00000001.00000003.1998064070.0000000005DB0000.00000004.00001000.00020000.00000000.sdmp, WinHTTrack.exe, 00000006.00000000.1995929747.0000000140056000.00000002.00000001.01000000.00000009.sdmp, WinHTTrack.exe, 00000006.00000002.2901555496.0000000140056000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: ProgramDatabaseFile="$(OutDir)/proxytrack.pdb" source: is-MFB8L.tmp.1.dr
Source: Binary string: O:\HTTrack\httrack\x64\htsswf.pdb source: is-6RASL.tmp.1.dr
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_004502C0 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,1_2_004502C0
Source: C:\Users\user\Desktop\httrack_x64-3.49.2.exeCode function: 0_2_004065C8 push 00406605h; ret 0_2_004065FD
Source: C:\Users\user\Desktop\httrack_x64-3.49.2.exeCode function: 0_2_004040B5 push eax; ret 0_2_004040F1
Source: C:\Users\user\Desktop\httrack_x64-3.49.2.exeCode function: 0_2_00408104 push ecx; mov dword ptr [esp], eax0_2_00408109
Source: C:\Users\user\Desktop\httrack_x64-3.49.2.exeCode function: 0_2_00404185 push 00404391h; ret 0_2_00404389
Source: C:\Users\user\Desktop\httrack_x64-3.49.2.exeCode function: 0_2_00404206 push 00404391h; ret 0_2_00404389
Source: C:\Users\user\Desktop\httrack_x64-3.49.2.exeCode function: 0_2_0040C218 push eax; ret 0_2_0040C219
Source: C:\Users\user\Desktop\httrack_x64-3.49.2.exeCode function: 0_2_004042E8 push 00404391h; ret 0_2_00404389
Source: C:\Users\user\Desktop\httrack_x64-3.49.2.exeCode function: 0_2_00404283 push 00404391h; ret 0_2_00404389
Source: C:\Users\user\Desktop\httrack_x64-3.49.2.exeCode function: 0_2_00408F38 push 00408F6Bh; ret 0_2_00408F63
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_00484364 push 00484472h; ret 1_2_0048446A
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_0040994C push 00409989h; ret 1_2_00409981
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_004062B4 push ecx; mov dword ptr [esp], eax1_2_004062B5
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_004104E0 push ecx; mov dword ptr [esp], edx1_2_004104E5
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_00412928 push 0041298Bh; ret 1_2_00412983
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_0049AD30 pushad ; retf 1_2_0049AD3F
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_0040CE38 push ecx; mov dword ptr [esp], edx1_2_0040CE3A
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_004951EC push ecx; mov dword ptr [esp], ecx1_2_004951F1
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_004592D0 push 00459314h; ret 1_2_0045930C
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_0040F398 push ecx; mov dword ptr [esp], edx1_2_0040F39A
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_00443440 push ecx; mov dword ptr [esp], ecx1_2_00443444
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_0040546D push eax; ret 1_2_004054A9
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_0040553D push 00405749h; ret 1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_004055BE push 00405749h; ret 1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_0040563B push 00405749h; ret 1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_004056A0 push 00405749h; ret 1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_004517F8 push 0045182Bh; ret 1_2_00451823
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_004519BC push ecx; mov dword ptr [esp], eax1_2_004519C1
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_00485A54 push ecx; mov dword ptr [esp], ecx1_2_00485A59
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_00419C28 push ecx; mov dword ptr [esp], ecx1_2_00419C2D
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_0045FD1C push ecx; mov dword ptr [esp], ecx1_2_0045FD20
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_00409E4F push ds; ret 1_2_00409E50
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\Users\user\AppData\Local\Temp\is-79SP6.tmp\_isetup\_shfoldr.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\Program Files\WinHTTrack\libssl32.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\Program Files\WinHTTrack\msvcr90.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\Program Files\WinHTTrack\libhttrack.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\Program Files\WinHTTrack\webhttrack.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\Program Files\WinHTTrack\ssleay32.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\Program Files\WinHTTrack\is-G01MI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\Program Files\WinHTTrack\is-7UNFS.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\Program Files\WinHTTrack\is-2D1ET.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\Users\user\AppData\Local\Temp\is-79SP6.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Users\user\Desktop\httrack_x64-3.49.2.exeFile created: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\Program Files\WinHTTrack\WinHTTrack.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\Program Files\WinHTTrack\htsswf.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\Program Files\WinHTTrack\unins000.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\Program Files\WinHTTrack\libeay32.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\Program Files\WinHTTrack\is-UUKLU.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\Program Files\WinHTTrack\is-FQSUO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\Program Files\WinHTTrack\is-4BTMC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\Program Files\WinHTTrack\is-NKRDO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\Program Files\WinHTTrack\is-G0QI5.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\Program Files\WinHTTrack\is-FO2NV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\Program Files\WinHTTrack\mfc90.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\Program Files\WinHTTrack\is-C2PFI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\Program Files\WinHTTrack\is-SUP1E.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\Program Files\WinHTTrack\htsjava.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\Program Files\WinHTTrack\is-EGSJE.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\Program Files\WinHTTrack\is-6RASL.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\Program Files\WinHTTrack\proxytrack.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\Program Files\WinHTTrack\zlib1.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\Program Files\WinHTTrack\is-G2MAL.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\Program Files\WinHTTrack\httrack.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinHTTrackJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinHTTrack\WinHTTrack Website Copier.lnkJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinHTTrack\Documentation.lnkJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinHTTrack\readme.lnkJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinHTTrack\copying.lnkJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinHTTrack\history.txt.lnkJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinHTTrack\license.txt.lnkJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinHTTrack\greetings.txt.lnkJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_0042285C SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,1_2_0042285C
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_00423C0C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,1_2_00423C0C
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_00423C0C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,1_2_00423C0C
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_004241DC IsIconic,SetActiveWindow,SetFocus,1_2_004241DC
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_00424194 IsIconic,SetActiveWindow,1_2_00424194
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_00418384 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,1_2_00418384
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_00417598 IsIconic,GetCapture,1_2_00417598
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_00417CCE IsIconic,SetWindowPos,1_2_00417CCE
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_00417CD0 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,1_2_00417CD0
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_00483D18 IsIconic,GetWindowLongA,ShowWindow,ShowWindow,1_2_00483D18
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_6659FC08 IsWindowVisible,IsIconic,6_2_6659FC08
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_665DA650 _mbscmp,_mbscmp,_mbscmp,_mbschr,IsIconic,SetForegroundWindow,_mbscmp,_mbschr,_mbscmp,_mbschr,_mbscmp,_mbschr,SendMessageA,PostMessageA,6_2_665DA650
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_66592148 MonitorFromWindow,IsIconic,GetWindowPlacement,GetWindowRect,MonitorFromRect,GetSystemMetrics,GetSystemMetrics,6_2_66592148
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_665DF134 IsIconic,IsWindowVisible,6_2_665DF134
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_665DBD1C GetParent,IsIconic,GetParent,6_2_665DBD1C
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_0041F118 GetVersion,SetErrorMode,LoadLibraryA,SetErrorMode,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,1_2_0041F118
Source: C:\Users\user\Desktop\httrack_x64-3.49.2.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0089CE40 GetVersionExW,LoadLibraryW,LoadLibraryW,LoadLibraryExW,GetProcAddress,GetProcAddressForCaller,NetStatisticsGet,NetStatisticsGet,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateToolhelp32Snapshot,GetTickCount,Heap32ListFirst,Heap32First,Heap32Next,GetTickCount,Heap32ListNext,GetTickCount,GetTickCount,Process32First,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,6_2_0089CE40
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-79SP6.tmp\_isetup\_shfoldr.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDropped PE file which has not been started: C:\Program Files\WinHTTrack\msvcr90.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDropped PE file which has not been started: C:\Program Files\WinHTTrack\libssl32.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDropped PE file which has not been started: C:\Program Files\WinHTTrack\is-FO2NV.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDropped PE file which has not been started: C:\Program Files\WinHTTrack\webhttrack.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDropped PE file which has not been started: C:\Program Files\WinHTTrack\mfc90.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDropped PE file which has not been started: C:\Program Files\WinHTTrack\is-SUP1E.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDropped PE file which has not been started: C:\Program Files\WinHTTrack\is-C2PFI.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDropped PE file which has not been started: C:\Program Files\WinHTTrack\is-7UNFS.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDropped PE file which has not been started: C:\Program Files\WinHTTrack\htsjava.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDropped PE file which has not been started: C:\Program Files\WinHTTrack\is-2D1ET.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-79SP6.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDropped PE file which has not been started: C:\Program Files\WinHTTrack\is-EGSJE.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDropped PE file which has not been started: C:\Program Files\WinHTTrack\htsswf.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDropped PE file which has not been started: C:\Program Files\WinHTTrack\is-6RASL.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDropped PE file which has not been started: C:\Program Files\WinHTTrack\proxytrack.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDropped PE file which has not been started: C:\Program Files\WinHTTrack\is-UUKLU.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDropped PE file which has not been started: C:\Program Files\WinHTTrack\is-4BTMC.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDropped PE file which has not been started: C:\Program Files\WinHTTrack\is-NKRDO.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDropped PE file which has not been started: C:\Program Files\WinHTTrack\httrack.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDropped PE file which has not been started: C:\Program Files\WinHTTrack\is-G2MAL.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpDropped PE file which has not been started: C:\Program Files\WinHTTrack\is-G0QI5.tmpJump to dropped file
Source: C:\Users\user\Desktop\httrack_x64-3.49.2.exeEvasive API call chain: GetSystemTime,DecisionNodesgraph_0-5448
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeAPI coverage: 3.7 %
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_00452A60 FindFirstFileA,GetLastError,1_2_00452A60
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_0047531C FindFirstFileA,FindNextFileA,FindClose,1_2_0047531C
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_00464158 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,1_2_00464158
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_004985E4 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,1_2_004985E4
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_00462750 FindFirstFileA,FindNextFileA,FindClose,1_2_00462750
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_00463CDC SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,1_2_00463CDC
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00845300 _errno,_errno,malloc,memset,malloc,calloc,free,free,_errno,MultiByteToWideChar,FindFirstFileW,free,free,free,_errno,FindNextFileW,WideCharToMultiByte,_errno,6_2_00845300
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_66586124 GetFullPathNameA,_mbsnbcpy_s,strlen,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlenA,strcpy_s,strlen,6_2_66586124
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_66588BC4 lstrlenA,FindFirstFileA,FindClose,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,6_2_66588BC4
Source: C:\Users\user\Desktop\httrack_x64-3.49.2.exeCode function: 0_2_00409B78 GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery,0_2_00409B78
Source: httrack_x64-3.49.2.tmp, 00000001.00000003.2003885926.000000000074B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: httrack_x64-3.49.2.tmp, 00000001.00000003.2003885926.000000000074B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: WinHTTrack.exe, 00000006.00000002.2899543300.000000000067F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpProcess information queried: ProcessInformationJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0081AA30 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,__crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,__crt_debugger_hook,GetCurrentProcess,TerminateProcess,6_2_0081AA30
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0089CE40 GetVersionExW,LoadLibraryW,LoadLibraryW,LoadLibraryExW,GetProcAddress,GetProcAddressForCaller,NetStatisticsGet,NetStatisticsGet,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateToolhelp32Snapshot,GetTickCount,Heap32ListFirst,Heap32First,Heap32Next,GetTickCount,Heap32ListNext,GetTickCount,GetTickCount,Process32First,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,6_2_0089CE40
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_004502C0 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,1_2_004502C0
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_0081AA30 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,__crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,__crt_debugger_hook,GetCurrentProcess,TerminateProcess,6_2_0081AA30
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00915B20 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,__crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,__crt_debugger_hook,GetCurrentProcess,TerminateProcess,6_2_00915B20
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_00478898 ShellExecuteEx,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle,1_2_00478898
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_0042E09C AllocateAndInitializeSid,GetVersion,GetModuleHandleA,GetProcAddress,CheckTokenMembership,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GetTokenInformation,EqualSid,CloseHandle,FreeSid,1_2_0042E09C
Source: C:\Users\user\Desktop\httrack_x64-3.49.2.exeCode function: GetLocaleInfoA,0_2_0040520C
Source: C:\Users\user\Desktop\httrack_x64-3.49.2.exeCode function: GetLocaleInfoA,0_2_00405258
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: GetLocaleInfoA,1_2_00408568
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: GetLocaleInfoA,1_2_004085B4
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: GetModuleHandleA,GetProcAddress,ConvertDefaultLocale,ConvertDefaultLocale,GetProcAddress,ConvertDefaultLocale,ConvertDefaultLocale,GetModuleHandleA,EnumResourceLanguagesA,ConvertDefaultLocale,ConvertDefaultLocale,GetModuleFileNameA,memset,CreateActCtxA,CreateActCtxA,ActivateActCtx,ActivateActCtx,strcpy_s,GetLocaleInfoA,_errno,_errno,_snprintf_s,_errno,_errno,_errno,LoadLibraryA,ReleaseActCtx,DeactivateActCtx,DeactivateActCtx,ReleaseActCtx,ReleaseActCtx,DeactivateActCtx,DeactivateActCtx,ReleaseActCtx,ReleaseActCtx,6_2_665EECC0
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\notepad.exeQueries volume information: C:\Program Files\WinHTTrack\history.txt VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_004585C8 GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeA,GetLastError,CreateFileA,SetNamedPipeHandleState,CreateProcessA,CloseHandle,CloseHandle,1_2_004585C8
Source: C:\Users\user\Desktop\httrack_x64-3.49.2.exeCode function: 0_2_004026C4 GetSystemTime,0_2_004026C4
Source: C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmpCode function: 1_2_0045559C GetUserNameA,1_2_0045559C
Source: C:\Users\user\Desktop\httrack_x64-3.49.2.exeCode function: 0_2_00405CF4 GetVersionExA,0_2_00405CF4
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
Source: C:\Program Files\WinHTTrack\WinHTTrack.exeCode function: 6_2_00897C70 htons,htonl,strchr,memcpy,socket,setsockopt,bind,WSAGetLastError,htonl,socket,connect,closesocket,closesocket,socket,WSAGetLastError,listen,WSAGetLastError,closesocket,6_2_00897C70

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Native API		1
DLL Side-Loading		1
Exploitation for Privilege Escalation		1
Deobfuscate/Decode Files or Information		21
Input Capture		1
System Time Discovery		Remote Services1
Archive Collected Data		1
Ingress Tool Transfer		Exfiltration Over Other Network Medium1
System Shutdown/Reboot
CredentialsDomainsDefault Accounts2
Command and Scripting Interpreter		1
Windows Service		1
DLL Side-Loading		2
Obfuscated Files or Information		LSASS Memory1
Account Discovery		Remote Desktop Protocol1
Screen Capture		1
Encrypted Channel		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
Registry Run Keys / Startup Folder		1
Access Token Manipulation		1
DLL Side-Loading		Security Account Manager2
File and Directory Discovery		SMB/Windows Admin Shares21
Input Capture		SteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
Windows Service		3
Masquerading		NTDS26
System Information Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script2
Process Injection		1
Virtualization/Sandbox Evasion		LSA Secrets21
Security Software Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts1
Registry Run Keys / Startup Folder		1
Access Token Manipulation		Cached Domain Credentials1
Virtualization/Sandbox Evasion		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items2
Process Injection		DCSync2
Process Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc Filesystem1
Application Window Discovery		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAtHTML Smuggling/etc/passwd and /etc/shadow3
System Owner/User Discovery		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1467144 Sample: httrack_x64-3.49.2.exe Startdate: 03/07/2024 Architecture: WINDOWS Score: 6 6 httrack_x64-3.49.2.exe 2 2->6         started        file3 16 C:\Users\user\...\httrack_x64-3.49.2.tmp, PE32 6->16 dropped 9 httrack_x64-3.49.2.tmp 41 587 6->9         started        process4 file5 18 C:\Users\user\AppData\Local\...\_shfoldr.dll, PE32 9->18 dropped 20 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 9->20 dropped 22 C:\Program Files\...\zlib1.dll (copy), PE32+ 9->22 dropped 24 33 other files (none is malicious) 9->24 dropped 12 WinHTTrack.exe 6 6 9->12         started        14 notepad.exe 9->14         started        process6

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
httrack_x64-3.49.2.exe0%ReversingLabs

Dropped Files

SourceDetectionScannerLabelLink
C:\Program Files\WinHTTrack\WinHTTrack.exe (copy)0%ReversingLabs
C:\Program Files\WinHTTrack\htsjava.dll (copy)0%ReversingLabs
C:\Program Files\WinHTTrack\htsswf.dll (copy)0%ReversingLabs
C:\Program Files\WinHTTrack\httrack.exe (copy)0%ReversingLabs
C:\Program Files\WinHTTrack\is-2D1ET.tmp0%ReversingLabs
C:\Program Files\WinHTTrack\is-4BTMC.tmp0%ReversingLabs
C:\Program Files\WinHTTrack\is-6RASL.tmp0%ReversingLabs
C:\Program Files\WinHTTrack\is-7UNFS.tmp0%ReversingLabs
C:\Program Files\WinHTTrack\is-C2PFI.tmp0%ReversingLabs
C:\Program Files\WinHTTrack\is-EGSJE.tmp0%ReversingLabs
C:\Program Files\WinHTTrack\is-FO2NV.tmp0%ReversingLabs
C:\Program Files\WinHTTrack\is-FQSUO.tmp0%ReversingLabs
C:\Program Files\WinHTTrack\is-G01MI.tmp2%ReversingLabs
C:\Program Files\WinHTTrack\is-G0QI5.tmp0%ReversingLabs
C:\Program Files\WinHTTrack\is-G2MAL.tmp0%ReversingLabs
C:\Program Files\WinHTTrack\is-NKRDO.tmp0%ReversingLabs
C:\Program Files\WinHTTrack\is-SUP1E.tmp0%ReversingLabs
C:\Program Files\WinHTTrack\is-UUKLU.tmp0%ReversingLabs
C:\Program Files\WinHTTrack\libeay32.dll (copy)0%ReversingLabs
C:\Program Files\WinHTTrack\libhttrack.dll (copy)0%ReversingLabs
C:\Program Files\WinHTTrack\libssl32.dll (copy)0%ReversingLabs
C:\Program Files\WinHTTrack\mfc90.dll (copy)0%ReversingLabs
C:\Program Files\WinHTTrack\msvcr90.dll (copy)0%ReversingLabs
C:\Program Files\WinHTTrack\proxytrack.exe (copy)0%ReversingLabs
C:\Program Files\WinHTTrack\src\htsbasiccharsets.sh (copy)0%ReversingLabs
C:\Program Files\WinHTTrack\src\htsentities.sh (copy)0%ReversingLabs
C:\Program Files\WinHTTrack\src\is-1H6RN.tmp0%ReversingLabs
C:\Program Files\WinHTTrack\src\is-2CPQ7.tmp0%ReversingLabs
C:\Program Files\WinHTTrack\src\is-BTPV3.tmp0%ReversingLabs
C:\Program Files\WinHTTrack\src\webhttrack (copy)0%ReversingLabs
C:\Program Files\WinHTTrack\ssleay32.dll (copy)0%ReversingLabs
C:\Program Files\WinHTTrack\unins000.exe (copy)2%ReversingLabs
C:\Program Files\WinHTTrack\webhttrack.exe (copy)0%ReversingLabs
C:\Program Files\WinHTTrack\zlib1.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Temp\is-79SP6.tmp\_isetup\_setup64.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Temp\is-79SP6.tmp\_isetup\_shfoldr.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp2%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://www.innosetup.com/0%URL Reputationsafe
http://www.openssl.org/support/faq.html0%URL Reputationsafe
http://crl.thawte.com/ThawteTimestampingCA.crl00%URL Reputationsafe
http://ocsp.thawte.com00%URL Reputationsafe
http://www.shoesizes.com0%Avira URL Cloudsafe
http://jpassing.com/2008/03/12/walking-the-stack-of-the-current-thread/0%Avira URL Cloudsafe
http://forum.httrack.comy0%Avira URL Cloudsafe
ftp://ftp.shoesizes.com)0%Avira URL Cloudsafe
http://programy.com.ua0%Avira URL Cloudsafe
http://vic-info.com.ua)0%Avira URL Cloudsafe
http://www.nicemice.net/amc/0%Avira URL Cloudsafe
http://httrack.free.fr/HelpHtml/addurl.html0%Avira URL Cloudsafe
http://www.awondefulsite.com/images/landscapes/bluewater.jpg0%Avira URL Cloudsafe
http://kauler.com/0%Avira URL Cloudsafe
http://forum.httrack.com0%Avira URL Cloudsafe
http://yourhost/email.php3?id=91ff1a480%Avira URL Cloudsafe
http://www.httrack.com/html/cache.html0%Avira URL Cloudsafe
http://www.jrsoftware.org/isinfo.php0%Avira URL Cloudsafe
http://www.httrack.com/html/faq.html0%Avira URL Cloudsafe
http://www.httrack.com/html/fade.gif0%Avira URL Cloudsafe
http://www.httrack.com/)0%Avira URL Cloudsafe
http://www.unicode.org/unicode/reports/tr28/0%Avira URL Cloudsafe
http://www.winimage.com/zLibDll/minizip.html0%Avira URL Cloudsafe
http://www.openssl.org/0%Avira URL Cloudsafe
https://github.com/madler/zlib/commit/6c9bd474aa08312ef2e2e9655a80e18db24a1680#diff-d466aa66f7e453e00%Avira URL Cloudsafe
http://www.certum.pl/CPS00%Avira URL Cloudsafe
http://www.someweb.com/test.cgi?foo0%Avira URL Cloudsafe
http://www.gnu.org/philosophy/why-not-lgpl.html0%Avira URL Cloudsafe
http://www.truc.fr/pub/index.html0%Avira URL Cloudsafe
http://www.somesite.com/~library/thing/thingmain.htm0%Avira URL Cloudsafe
http://crl.certum.pl/ctnca.crl0k0%Avira URL Cloudsafe
http://www.macromedia.com/software/flash/download/search_engine/index.html0%Avira URL Cloudsafe
http://www.winzip.com/aes_info.htm0%Avira URL Cloudsafe
http://www.httrack.com/html/0%Avira URL Cloudsafe
http://www.winimage.com/zLibDll1.2.80%Avira URL Cloudsafe
http://www.httrack.com/page/2/0%Avira URL Cloudsafe
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline0%Avira URL Cloudsafe
http://www.all.net/foo/0%Avira URL Cloudsafe
http://www.httrack.com/robots.txt0%Avira URL Cloudsafe
http://www.ietf.org/rfc/rfc2616.txt?number=26160%Avira URL Cloudsafe
http://www.ietf.org/rfc/rfc2396.txt?number=23960%Avira URL Cloudsafe
http://www.all.net/bar/0%Avira URL Cloudsafe
https://www.certum.pl/repository.00%Avira URL Cloudsafe
http://www.winimage.com/zLibDll/unzip.htm0%Avira URL Cloudsafe
http://www.all.net/bar/blue.jpg)0%Avira URL Cloudsafe
http://all.net/0%Avira URL Cloudsafe
http://www.foobar.com/index.html0%Avira URL Cloudsafe
http://www.zlib.net/0%Avira URL Cloudsafe
http://www.someweb.com/bar/0%Avira URL Cloudsafe
http://www..)0%Avira URL Cloudsafe
http://www.someweb.com/bar/blue.jpg)0%Avira URL Cloudsafe
http://www.foo.com?bar=10%Avira URL Cloudsafe
http://www.gzip.org/zlib/0%Avira URL Cloudsafe
http://koti.mbnet.fi/kahoset0%Avira URL Cloudsafe
http://www.nicemice.net/idn/0%Avira URL Cloudsafe
http://www.shoesizes.com/othersites.html0%Avira URL Cloudsafe
http://www.someweb.com/foo/0%Avira URL Cloudsafe
ftp://ftp.someweb.com0%Avira URL Cloudsafe
http://repository.certum.pl/cscasha2.cer00%Avira URL Cloudsafe
http://www.httrack.com/update.php3?Product=HTTrack&Version=3.49.2&VersionStr=3.49-2&Platform=%d&Lang0%Avira URL Cloudsafe
http://www.httrack.com/html/images/header_title_4.gif0%Avira URL Cloudsafe
http://www.openssl.org/V0%Avira URL Cloudsafe
http://www.isthe.com/chongo/tech/comp/fnv/0%Avira URL Cloudsafe
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU0%Avira URL Cloudsafe
http://www.all.net/0%Avira URL Cloudsafe
http://www.it-c.dk/people/pagh/papers/cuckoo-jour.pdf0%Avira URL Cloudsafe
http://www.foobar.com/folder/foo4B54.html?q=450%Avira URL Cloudsafe
http://www.openssl.org/support/faq.html.0%Avira URL Cloudsafe
http://www.pkware.com/products/enterprise/white_papers/appnote.txt0%Avira URL Cloudsafe
http://www.greyc.ensicaen.fr/~dcarre/0%Avira URL Cloudsafe
http://result42.com0%Avira URL Cloudsafe
http://www.foobar.com/0%Avira URL Cloudsafe
http://www.awondefulsite.com/mike/index/index.html0%Avira URL Cloudsafe
http://www.shoesizes.com/0%Avira URL Cloudsafe
http://www.httrack.com/html/images/bg_rings.gif0%Avira URL Cloudsafe
http://nbenoit.tuxfamily.org/0%Avira URL Cloudsafe
http://subca.ocsp-certum.com010%Avira URL Cloudsafe
http://vic-info.com.ua0%Avira URL Cloudsafe
http://gcc.gnu.org/wiki/Visibility0%Avira URL Cloudsafe
http://www.httrack.com/0%Avira URL Cloudsafe
http://www.httrack.com0%Avira URL Cloudsafe
http://www.shoesizes.com/bob/0%Avira URL Cloudsafe
http://www.info-zip.org/pub/infozip/doc/0%Avira URL Cloudsafe
http://www.gnu.org/licenses/0%Avira URL Cloudsafe
http://repository.certum.pl/ctnca.cer090%Avira URL Cloudsafe
http://www.ducrot.org/0%Avira URL Cloudsafe
http://www.ensicaen.fr/0%Avira URL Cloudsafe
http://www.someweb.com/foo.asp?ts=2000/10/100%Avira URL Cloudsafe
http://www.foobar.com/folder/foo.cgi?q=450%Avira URL Cloudsafe
http://physics.nist.gov/cuu/Units/binary.html0%Avira URL Cloudsafe
http://www.someweb.com/big/index.html0%Avira URL Cloudsafe
https://www.certum.pl/CPS00%Avira URL Cloudsafe
http://crl.certum.pl/cscasha2.crl0q0%Avira URL Cloudsafe
http://..0%Avira URL Cloudsafe
http://cscasha2.ocsp-certum.com040%Avira URL Cloudsafe
http://yourhost/email.php3?id=&quot;0%Avira URL Cloudsafe
http://www.httrack.comHTS_PLATFORMHTTRACK_AFF_VERSION3.xHTTRACK_VERSIONID3.49.2HTTRACK_VERSION3.49-20%Avira URL Cloudsafe
http://www.gnu.org/licenses/gpl.txt0%Avira URL Cloudsafe
http://www.macromedia.com/software/flash/download/search_engine/license2.html)0%Avira URL Cloudsafe
http://www.httrack.com/update.php3?Product=HTTrack&Version=0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
http://jpassing.com/2008/03/12/walking-the-stack-of-the-current-thread/is-T7GR2.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.shoesizes.comis-HMR29.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://httrack.free.fr/HelpHtml/addurl.htmlis-HMR29.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://programy.com.uais-QVG6I.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.nicemice.net/amc/is-V1DLV.tmp.1.dr, is-TARNO.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://forum.httrack.comyhttrack_x64-3.49.2.tmp, 00000001.00000003.2003755226.000000000079C000.00000004.00000020.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.2001107389.0000000000789000.00000004.00000020.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.2001063937.000000000076F000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
ftp://ftp.shoesizes.com)is-HMR29.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.awondefulsite.com/images/landscapes/bluewater.jpgis-M41SM.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://kauler.com/is-1B14P.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://vic-info.com.ua)is-QVG6I.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://forum.httrack.comhttrack_x64-3.49.2.exe, 00000000.00000003.1657471855.0000000002340000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.exe, 00000000.00000003.1657540599.0000000002111000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.exe, 00000000.00000003.2008106386.0000000002110000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1998064070.0000000005DB0000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1983777861.00000000022B4000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.2002783477.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1659068157.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1967871818.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1658998958.0000000003230000.00000004.00001000.00020000.00000000.sdmp, WinHTTrack.exe, WinHTTrack.exe, 00000006.00000000.1995929747.0000000140056000.00000002.00000001.01000000.00000009.sdmp, WinHTTrack.exe, 00000006.00000002.2901717260.000000018008D000.00000002.00000001.01000000.0000000A.sdmp, WinHTTrack.exe, 00000006.00000002.2901555496.0000000140056000.00000002.00000001.01000000.00000009.sdmp, is-T7GR2.tmp.1.dr, is-O7ODN.tmp.1.dr, is-2D1ET.tmp.1.dr, is-SUP1E.tmp.1.dr, is-61SD2.tmp.1.dr, is-QKGQP.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://yourhost/email.php3?id=91ff1a48is-0PTKM.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.httrack.com/html/cache.htmlis-GOS7L.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.httrack.com/html/faq.htmlis-K81A9.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.unicode.org/unicode/reports/tr28/is-852L9.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.jrsoftware.org/isinfo.phpis-1B14P.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.httrack.com/)is-KAHEU.tmp.1.dr, is-P6JHN.tmp.1.dr, is-T2AOJ.tmp.1.dr, is-SP4UO.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.winimage.com/zLibDll/minizip.htmlis-N2DF1.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.httrack.com/html/fade.gifis-GOS7L.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.openssl.org/WinHTTrack.exe, is-1B14P.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
https://github.com/madler/zlib/commit/6c9bd474aa08312ef2e2e9655a80e18db24a1680#diff-d466aa66f7e453e0is-LU355.tmp.1.dr, is-S28UL.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.certum.pl/CPS0httrack_x64-3.49.2.exe, is-G01MI.tmp.1.dr, httrack_x64-3.49.2.tmp.0.dr, is-6RASL.tmp.1.dr, is-7UNFS.tmp.1.dr, is-UUKLU.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.macromedia.com/software/flash/download/search_engine/index.htmlis-2LHK6.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.innosetup.com/httrack_x64-3.49.2.tmp, httrack_x64-3.49.2.tmp, 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-G01MI.tmp.1.dr, httrack_x64-3.49.2.tmp.0.drfalse
  • URL Reputation: safe
unknown
http://www.somesite.com/~library/thing/thingmain.htmis-HMR29.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.someweb.com/test.cgi?foois-852L9.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.gnu.org/philosophy/why-not-lgpl.htmlhttrack_x64-3.49.2.exe, 00000000.00000003.1657471855.0000000002340000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.exe, 00000000.00000003.2008134065.0000000002118000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1713688230.000000000078E000.00000004.00000020.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1983777861.00000000022B4000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.2002783477.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.2001063937.000000000076F000.00000004.00000020.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1659068157.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1967871818.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1658998958.0000000003230000.00000004.00001000.00020000.00000000.sdmp, is-V2QNV.tmp.1.dr, is-6KT95.tmp.1.dr, is-O26L8.tmp.1.dr, is-T3LTB.tmp.1.dr, is-BHNUF.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.truc.fr/pub/index.htmlis-852L9.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://crl.certum.pl/ctnca.crl0khttrack_x64-3.49.2.exe, is-G01MI.tmp.1.dr, httrack_x64-3.49.2.tmp.0.dr, is-6RASL.tmp.1.dr, is-7UNFS.tmp.1.dr, is-UUKLU.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.winzip.com/aes_info.htmis-45IGK.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.httrack.com/html/is-K81A9.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.winimage.com/zLibDll1.2.8WinHTTrack.exe, 00000006.00000002.2901717260.000000018008D000.00000002.00000001.01000000.0000000A.sdmp, is-2D1ET.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.httrack.com/page/2/httrack_x64-3.49.2.exe, 00000000.00000003.1657471855.0000000002340000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.exe, 00000000.00000003.1657540599.0000000002111000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.exe, 00000000.00000003.2008106386.0000000002110000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1983777861.00000000022B4000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.2002783477.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1659068157.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1967871818.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, httrack_x64-3.49.2.tmp, 00000001.00000003.1658998958.0000000003230000.00000004.00001000.00020000.00000000.sdmp, is-QKGQP.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlinehttrack_x64-3.49.2.exefalse
  • Avira URL Cloud: safe
unknown
http://www.all.net/foo/is-HMR29.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.ietf.org/rfc/rfc2616.txt?number=2616is-GOS7L.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.ietf.org/rfc/rfc2396.txt?number=2396is-GOS7L.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.all.net/bar/is-HMR29.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.httrack.com/robots.txtis-GOS7L.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.winimage.com/zLibDll/unzip.htmis-CPD8I.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
https://www.certum.pl/repository.0httrack_x64-3.49.2.exe, is-G01MI.tmp.1.dr, httrack_x64-3.49.2.tmp.0.dr, is-6RASL.tmp.1.dr, is-7UNFS.tmp.1.dr, is-UUKLU.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.all.net/bar/blue.jpg)is-HMR29.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://all.net/is-1B14P.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.foobar.com/index.htmlis-1UK74.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.zlib.net/is-1B14P.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www..)is-32RGM.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.someweb.com/bar/is-1UK74.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.someweb.com/bar/blue.jpg)is-1UK74.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://koti.mbnet.fi/kahosetis-T9H9H.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.foo.com?bar=1is-852L9.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.gzip.org/zlib/is-GOS7L.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.shoesizes.com/othersites.htmlis-HMR29.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.httrack.com/html/images/header_title_4.gifis-GOS7L.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.someweb.com/foo/is-1UK74.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.nicemice.net/idn/is-V1DLV.tmp.1.dr, is-TARNO.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
ftp://ftp.someweb.comis-1UK74.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://repository.certum.pl/cscasha2.cer0httrack_x64-3.49.2.exe, is-G01MI.tmp.1.dr, httrack_x64-3.49.2.tmp.0.dr, is-6RASL.tmp.1.dr, is-7UNFS.tmp.1.dr, is-UUKLU.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.httrack.com/update.php3?Product=HTTrack&Version=3.49.2&VersionStr=3.49-2&Platform=%d&LangWinHTTrack.exe, 00000006.00000002.2901555496.0000000140056000.00000002.00000001.01000000.00000009.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.openssl.org/VWinHTTrack.exe, 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmp, WinHTTrack.exe, 00000006.00000002.2900249507.0000000000836000.00000002.00000001.01000000.0000000D.sdmp, is-EGSJE.tmp.1.dr, is-NKRDO.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.isthe.com/chongo/tech/comp/fnv/is-P6JHN.tmp.1.dr, is-SP4UO.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupUhttrack_x64-3.49.2.exefalse
  • Avira URL Cloud: safe
unknown
http://www.all.net/is-HMR29.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.foobar.com/folder/foo4B54.html?q=45WinHTTrack.exe, WinHTTrack.exe, 00000006.00000002.2901717260.000000018008D000.00000002.00000001.01000000.0000000A.sdmp, is-IBLJI.tmp.1.dr, is-2D1ET.tmp.1.dr, is-K81A9.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.greyc.ensicaen.fr/~dcarre/is-1B14P.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.it-c.dk/people/pagh/papers/cuckoo-jour.pdfis-P6JHN.tmp.1.dr, is-SP4UO.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://result42.comis-LU355.tmp.1.dr, is-7ULJB.tmp.1.dr, is-03U5C.tmp.1.dr, is-3BEQG.tmp.1.dr, is-EOSGJ.tmp.1.dr, is-VLGB1.tmp.1.dr, is-U93QS.tmp.1.dr, is-1BOAJ.tmp.1.dr, is-1M2J2.tmp.1.dr, is-S30J0.tmp.1.dr, is-N2DF1.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.pkware.com/products/enterprise/white_papers/appnote.txtis-GOS7L.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.openssl.org/support/faq.html.WinHTTrack.exe, 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.openssl.org/support/faq.htmlWinHTTrack.exe, WinHTTrack.exe, 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpfalse
  • URL Reputation: safe
unknown
http://www.awondefulsite.com/mike/index/index.htmlis-M41SM.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.foobar.com/is-1UK74.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.shoesizes.com/is-HMR29.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0httrack_x64-3.49.2.exe, is-G01MI.tmp.1.dr, httrack_x64-3.49.2.tmp.0.dr, is-6RASL.tmp.1.dr, is-7UNFS.tmp.1.dr, is-UUKLU.tmp.1.drfalse
  • URL Reputation: safe
unknown
http://nbenoit.tuxfamily.org/is-1B14P.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://gcc.gnu.org/wiki/Visibilityis-UPOFD.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://subca.ocsp-certum.com01httrack_x64-3.49.2.exe, is-G01MI.tmp.1.dr, httrack_x64-3.49.2.tmp.0.dr, is-6RASL.tmp.1.dr, is-7UNFS.tmp.1.dr, is-UUKLU.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://vic-info.com.uais-QVG6I.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.httrack.com/httrack_x64-3.49.2.exe, is-G01MI.tmp.1.dr, is-1BG43.tmp.1.dr, httrack_x64-3.49.2.tmp.0.dr, is-61SD2.tmp.1.dr, is-OHOS2.tmp.1.dr, is-QKGQP.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.httrack.com/html/images/bg_rings.gifis-GOS7L.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.httrack.comis-UPOFD.tmp.1.dr, is-H2T1C.tmp.1.dr, is-IBLJI.tmp.1.dr, is-D7J0E.tmp.1.dr, is-PUKE8.tmp.1.dr, is-1P6DT.tmp.1.dr, is-GP5P6.tmp.1.dr, is-OML73.tmp.1.dr, is-A3OFJ.tmp.1.dr, is-9H465.tmp.1.dr, is-K8LVH.tmp.1.dr, is-O7ODN.tmp.1.dr, is-QDVU7.tmp.1.dr, is-U8F0K.tmp.1.dr, is-41J9P.tmp.1.dr, is-KF29L.tmp.1.dr, is-GPMLD.tmp.1.dr, is-28TUG.tmp.1.dr, is-UFEQA.tmp.1.dr, is-QDUQR.tmp.1.dr, is-MPI80.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.shoesizes.com/bob/is-HMR29.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.gnu.org/licenses/is-BHNUF.tmp.1.dr, is-JHS9G.tmp.1.dr, is-1H0GV.tmp.1.dr, is-AOLO5.tmp.1.dr, is-FQ85O.tmp.1.dr, is-6RT8U.tmp.1.dr, is-99I0V.tmp.1.dr, is-4O2NQ.tmp.1.dr, is-QOE38.tmp.1.dr, is-1A6MG.tmp.1.dr, is-1VB0O.tmp.1.dr, is-LS30R.tmp.1.dr, is-QS1DK.tmp.1.dr, is-32RGM.tmp.1.dr, is-6MIIJ.tmp.1.dr, is-VUG0T.tmp.1.dr, is-LE3AT.tmp.1.dr, is-IBQLD.tmp.1.dr, is-852L9.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.info-zip.org/pub/infozip/doc/is-CPD8I.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.someweb.com/foo.asp?ts=2000/10/10is-1UK74.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://repository.certum.pl/ctnca.cer09httrack_x64-3.49.2.exe, is-G01MI.tmp.1.dr, httrack_x64-3.49.2.tmp.0.dr, is-6RASL.tmp.1.dr, is-7UNFS.tmp.1.dr, is-UUKLU.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://physics.nist.gov/cuu/Units/binary.htmlis-852L9.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.foobar.com/folder/foo.cgi?q=45WinHTTrack.exe, WinHTTrack.exe, 00000006.00000002.2901717260.000000018008D000.00000002.00000001.01000000.0000000A.sdmp, is-IBLJI.tmp.1.dr, is-2D1ET.tmp.1.dr, is-K81A9.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://ocsp.thawte.com0httrack_x64-3.49.2.exe, is-G01MI.tmp.1.dr, httrack_x64-3.49.2.tmp.0.dr, is-6RASL.tmp.1.dr, is-7UNFS.tmp.1.dr, is-UUKLU.tmp.1.drfalse
  • URL Reputation: safe
unknown
http://www.ducrot.org/is-1B14P.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.ensicaen.fr/is-1B14P.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.someweb.com/big/index.htmlis-1UK74.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
https://www.certum.pl/CPS0httrack_x64-3.49.2.exe, is-G01MI.tmp.1.dr, httrack_x64-3.49.2.tmp.0.dr, is-6RASL.tmp.1.dr, is-7UNFS.tmp.1.dr, is-UUKLU.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.httrack.com/update.php3?Product=HTTrack&Version=is-UPOFD.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://crl.certum.pl/cscasha2.crl0qhttrack_x64-3.49.2.exe, is-G01MI.tmp.1.dr, httrack_x64-3.49.2.tmp.0.dr, is-6RASL.tmp.1.dr, is-7UNFS.tmp.1.dr, is-UUKLU.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://..is-JSRA8.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://cscasha2.ocsp-certum.com04httrack_x64-3.49.2.exe, is-G01MI.tmp.1.dr, httrack_x64-3.49.2.tmp.0.dr, is-6RASL.tmp.1.dr, is-7UNFS.tmp.1.dr, is-UUKLU.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.httrack.comHTS_PLATFORMHTTRACK_AFF_VERSION3.xHTTRACK_VERSIONID3.49.2HTTRACK_VERSION3.49-2is-7UNFS.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.macromedia.com/software/flash/download/search_engine/license2.html)is-2LHK6.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://yourhost/email.php3?id=&quot;is-0PTKM.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown
http://www.gnu.org/licenses/gpl.txtis-1UK74.tmp.1.drfalse
  • Avira URL Cloud: safe
unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1467144
Start date and time:2024-07-03 18:50:13 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 7m 35s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:default.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:11
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:httrack_x64-3.49.2.exe
Detection:CLEAN
Classification:clean6.winEXE@7/1077@0/0
EGA Information:
  • Successful, ratio: 100%
HCA Information:
  • Successful, ratio: 97%
  • Number of executed functions: 310
  • Number of non-executed functions: 200
Cookbook Comments:
  • Found application associated with file extension: .exe

Warnings

  • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
  • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
  • Not all processes where analyzed, report is missing behavior information
  • Report size exceeded maximum capacity and may have missing behavior information.
  • Report size exceeded maximum capacity and may have missing disassembly code.
  • Report size getting too big, too many NtOpenKeyEx calls found.
  • Report size getting too big, too many NtQueryAttributesFile calls found.
  • Report size getting too big, too many NtQueryValueKey calls found.
  • Report size getting too big, too many NtSetInformationFile calls found.
  • VT rate limit hit for: httrack_x64-3.49.2.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
C:\Program Files\WinHTTrack\is-4BTMC.tmpbjYuQcovwE.exeGet hashmaliciousXmrigBrowse

    Created / dropped Files

    C:\Program Files\WinHTTrack\Microsoft.VC90.CRT.manifest (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1506), with CRLF line terminators
    Category:dropped
    Size (bytes):1859
    Entropy (8bit):5.368960172138106
    Encrypted:false
    SSDEEP:48:3SlK+6gc209kkKVzp09kkKxzWaA/09kkK4kzY:CltK2XkwNXkIWXkjk8
    MD5:CFDFB365D8F581E80292124EEB97854F
    SHA1:7CF6859AE9693EAD128A40F7F36B2EBAF9CE923F
    SHA-256:F20BC224A6E3EF391C67FD91378E2EC9734E450EA30AC1D6B84E5ACB4AC9A087
    SHA-512:309D66CF8A3D026A00B90E635BE2535F9E13489CD35A89532D304AB3FF026B914AC508C4F1314BBD72CEFEC8303402F45FF63EA31E66CFE9480F586F8688720A
    Malicious:false
    Reputation:moderate, very likely benign file
    Preview:.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC90.CRT" version="9.0.21022.8" processorArchitecture="amd64" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="msvcr90.dll" hashalg="SHA1" hash="b2f60c4aac5e14a70e51af1adfb7a3e3c8d78974"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>Jqd8zw5i+qQ2JV5HoMPIqBhzMZM=</dsig:DigestValue></asmv2:hash></file> <file name="msvcp90.dll" hashalg="SHA1" hash="a41203d30322a6320bfef2ba29f48899a5b1d608"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:ds

    C:\Program Files\WinHTTrack\Microsoft.VC90.MFC.manifest (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (2003), with CRLF line terminators
    Category:dropped
    Size (bytes):2356
    Entropy (8bit):5.364713684629331
    Encrypted:false
    SSDEEP:48:3SlK+1gbm09kkK5jMzgwBoP09kkKqzxu09kkKezl309kkK1AFzY:CltFXkAIMw6XkX0XkXp3XkbF8
    MD5:FB7000534D403608EBC2DF6321E3A89B
    SHA1:8929595B79DD8F0C452A7BAC17C21343B3D89F1C
    SHA-256:186ADFA33201DF5A23B2ADD63B5F54B667BA64DD2802925650600F69ABC3A84C
    SHA-512:4C3B5851CE365D166694513E0C9D6906EA16E578EE90A951FB1A1841B949F655E9BD84F4C93DAD7917BB1FB177611A608F94E5C5C2410AF6C409260289810E37
    Malicious:false
    Reputation:low
    Preview:.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC90.MFC" version="9.0.21022.8" processorArchitecture="amd64" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="mfc90.dll" hashalg="SHA1" hash="1c1e72f1f8d28681a86e901ddc41d492396f9bed"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>rkU3K0zhnHc9Yn+d+Cn8FnAv6EA=</dsig:DigestValue></asmv2:hash></file> <file name="mfc90u.dll" hashalg="SHA1" hash="bffa184672fbcbff765794e7093f261ce7805ae9"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig=

    C:\Program Files\WinHTTrack\WinHTTrack.exe (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:PE32+ executable (GUI) x86-64, for MS Windows
    Category:dropped
    Size (bytes):683592
    Entropy (8bit):5.877637795516158
    Encrypted:false
    SSDEEP:6144:+bqdIUfdNaQJHr1jUMOWN8y+463aOvrU1fjuGGTpTOJKAOooaHP:tWc14MTy463aOvrwyooM
    MD5:1222165410734DB4A128E0B6F37EB89C
    SHA1:557D871D9F3CBE79D3B2B872E17F780C5FBE2638
    SHA-256:D37CC42BD29FF5046097DCA847967F59A6A1625829CD6DFAC387BDC4134F48A6
    SHA-512:8BA4B7114B7AE6566251AE287F6789335A65699DA050BE57C95E5421723162D088EA464CA56969D640DE35330457F42868888D4F8D3767E651A5CDF9F0B5E339
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 0%
    Reputation:low
    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........oM...................g.......................z.........................................Rich............................PE..d..... Y..........#......J...........v.........@.....................................3...............................................................P..(.......4t...V..H............z...............................................`...............................text...,I.......J.................. ..`.rdata.......`.......N..............@..@.data.......0......................@....pdata..4t.......v...(..............@..@.rsrc...(....P......................@..@........................................................................................................................................................................................................................................................................................

    C:\Program Files\WinHTTrack\copying (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text
    Category:dropped
    Size (bytes):35147
    Entropy (8bit):4.573442652974749
    Encrypted:false
    SSDEEP:768:Mo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A7D:Mhcycsrfrnoue
    MD5:D32239BCB673463AB874E80D47FAE504
    SHA1:8624BCDAE55BAEEF00CD11D5DFCFA60F68710A02
    SHA-256:8CEB4B9EE5ADEDDE47B31E975C1D90C73AD27B6B165A1DCD80C7C545EB65B903
    SHA-512:7633623B66B5E686BB94DD96A7CDB5A7E5EE00E87004FAB416A5610D59C62BADAF512A2E26E34E2455B7ED6B76690D2CD47464836D7D85D78B51D50F7E933D5C
    Malicious:false
    Reputation:moderate, very likely benign file
    Preview: GNU GENERAL PUBLIC LICENSE. Version 3, 29 June 2007.. Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>. Everyone is permitted to copy and distribute verbatim copies. of this license document, but changing it is not allowed... Preamble.. The GNU General Public License is a free, copyleft license for.software and other kinds of works... The licenses for most software and other practical works are designed.to take away your freedom to share and change the works. By contrast,.the GNU General Public License is intended to guarantee your freedom to.share and change all versions of a program--to make sure it remains free.software for all its users. We, the Free Software Foundation, use the.GNU General Public License for most of our software; it applies also to.any other work released this way by its authors. You can apply it to.your programs, too... When we speak of free software, we are referring to

    C:\Program Files\WinHTTrack\file_id.diz (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):385
    Entropy (8bit):4.703745881432501
    Encrypted:false
    SSDEEP:6:VMmRpseVj9R3XnoBMkztyFR4EQov3THcLeHJXQemBok773JisJtVQITc59vL+9A0:3UeVJhnJkzEr4EJef8sbVLTM9vC9A0
    MD5:7F7F0ED10E9B84002C9E7B33AF461902
    SHA1:69EC63D38AB1435FA7B4B5E5C5517543219F3BE9
    SHA-256:476379735FA66AD196CD62F6D225A247E2A53B3C2BB3F7B67BDA4DD72D00E815
    SHA-512:720303E77955418C95E09BBF7A51DF2B53BD3D343D46B233A9DA7E15EF10C16C0B9127A41017143D78E786EDE9E83E4E5931FED19B3EE397F73644F84DAB5EAC
    Malicious:false
    Preview:HTTrack Website Copier III..This program is an offline browser for..Windows and Unix/Linux. ..It allows you to transfer one or several..websites from the Internet to your hard ..disk. The robot is fully configurable,..with a LOT of parameters: possibility ..of update/continue, multiple ..connections, filters, proxy, wizard.....Windows interface + command-line release..Freeware/GPL..

    C:\Program Files\WinHTTrack\gpl-fr.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Non-ISO extended-ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):46897
    Entropy (8bit):4.695250476503557
    Encrypted:false
    SSDEEP:768:aSmnirui5zaqHu2MucO4wgUL5Xwgfq2IF71B8XF5AYcZuR42ygr0Hd1u:aSme5e2u2c+L5XwgfqPF70SZuhEzu
    MD5:671572ED27A6963687B00C9806B315AD
    SHA1:9704FC5366531840B8FF0972A675980AB4A79532
    SHA-256:E0ACC9B46E7BECE51C63550852ED353C5358CD7D365FB562DBA573FF93B8539B
    SHA-512:2BAD416FBDAD788501BB153B6CB5F4374F946A5A723B228BB8C258469C576364C8347A6CC5997765E12C8EEBB27BEB02BFACF757D03475D41381402F1A0F44AF
    Malicious:false
    Preview:.. LICENCE PUBLIQUE G.N.RALE GNU.. Version 3, du 29 juin 2007.....Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>....Chacun est autoris. . copier et distribuer des copies conformes de ce..document de licence, mais toute modification en est proscrite.....Traduction fran.aise par Philippe Verdy..<verdy_p (.) wanadoo (point) fr>, le 30 juin 2007....._______________________________________________________________________....Avertissement important au sujet de cette traduction fran.aise..._______________________________________________________________________....Ceci est une traduction en fran.ais de la licence .GNU General Public..License. (GPL). Cette traduction est fournie ici dans l.espoir qu.elle..facilitera sa compr.hension, mais elle ne constitue pas une traduction..officielle ou approuv.e d.un point de vue juridique.....La Free Software Foundation (FSF) ne publie pas cette traduction et ne..l.a pas approuv.e en tant

    C:\Program Files\WinHTTrack\gpl.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):35821
    Entropy (8bit):4.622128610438848
    Encrypted:false
    SSDEEP:768:A7Y+tNdSz3ZlqXOWoInuzx3Y8N3WiYD0v:AVtNIq1uzZY1C
    MD5:3C34AFDC3ADF82D2448F12715A255122
    SHA1:7713A1753CE88F2C7E6B054ECC8E4C786DF76300
    SHA-256:0B383D5A63DA644F628D99C33976EA6487ED89AAA59F0B3257992DEAC1171E6B
    SHA-512:4937848B94F5B50EA16C51F9E98FDCD3953ACA63D63CA3BB05D8A62C107E382B71C496838D130AE504A52032398630B957ACAEA6C48032081A6366D27CBA5EA9
    Malicious:false
    Preview: GNU GENERAL PUBLIC LICENSE.. Version 3, 29 June 2007.... Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>.. Everyone is permitted to copy and distribute verbatim copies.. of this license document, but changing it is not allowed..... Preamble.... The GNU General Public License is a free, copyleft license for..software and other kinds of works..... The licenses for most software and other practical works are designed..to take away your freedom to share and change the works. By contrast,..the GNU General Public License is intended to guarantee your freedom to..share and change all versions of a program--to make sure it remains free..software for all its users. We, the Free Software Foundation, use the..GNU General Public License for most of our software; it applies also to..any other work released this way by its authors. You can apply it to..your programs, too..... When we speak of free software

    C:\Program Files\WinHTTrack\greetings.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
    Category:dropped
    Size (bytes):3681
    Entropy (8bit):4.91086945664726
    Encrypted:false
    SSDEEP:96:Lk08iZKCbRV6GaedI5G88jIBRm3Z3GhmEk4RGYSqB7fUo:LPKCbxa6I5GpUBRm3Z3xqSILj
    MD5:DA381B4B0BFF110C5654C77721F5D282
    SHA1:45E0596071DD281171168DADB632ECB6000BA8F8
    SHA-256:DB6FBC85BE077AEF218D1688BFAD1D9022B799FC053B32AD063AE60A739F2CFF
    SHA-512:F1404063991E9B8BE4F1B213DFBCBD5CB497AA1CB243C893AE58B5A92073AAAD3B8B88B90373DA5F81D4226F8AF113894F60A1EBE8235EF7FF5D9F5226AA5C1B
    Malicious:false
    Preview:.Informations on this project:....This project has been developed by:..Xavier Roche (xroche at httrack.com).. project leader.. core engine, Windows/Linux GUI..Yann Philippot (yphilippot at lemel.fr).. for the java binary .class parser....With the help of:..Leto Kauler (molotov at tasmail.com).. for the site/logos design.. http://kauler.com/..Christian Marillat (marillat.christian at wanadoo.fr).. for autoconf compliance and .deb package..Fred Cohen (fc at all.net).. for HTTrack user's guide.. http://all.net/....And the help of the following third party developers:..Nicolas Benoit (nbenoit at tuxfamily.org), SDP Multimedia and Major MMS.. for the mms plugin core routines (MMSRIP).. http://nbenoit.tuxfamily.org/..Jean-loup Gailly from gzip.org.. for the help provided with Zlib.. http://www.zlib.net/..Eric A. Young (eay at cryptsoft.com).. for SSL cryptographic material (OpenSSL).. http://www.openssl.org/..Jordan Russell.. for the Windows setup tool (Inno Setup).. http:/

    C:\Program Files\WinHTTrack\history.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Unicode text, UTF-8 text, with CRLF line terminators
    Category:dropped
    Size (bytes):40386
    Entropy (8bit):4.9587924480464265
    Encrypted:false
    SSDEEP:768:0wEtyOjgiKgKkd4EfzOe770GxE3o6Hvt4i7Yh3CRte9qTI5ytwtBC:0wEtrdD7KRtNE5yS43
    MD5:58ACFD2B4ABF9AABB8273AF3E1D5AE5F
    SHA1:6F27FD88A6E827B4D1DCEE15AC6B1C5D0BFBF79F
    SHA-256:A962C6B5C7284C7993C6FD8359361F077FBC730762F55187E2C02B17F198B5BC
    SHA-512:75CF7D9E5BD56DC5A267937ACD2496C712AFB562ECE86771FEAE89716F35103F1BD55D7836743EFCAF6301A1287B9B9B7F486BEF895145BABB4BDCFB4476DB1E
    Malicious:false
    Preview:..HTTrack Website Copier release history:..--------------------------------------....This file lists all changes and fixes that have been made for HTTrack....3.49-2..+ Fixed: Buffer overflow in output option commandline argument (VL-ID 2068) (Hosein Askari)..+ Fixed: Minor fixes....3.48-23..+ Fixed: on Linux, FTBFS with openssl 1.1.0....3.48-22..+ Fixed: on Windows, fixed possible DLL local injection (Tunisian Cyber)..+ Fixed: various typos....3.48-21..+ Fixed: Google RPMs use /usr/bin/google-chrome as program location (Cickumqt)..+ Fixed: Fixed htsserver not dying (immediately) on quit..+ New: Updated WIN32 OpenSSL to 1.0.1j (Evgeniy)..+ Fixed: webhttrack incompatibility with Chrome..+ Fixed: assertion failure at htslib.c:3458 (strlen(copyBuff) == qLen) seen on Linux..+ Fixed: infamous crashes inside the DNS cache due to a corruption within the option structure (E.Kalinowski/karbofos)..+ New: added minimalistic crash reporting on Windows and Linux..+ Fixed: URL list not working anymor

    C:\Program Files\WinHTTrack\html\Makefile.in (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:makefile script, ASCII text, with very long lines (349)
    Category:dropped
    Size (bytes):19796
    Entropy (8bit):5.544815629624758
    Encrypted:false
    SSDEEP:384:wN152iTtmSQI+vDT3HYjY3AF9BawN+1IY2fQgOUK+JzpTZNC:Cv2iTtmSGvDT3HYjY3AF9BawN+1IY2fg
    MD5:0F45F34AD50E36C29E2C1D5F8E97282B
    SHA1:0597D4CABA0763901F11A182489A92565CB35BF2
    SHA-256:21C9D2C7704F95CF90667567B9E87EC8D021C3A9BBC179B40B52D4C80374B91F
    SHA-512:3716F47BF06D37D29EC3056BBBF48AFAEDA498AEAF098181EA9AE86453CAA3E9FFE2C3FAD42B437DAA14F9361CED716F5BEAB1D66E4F27C449C46539B8F0FB47
    Malicious:false
    Preview:# Makefile.in generated by automake 1.7.9 from Makefile.am..# @configure_input@..# Copyright 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003.# Free Software Foundation, Inc..# This Makefile.in is free software; the Free Software Foundation.# gives unlimited permission to copy and/or distribute it,.# with or without modifications, as long as this notice is preserved...# This program is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY, to the extent permitted by law; without.# even the implied warranty of MERCHANTABILITY or FITNESS FOR A.# PARTICULAR PURPOSE...@SET_MAKE@..srcdir = @srcdir@.top_srcdir = @top_srcdir@.VPATH = @srcdir@.pkgdatadir = $(datadir)/@PACKAGE@.pkglibdir = $(libdir)/@PACKAGE@.pkgincludedir = $(includedir)/@PACKAGE@.top_builddir = ....am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd.INSTALL = @INSTALL@.install_sh_DATA = $(install_sh) -c -m 644.install_sh_PROGRAM = $(install_sh) -c.install_sh_SCRIPT = $(install_sh) -c.INST

    C:\Program Files\WinHTTrack\html\abuse.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):21071
    Entropy (8bit):5.207250860239461
    Encrypted:false
    SSDEEP:384:l/fV+lHoSQi8d+Xw5Kfwepw5Cmuhklshnd3v6px/+U:pV+A/dOqK0CdhhRvUL
    MD5:1D89A9A7547179DAAE778DCC0EF908B5
    SHA1:289F614D8AEBBA9A3E7BD8E5D4D788E34330AB35
    SHA-256:282770D2A8BD03CA4083F7453001A9E827958408019C6CBFD940AC65D213B149
    SHA-512:3887C5994764ED4C2EAF37DBC5770D26146C7053D2CC153CD306519C204206BD88558C622EAC5849AD99530D5C34B62F627EC6D2C8881F05D3DA65112AD4C757
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\addurl.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):5785
    Entropy (8bit):5.120838398191975
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKFEju7fxlLu:5ym/JPNV+4GTzMNINTIHfbF8ohq
    MD5:FDD1D618AAC1BE97B2F14D52AFAAA5F6
    SHA1:CB31CF4E9031AC01BFB1D2CEBF3038BB23E07EE9
    SHA-256:0FD76E56BF1C7C123B8C1B3B3C93FE6FAFBD294A70445B719161C7665835B318
    SHA-512:B8A0AFAFC077FBF4D3C06F18599F1706D68DCAE5C4E61A52CFE13B529038370A43623A6562AC65206D8706624B5E226E25E236D25E8EC2B28FC49BF171C90C0E
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\cache.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):11067
    Entropy (8bit):5.1919349581405525
    Encrypted:false
    SSDEEP:192:5ym/KPNV+4GTzMNINTIhsM7ESZR7jtupdxmuSJuEHr6l29CIRToMLsAF8ohq:l/+V+lJWzXMprmu1EL6KCI1oXL+q
    MD5:1EBA20582A075D281CD488A5ED143E30
    SHA1:C91FAE90607BDA9CD335B340DD5E55C3E3DBA7E5
    SHA-256:A25B9AC3791C5CAC30EDAD325296B3C83D1B6731E9CE48A606DC2592EE33BE0B
    SHA-512:1F2A5D0C1B58CA4884B2392050861A3B36AC6CBF33E63F66E97B38B777D8DD67B16EA0A07E301F742C9C341FBFB8922460C774A5CD2ABEE3E023F88205E56E56
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\cmddoc.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):5583
    Entropy (8bit):5.107715249572924
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKFBskKQZbg9:5ym/JPNV+4GTzMNINTIVFKeOgF8ohg
    MD5:D00CB59EB5E64E6FD3FFC10962C8E114
    SHA1:BB55E0AD538A9CDE7556F9794EBC3A0F74A1402C
    SHA-256:EFF26868A40711316674C7889982A1C8442CC5D2AEB18422B56CF16BE9566A04
    SHA-512:76BA275B71CD1BDCA676575C1A1C8AAE99F74E9D9DC759CE0A785FABEDC111FC4B0C287AD1430A4768CA5D67510327EABDF10D9E1222EB0768DF3FD3872EE4BD
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\contact.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ISO-8859 text, with very long lines (603), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):9216
    Entropy (8bit):5.136800918131365
    Encrypted:false
    SSDEEP:192:5ym/lPPNV+4GTzMNINTIo/QWVowNLGgmdacz66JjDLkg7NRCF8ohq:l/ltV+lN11I6MBR+q
    MD5:D37B41E109339F58F83B2757DF7E4E1B
    SHA1:019D63317AD3D51A325896C44ABAFCEACFD356C5
    SHA-256:FA67041648CADF9B7D099F35A8E34A09925B80F5F192F9ABDEC2ED25C0259D22
    SHA-512:FF293D947D3373B57C60C080018D2BD160F214894D628AD28A949651972386629798463B0642D8E889F494A2AAFEB9F0FC013BAB188630871822DA3C13B18009
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\dev.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):5992
    Entropy (8bit):5.128161981291414
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKFzEgL4HAEl:5ym/JPNV+4GTzMNINTIsiKc27j2zF8oA
    MD5:9597BC7F175505FDD558FA22EACD654C
    SHA1:2787B672148BEC3F7234BB4C0F952C098C9CFFDC
    SHA-256:7B7DDB0A96CA2850E10E95A4967C7A8F01BEA4249A9BC293713A3833E7629ECA
    SHA-512:AF7E866692FEEB833995E848CEFDBA502863258019AD90C8D979EB86C2E9392F5EA7365F2F07FA247C229059131164760D8D625C6CD34794BB603E75840F5912
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\div\is-86O9O.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text
    Category:dropped
    Size (bytes):1506
    Entropy (8bit):5.103117153755365
    Encrypted:false
    SSDEEP:24:ecZAooM05I/mVd6L7XFNXIK5KQKPJg7K8eRlFp6zvv9Yb5n5opys8HQkY:/CSIEwieNhPJ+K8eRlFWHk68HQkY
    MD5:3B290E31D6562D32ABFE6CB1E7C51074
    SHA1:5BB97E8001972B07976241C47F31F5649C8070B1
    SHA-256:271791E4F548B6314FC35EEE9837569127A2BAA43487A7E21D6527FD76E16821
    SHA-512:D35052CE1411078F085D705C718083D7C32890B2CDF577FFB138704E7B4DB2807AE6BB7693D63D047D6CC45882161B17FF10CD046CF5166C2BB4D2D3818B2744
    Malicious:false
    Preview:.#!/bin/sh..# Simple indexing test using HTTrack.# A "real" script/program would use advanced search, and .# use dichotomy to find the word in the index.txt file.# This script is really basic and NOT optimized, and.# should not be used for professional purpose :)..TESTSITE="http://localhost/"..# Create an index if necessary.if ! test -f "index.txt"; then..echo "Building the index .."..rm -rf test..httrack --display "$TESTSITE" -%I -O test..mv test/index.txt ./.fi..# Convert crlf to lf.if test "`head index.txt -n 1 | tr '\r' '#' | grep -c '#'`" = "1"; then..echo "Converting index to Unix LF style (not CR/LF) .."..mv -f index.txt index.txt.old..cat index.txt.old|tr -d '\r' > index.txt.fi..keyword=-.while test -n "$keyword"; do..printf "Enter a keyword: "..read keyword...if test -n "$keyword"; then...FOUNDK="`grep -niE \"^$keyword\" index.txt`"....if test -n "$FOUNDK"; then.....if ! test `echo "$FOUNDK"|wc -l` = "1"; then.....# Multiple matches.....printf "Found multiple keywords: ".....

    C:\Program Files\WinHTTrack\html\div\search.sh (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text
    Category:dropped
    Size (bytes):1506
    Entropy (8bit):5.103117153755365
    Encrypted:false
    SSDEEP:24:ecZAooM05I/mVd6L7XFNXIK5KQKPJg7K8eRlFp6zvv9Yb5n5opys8HQkY:/CSIEwieNhPJ+K8eRlFWHk68HQkY
    MD5:3B290E31D6562D32ABFE6CB1E7C51074
    SHA1:5BB97E8001972B07976241C47F31F5649C8070B1
    SHA-256:271791E4F548B6314FC35EEE9837569127A2BAA43487A7E21D6527FD76E16821
    SHA-512:D35052CE1411078F085D705C718083D7C32890B2CDF577FFB138704E7B4DB2807AE6BB7693D63D047D6CC45882161B17FF10CD046CF5166C2BB4D2D3818B2744
    Malicious:false
    Preview:.#!/bin/sh..# Simple indexing test using HTTrack.# A "real" script/program would use advanced search, and .# use dichotomy to find the word in the index.txt file.# This script is really basic and NOT optimized, and.# should not be used for professional purpose :)..TESTSITE="http://localhost/"..# Create an index if necessary.if ! test -f "index.txt"; then..echo "Building the index .."..rm -rf test..httrack --display "$TESTSITE" -%I -O test..mv test/index.txt ./.fi..# Convert crlf to lf.if test "`head index.txt -n 1 | tr '\r' '#' | grep -c '#'`" = "1"; then..echo "Converting index to Unix LF style (not CR/LF) .."..mv -f index.txt index.txt.old..cat index.txt.old|tr -d '\r' > index.txt.fi..keyword=-.while test -n "$keyword"; do..printf "Enter a keyword: "..read keyword...if test -n "$keyword"; then...FOUNDK="`grep -niE \"^$keyword\" index.txt`"....if test -n "$FOUNDK"; then.....if ! test `echo "$FOUNDK"|wc -l` = "1"; then.....# Multiple matches.....printf "Found multiple keywords: ".....

    C:\Program Files\WinHTTrack\html\faq.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):52811
    Entropy (8bit):5.011530968063998
    Encrypted:false
    SSDEEP:768:DV+RlfcF/sfnMDue+huC1zjWUDbQFeBcF/Oyf/dJVJLqoMUg:glUF/sfXewF1zxD+eiFlHdbJLm
    MD5:46AE64FEDE879BDF5D6AF403917B4EB8
    SHA1:07D45D7820C63F49C64962DC5005205A1385BB96
    SHA-256:BA4118706C37CEA29B890550E591A84ABA5BB50D49B952B6BA8D78322CD5950E
    SHA-512:7FC19CC9AD4B390BF593139680F77B331011CC0F351FDBDD750D13F0039CF60536822FD6A778F75917A529A88E8B49BD49E246C0117895055D827F746B123634
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\fcguide.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):105472
    Entropy (8bit):4.921317320877524
    Encrypted:false
    SSDEEP:1536:L+hCmFkDMpZH0rFCi0FZdaTkO7Z+/y+dFwOs3jT:L+hnFOMvS0FbaTkA+a+dFwOYv
    MD5:24A8361EB3C63D5478671BE9D4D908AD
    SHA1:16FC30299A7D83FD626A33E36E003BFD706748E1
    SHA-256:EACC80E42F205270587FA18A4C912C7FEAA18B460634961D01EB6C253258A345
    SHA-512:6B28396CD2E4E316F15EB134542EC354F8D23C10EA7574C91E6F6ABB8541DC2AAF97A751D527E1BF685FAC9C51E0A30483D254CD5C3B0A58B07635959DBE4C4E
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\filters.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):19497
    Entropy (8bit):4.887832798018361
    Encrypted:false
    SSDEEP:384:l/fV+lvUEXSzs6T/J3EVcxVkZxdPJmJ3KQI5w53u+q:pV+SzruQIiE
    MD5:B5E54867B9FFF5C98C6BBCDE4D0EB4C7
    SHA1:A68B98F540E58247BED1011204C087AB5C2B4BEB
    SHA-256:367A51005B6D0FAAE37EB34022F7B46DF4FDA08FABA82937C28E8D9645270C8C
    SHA-512:15B823764C1C13FC628D3328821E0317CFBB8A9FB628204652DFE3EBB9434064776F51AE637ABB65F1B729ADDF1818F67E47A897A2DC150B726A740F4FC9C066
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\httrack.css (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text
    Category:dropped
    Size (bytes):1914
    Entropy (8bit):4.959904245247355
    Encrypted:false
    SSDEEP:48:19JZI7XKWsee++XvX7aT2ypOuGq1F5HVf/sebfj:19JuLKO+fLy2yY70XH1z
    MD5:2E4FD7238B05CE0F73F8D70D10A66D84
    SHA1:4E03F2DBCA1B307C658156ACD7BF30FBF866A774
    SHA-256:9A1BBE9E472DFFE9888230C0FF017E21295334B17273D30DDCF1381E4358C6EB
    SHA-512:2DADE3F6EE54FDE1145204EE8DA331DA248FB633E8D8009AC34A1952807BF8F4881B9BDC9C1C251348E48B16B6CEB375B55C485414021AD7176C15FF46C74E8B
    Malicious:false
    Preview:.body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 0.96em/1.3em "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}../*..Width for "#siteNavigation td" based on number of buttons..Six: 16.6%.*/.#siteNavigation td { width: 16.6%; }.#siteNavigation a {..display: block; padding: 2px;..text-align: center; font-weight: bold; color: #448; /* font-size: 12px; */ background-color: #99c;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }.#siteNavigation a:hover { text-decoration: none; background-color: #fff; color: #000; }.#siteNavigation a:active { text-decoration: none; background-color: #ccc; }..a:link { text-decoration: underline; color: #00f; }.a:visited { text-decoration: underline; color: #000; }.a:hover { text-decoration: underline; color: #c00; }.a:active { te

    C:\Program Files\WinHTTrack\html\httrack.man.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text
    Category:dropped
    Size (bytes):53435
    Entropy (8bit):5.18614897584775
    Encrypted:false
    SSDEEP:192:dHwmAurWhLcKEbxKdlvkZe6GAbDIVjoFJsbDUGzo2X4ObDjEaRMOubDasaHDfiND:rrUUAdgae5Y9T8ZnVUFVWZYaOnlYqE1X
    MD5:E71DB8F1C20E497DD44B96B14F731C91
    SHA1:4AFDC9FACB43B93F2724BDAC4BFB6141F2639957
    SHA-256:C0A508B8B4290283990C90306A5DC6D3578D820DAA41D4F80AFE43332A3AF4B4
    SHA-512:6A143553DB5AA6126D103FB45AD942749D5C82C9C8C40B5CB6009AB43B89CFFC7DB4074669EAB45DCA63E830351B2C12BCF4E8CCFF1567566824BDB462FEA4A1
    Malicious:false
    Preview: Creator : groff version 1.20.1 -->.<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"."http://www.w3.org/TR/html4/loose.dtd">.<html>.<head>.<meta name="generator" content="groff -Thtml, see www.gnu.org">.<meta http-equiv="Content-Type" content="text/html; charset=US-ASCII">.<meta name="Content-Style" content="text/css">.<style type="text/css">. p { margin-top: 0; margin-bottom: 0; vertical-align: top }. pre { margin-top: 0; margin-bottom: 0; vertical-align: top }. table { margin-top: 0; margin-bottom: 0; vertical-align: top }. h1 { text-align: center }.</style>.<title>httrack</title>..</head>.<body>..<h1 align="center">httrack</h1>..<a href="#NAME">NAME</a><br>.<a href="#SYNOPSIS">SYNOPSIS</a><br>.<a href="#DESCRIPTION">DESCRIPTION</a><br>.<a href="#EXAMPLES">EXAMPLES</a><br>.<a href="#OPTIONS">OPTIONS</a><br>.<a href="#FILES">FILES</a><br>.<a href="#ENVIRONMENT">ENVIRONMENT</a><br>.<a href="#DIAGNOSTICS">DIAGNOSTICS</a><br>

    C:\Program Files\WinHTTrack\html\images\bg_rings.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 501 x 456
    Category:dropped
    Size (bytes):4235
    Entropy (8bit):7.944071402073359
    Encrypted:false
    SSDEEP:96:KqFHZj0KbQWaccNykXUzdSDJRXi3GIvl4M0MiiVQCve:KqVZj5bH0yGUcRy/q6QD
    MD5:89901B7113B4D2B7D1AC3AD5B59D297F
    SHA1:A7F90C09ECA9295C52260B2B6F3E04CED0BDE6D2
    SHA-256:184A19682D4439A94400329411B5CB4ACC5500CCD4E802A7E284F546894DCB9D
    SHA-512:96D310FC8E302F51D19194A28C2FBF2B5A1CB380B1E67EE23D32576155ABEE4CD9C9F9A608F4BF76FF70AC139DA38DC8BE7FFA2E39D490A7328C4FBC3ADA70B0
    Malicious:false
    Preview:GIF87a............................,........@......0.I..8...`(.di.h..l.p,.tm."!.C....pH,....8h....tJ..t..v..z..0.i-..hBO.n...](@...y=...BM;wz.O;M.m..........C.....X.....$...n....<s...Y..[.... ..b..(...C....6|].........g.\...........I.3........Kv).....:..q....F.......^?....a...|...3..\.q.{q.3...E... L.1.\K2.....)#..|.G...Z.QI3EL`3{.kG..K.bp..Gr...=..E...S.?K...u*./\I.T..l..r.z..N...Y.Z{.a,.......WR[.:...`fv..-.G........U...I.[.M`..7.%......6K.............?.fW.j....M/xo0...>..x...4....su.+...x.w.A..{.....<..DK._....-..g.;`:...........C.....Z.'.M..!...<a.!...C.S.`.Z\v.J ..V.%...}..8.a(....R.C..]..r.X.K..c.>.i$=....L.........<..9dP.%$V^...O.w.a[>..h.Y.4g..fmk^E.t..'qs.'.w..W.{B..)."d.}0B#.....F.h..Vj..R.!......fx.C...6......ZD..R....S@...ph.>(:.=...k.;".`..l...#.:,.6.b..K."...".{...`......Ut......!xgX....n9+.2.....f`!.......r...\Ip.....Sd....e..p.\.....q...F..q......(.R...v0.-......0qa.o.S9X..M.l..$.,....sd@. ..5.d].5.,W.e.,!.RH...n-}

    C:\Program Files\WinHTTrack\html\images\header_title_4.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 89a, 400 x 34
    Category:dropped
    Size (bytes):1986
    Entropy (8bit):7.832106548232159
    Encrypted:false
    SSDEEP:48:XD7LljQ9Cs7mlPRe28j18AkqFv1RO766kVzfJzrssiyejst7yHve:Xzlc9Cs7GPvQ1TkWVZ4xyGY+HG
    MD5:8E8BC9C63A59AC8BF23CC894C96E4405
    SHA1:BE6B7FACD7830EDD612499F971E2CC3B03681082
    SHA-256:0E2E5B02984BDD88B9ECDB4A03D017877793F768B4DE88169EC10AEA660B5F2E
    SHA-512:F3142CC72F68CDD353C852FB98F70E0778C76837AA726F973DB58F9AA05BB69285B9736A096BF2C1CB8AD59D9AC0FE0107B69C7E45ADEC43D76C16C8D5F60151
    Malicious:false
    Preview:GIF89a.."..........kk.??_...{{....++AUU....44Nvv.JJo..-``....!.......,......!.@....I..8...`%.$..h..l.p..Am..m..._MF..~..r.l:.).pJ..2.P#......ji.m..q..0....tA...{ -..}....5t.6....kW.b|.:,;.....z.......j<a_...:.R79B..Y ..b;..[......k6If?.+.5....q.......~......6.......)......o.x.5........b.......~.........p..&Q.!...0....2B*.8...;,^...H@...]S.Q....8/.6.......U...D.X.{cJ..Q.$...~><...R.?....M..X.j.'0`.....$.C...n....T....+R...2.&.r@@BM..%N..ha..;.F..V....=.>&A.....:.T....."..E.d..}%...+.:..c....P.Yc[.PY!]m..& ....\*.C`.9.....&.|...L..HlP..P.g.W..#..5.9...rA+xV.....:........v.Z.....T.Q.......{#.0`r.....U.$....0.4.Y`.|..#.D)8p....5."+EU.R....4=..Q@...SP.Ol.(.D....+v%..L9...Fv.`.TVi.UH^.e,.R../...d...S...5].E.6.Qq......}d..hM....<.g."...MKND.+...$.f..A.~,.CLq.b.D..a..q&`.=.j.h3..`.kh..%A....l.H8.I..t...0......?...I.B}..\..N.G...f..Gb...X..x.hQ|..Aj..T+F..%....z..n..W!..i.].B....N..=..B..H...M.~K......!.|.P..^..R.Pj.#...n.#O@i..fz-...c.=.4..En......m3.T6o..`2.. "D.~

    C:\Program Files\WinHTTrack\html\images\is-DOCQP.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 300x233, components 3
    Category:dropped
    Size (bytes):6046
    Entropy (8bit):7.869057682104174
    Encrypted:false
    SSDEEP:96:SIUmp3XalHWMY8zrFA/R3xdnDl9X6YnqHZV9qpY/Y01bthnXla4CX9YG5wDRJQy:2qXaNi8KZnR9Xr4p/X1bthnVa4CX9YEQ
    MD5:6119412D157149921683BB768A46D6CB
    SHA1:17E4E738740ACAC867AFCFDC361899D1D7798E44
    SHA-256:22A95127FB86AF5809F59F359B3A05DF76D2B21809658F819517CEF456CCE0D0
    SHA-512:5354C0C4F13CEE45B1114B8D53CF8DA522393B913116696C17153CAEB97E897AF9E1CE3B6D4FEF94345630BCFD146EA0E38710B9378FF6E4EDAA8252A332707E
    Malicious:false
    Preview:......JFIF.....d.d......Ducky..............Adobe.d.........................#....#"....."'."!!".''.030.'>>AA>>AAAAAAAAAAAAAAA................!....!1!!$!!1>-''''->8;333;8AA>>AAAAAAAAAAAAAAAAA........,.."...............................................................................!1..AQS....."2R.s..aq.B.E.#.T.....3rCc$%......................R.!Q.1..Aa.2..............?...[2....N.)i..ApF..a.....c.:.^.b...T.aH... .z....X....[.+Y0l....}KV..Z.j..w...\...G.....K..kTY..f.v.2..hh.-0....+._..G..X...'..Z&..-o..%..xLg..OyWsjO...1....>.[.~.s#..d..h.:aa].Oia..k.JZD!..J....'%..x1..;..l.?.s. ......&..o".s.."w..E.h..../.N.H.}.../.D.X..c=.q..<k9.y.kC.p...."...T&..n....\>.cz.b..p..`&.J..V.O.f .X.M.0>....c....s[..;..0\ ..f.B..g...,..k..%h.K..bx.N.Z...0K...X..o....4...*i..9-.....y......7......../.../...ym.........w.2.....;..z....|-I...|-N[t......?.w.2..Y...r|.j..S..j..T.H0..A.s.wqs)...;..vq(v.....g.S.. .vr...m..3....[..i.-LJ..p.9m..'g,g.{gq)..oj.%...g.S..m.-NKt......

    C:\Program Files\WinHTTrack\html\images\is-F0BAO.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 501 x 456
    Category:dropped
    Size (bytes):4235
    Entropy (8bit):7.944071402073359
    Encrypted:false
    SSDEEP:96:KqFHZj0KbQWaccNykXUzdSDJRXi3GIvl4M0MiiVQCve:KqVZj5bH0yGUcRy/q6QD
    MD5:89901B7113B4D2B7D1AC3AD5B59D297F
    SHA1:A7F90C09ECA9295C52260B2B6F3E04CED0BDE6D2
    SHA-256:184A19682D4439A94400329411B5CB4ACC5500CCD4E802A7E284F546894DCB9D
    SHA-512:96D310FC8E302F51D19194A28C2FBF2B5A1CB380B1E67EE23D32576155ABEE4CD9C9F9A608F4BF76FF70AC139DA38DC8BE7FFA2E39D490A7328C4FBC3ADA70B0
    Malicious:false
    Preview:GIF87a............................,........@......0.I..8...`(.di.h..l.p,.tm."!.C....pH,....8h....tJ..t..v..z..0.i-..hBO.n...](@...y=...BM;wz.O;M.m..........C.....X.....$...n....<s...Y..[.... ..b..(...C....6|].........g.\...........I.3........Kv).....:..q....F.......^?....a...|...3..\.q.{q.3...E... L.1.\K2.....)#..|.G...Z.QI3EL`3{.kG..K.bp..Gr...=..E...S.?K...u*./\I.T..l..r.z..N...Y.Z{.a,.......WR[.:...`fv..-.G........U...I.[.M`..7.%......6K.............?.fW.j....M/xo0...>..x...4....su.+...x.w.A..{.....<..DK._....-..g.;`:...........C.....Z.'.M..!...<a.!...C.S.`.Z\v.J ..V.%...}..8.a(....R.C..]..r.X.K..c.>.i$=....L.........<..9dP.%$V^...O.w.a[>..h.Y.4g..fmk^E.t..'qs.'.w..W.{B..)."d.}0B#.....F.h..Vj..R.!......fx.C...6......ZD..R....S@...ph.>(:.=...k.;".`..l...#.:,.6.b..K."...".{...`......Ut......!xgX....n9+.2.....f`!.......r...\Ip.....Sd....e..p.\.....q...F..q......(.R...v0.-......0qa.o.S9X..M.l..$.,....sd@. ..5.d].5.,W.e.,!.RH...n-}

    C:\Program Files\WinHTTrack\html\images\is-LKLVS.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 89a, 400 x 34
    Category:dropped
    Size (bytes):1986
    Entropy (8bit):7.832106548232159
    Encrypted:false
    SSDEEP:48:XD7LljQ9Cs7mlPRe28j18AkqFv1RO766kVzfJzrssiyejst7yHve:Xzlc9Cs7GPvQ1TkWVZ4xyGY+HG
    MD5:8E8BC9C63A59AC8BF23CC894C96E4405
    SHA1:BE6B7FACD7830EDD612499F971E2CC3B03681082
    SHA-256:0E2E5B02984BDD88B9ECDB4A03D017877793F768B4DE88169EC10AEA660B5F2E
    SHA-512:F3142CC72F68CDD353C852FB98F70E0778C76837AA726F973DB58F9AA05BB69285B9736A096BF2C1CB8AD59D9AC0FE0107B69C7E45ADEC43D76C16C8D5F60151
    Malicious:false
    Preview:GIF89a.."..........kk.??_...{{....++AUU....44Nvv.JJo..-``....!.......,......!.@....I..8...`%.$..h..l.p..Am..m..._MF..~..r.l:.).pJ..2.P#......ji.m..q..0....tA...{ -..}....5t.6....kW.b|.:,;.....z.......j<a_...:.R79B..Y ..b;..[......k6If?.+.5....q.......~......6.......)......o.x.5........b.......~.........p..&Q.!...0....2B*.8...;,^...H@...]S.Q....8/.6.......U...D.X.{cJ..Q.$...~><...R.?....M..X.j.'0`.....$.C...n....T....+R...2.&.r@@BM..%N..ha..;.F..V....=.>&A.....:.T....."..E.d..}%...+.:..c....P.Yc[.PY!]m..& ....\*.C`.9.....&.|...L..HlP..P.g.W..#..5.9...rA+xV.....:........v.Z.....T.Q.......{#.0`r.....U.$....0.4.Y`.|..#.D)8p....5."+EU.R....4=..Q@...SP.Ol.(.D....+v%..L9...Fv.`.TVi.UH^.e,.R../...d...S...5].E.6.Qq......}d..hM....<.g."...MKND.+...$.f..A.~,.CLq.b.D..a..q&`.=.j.h3..`.kh..%A....l.H8.I..t...0......?...I.B}..\..N.G...f..Gb...X..x.hQ|..Aj..T+F..%....z..n..W!..i.].B....N..=..B..H...M.~K......!.|.P..^..R.Pj.#...n.#O@i..fz-...c.=.4..En......m3.T6o..`2.. "D.~

    C:\Program Files\WinHTTrack\html\images\is-VQENL.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x238, components 3
    Category:dropped
    Size (bytes):8473
    Entropy (8bit):7.781336937589333
    Encrypted:false
    SSDEEP:192:NQHtczQZVyim2sT56J/cysDpBU0DCz5ObFAmmsIeLHMX8ErF1M+:NQHtKCVxUcJ/lq7UrEb1n28O1b
    MD5:FB0C4753FEE5CF75DB20A82477E7B24F
    SHA1:8AF4E7F37E3D446B2D7AFDA247F7B22DC75E0A7B
    SHA-256:AF88EE9814BE9185A65876552A4A2497CE29B28BB56F5CEF121BBC4341C27911
    SHA-512:E1273BF68DE9ADC85DB48EA274BB8A3D034B0303AEC6A9784186BDB5F903967D55D48760B72D9E38CB70BD9FF34881425E05BCF0570354BB86B025D3D8C8C91B
    Malicious:false
    Preview:......JFIF.....`.`.....C................2!....=,.$2I@LKG@FEPZsbPUmVEFd.emw{...N`...}.s~.|...C.......;!!;|SFS||||||||||||||||||||||||||||||||||||||||||||||||||........,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...n..B..2.6...J/<.R`U.\......`[...+8l.Nx._Z........5....0.`....Ni.Mx.(HC.?)...R}=F?....ll....J.........>V.S=.}.NW8...v3..&......&...9..T...V..6...z..J/..2I=.CG+...t..F.d.<e.....<...0..2@Q...U..l{....c...$l.z.......%e&.T..*.....s.c.^.v.p.A.........H..........6.,......k...~].....8.,......`I....:w........4.{k.[....Q.....lq.b02x_^.=9.a{...?/....T..m....8...Z.{...

    C:\Program Files\WinHTTrack\html\images\screenshot_01.jpg (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 300x233, components 3
    Category:dropped
    Size (bytes):6046
    Entropy (8bit):7.869057682104174
    Encrypted:false
    SSDEEP:96:SIUmp3XalHWMY8zrFA/R3xdnDl9X6YnqHZV9qpY/Y01bthnXla4CX9YG5wDRJQy:2qXaNi8KZnR9Xr4p/X1bthnVa4CX9YEQ
    MD5:6119412D157149921683BB768A46D6CB
    SHA1:17E4E738740ACAC867AFCFDC361899D1D7798E44
    SHA-256:22A95127FB86AF5809F59F359B3A05DF76D2B21809658F819517CEF456CCE0D0
    SHA-512:5354C0C4F13CEE45B1114B8D53CF8DA522393B913116696C17153CAEB97E897AF9E1CE3B6D4FEF94345630BCFD146EA0E38710B9378FF6E4EDAA8252A332707E
    Malicious:false
    Preview:......JFIF.....d.d......Ducky..............Adobe.d.........................#....#"....."'."!!".''.030.'>>AA>>AAAAAAAAAAAAAAA................!....!1!!$!!1>-''''->8;333;8AA>>AAAAAAAAAAAAAAAAA........,.."...............................................................................!1..AQS....."2R.s..aq.B.E.#.T.....3rCc$%......................R.!Q.1..Aa.2..............?...[2....N.)i..ApF..a.....c.:.^.b...T.aH... .z....X....[.+Y0l....}KV..Z.j..w...\...G.....K..kTY..f.v.2..hh.-0....+._..G..X...'..Z&..-o..%..xLg..OyWsjO...1....>.[.~.s#..d..h.:aa].Oia..k.JZD!..J....'%..x1..;..l.?.s. ......&..o".s.."w..E.h..../.N.H.}.../.D.X..c=.q..<k9.y.kC.p...."...T&..n....\>.cz.b..p..`&.J..V.O.f .X.M.0>....c....s[..;..0\ ..f.B..g...,..k..%h.K..bx.N.Z...0K...X..o....4...*i..9-.....y......7......../.../...ym.........w.2.....;..z....|-I...|-N[t......?.w.2..Y...r|.j..S..j..T.H0..A.s.wqs)...;..vq(v.....g.S.. .vr...m..3....[..i.-LJ..p.9m..'g,g.{gq)..oj.%...g.S..m.-NKt......

    C:\Program Files\WinHTTrack\html\images\screenshot_01b.jpg (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x238, components 3
    Category:dropped
    Size (bytes):8473
    Entropy (8bit):7.781336937589333
    Encrypted:false
    SSDEEP:192:NQHtczQZVyim2sT56J/cysDpBU0DCz5ObFAmmsIeLHMX8ErF1M+:NQHtKCVxUcJ/lq7UrEb1n28O1b
    MD5:FB0C4753FEE5CF75DB20A82477E7B24F
    SHA1:8AF4E7F37E3D446B2D7AFDA247F7B22DC75E0A7B
    SHA-256:AF88EE9814BE9185A65876552A4A2497CE29B28BB56F5CEF121BBC4341C27911
    SHA-512:E1273BF68DE9ADC85DB48EA274BB8A3D034B0303AEC6A9784186BDB5F903967D55D48760B72D9E38CB70BD9FF34881425E05BCF0570354BB86B025D3D8C8C91B
    Malicious:false
    Preview:......JFIF.....`.`.....C................2!....=,.$2I@LKG@FEPZsbPUmVEFd.emw{...N`...}.s~.|...C.......;!!;|SFS||||||||||||||||||||||||||||||||||||||||||||||||||........,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...n..B..2.6...J/<.R`U.\......`[...+8l.Nx._Z........5....0.`....Ni.Mx.(HC.?)...R}=F?....ll....J.........>V.S=.}.NW8...v3..&......&...9..T...V..6...z..J/..2I=.CG+...t..F.d.<e.....<...0..2@Q...U..l{....c...$l.z.......%e&.T..*.....s.c.^.v.p.A.........H..........6.,......k...~].....8.,......`I....:w........4.{k.[....Q.....lq.b02x_^.=9.a{...?/....T..m....8...Z.{...

    C:\Program Files\WinHTTrack\html\img\addurl1.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 430 x 247
    Category:dropped
    Size (bytes):9687
    Entropy (8bit):7.969114275230565
    Encrypted:false
    SSDEEP:192:8iuF2KHh2HrZrGYc4hZRch7k/3r411ay8ioZvYsHVDP3JY+BE8i1mb5mt0/qEZw:8xPh2LZrGYT3M1l8LYstPZYIXi0mKqE6
    MD5:D7E20C0B6CFFCF77BCCBBF896A51991E
    SHA1:2DC1DC7EAAA71D6AD0976B78B410AC526E22BF4C
    SHA-256:E20C55B4140E7D0718564FA78B6A6DF531778DEEB7575F7A2C5A11B2B7CFC418
    SHA-512:F86C6C49C1A5CD5FE25A530303ECF56DC2A53CA08DED200B54323ED540E3BAD7CF2A595A8B044EC9C63D414C62341567FBA7EE3BCF41FBB682D2053FED874E81
    Malicious:false
    Preview:GIF87a..............BB..........BB9,........@......0.I..8...`(..g..0..!.. .@... ....?.....o@D:..tJ.Z...sk.i.[p..%..^.Z.>..o^Z.f..k|}....Cj;.D........2....2..(-........X.......9`.m..w.pzv.shx.r..y}.z.u......u...C.8....2.'(..(..........................................(O`;.......S.....PP.....1R.X..#...;ZS@.....0U:p....i.4...8s.....@.B..P_Av....d..E....l.dT.XCf].q.....BMW.e...M.-.RjK....hJ$.I./.J=9...X.`17.].w.a...d.y..u.p.wa.p..1d....5....e. .R4d.._...(D{.1%.y..o.....:<.mz.3.X....._...o7C...k/..cB.\.s.......Y......._O.9........v....L.`...c!..D_..V`..@Ri.@H....u.5'eb....T..#YU.........0.....8...nM2..4i&.."...D.i...\R....}....B.q..%.U..@...e.`~)f.N....M..\CJn)Q~]....PN..y(.&.|......^.K.d....!a;..K.J%UE...O.Z..fwz....P.......y..*q..Y..........*%..Gh<.>y.VYV9%...:'%..6...F+..Vk.J..mV.......$.$.D.D.aT..W..-x.~.)....m....P..2.j}Y.l...:o.......6<.........Z.}._:...k....k...$g.......>,..B-..r.4.l..8...:....;...@.mt.H....K'.4A.b...T.lu..a...\w.

    C:\Program Files\WinHTTrack\html\img\addurl2.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 89a, 430 x 247
    Category:dropped
    Size (bytes):9834
    Entropy (8bit):7.970745894312722
    Encrypted:false
    SSDEEP:192:5pM19FKVX/r7BOUOLKD1ic5afH03s/dPapI+9/OR2QKmktUGLbV7Gz:6cVX/rFtOOUc5av0CYIU/ydKR3V78
    MD5:BDB8103FCE5ABE82BA509851192C6FDC
    SHA1:9DB9D3244D453AFD62EF53C39D05F6E013E5B8CF
    SHA-256:B02A59502AA72342CB6638F517AAB88767B4D119B85927766BC102CFEF565072
    SHA-512:6D6E9D19166EB43F541C61DEC2C21E87EBA68325BF7F3527DF56B6D767489538274843FE67DBCDF1A474FB982138D19F6899F0AADD5428DB8817FA4395400AF8
    Malicious:false
    Preview:GIF89a..........B99.......BB.......,........@..H...0.I..8...`(..w.BQ.....+..j..p....9.A.....^axl:..tJ.Z....X.v._..;....t.lF/.;t\....w.~...i:.C..............2(-........W.......8_.l..v.oyu.rgw.q..x|.y.t.~....t...B.7......(.3(.............................................._.k....d...j..X.0c.E..#..(..#.'.... d.K.....@c>l...I...8s....OH........,.HT.e..-.z...j9m...|..T.(c...`,..%.XT; m#.J.$=.....e..\{.m...m..j.d.6B.hdc.h.u.......).K..h1C.tY._.x.. ..u.e.2...!=.aC..}{(.V...x. U.%.+_.9s.V.....,p....'z..o{...>.<.......{......OO.;.............7.n.M..IJ. @Wt........%..e....5..C.0.j.r..Y...!.%:8.R!...-....@..Z.5".......1...sD.i.Hj..F.fe.L...PoS...@X.7.QWZ.q.i...d.if..Q..;MZ..A0-.....p.i...y.BK?.*.M..y....9m.g.G+&.`.!...a.M..Ws..&.U"......'....l..J...|..:N...^~v.G%.{~.d.. ....(.....(..=T..._...Jj}.i....+..k..{...6+.....l..c+.X.E...&......V..$...F..{....JS..V.:.B+....,.A....z..<..C.2[J...LkZ,.....O..M...&.......v<.gt..N...4.lq..J.t..R...Vg]..Xs.

    C:\Program Files\WinHTTrack\html\img\addurl3.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 430 x 247
    Category:dropped
    Size (bytes):10529
    Entropy (8bit):7.973281792659444
    Encrypted:false
    SSDEEP:192:GlZwUO7uLzhf+kdiE/y3g/2g4RycAIqqaF6Nq+Cb2I1sXui6JFWUer38e3UlrOeE:GMPKhfeE/mg/2g4RytIqN9+Cb2I1s+VA
    MD5:91CEF992FD88A3938A7B8EBFA2957BBE
    SHA1:0E5BB1CB87D26A1519C6C20E4084227630962118
    SHA-256:C7C02FC4813DFE506C8E60285854BD4FC7D99CBB20262CC99E42C6596783FEEE
    SHA-512:1D74264B78EB2693A44812770035BF02827956CE946FE1922F9AFB181C73A3ED5822F1C3354F992B48FD4F048D4DE5381BD4247634C8BC7729159FAFAEB20357
    Malicious:false
    Preview:GIF87a.................99.......JJB,........@......0.I..8...`(..g(.a..0.B..EZ.p....9]A...}.cmXl:..tJ......u..m......m.6s}_...v..xz~....Bx.7:.C.B.C..........32,.././(V.......Nhv.r.idstof.m.q..zox.........k.l.............3.2.......................2.................7o.y...;HP^.z...C..!.n.2>.G...;...U;q..L..`......(M.H.].....Spb....z2..........8r..P.J.J...X.j.:.c@.3.5.....sG.%-.....g...q..t....T_..h..M.c....+^.j..!3z.)V....3..l7g.:+..8Z.Cm(K.^....'c.9...|.C{5....|.i..L.8...+_.....;g'.!..%.....xo...........K_.....A*.?.2YK..<.......db..-h...g..R.............X..a.T`.-(....Xb.5....1 .C5....c-.(!..}g.\7..:...>..Rh".'..7.FJ...n.9I.n.Qi..;.^.@v..^...bz.du..9...i.Rn..R...w..NR9_..a..F.I...-U&.....}~F...L.f.[....=...._...R...)....yed.ny........._.Y.I.....Y..ZE...k.....A...jC....,.{.*....h.u.~...&..M..$..R'Zz.*Kj7F.....+...ko.LM.o..B..>.fl....I.,..R.Be).F...........V......\.x..*..%G...s.p..Wyn..^<n6.s.sT...3.^K[...g.B.D.G/......2......a}..^.]

    C:\Program Files\WinHTTrack\html\img\addurl4.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 506 x 282
    Category:dropped
    Size (bytes):9683
    Entropy (8bit):7.966546233554232
    Encrypted:false
    SSDEEP:192:HaX8qaqMoF1ZSHoa2WhccNROAGD6eerImjHAa39Gl7ltisrix5eTlGTt4KwpYrXD:IxMoF1cQWhTNkBD7ernjRWhtiB7hTL3X
    MD5:BEA787BC2F5032F298658875977785BC
    SHA1:31E8308CFFB9894E98B57AE541DEC0004D5D4D0B
    SHA-256:F1BC347DC3F3E5F2E3953BC3AFA6375C514060013D1A13703615462E7A2A961A
    SHA-512:6DB44FF98B4D12D8C8C234FF403F2FDA32FEABAF89C43184F8095E8B5E5E46B4A18340AF8ABD650A9583C69B8EB33A4C5B719D78440AFE3CB1B6CAC285FC3A79
    Malicious:false
    Preview:GIF87a....................k))!!!.ss.,........@......0.I..8...`(.di....F..q..p.........f..f.`K.k:..t:UF...m{.../w..o.g...F...w|N...x.@o....~5......{....6.~.......5...<..(.....+..+...99..........*..T......RXjrywpkp........................<....<..................*.P....l)......#J.H....3B..p.B.z.....@.F....3.1..#D.t(sc... . ....3#..0 (...>nxy..*..8.. @...)7..Y..J.P/`...,..;GJDI....C.Jp:5)O.>..`.k@..J..(..@M.|....S$......G./.........+....S..;....:.5.[5...}.}.m...|........*<f..CO......i.'..x.."../....F.9X....c_T.......0....x....16._#a..|z...<....z.....E.SJ.e. ^.$.Zh...k.H g...~Ga..v.,H.d...\\+.....vG.a....#)..d2n.[}>.(.....G.:....7..{aX_..>g$.iMhdW.E@.a....H.f.H7".Xg.....*..TG.&..F.f..F*.........`....;.....`...T.........b?f....n..R..8...WO.;%..$w.5_..Z......,J....%.!\..vH..tw....H....n...F..fV.N..u.[....G..Z.X.9P.....R....Q..'....?4p.........`.....w....=\.`O.|q...... .....7@pk..(..).........*_.>.w........\p..p......XO.4.(..

    C:\Program Files\WinHTTrack\html\img\addurl5.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 350 x 336
    Category:dropped
    Size (bytes):9659
    Entropy (8bit):7.96595396151648
    Encrypted:false
    SSDEEP:192:Gn8cxC/utDKCU9vX4FdiAieuEylY8FPmc0h/IXxTCLtmVrIBUTkhxjbXRBR:g1ndU9vIbLyEb8FPih7RmVUvzbXRv
    MD5:E27285B1B06742ABCF04BAB83DE8F8A8
    SHA1:556AF02C4A17B7E7706EF44C21C737BFBCBA0E7C
    SHA-256:3FA4944E568A5F6F81EE7D3AFD2BB3217E828E86E0BFF1E5898E76D9C77ACD24
    SHA-512:9A07DFE437A5F7E2972C9BB6EB8F4809B0CD6DBF2F052F26C8736A53D6304EC06143777ACE38853938FDAA5693EB845C165D1FAED7B488A0E771ADEEE25D8924
    Malicious:false
    Preview:GIF87a^.P...............RR....)!!ssk,....^.P.@..(...0.I..8...`(.."..A..1.F[.(0.x.....@.....;...S.z..t@.Q.V.uK.i.]......b......T.[.......,....J....&........../...}............(.34*4.H...TK....].>S?.c.dgnek.n.p.kvzzvx....6....}............0...%........1.0...%.....,.S.c.M...4......Pd.!.{......;.....x.....J.H....u.Mr.@.!.H4...@e$.....I..E.......).N.Be.n\....H....U.........h...V..b..UK..W.n..}...Y.d....7..Gd.*.'....1bw.2...(.L)..8X.I...Ae.........=w6.zh..r.UZT(n.u..~.w..y.>..vr..?.N}.u...`........O......_..x.A...O..........>wK..d..74.2.9...H...P.'J4.M&..x@>..`C).>. ..n. !..p`.J......"...6.6.a...X.....!..<..2...w.J8H....B.Xa..<XD..m......2...!.8....R9.... .;.....).&J....!>..v....J...?..'.h...%v.r..w..).WZ.$..<.%.....u28..!......e)..j..*.....^&..+,y.v..".j.....,6..B.ej.x%..([..(&."......hK..........;Jz$xg6Xc..2.....n.....&..N...j\..b..F,.~5....)..{..:.. .,...n.$.W....j6......`..Z2-.6......HU.I..l.....<t.f.;:.&......lZ.-.w.#

    C:\Program Files\WinHTTrack\html\img\backblue.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 128 x 128
    Category:dropped
    Size (bytes):4721
    Entropy (8bit):7.90271334735674
    Encrypted:false
    SSDEEP:96:FHRN+dMwytQofzXS15iFz9jPOA4l+8dfK3EP+kWyTBCWSmLEhN5WP4yM4:FxcMtTfzCimAeC8JWX1Hvib
    MD5:66DEB0046BE9541CF50FCA416816D375
    SHA1:9ED9AD2CD21C7561B892494917E4E37CA033B471
    SHA-256:6AC5FADF79B93E9A00BDF495DEDCD1C45A68A5BB43192C913D5FF3FAC4322B87
    SHA-512:DCAA63259B2EB25BF2EC76F36C34C71F77C45E7B23ABBA07E3F0EEC25CE65A76439C54B7D1395C908A0ED97B22725984A3B4B95AAFEE7712D66D5665D4C2F91A
    Malicious:false
    Preview:GIF87a...............................,............ ...E7j...0!.Rm.F...J$.....E.1O..K...T.!......iv`..".AU\...V.,....3r.......R..p..E..%....YK..c v})>@O3..=.=Q1..q..uK>..!.*r..yX.H ..........*hr8:#HPc......)_ q..%..OK.U.B..6....k:..HTp...OH..{*....y....V.......P.F$..f..7.W'2O.... ..O.B..D..$L..8....qr.....6Je...b....4..!.2..a......G.,i...I.l....O.j.Q.4.(..e......U8..A5s..L.X.UF.Ih..+f..&.`..B......j....R.&.6".....Z.h.tUd../>......Y>.l..@.<+`2....."..|.L....(..... .lZ........)#.....&.T.S.Y..].ETamFM..8x.%.].Q..R.]S..;...!..>!.o5....l...(....H.T R......GZ/...3!.`..+Pr.B....E..ID..PJ...q.fB.uM1.4..!Px..z.....H...J....!..Q..W$9Q.....E{.r.R]=C..fy.q..&Ki.. %o.. &7P...D:|....'.'+.H.TU..%!....H[.....|...kA..51P^0D..I2e.F.S0w.$.....b.i......K.]..g7..4T..V.|E.%B R.W6R.0...h.uQd8kl..c.c.c.b.?4.ci.*.TH.eB..`.L....%...N...#k.(..Ar.L"=. ....gi.. .dH...e.#>7.3...,..'...a..D. #..pE....^9rD..............'.[(Q$.u.".8.T.8qT.|n....p.mi..e(.....W.3....&hS%..3...I....2

    C:\Program Files\WinHTTrack\html\img\fade.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 89a, 8 x 8
    Category:dropped
    Size (bytes):53
    Entropy (8bit):4.204243331880868
    Encrypted:false
    SSDEEP:3:CNKPcC/xlHlLHVu45nSae:OyZO45nU
    MD5:8750A2C079D1DCB3D999F074FD06933B
    SHA1:18F0BA788553D1ECAF6CC23043E8577B51591140
    SHA-256:1E66F43615924C2C61411D5679D200512209E6710D5C55FFA38DB8838A382ED9
    SHA-512:99DD61D923080F0D929754995F922382194C6A5CA9CFDB4FEE7350816A2711ECC41BE23FE303370A483B3FC72D0935055D6FC9C7E4B8302BCC95811A76E44E8E
    Malicious:false
    Preview:GIF89a.......!.....!.......,.............p.....*...;

    C:\Program Files\WinHTTrack\html\img\httrack.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 89a, 201 x 117
    Category:dropped
    Size (bytes):4085
    Entropy (8bit):7.888302594135794
    Encrypted:false
    SSDEEP:96:bBBlhzn7cHd3MfS/t9JqWeVpZEdC5gnRttmx:Dlpc9cqFqVsCuPtY
    MD5:F5D7F2AB6279EA5B240B60AB1FC03B60
    SHA1:C50908DA175CAAAFD1A89ED2F31818CCE442C18D
    SHA-256:35776AD01D39DFCC6C66A3BFF35DE6C1A70EB5E18E26C1130D60DA3016789C99
    SHA-512:FE8CD80D8FA9776CF289170293089AD930C44BA642B21FAF8F165CEE2E63C5A73DF4B743FB1F430B07AF2182C13BAF401F785E5666C1F33EA4F4BDE0E46FF1AE
    Malicious:false
    Preview:GIF89a..u............f.ff...f.fffff3..f.f.f...f3f.3..3.f..ff.......f..fff.f.....f3ff33.3f.33............!.......,......o.... .di.h..l.p,.D4.x..|.F...G,....B.L:..(..\H..l2.`j..p......4.. .....f..... .z..7.}.}....+.....w......vV<..1..G.H..(|...:...0...(...-.n.'../...'n..m.;....0..%...............(.............#..;............Z.c'.A.q.d}....w..$.G..!;.f.....k&..../...d....h.:k....".7...o..`.J..PA.@P....[.o..B..'b.m6E.)&D....]...........g......x..mY..ff.....1......G..R...6p...r...0..Ru.[BH*38.0..#..@.@;.q-....[......1....7..h....6...h.U+..Z...X2l..F...x.nk...n...f+".ssm......ve^.i.....c..<@So.!..D2.GZ...`L*...|....J.,..l.XSWen....^".....`.'.c.7s...[$.X.M".c.ur...[4A%K..b..q.....&.........F-..[....q&..#n.X...D.s.F.t.......$....-....E..Y"\..k...Jue^.U)...h.J2..&.@..9.1.%d...T.Mb:.ka2..f..p"..5 .2.8....b.>..?.f....9.[/Z.&.e.......p.q..j.. .....e....9..O.u...-.J$1......(c...@;.Y..0T.U..B[a..g.# W..8.gN.F. .S,4.....N.....2.n...%.5Em..].<...8...\

    C:\Program Files\WinHTTrack\html\img\is-0423B.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 650 x 346
    Category:dropped
    Size (bytes):2841
    Entropy (8bit):7.889280901260727
    Encrypted:false
    SSDEEP:48:J5zpaWs/PKalYzuv9KTTA/zkeV6Rd3EpRca1vZ/TwjQmPl5KwZS+dHn8PoAyHCJw:JlY5+zX8/TGqqQm98YScHztHmw
    MD5:321C19589311041E02F9D4F0BF0CF13C
    SHA1:C28F469244BDCDBB363CAB07F9BD650BFEB1D159
    SHA-256:4060785F14123937080B852210130FABE4FA1BDE9127F4971C1993B60ED06D61
    SHA-512:82CD20EBFC41B67721DF7AC3871DD6753D112322B88681AFF794214718F20E29F64C4C4A3AABC3F758A7EB99AD0DAE3BEB43BA2716B6151D9DC0D9F75A607670
    Malicious:false
    Preview:GIF87a..Z...................k.{{...,......Z.@......0.I..8...`(.di.h..l.p,.tm.x..|....pH,...r.l:...W.Z..v..z..xL....z.no.S.1....|....~.z.w}w....q ................................................................p.....@.........................s........................*\....#J.H..EI...,....G<.8... ....?..0.Q1.....).e.6......K.>Y..zShPe@.&-..N.-.2=zl.P.@i:.:.h.Y.....i..c.nU{.+DxR.@...n.......-.m....u.2x...]....#K.L....3k.....C..M....S.^....c.M....s..........N.....+_.....K.N.....k........O......_.......O...............(....h...&....6....F(..v...|.RR......X..$.h.(......b.(.O\......hcK.Jp..?.h.........d'...6O.b.).(..V6.$.IF...Sz....`i...H.J..\.J)Z:..I......"_0."c.9.e...j.&...^h..F*)w"uHG..8..Tyl*$...&.Y1.E.^Im5.`.*..L4.*.C...*2.~E#....ZS..SVE.{(...9......XX).m.\)...iA..YCY.....[...^...k.u-.Mm..}=....,C.2..0..oet.+....l...'....7....G,...Wl...g....w... .,..$.l..(....,....0.,..4.l..8...<....@.-..D.m..H'...L7...PG-..TWm..H....\w.

    C:\Program Files\WinHTTrack\html\img\is-0G57R.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 495 x 266
    Category:dropped
    Size (bytes):21952
    Entropy (8bit):7.985504184139934
    Encrypted:false
    SSDEEP:384:SBymXu+8dvRC53hHKPuoSXEqD68/ulWAPu3jYsj9iSit7m6NuC1QJdJ5xPhC7bi:SBnXu+6RCLqPuotqjWPq8y9Hi4C1oTPX
    MD5:71ED743738E9F1B5A1C357E05F6B5882
    SHA1:66E7D7BFD54ACA0F1336F75FA54617A6C12671E7
    SHA-256:96250D72E9336365C89FD43F0062052F8794A4F206783A3D9BD4C54E7DD84350
    SHA-512:5159AACFF98EEE32810791838C8AB659D0CCBA1ED707C14D85E8F6E5ED83A0FD0006261A60EC9EC17F449980F95D3F7CBF3A98E826E97A8BEF68A3BEE883AA86
    Malicious:false
    Preview:GIF87a..........2okekb...R..n...........................,........@....I..8...`(.di.h..l....sM.v...3...c.+..;.p.| i..N*.U.V*2..v........z.n..g<N.....<....u..y................................................................4F..GAN.GSB.:.OQV6T.c..iY..e..hb`o....rf~x.{}..............]...P.P...,.S.Y.#J.X@.D....2. U.....4P`....Z..u.....^.,..... .tT...T..............k.J....4Uj..%.Z.....S'M......[K.]K.-..P.u.V..i..Kv..T....W....*.........q..f._...jd.R.[v,.-.&.....VP]..R.J[._.e[....Y.....7f.^}s>...a..s.N.7x.U.....vg....r...k..><.....-.1........n....w.|..E`y....`..h.g.6..z.UH.`.u. ..B..R.!...h.'B.`i!.H..(..c.2.hb.8.#.;...>...$N. [.-..d|]F.d....q.a.....$h.Y.....ft...\ib..z...\.....QNig.u.W.{....R....y.:(.w..(..>G...<..VJ.f........*..j........*..j............+....D....u..b.^..>+-..:K..f.-..j[m..~+...zK......[n..+/....kk../..F!._i.`...k........7L...C...Gl...wKa....1..*($.=!.@G^^.S..=.e..r.r.4....5.is.....Im...D.m..H'...L7.

    C:\Program Files\WinHTTrack\html\img\is-1QA7B.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 586 x 401
    Category:dropped
    Size (bytes):41328
    Entropy (8bit):7.9677210443728
    Encrypted:false
    SSDEEP:768:XucKNjH67nGI0xfzhucOUzhOlfzieQL5tTyBVai7wJ7ufBMmfh:X9wunorwcpsogBomwMGmp
    MD5:80ADA7D9FA9E9C37377B7723628E79C6
    SHA1:A21630B0E22BDE483D57AACB019C93658BD58CA1
    SHA-256:835DC7FDDA5493F29BAABA37E86FE5DA57AE057F772F7C0564377F8DDAA52DB1
    SHA-512:F427312028B7D39E54678F007934F2A827517A865F4503155AE9F8F81616E9B0A1F858B25E8D3A1C0F5F58FD119A95BB8C38BAA3674282357D1EED8E758062AF
    Malicious:false
    Preview:GIF87aJ................................{........B..)..9..!!.c..1..Z..))!R.....{sk..!.........cZBZ........k..J..k..R.......)!!J..J.....ssk......scJc........9.....999kcZkZB...BBB.....{B..kcJ..........skck..!!!......91!...s..1..BB9!.......)))..sZZR!!....c..ccZ1..kkc..s..k111...!..B91...s..cZR................{s...9911)){....{{{RRR......91)......B..B99JJJ11)...JJB...cccJBB.....{kJ911R..kkk..{sss..{s........ZJ9...B..ZRJ.....{)..k..Z.......RRJ.......k..s.....ZZZ......sscZR9...cRB.........ZRR...{{s{{kR....{..RJB........JB9s..kkZ...J.....RJJ...............JB1....skcBc...................RJ9.........RJ1skR.....................9..Z........{...c......{c...............!..ZRBRRB.{c.sR.{Z..k.....kcRs........................................................,....J...@......H......*\....#J.H....3j.... Cf...I.N@.`....-a.t.a...@.tR..N.:kr....(.=5.E....C.>@.(...Sy....&..Ua`}0....h.].h.Z.J..u.....J.N.....J...+8.....B..x..%.#;.<#2e..+c..93...3..0c4..S.vp..k.y..@.l.

    C:\Program Files\WinHTTrack\html\img\is-2VRKH.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 652 x 394
    Category:dropped
    Size (bytes):3949
    Entropy (8bit):7.921309663854937
    Encrypted:false
    SSDEEP:96:Yr58Nf4vrcy3dU3DMPrIbTMF5COI97he7SInCbqFeGlvQ:Y6NwjcqZYFOI97U7jnIqFy
    MD5:365586D3CC453A85499650D20152E8B6
    SHA1:F302DEE259F6499ABD174ECA0A8CAAE6BDD1DB48
    SHA-256:7A9A5BE9CFD033AB4EEE7DEC4E5365024F8AE0A7A6BB00A2CF93ECB3535E383E
    SHA-512:77B95CC5ADFB990382AA242701F54AE07A1D6876D57DDB1DA8C4A923590C4821233AF428D9B2661D845428C9DFCF4C8259F3176839C701975C5CCF84B58A3922
    Malicious:false
    Preview:GIF87a...................k.........,........@......0.I..8...`(.di.h..l.p,.tm.x..|....pH,._.FR.\2.J....6.R..2.R.[0v.~..Xm^o.m........zN...xxcyG.....................#.....x....z.V...z`.L...b..e..iqW..I.M........;.................................h1.!...:.{.....{........H../....UJ.-......O. .r.i..... C..I...(S.\...0Q...i&.87u.....>....j.P.G.."..(....4....1.j.....r....#.h.]..G........x..................L......!<1#...2.f...C.~I!IX..G.^....^.uF.4...;9..3..V....n.?...^|.T..[.\...."yS..}...XqW].U<....G...m....'..{..q.w......I..Z..V.[.F..H.5.`........5!.m5....u.. .(.$.h.(...,..@..hx...D...Q...><....o...!......,.. ..I#B..h..TV..E.I0....2P.V.).d.i.h...l...p.).t.i.x..|....*..j.&..6..F*.Vj.f..v...*..j........p.......9b@.a7.....z3XD...e-.<t.D........8.E6*.l..>.dE...m.S".....,.."..a......%/...k..f...c:j.n@7.XC........Y..6....G,...Wl..9P.n..L.p+.RGQ-.......|Y.N&.2..+..4.l..8...<....@..W.0.]T....S..D_.M#.\.T.$....MVj.I}

    C:\Program Files\WinHTTrack\html\img\is-39ATU.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 650 x 466
    Category:dropped
    Size (bytes):37989
    Entropy (8bit):7.986287510180498
    Encrypted:false
    SSDEEP:768:IN99dSapP7hy71GTNufQ+VWEWL+BxIN/J2Pfnq2p4Fb/5txKwvBC/:IN99capP7ha1GZb+AE6+BxI1J2PX6/5a
    MD5:F563D2EC8523D9AA2AA8EB132116F7CA
    SHA1:0279BCC0F65B6891574C83AEE9178C8EAD25365F
    SHA-256:1DAF6B5735028617D4B32846376A006E88AD394E183D92F9966F49460905705E
    SHA-512:339325CF5250544FA1B7874829ABEB4E538990F3CB4BE732E9BAB1E7AFF19A962C932808280FB08DE7265C1790CDB4DD4CA632E07F71EA95C12722219DE4BACB
    Malicious:false
    Preview:GIF87a.................`]Q...J.. ....s...&nj..............,........@....I..8...`(.di.h..l.p,.bp.....;..n.x..;\..\8...JU...,oAezw.-...&}glrM.9....E...o../..s.............\.....e..~.n..\.........................................................................CjjP...YgK..M9z..].~;m|u{y.0....}..(..0.!.."J.HQ"%Q.*iT..b......$*.&S.S.\.r%.Y.~..IJ.0\.....k..@qU.J..P.F... M....2H..*......p@..d..LM.@.5.O.4.P.)S.S.R].L.2.j'|......Z...j..a...^-...a..#Kfl....O..x.f./..,..h.+c6.....=.~=[6..[..{tn.....L.bp..Z..{yj..3.:.t..o.o.Z....ak...vv.._..|x....'N......cg...a.....}..6.~.!(.x.6...........w..Gaz.v.`..N...9X.. ..!..i.b.)N.....X.#.w`.%...>..!..$.:......!..:.$./.ie.2.w$.W.'..`.)...`..8#.7...f.p.).t.i.x..|....*..j.&..6.....1..`.f...k...1....2Wd.....RB..K..j....$..............Z...h......&.]."#..$.z....H.....m..~+...k..k....m.../c..k..>.L....-YO.p.|PE..pd.Y..._...+q...;....{q..v.....V........%u..E@..)..5..|...0.sV0#0._....3..E@.x......|

    C:\Program Files\WinHTTrack\html\img\is-3GEN5.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 430 x 247
    Category:dropped
    Size (bytes):9687
    Entropy (8bit):7.969114275230565
    Encrypted:false
    SSDEEP:192:8iuF2KHh2HrZrGYc4hZRch7k/3r411ay8ioZvYsHVDP3JY+BE8i1mb5mt0/qEZw:8xPh2LZrGYT3M1l8LYstPZYIXi0mKqE6
    MD5:D7E20C0B6CFFCF77BCCBBF896A51991E
    SHA1:2DC1DC7EAAA71D6AD0976B78B410AC526E22BF4C
    SHA-256:E20C55B4140E7D0718564FA78B6A6DF531778DEEB7575F7A2C5A11B2B7CFC418
    SHA-512:F86C6C49C1A5CD5FE25A530303ECF56DC2A53CA08DED200B54323ED540E3BAD7CF2A595A8B044EC9C63D414C62341567FBA7EE3BCF41FBB682D2053FED874E81
    Malicious:false
    Preview:GIF87a..............BB..........BB9,........@......0.I..8...`(..g..0..!.. .@... ....?.....o@D:..tJ.Z...sk.i.[p..%..^.Z.>..o^Z.f..k|}....Cj;.D........2....2..(-........X.......9`.m..w.pzv.shx.r..y}.z.u......u...C.8....2.'(..(..........................................(O`;.......S.....PP.....1R.X..#...;ZS@.....0U:p....i.4...8s.....@.B..P_Av....d..E....l.dT.XCf].q.....BMW.e...M.-.RjK....hJ$.I./.J=9...X.`17.].w.a...d.y..u.p.wa.p..1d....5....e. .R4d.._...(D{.1%.y..o.....:<.mz.3.X....._...o7C...k/..cB.\.s.......Y......._O.9........v....L.`...c!..D_..V`..@Ri.@H....u.5'eb....T..#YU.........0.....8...nM2..4i&.."...D.i...\R....}....B.q..%.U..@...e.`~)f.N....M..\CJn)Q~]....PN..y(.&.|......^.K.d....!a;..K.J%UE...O.Z..fwz....P.......y..*q..Y..........*%..Gh<.>y.VYV9%...:'%..6...F+..Vk.J..mV.......$.$.D.D.aT..W..-x.~.)....m....P..2.j}Y.l...:o.......6<.........Z.}._:...k....k...$g.......>,..B-..r.4.l..8...:....;...@.mt.H....K'.4A.b...T.lu..a...\w.

    C:\Program Files\WinHTTrack\html\img\is-5BFJ5.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 650 x 396
    Category:dropped
    Size (bytes):2427
    Entropy (8bit):7.886297117808314
    Encrypted:false
    SSDEEP:48:9C6+7fTL37qJ762Fr7x72Fo4EjxVY0th9Tb6jA0YiUy8fL60UBOI7UtE:9Cxf33U62FH6o4Sltb6c3iyeBOI7UtE
    MD5:C7C338DB2F7B01CDDD96818AAC2F25DB
    SHA1:9BC0845FC47C4C2841EF266EB5E21179EF3B12C3
    SHA-256:1F4948711AE967171ED568100442A8A9BE654E0D2898CC8A37CA167FBEEA1531
    SHA-512:F9777E8B42E521423E30F5145BAF63FCFE26A75D616D60DA27D79F604FCF533732A7EA3E905B3AFBA1C5C0C478E71AB305B014AAD5AFA8294ECA9F5AA22DC8A2
    Malicious:false
    Preview:GIF87a...................k.........,...............0.I..8...`(.di.h..l.p,.tm.x..|....pH,...r.l:..tJ.Z..v..z..xL....z.n...|N.....~...................................................................................................................(..........&...S.......].{$...@...."6.8p`....@.`..^...}l.H..../z<xN.:..]....A.-..l..G{._j..'PyDK*.q..J.!.......tR..kU..cJ.....K..hZ.i..d..i...Z.f%..%Q._..L..Ev......K. ..c.x...[..LJ.s...._.....7#...z.h.Wf.L.........*..Z.X..].......n7#O*.3.'....z..gN5..g..&.L..}...................(....h...&....6....F(..Vh..f...v.. .(.$.H.7(....,.a.d3....h]P..}y0..X.. .E.c.7VP$.G..V.>.0d.?........^D~0$.M..d..LYey=Vg.y5........ef....P........{..w}.)..(.6.V..\O..F.Xv...v..7......b......u..v..dls...6..k..v)....cc..G.P..W.d.^I.....j_."..]..B*....lX.Z&.|...o......Q.r...j.8.P..FkkF.bF.uA..ok..e.q.......V.j.\.Vz......;.......zk.....m.4..l......9..i.{ri........r.'...X..)....)>.ltBE....L7...PG-..TWm..Xg...\w.

    C:\Program Files\WinHTTrack\html\img\is-7CAMJ.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 650 x 394
    Category:dropped
    Size (bytes):4901
    Entropy (8bit):7.9177808199843245
    Encrypted:false
    SSDEEP:96:cxf33EgUnCGi+sOprjsWtrDLSD6Ky6JUyBP+WhHAuvbha1g:sai+swjFZnSD6Kv7RguvbM6
    MD5:844AA7CF56C5CE9AFC1C8023800A5225
    SHA1:B5583C68BAC2DF1D5075D0D705D5CE1518800FBF
    SHA-256:A3185E3D227A2C0811543F942967E69B47421EC52E0BB447024EC4D53F88679C
    SHA-512:C95FAF412ADE2AFA6AA82405E6B0637F0E9F8A178FA141E124746B66F446750E8DF4129EE0B6A75237F65D133FBE6398E0515C02A0CBEF497FC4FC1703D95DC0
    Malicious:false
    Preview:GIF87a.................k............,...............0.I..8...`(.di.h..l.p,.tm.x..|....pH,...r.l:..tJ.Z..v..z..xL....z.n...|N.....~......................................................................................................2...........B..........C.....-....<s....WN\......1!....j..-.".....t...A| ...x0.Kx.On..f..7Ez....J.$[....AE.EE......P.J.J...X.j....`..K.,X.l..X.v..<}&.`r.C.o...K..Q.m...L.....+^....#K.L....%.M...\...zV.Ro_.+...[...k`.%-..?.~e....4.]W....i.a.,9..]..%.m..!...?.=....t.N..x2....^L...g.>.}/..........'`..nQ....q`..&.`..^....0a..V.a..N.. ..a.#.hb.%.W.,.............m-V.b.1.S....8.;f.O....D..M@d(..A}]0e..1y..K@..Q.d.Rth..H.1Y..P\24.@.9w..=y...J...o..T.....H.3.*.r.UT.j...'...h...-..jHF..o;I..sA....P....2.i.vYd.Aj....i[R......K..Lu.)..5......zd...e.....u.6..(M..u."..B.b+..'Vk...z.w=.l .&7..Q....j....0...n....p....k.....Q%.|0..+.........w.0g"......l.......,S...3.`.<.h..<....=.-..C....;.,..L7...PG-.....!.Xg...\w.

    C:\Program Files\WinHTTrack\html\img\is-7KA9O.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 466 x 326
    Category:dropped
    Size (bytes):9558
    Entropy (8bit):7.972771128719367
    Encrypted:false
    SSDEEP:192:iV0egZvPvA0QHQ1+syWLOeb3SPBdZV5hryN2Zm/LVymv7Zw6nuN7Z:iSZvPYfZsKs3ST5hr3SB57huNN
    MD5:572495656567B130346412CC1110CEA4
    SHA1:5DC9F028CE567329891E5AC214FA2E19B5AF297E
    SHA-256:3E4A2685D49F013AEC6B9E2C55E2DF54C5F7FBA40FDDA4B674D62DB4904D73B4
    SHA-512:656F7687DFD3F1B37B3E51A57CE006BE9DB8AD21C275042E7A20EF2C87E32E47F886ADF4FDA83FC7A3016D496F60E093D9E4AD5BC9217B4ACBF74E8760D79415
    Malicious:false
    Preview:GIF87a..F.................k...c..R..s..B..).....9.....1..!..Z.....J..{...........k..{..c..J........!..1..1..B..{..c...............1..11.c..c..1...1.11.c1......1..........1.RR.11c11.1....c1..c...c1.cc...,......F.@..@.pH,...r.l:..tJ.Z..v..z...`0...$R.v:.P..kG..#.F]..D..|................................................................................................... ...............................!`.....,h.@C...J.h.b..0f0.1c../x.(.....D"0..e.......Sf.1'.....O...&...b.....*M:..S.P.J.#D..!V.......0c....D.4.l.0....;w..H4.P"=w.(24..#..$.........kJ.S'..Gm...r...f=X..V.[.n.....].R.K.`.2e.b?.F...l.r{........%@...v........}....8p.A...BD..;E..#B.pQ<..#A.<..<J.'S..9.&K.1a.....<....E.u.SO...TMY@..[u..^Th..f...v....N..$.h.(..".">qU./F.cUT\5#.7Na#.8v...?...D.i.W`P..L...X...NB).PN.e.0rI.Xn.`>.c.Vf...U.y.p.E.r.i.x...t....*(.}.j.&.h.....F:d..Vj.jAi..n..U.Z............z....*..J......G.+$.Y.ic.\..&...jk......J.m...j*..B...Z.................2.

    C:\Program Files\WinHTTrack\html\img\is-8SFQT.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 89a, 584 x 408
    Category:dropped
    Size (bytes):6114
    Entropy (8bit):7.950320594924544
    Encrypted:false
    SSDEEP:96:8oflPaZzOzgAuaoGfIy3lkBAPKlq3AKfIDRsDoC/q2kJ11aTQPMnH9XQvX1rsL4:Vdi4o4V3aeKQQtqcC/q2kJ2uKdAvFT
    MD5:D85FCF63724BDCC5D8D5322C008DAD57
    SHA1:468881C9D5587542B0DEABDDF5016A7C890B3C84
    SHA-256:63EA044CDAC143A481F34075237B251C123AB172E7C6884F34D2E586C4C5DB66
    SHA-512:C2B61FE295892E40C470EAC7EAF349D66768B2700EA5EBFD6A29580A054B9062EF309100A418AE806A404A3E966D189F17427E847FB47AD95357D030C8FBD969
    Malicious:false
    Preview:GIF89aH...........h.........................................,....H......P.I..8...`(.di.h..l.p,.tm.x..|....pH,...r.l:..tJ.Z..v..z..xL....z.n...S`N.....~................|.q.*...............................&....D........3.......%.........p......k.....f...q..a...i..\.....h...Z..S...R..9.(........ .....J.Hq.../j..q... ?..Ir..('f........y.....2k..As'.......S.C$E..L..i..>},.8............0.F....U....P..m.'n....on..G.V.J4.......0`....&..._.C.+F......cn..rR.EA.<z....+.K..P.....J.C..?...7..w.fL|.......m..i..)J..k.-b[.V.s.;....7o.G...;......<...g..?..x..1...#.ig.2s.6.w..V.p.J...U...Y..z.IX.t....{ga.....W.u+.X.3A. #.A.U..&.. .y!..t<..\.....A..a....#...R.......3.(.kLI..f.}y_j}..fM..X.*..f......f$......c...L.Qy.]W....[v...q.$S...0..(.....E.f....XD*...bi..9....j$..j.......W.j..V.J......h...z..q.%{..c..1VJ...\..Cz.U.`h'..,..*.h.QH;...LB...........,...._..m...0M%.D.f...Y.Q......v&.m....a.&f.[.^E.....s...f.n. Lu.{).....?. ...k&u.A.d.:.;a.m.g...!...\

    C:\Program Files\WinHTTrack\html\img\is-9F3Q4.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 652 x 394
    Category:dropped
    Size (bytes):5688
    Entropy (8bit):7.946597529905821
    Encrypted:false
    SSDEEP:96:VrBfbYd5OU8VBUXkUqWJFIk/Nn50Jqq2KnXpRx4rZtBGUxYHfshwq92jUT8XmJnc:VtzYdmViT9Ik/NnCIe5Rx+tBJYH0hBkB
    MD5:100F1F9F6DD4624F9ECEB68E9ABC3ACE
    SHA1:D36B29B5151ECF55612D532CB9B4C863A16D2589
    SHA-256:C3233057C47AB4ADDF70466D8ED3A5D6D06860E5F592E182C6099ED55AB6B8EA
    SHA-512:75DA865951B86725C331363E1F3C7BCE695992FFA265E2EEB126D63E243E3FAEA568C03B2F733DD065D179DD59E1DF6DA037556CC788734F86C6230098374842
    Malicious:false
    Preview:GIF87a.......................k.{{...,........@......0.I..8...`(.di.h..l.p,.tm.x..|....pH,.Y.G..\B.P@S1]T.N).U2...c....${..._8...{..u\..V.uG.............0ftr.w|xx~.b.[o{...a..si...u.y.z...O.................v......b.............................H.d.m......]QS..Z..N....A.Q(pBFk.=x...s6....3j..... C..I...(S.\...0o..i....6......@...J.'Q.H..0.T..L.Fu:u..?...zUh.....K...h.]...p..0..M...(.N.*Pd...(..*..N....R._.J..U)...f.<.qQ.......i.'GV..s.K...V...s..6...I...N3.b.9y+_.....K.N]....c.[.[.....O.............O........^......'....h ..i.......o...`..&....T..5.p.. .(.%..E4....V. .0.(......+..".<........9..#.H&....9..E.r$.TVi.N.....^..`.%.[.2e.h...uBjY..g.).t.5...Y.|.y'.....R.'...Z.....h..V..z.Ef..hj..N.*..j.........i..l."w........+...k......Bz..F.H..P....8.J..T...Z.C..h......P..B.-...2.`.X!.'."........PX...B8....p.l......E...lo.....&.Y.,. [\...,1...{p.)[....+m2\..(......||3.>.l.>.<..^.+n.3.....x;K.Q?..%..5p..k.

    C:\Program Files\WinHTTrack\html\img\is-9VVJ8.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 537 x 284
    Category:dropped
    Size (bytes):8457
    Entropy (8bit):7.960530540972922
    Encrypted:false
    SSDEEP:192:cfT21qnBWYzodRF67nQTAlzoD4Yy6aicJ1FR6I+:QTTn0NPTQYyAC+
    MD5:B924FFDFB4F979215AF65F1DF87700EC
    SHA1:CB65B548A7BCB58CD892AABD2256B2667FE33CC5
    SHA-256:AE37F35E84C4568A96A57E561CB30F92F05A8A7F22E5DD3AB6D0253784F799BF
    SHA-512:2757AE1651391C2FD0A886A3D7B39575BF51BEAF8B962795DB646FF58DA571B9CC5B43EF4B8A47CBA8ADA83280ED2971A35117435D1EBF5EE4788C7C76CD44EC
    Malicious:false
    Preview:GIF87a.................k......R..c..s..B..)..9.....!..1..Z.....J.....{.....k.....{..c..J.....!.....1..1..B.....{..c...............1..11.c..c..1...1.11.c11...............RR..1.11c11.1....c1..c...c1.cc...,........@..@.pH,...r.l:..tJ.Z..v..z.`....@D......N......|@of.!~................................................................................................................................".....?..."...!...H.H.....-j............H.(..4..@..\.).e..7s.<.3.M..:."8 ....F."=.i..G.JE......b.5.V.....pal.....k........2@@Z.u...#@....p.`....w pJ..O.@.8.....e.....l..'E.)H...3...8|..Zt..._.~...l.F..-...X...R.!.0`.3....3h..I.F.z.m...}\8t..kG~.z...L.._@...)....?...>..?....}.QI*}..I.bp`L-....3.d.M7.SP<U..D.e...B..TRN...YI.b.V]e.U^...Xh.E.[6....u.W.@.).D.i.H&..[...PF).TVi.\8..\.Y.\`.).d.i.h...l...p.).t....Fj.D\G......1.[...(...Zh.o.)....uq"@.`.v.f..fpm....Z.).......j........j........zg.zNj.VT:j.....B...Vk..f..H.....+...m.....e...g.....KH.

    C:\Program Files\WinHTTrack\html\img\is-B1VSM.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 497 x 268
    Category:dropped
    Size (bytes):10567
    Entropy (8bit):7.9717467125194394
    Encrypted:false
    SSDEEP:192:qw4RZ2gkjgxRJqp9QPLYPGwQRXnchmieJ8ZseJsyURECmapEbMx:qwfgk8xRMzQp5n4miEAC1/x
    MD5:A0B43835BABD7AA353E5F832CB05934B
    SHA1:D879E66990B710DBA484745545FDBEBF89AC40C2
    SHA-256:C7E273A238EF922051865E14592081E9D6A2605442798B22EFEAD31B9A363D9D
    SHA-512:6BCF462E46C6F4338539823E3E776844C2FF207C7E4B5745726228D4775914DA19F34AB18C804EE478E4A67D2D5BBB6532C8741FC82E22A1B333B9EF5E2F1121
    Malicious:false
    Preview:GIF87a..................f.....C..~zn.+).....<NJ.........,........@..0.I..8...`(.di.h..l..R..l..=.9....,..(x...l&.F.!!H.j.hS.]..x.....z.n...r<~...x.\o......s~.}.......................................................................2:>?6=..E.aL.NJZI.].\.Z.`h\.b^..o...kwvpb.y{............Q.G..*\.0.'I."..51.EV.He.H... .C.R.L..f...|...J..b.)...........N./a...C...1..R.......X..VS.L..d..*._.z.....h.5.6m.n.....\.t.............N.}k.^...N...3..y...)k..93..C.%.K4..O.6.:u..c.......o..6..........I.X.....O.p`....k........O......_.......J.,......n....."......h`...E...5h.t..(..&H..fX.h-... ..J....[0q.!.*......(.4.h.8..s.X@...U........5p.,.P../8...2...1.(...,Yg...qi.,...e.,.....QA.p.).pN7.c....sB......o..`.&.h..a..~.*i.....3..Q@.8$....p...NAj.B(`.......3.*......}l.*.7x.C..j.*4..k..&....,...T...q....b.-`M-@...+n....\..L..r.dFm.#...TX..@I.(.@/Z...S.,./N...@2.`y..h.r.8.@...p...&p......J.;..r..,.U..+..@2.2.*..2...<..8...s."......2Q...nu.qs.|

    C:\Program Files\WinHTTrack\html\img\is-BV5D0.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 652 x 394
    Category:dropped
    Size (bytes):2559
    Entropy (8bit):7.886439900004965
    Encrypted:false
    SSDEEP:48:irscRiPmfnzd4U1r+WpG4ybrUQISNMrj6E61FHdOrGv6fuX5nU4p7O6AvRn:irvx5J+WMlMQISNVE6DHoVuX5nHA5
    MD5:8AA03F3A0A2289B26D06C655F3265BA9
    SHA1:DF2BC05064959FB56A97912673881A508F0F38B2
    SHA-256:498A739F5AAB413052C213CA2743964EBCB598E2A880CD61EF55BFD8FA0ACE46
    SHA-512:00D9EEE3D2B435E4EA2848B368F4D7757BC0D683C3605004EF22EB56181D36B98959858D27638AA8F7C4F2CAE31EDC2EA382F82E6C3BAB9FC727C3E66FE6127A
    Malicious:false
    Preview:GIF87a...................k.........,........@......0.I..8...`(.di.h..l.p,.tm.x..|....pH,...r.l:..tJ.Z.X.! .....`..,.....n..h...>7..z}....r}t.rs|xwvv...n..y.z..g....|............p.......Y..D..#...a...0.+.................@[_..c...........f....w.................Zi..H.?V.....Cd..{H....3j..... C..I...(S.\...0c.I..5k..@..N...x,.7.].B...;.h[....~.G.)U..jj..W....r.K...h.]...p.........r[.7+^.e0..K.....t.^....#K.L....3k.....C..M....S.^....c.M....s..........N.....+_.....K.N.....k........O......{."...d..L..`..{117#?....e7.....)G..)....A.@X.=G1. %Ka.`<..q..Jm.U..n.a..vx"S..$a>.h..z4.h...^........_..Q..".._.}..8.FD..8n0.].:.T.(...]{..MR.....%...>%u"|j.....H.S`LBU./T..f.U.*..j.&..6..I:...^u....5_..J@e..R..W\.S.`.I!.Dy...rV..].*c.zj.j.0...i..'...k..&....nejN.E.c.l.i.pH)d@...i...+..k........+...k..........,....l...'....7....G,...Wl...g....w... .,..$.l.]...O\.0T..f .K^0..7.|..7...s.S`.BJ.....Ew.......|..P..g.m.h

    C:\Program Files\WinHTTrack\html\img\is-C06EE.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 89a, 8 x 8
    Category:dropped
    Size (bytes):53
    Entropy (8bit):4.204243331880868
    Encrypted:false
    SSDEEP:3:CNKPcC/xlHlLHVu45nSae:OyZO45nU
    MD5:8750A2C079D1DCB3D999F074FD06933B
    SHA1:18F0BA788553D1ECAF6CC23043E8577B51591140
    SHA-256:1E66F43615924C2C61411D5679D200512209E6710D5C55FFA38DB8838A382ED9
    SHA-512:99DD61D923080F0D929754995F922382194C6A5CA9CFDB4FEE7350816A2711ECC41BE23FE303370A483B3FC72D0935055D6FC9C7E4B8302BCC95811A76E44E8E
    Malicious:false
    Preview:GIF89a.......!.....!.......,.............p.....*...;

    C:\Program Files\WinHTTrack\html\img\is-E7TF7.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 467 x 325
    Category:dropped
    Size (bytes):7411
    Entropy (8bit):7.953665463307132
    Encrypted:false
    SSDEEP:192:f5WKqgRqFDeJzE/5iTZB6s/1Co1WiAgIV/d2l:f5lRqFah3/1CosiA9/8l
    MD5:E128D56A7E0FB7CF99A9E9249C3B146C
    SHA1:8046D03400958FAB29DBC0C02022EA8D739E0908
    SHA-256:E01439E7984F38C6C23E672A4BA60ACD683E6E603FFDD7249D53A128432A857E
    SHA-512:FB2BEFFF5E74B62CA205AE948B8825AA69FB9BE85F8AA15D1C6205913B77E6A9880E0852CF20A11993A15892C13D926342D1D660EF5642C7561FAF2E44D10A41
    Malicious:false
    Preview:GIF87a..E..............k...c..R..s..B..)..9........1..!..Z.....J..{...........k..{..c..J........!..1..1..B.....{..c...............1..11.c..c..1...1.11.c11...............RR..1.11c11.1....c1..c...c1.cc...,......E.@..@.pH,...r.l:..tJ.Z..v..z.B......$R.v:.P..kG..A F]....|................................................................................................................................... `A....,X.@....J.X.b..0b(.1c..-x.(.d...D.(..eJ......Sf.1%.....O...$...bh....*M*....P.J.#D..!V.......0c....D.4.l.0....;w.@H..P"=w.(24..#..$.........kJ.S...Gi...r...f9X..V.[.n.....].R.K.`.2e.b?.F...l.r{........!@...v........}....8p.A...BD..;E..#>.pQ<..#A.<..<J.'S..9.&K.1a.....<....E.u.SO...TMU@..[u....za..f...v... b8a.!.h.(...,.8".W..c.3VE.U5....8...;....-.i.Hzu..K..>....OR...T.(e.\N)..V..e.`B)f.?n.eVa.Y.I.).[.H.x..|Rag...*...g..&...qh..F*.F>J.f.i.Kn*.V.X%.U..............*.........Z+.I|.d..>.$.[....Qb......*...k..b....J.m..[...z........{....+/.."!

    C:\Program Files\WinHTTrack\html\img\is-ESLJA.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 682 x 391
    Category:dropped
    Size (bytes):14993
    Entropy (8bit):7.974640290885835
    Encrypted:false
    SSDEEP:384:lpWZHjraxJA+YGSfkfujsZ6gS3LPMfaUgznTu:rADrQJfsUOny
    MD5:9E9B36A3A4B2F171DAEDC38F16D5DE37
    SHA1:365435395CBCE3B98247B6AF1D0DE2B0EA6FDDA6
    SHA-256:A701CE4D04CC0C7977D8D5CD18867BA955EB63E6A8F51D62FD1D4B73DD5B5C0F
    SHA-512:4ED16E26938743EF3F1AC094647EEA86235EA41B15DC69BBA846157138E549455EBE5B9B25955E4B76C9B8A88313A11BE06776B6C7FF37D966DC04AE6485F9E4
    Malicious:false
    Preview:GIF87a.......# .)..^`X..zK..j............................,........@..P.I..8...`(.di.h..l.p,...A...s.B....F...........l@J.F.[.0<....G...9..nNN..u.@w.......u..z................................................................................................................7...g....<..P..8g..!.p`A-.. .....~*.!4.#.E......id#J.6.\.r.K.H5Z....r......X>q...4h.eH.*-....iK.I..,.6.T.N.j....`.~.$v..s..3`..7.m. ..6.7..... @...g...........mK..8.......7v..;.l.qg.C.v...i.G.^...kq._.n.z.m.i...;...}.>...p.........C.Fn...w....x....{']/8....S_..}.....O..x......|......|.g`}.C`..6....>(a..Bh..V...v....H....hb.(...+.......0.(.....<...=6.N..u.......L6..PF).TVi.Xf..\v..`.).d.i.h..f.....p6..\tV..HJ..|..g......J.&z[......t..:.........v....i..........Qj......m...y."..c.:V.g.....jl.......2xj...:.....w.u.=.l..`..G.........7..s.....I...{.+.....n:.......L.....0.>.m....j....\j.U...B.V=...q...5.....Y...$`..LO;|...5k.$^z.*+....[....o.8..3..2.

    C:\Program Files\WinHTTrack\html\img\is-GTT7P.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 506 x 282
    Category:dropped
    Size (bytes):9683
    Entropy (8bit):7.966546233554232
    Encrypted:false
    SSDEEP:192:HaX8qaqMoF1ZSHoa2WhccNROAGD6eerImjHAa39Gl7ltisrix5eTlGTt4KwpYrXD:IxMoF1cQWhTNkBD7ernjRWhtiB7hTL3X
    MD5:BEA787BC2F5032F298658875977785BC
    SHA1:31E8308CFFB9894E98B57AE541DEC0004D5D4D0B
    SHA-256:F1BC347DC3F3E5F2E3953BC3AFA6375C514060013D1A13703615462E7A2A961A
    SHA-512:6DB44FF98B4D12D8C8C234FF403F2FDA32FEABAF89C43184F8095E8B5E5E46B4A18340AF8ABD650A9583C69B8EB33A4C5B719D78440AFE3CB1B6CAC285FC3A79
    Malicious:false
    Preview:GIF87a....................k))!!!.ss.,........@......0.I..8...`(.di....F..q..p.........f..f.`K.k:..t:UF...m{.../w..o.g...F...w|N...x.@o....~5......{....6.~.......5...<..(.....+..+...99..........*..T......RXjrywpkp........................<....<..................*.P....l)......#J.H....3B..p.B.z.....@.F....3.1..#D.t(sc... . ....3#..0 (...>nxy..*..8.. @...)7..Y..J.P/`...,..;GJDI....C.Jp:5)O.>..`.k@..J..(..@M.|....S$......G./.........+....S..;....:.5.[5...}.}.m...|........*<f..CO......i.'..x.."../....F.9X....c_T.......0....x....16._#a..|z...<....z.....E.SJ.e. ^.$.Zh...k.H g...~Ga..v.,H.d...\\+.....vG.a....#)..d2n.[}>.(.....G.:....7..{aX_..>g$.iMhdW.E@.a....H.f.H7".Xg.....*..TG.&..F.f..F*.........`....;.....`...T.........b?f....n..R..8...WO.;%..$w.5_..Z......,J....%.!\..vH..tw....H....n...F..fV.N..u.[....G..Z.X.9P.....R....Q..'....?4p.........`.....w....=\.`O.|q...... .....7@pk..(..).........*_.>.w........\p..p......XO.4.(..

    C:\Program Files\WinHTTrack\html\img\is-IQ5VT.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 465 x 326
    Category:dropped
    Size (bytes):7970
    Entropy (8bit):7.961428141397612
    Encrypted:false
    SSDEEP:192:AbIXLs8N34pTJ/m6IDByh9saEo+CI7KIprG70DoGRemg:AbIX4pT1m6AUsiYv8NGRemg
    MD5:135A41D8918737A1F99E9AC308904879
    SHA1:561FD30BC38545A0196A2FC14E9637E66633971A
    SHA-256:7CBDEE92358F5D7A627E62C60117AA83FBFA721B739C2E639FC677060DD5B303
    SHA-512:CEC595957A901BBAF8E0479AD67048A062D81B6FC4A750A63F235FC76C742F25E38FDF67CFA7A5B763AAAC06D810A14E18B734E80E719B59B8E01E995BEEA289
    Malicious:false
    Preview:GIF87a..F..............k...c..R..s..B..)..9........1..!..Z.....J..{...........k..{..c..J........!..1..1..B.....{..c...............1..11.c..c..1...1.11.c11...............RR..1.11c11.1....c1..c...c1.cc...,......F.@..@.pH,...r.l:..tJ.Z..v..v...."..H...tr.\l.nL..@.z~....{..~...............................................................................................................................|........,`....#>,0."...1....F..:b.I.@I.!..P......^....M..h..y`g.......!....F.".Pai..M..."@...C..x.@k.1"t.hA...D6H..A.O.;. .0.Q......d.Q_D...84.....3!....4@V............-..B...K..a..!K..X.g..M.mm..k..e....q...{...;x...[~..>.....(.......|.}b...`..~.y..M..i..J.(W..reM./o.....@.%.Q@...S."..S.L.V\y...Vh..f...v......(.$.h.(....V.../..#.-.xU.5RU....x..?.(.D....4.$.1.../:...T.(.S>I.[^yU.M...:J.$.gj.%.F...[...t.i.xJ!g.|...v.g...j..1h..6..)...Vji..^J.V.T.....J...J....**......*..j.&...Fh........a.Ie.Xi.)....j".*-..z.b{m..Z...j.n..k....+...D........[

    C:\Program Files\WinHTTrack\html\img\is-JH9E1.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 652 x 394
    Category:dropped
    Size (bytes):2555
    Entropy (8bit):7.904546130614872
    Encrypted:false
    SSDEEP:48:Yr6nMq+/Lgc+9TZfx164RPU0G400qfHMe19M10tjPECkiSmFghRchsJt4hEivR:YrAWDr+3f/64RPuTHF9bBjSmghRayt4P
    MD5:E652732C2EF083923916AECD742DE194
    SHA1:C36ECFA9507A80F42123F92B81F35B5565998AB9
    SHA-256:3FD7AF6C76DA310124ABC057A6D2CD46EEAEFAD6D1DD662194287352C1A9CBE8
    SHA-512:9EAC6A1EFC9B68F2E12EF7F48C93842F715CA5AE1C6FC9318BEC5349487EC2E03265B24ED72CD602C88749871AD7210FCB82D18966424720AEFE4C47A835B8DE
    Malicious:false
    Preview:GIF87a...................k.........,........@......0.I..8...`(.di.h..l.p,.tm.x..|....pH,...r.l:..t.!X..v..z...xL...g@:.V..n.Z.o..x..>...xw~u..e..............a..................g..............%_........B.}y.{......<...............*.....................$..h...z....H..Ac...,(.!....I.H....3j....,^ C......(.....I....l..Z..8s.h.OF5...I...H.*.!..S-$.J.q.N..v....L..nP.....0.].i....HA'.54..]Om...........L.....R..l..d..9.{....9lS.+..C..M....S.^....c.M....s..........N.....+_.....K.N.....k........O......_.......O..f...z....7..{....C..Lc.@D.Wa....A.ad....6..,..H./w.h..Nt.!\_.D.,.._.-E. ./.e...%b...a..0.VW.YXcQ7.H..B....<F.B.JR..Rf.....\6....Z. &..y...:X..e.Yf.d.HW..4$$e.....*.r`.I..Ub...%'...i!k.*.O.N2.)......}m*.9...g*.....fb=U......*.*..g.E..Y2n>:.V)].e1..j.+...*...$......@[..v..k.9....E....0A......+...k..........,....l...'....7....G,...Wl...g....w... .,..$.l..(....,.pm..h.......9.dvH..U|.\..[.]'..b......*.i....O.5..Q#C.e...

    C:\Program Files\WinHTTrack\html\img\is-K16JT.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 466 x 326
    Category:dropped
    Size (bytes):8024
    Entropy (8bit):7.9632528194415215
    Encrypted:false
    SSDEEP:192:xVWKqgoSVSKEXO6otNcE4jvDgEUso1egI1KAbn:xVloCSKuoLcEqvUskeg2Ks
    MD5:0829EE35F2F2C83C656B4936BEAF4189
    SHA1:848703D664B31D5086008F076B752CC179C6A4A4
    SHA-256:A7B531AF9671F753327B997EBF869FBFD66762BB967F8FDC10A14D6674CC6F87
    SHA-512:187B8E561CA6D222EEAC75A2B6EA14163A281BCF77CF376560CF11790B63D0B056AD57A4920ED20742EA5095A4AE1CAE7386E8C377C1A86A008F35755714B309
    Malicious:false
    Preview:GIF87a..F..............k...c..R..s..B..)..9........1..!..Z.....J..{...........k..{..c..J........!..1..1..B.....{..c...............1..11.c..c..1...1.11.c11...............RR..1.11c11.1....c1..c...c1.cc...,......F.@..@.pH,...r.l:..tJ.Z..v..z........$R.v:.P..kG..A F]....|................................................................................................................................... `A....,X.@....J.X.b..0b(.1c..-x.(.d...D.(..eJ......Sf.1%.....O...$...bh....*M*....P.J.#D..!V.......0c....D.4.l.0....;w.@H..P"=w.(24..#..$.........kJ.S...Gi...r...f9X..V.[.n.....].R.K.`.2e.b?.F...l.r{........!@...v........}....8p.A...BD..;E..#>.pQ<..#A.<..<J.'S..9.&K.1a.....<....E.u.SO...TMU@..[u..^Th..f...v....N..$.h.(..".">qU./F.cUT\5#.7Na#.8v...?...D.i.W`P..L...X...NB).PN.e.0rI.Xn.`>.c.Vf...U.y.p.E.r.i.x...t....*(.}.j.&.h.....F:d..Vj.jAi..n..U......|Z..:*......*..j.."`!......d.d.H,.j......l..F...:..>...B[-..*B..k....+.I>...@....;

    C:\Program Files\WinHTTrack\html\img\is-M22US.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 350 x 336
    Category:dropped
    Size (bytes):9659
    Entropy (8bit):7.96595396151648
    Encrypted:false
    SSDEEP:192:Gn8cxC/utDKCU9vX4FdiAieuEylY8FPmc0h/IXxTCLtmVrIBUTkhxjbXRBR:g1ndU9vIbLyEb8FPih7RmVUvzbXRv
    MD5:E27285B1B06742ABCF04BAB83DE8F8A8
    SHA1:556AF02C4A17B7E7706EF44C21C737BFBCBA0E7C
    SHA-256:3FA4944E568A5F6F81EE7D3AFD2BB3217E828E86E0BFF1E5898E76D9C77ACD24
    SHA-512:9A07DFE437A5F7E2972C9BB6EB8F4809B0CD6DBF2F052F26C8736A53D6304EC06143777ACE38853938FDAA5693EB845C165D1FAED7B488A0E771ADEEE25D8924
    Malicious:false
    Preview:GIF87a^.P...............RR....)!!ssk,....^.P.@..(...0.I..8...`(.."..A..1.F[.(0.x.....@.....;...S.z..t@.Q.V.uK.i.]......b......T.[.......,....J....&........../...}............(.34*4.H...TK....].>S?.c.dgnek.n.p.kvzzvx....6....}............0...%........1.0...%.....,.S.c.M...4......Pd.!.{......;.....x.....J.H....u.Mr.@.!.H4...@e$.....I..E.......).N.Be.n\....H....U.........h...V..b..UK..W.n..}...Y.d....7..Gd.*.'....1bw.2...(.L)..8X.I...Ae.........=w6.zh..r.UZT(n.u..~.w..y.>..vr..?.N}.u...`........O......_..x.A...O..........>wK..d..74.2.9...H...P.'J4.M&..x@>..`C).>. ..n. !..p`.J......"...6.6.a...X.....!..<..2...w.J8H....B.Xa..<XD..m......2...!.8....R9.... .;.....).&J....!>..v....J...?..'.h...%v.r..w..).WZ.$..<.%.....u28..!......e)..j..*.....^&..+,y.v..".j.....,6..B.ej.x%..([..(&."......hK..........;Jz$xg6Xc..2.....n.....&..N...j\..b..F,.~5....)..{..:.. .,...n.$.W....j6......`..Z2-.6......HU.I..l.....<t.f.;:.&......lZ.-.w.#

    C:\Program Files\WinHTTrack\html\img\is-M31FO.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 466 x 326
    Category:dropped
    Size (bytes):7344
    Entropy (8bit):7.958779929908501
    Encrypted:false
    SSDEEP:192:xVWKqg1vqPBkeRNi6boPJYUSIUFI6y3S0v:xVl1vqkeR46bjjmVFv
    MD5:71B2D81B94520773E0D45EE8AD212FA4
    SHA1:F740A3645D288886F604D07A620D8880E9E7F98D
    SHA-256:D2B651F44D97719ED855C3B2FBCBA2D6B523BE3315AE2BBD8FE19DB95693AC04
    SHA-512:18183025606F128CF4B6B85E06F5CF9883A8E578B6DD76223871E10C82B70A0D3AEE984DFB2F36DC7EBDEAB9E8DF539FDAC8A88A9EC02F6820CE9A4DB752A929
    Malicious:false
    Preview:GIF87a..F..............k...c..R..s..B..)..9........1..!..Z.....J..{...........k..{..c..J........!..1..1..B.....{..c...............1..11.c..c..1...1.11.c11...............RR..1.11c11.1....c1..c...c1.cc...,......F.@..@.pH,...r.l:..tJ.Z..v..z........$R.v:.P..kG..A F]....|................................................................................................................................... `A....,X.@....J.X.b..0b(.1c..-x.(.d...D.(..eJ......Sf.1%.....O...$...bh....*M*....P.J.#D..!V.......0c....D.4.l.0....;w.@H..P"=w.(24..#..$.........kJ.S...Gi...r...f9X..V.[.n.....].R.K.`.2e.b?.F...l.r{........!@...v........}....8p.A...BD..;E..#>.pQ<..#A.<..<J.'S..9.&K.1a.....<....E.u.SO...TMU@..[u..^Th..f...v....N..$.h.(..".">qU./F.cUT\5#.7Na#.8v...?...D.i.W`P..L...X...NB).PN.e.0rI.Xn.`>.c.Vf...U.y.p.E.r.i.x...t....*(.}.j.&.h.....F:d..Vj.jAi..n..U.Z............z....*..J......G.+$.Y.ic.\..&...jk......J.m...j*..B...Z.................2.

    C:\Program Files\WinHTTrack\html\img\is-MSSD6.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 650 x 396
    Category:dropped
    Size (bytes):3458
    Entropy (8bit):7.912655822071319
    Encrypted:false
    SSDEEP:96:JCxf33Puy+8pfR1b5kqU4+4bB6EJHhXhqqvMhABzud2ZUKLue:AnuCVbeUyIHDqqDFud2W63
    MD5:5FD00C7325AE9D596F2A88FC7BD005FE
    SHA1:F59CAE6F5B217C280F71153FA576550857BB9742
    SHA-256:20112ABBC3DF0FB63AC09278B0C638AD1F49A63160D2BEF42520D2BD4FF77663
    SHA-512:CE6CBB27F94555D1238E44DFF956F81770B9E5951227A46F15B3CC44A20655AD9E0195720AB255E110E80FBAAEF7C4F3F3945C1725E1235FB9D890A1AB3A6BC1
    Malicious:false
    Preview:GIF87a......................k......,...............0.I..8...`(.di.h..l.p,.tm.x..|....pH,...r.l:..tJ.Z..v..z..xL....z.n...|N.....~...................................................................................................%.....8...$.. ....N...............D.[0..;z..j..P.B....8.BaD"....w..AG.....Wn...!S....$D....9s%.w.O...S.M..]........&..P.Fx0y6..$.t:......Zo...5iU.Y.R.z.'.jGf.*.,.Nw....W.c....k?....M;...|....s'b...*.....7...ypd....5L.f..m..FM.*T....{.o..q.&my1d..I...9-.......u.^._......?g..j.......q...M..y..a.u..9.[..-e.n*...T.q%TW.).VqJ.(..5.G.{..V.Z.fH.~.bF.w....Y.....&...e......8.k.U@c.;..I.@.).D.i.H&..L6..PF).TVi.Xf..\v.%.....d.i.h...l...p.).t.i.x..|......9....j.&..6..F*.Vj.f..v..B..a.0@.........*..j........+...;........Ij...+..Vk..f...v[+..>.l..................................*....0..+l+..',...W....~C.........k.FL...3...,.....b...t.......";.*.8..4.D.m4.27@s...0..C..P.j...W=...^]

    C:\Program Files\WinHTTrack\html\img\is-MT9VU.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 89a, 201 x 117
    Category:dropped
    Size (bytes):4085
    Entropy (8bit):7.888302594135794
    Encrypted:false
    SSDEEP:96:bBBlhzn7cHd3MfS/t9JqWeVpZEdC5gnRttmx:Dlpc9cqFqVsCuPtY
    MD5:F5D7F2AB6279EA5B240B60AB1FC03B60
    SHA1:C50908DA175CAAAFD1A89ED2F31818CCE442C18D
    SHA-256:35776AD01D39DFCC6C66A3BFF35DE6C1A70EB5E18E26C1130D60DA3016789C99
    SHA-512:FE8CD80D8FA9776CF289170293089AD930C44BA642B21FAF8F165CEE2E63C5A73DF4B743FB1F430B07AF2182C13BAF401F785E5666C1F33EA4F4BDE0E46FF1AE
    Malicious:false
    Preview:GIF89a..u............f.ff...f.fffff3..f.f.f...f3f.3..3.f..ff.......f..fff.f.....f3ff33.3f.33............!.......,......o.... .di.h..l.p,.D4.x..|.F...G,....B.L:..(..\H..l2.`j..p......4.. .....f..... .z..7.}.}....+.....w......vV<..1..G.H..(|...:...0...(...-.n.'../...'n..m.;....0..%...............(.............#..;............Z.c'.A.q.d}....w..$.G..!;.f.....k&..../...d....h.:k....".7...o..`.J..PA.@P....[.o..B..'b.m6E.)&D....]...........g......x..mY..ff.....1......G..R...6p...r...0..Ru.[BH*38.0..#..@.@;.q-....[......1....7..h....6...h.U+..Z...X2l..F...x.nk...n...f+".ssm......ve^.i.....c..<@So.!..D2.GZ...`L*...|....J.,..l.XSWen....^".....`.'.c.7s...[$.X.M".c.ur...[4A%K..b..q.....&.........F-..[....q&..#n.X...D.s.F.t.......$....-....E..Y"\..k...Jue^.U)...h.J2..&.@..9.1.%d...T.Mb:.ka2..f..p"..5 .2.8....b.>..?.f....9.[/Z.&.e.......p.q..j.. .....e....9..O.u...-.J$1......(c...@;.Y..0T.U..B[a..g.# W..8.gN.F. .S,4.....N.....2.n...%.5Em..].<...8...\

    C:\Program Files\WinHTTrack\html\img\is-NFUUM.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 491 x 271
    Category:dropped
    Size (bytes):9925
    Entropy (8bit):7.967000588880026
    Encrypted:false
    SSDEEP:192:K2DDV6LgwGvhXO7nfOoAc3aKjuKvMRoosskwYBg5/JUQpHdqijSXt:7wLgV6fAcXjuIsHYcJfvK
    MD5:DB0B92408C8553AD23F70CAF152F13EB
    SHA1:114E6AA89B238DFFF07E270FAC9DA385F05F1201
    SHA-256:70E91FB67497EA5EFEADE36584BD5B0898CCC744C12FFF7765BE8160F074A809
    SHA-512:FF4A959B342AC43EC2D49322F14FDD783F454062134D3990D55BEBA9AD90D558409C5D06FA5674F48BE147ED7B1005FBB8FB38D8EE0EEA1EEDCB523739D9FF93
    Malicious:false
    Preview:GIF87a..........-TPYd\..{R..o............................,........@..P.I..8...`(.di.h..l..@..\.M.;N....vh.|.[..<6..F..0&.G^sk.b...wL....t.pd'....N.....>.....z............................................................HZ.^4C>..Y?Fb.]`TVebL.._.g.j....mhqqxyr.}..................0.`........< ..A..0!H5...P.0.2%J@.....\.h ....T.e.....4bT.......$(........*3#....]..iQ.Fe"....S.W.j...k.\.z...,.`.M..j.^...*..q..=....|?.B.7/.c..N|..b....l..d...gVk..g.f?[..j...S.V.z...Y.~=;6..s....w...........+7......K.N}z..x?.......{..=<y...O..{...._..>..................."....*.`..2h`..J.(...\u.v....:.Rf.%.\.(....,....Z.a*..8....W.0...<..c.D.I.(..h.8..c^&.r.rQ.)......\v..`.Y].b..e.......a.......O....5...a).SF.......`.^"%`KP....K.*..5%.f-.h.f.q.di..h.(N..b../.R..Fb....8........@..*h.`........l(,t...@........i..9...b.l......P{...,...~+..v.i....;....(..b."J.."@..%`g....'..Z.p.F...o...'.U,...G.1.._....o.1...lr.(....'..2./.,..,.<s..o.....\..:".......H....$y

    C:\Program Files\WinHTTrack\html\img\is-NOB9S.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 633 x 395
    Category:dropped
    Size (bytes):49389
    Entropy (8bit):7.965162467088538
    Encrypted:false
    SSDEEP:768:bwU5bfah1CFrVOGRi6VPFmYwjvf5+EX4L66/MyJEn9CmQB0FsLn2ES14AC/+G1:M0ivCF5Ow4YwFpIvMX9CmQSF+2m
    MD5:DDA2FC21ECF67EB257182EA34110D498
    SHA1:E8311BE446B7B52A57423D366B0D5EB64CEF79A6
    SHA-256:68F7CB26859449F57E7AAFD7796209C9CE804456460AD5B60C7DC1EC20D25188
    SHA-512:635B88E51A9610D863D36EECCF6339C33EC9707BE502C306EAEB85FBA21AF329923E5EEE04A9A08EBE9CA9681FE57CF2C96C7A83F53DFE00604BC610C3E0D20D
    Malicious:false
    Preview:GIF87ay...........................................B....{s..9.....)..c..1...........!!.{{{...R.....!..Z...sRBBBJJJRRR...!.....111......Z.....k..))!J.....k.......RJ1..R..J..ZZRJ.....RJJccZ..{......cZB...RRJokcsog-{{c......c..-)){.....9..ZZZ.....................s.{s...k....B{{{sk......kgZ........sB..)!!......B=9.......sZs....c..ZRR1..kkk1........!..c{{.....!!!cZN...{..!))...B.....11)sssRJB.........1!!obFJBB...JJBJ..v...........R........s<1*{{k.!!9!!).....sskR...!!...{kR......{...Z..)!...............................{.))B....s...JB9............k..R.................{{............k.....c.....9..Z..........Vuu..............ZNA...{{s...!....RB1..........k....!!......9))........kR99R..R....s.dd!...{ZB.....{..{........k.....................,....y...@...... ......*4.0a..#B....D../j......;..).d.$Q.L.r.K.0[.|).&.3s...`...~.M..'.E.*%....N..J.*...b}Z....]=x..v.X.f.N8..G.Mf..$.n......Wo...O.0A......A..B...W.3..../c.9.f.L0.......+.N..t...U...:...

    C:\Program Files\WinHTTrack\html\img\is-O0I46.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 650 x 394
    Category:dropped
    Size (bytes):3347
    Entropy (8bit):7.921811353296926
    Encrypted:false
    SSDEEP:96:Uxf33rTWYXy+qFFE2AizBrAHZqUWqRcv/T1iYpn9Ig:0jTDy+qrzeZGbkYWg
    MD5:6D81EB66A71CA9FA8B804122B332BB16
    SHA1:E642B44C95FBF0FC3683C82B3D6D7310303EDE02
    SHA-256:530A9BEB02665408AFBA77FA8B16C10D368D7A0034ECBDCD597BED7B18E8FC35
    SHA-512:E60CDF597F56ADF165AB09B4619C7D9C4F93A891562B7B908CFE13FCAD1B42F088FCE7E5D091DD67BF83B3758B3ABA68768099DDEFB9EE777424432E1ED1FCB6
    Malicious:false
    Preview:GIF87a...................k.........,...............0.I..8...`(.di.h..l.p,.tm.x..|....pH,...r.l:..tJ.Z..v..z..xL....z.n...|N.....~..................................................................................................................H.............(. ....' .......H.a...#..g.\.....C.@........8..H.!9~.dI..c..W......l..../.....$.H..5....fh...S.N.G.....kK.E...J6.T.U7.....Z.Y....2.[.e..6m.........J....X...5..T..(Q...^f:7...C_yl./e.*S.M-.lG.U....g]....09.......N.8....+..|....K.N.....k........O......_.......O...............(....h...&._o.5b.Z.F(..Vh..f...v...b.#..f.(...,...0.(./R.........1S".@.).D.id...W.9"...=bU.P..x.Xf..36Y...%..QF....E..l..f.^..$..8$.[uy4.LJ.'W%..ZJx.Skx....o6.....a...g.)..g.~..a......V.c....l...E..j...P...\..W..z.[.b*j....(...$...[2...S.*.d........U...+O.......v. .B.l..^....JK..N.6.....W....f,..m".........Tj.....2\Z.T5l.Z.#.k_......Eo..zkrSh.......-.q..........3..C..A@........@.4.D..iN...........l.j..

    C:\Program Files\WinHTTrack\html\img\is-O20I8.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 89a, 525 x 191
    Category:dropped
    Size (bytes):3525
    Entropy (8bit):7.935733264757919
    Encrypted:false
    SSDEEP:96:Aoiuuy4DWJ3iqiYR9FbJ8p/hcQxmVGCyBKDKBz4k/:AoiDy4DwiKuAQxmVGCyBKz8
    MD5:4CA5AE42CF68E307DF1FBFD7DAA1FBAA
    SHA1:AABF0D8B5F3B23214AFDA824DA79A4E396023809
    SHA-256:10211930CB3AB40C76DEB7E0508D6387AC94507057202C3988BDF4EC2FE90405
    SHA-512:E732B029E099E81C56F4A7B1F607E6946F60B79DE1E234DBC895DED80414675B9D84A587AE556F52E8F228B96E2DA124C4DF2C73972A2DA6B6B3559777BB0FDA
    Malicious:false
    Preview:GIF89a..............{J..............,........@..8.....'G.8.m..`.}.).de.l.p,.t.^f!.:....P......RID:;..g|B}.+.7.....3..I..5..].mN.....~....................+(...G...".r,........5an.o*qZ..WUg.KCj.m.p..+.[._I.T.;....D..............................2.................'.....H0 A....\.....JD8..E...^..m... C..I.....,..R...nb...eU.1hba...?.....80b.E."....R.J.FmJ..P.N.b.jR..`..KV"..h.|..O....Kwl.x...+R..m7....... .!^..^.j.k.L....3g..];.t=+.M...%..U..>...+..m.s...;5[._n>aSs..[.X........K..;0.. .O...w...........f..x..!..L...............(..)..{.....6.`..F(..Vh..f....vx`. .(.$.h.(.8.LV4......K.0...3.h.q3..c.A...(...+f.\.,"..q1%.%r*Vi.Xfy".Q.)G.=.C.. w..R.d.g.9$.pN"..`.....i..|....*..j.~.&...'.J.)g0..cqT.!.j.&.F6..q.....&.....".&.......i[......x..y....7.&.....`.F;.O.q@.lB=..QV9..US..T..j.TSJUE.V.n..H^)+.n.T/$.....y.dX..a{X...\Zx.t....7....;.M...l.7.gl..V....},.s..X...2d..,....0.\r.tv...Ac.'.[q.@.-4H3k..k0.L..L7.tEE...TW.4..Nm..\.|

    C:\Program Files\WinHTTrack\html\img\is-O3P7F.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 650 x 396
    Category:dropped
    Size (bytes):4425
    Entropy (8bit):7.9208525283536675
    Encrypted:false
    SSDEEP:96:9Cxf33IuAvt9JLS1TBEymRO375z3jAIYeaES0AlCxhw700nFKa8f:EAuAvvJXAYeaES0ECxqy
    MD5:53CF2816321698C42DA17334EA593C4C
    SHA1:58D3C1172A02BE42AB311446EBD91CD137DDBA8A
    SHA-256:405E176424164FDF38054766683C5B38C1182DEC78651911F8EF0663BE7932D9
    SHA-512:2F75ED7511D2B8B8FC7E08B380FA5E7F8B80A0D604BE1D280EB20B880146293BEA1037CC0F93353D587C7583222E89A3379BFA99B2E8AB70B1C1A169AE5B292E
    Malicious:false
    Preview:GIF87a...................k.........,...............0.I..8...`(.di.h..l.p,.tm.x..|....pH,...r.l:..tJ.Z..v..z..xL....z.n...|N.....~...................................................................................m.................................................g......P..!... .............8x..@...d..&.P..%F..>..9f\..vR>@ih..@..| .f.....S...O.J.2...S...R.J..T.S.v.{.fV.a.....g...:(j.&.<.r.[u.].L.&..7..{...|.1b.......e.r....,..h%...._..M.6=..k.#.~.z...3..,.......N=y5..Y7-..q...b/...v...23....p.._#..xr.e.g..1....T.N.ft..sQ..<...P.W.|..7.c..w....g.}..3Th..........q.y....rf.Tb....Yz*=.a}3)T....tR$.x.v..H.06B.. 9.......c/Ku0. E........D).OT*..P...e]Z..h9&KeR..z...n.x..u.9gE.ec&.......f..B..n.6.FG.F*.Vj.:..v...*..j....$...V...!.;...^.Z.@.J(?.....#a...&-..y.;.>.Mj.)$....4..u=.9-..Vi,.'.%......).t..'.....Z....p}.. hXE.VS.Yu.._..Wm..K/..^.o.....t....s.)(....<.h.L.....f...{.Y..w`z.........s@.......]...lX,.%.......(.lspA.'4.a.M

    C:\Program Files\WinHTTrack\html\img\is-OS2F1.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 430 x 247
    Category:dropped
    Size (bytes):10529
    Entropy (8bit):7.973281792659444
    Encrypted:false
    SSDEEP:192:GlZwUO7uLzhf+kdiE/y3g/2g4RycAIqqaF6Nq+Cb2I1sXui6JFWUer38e3UlrOeE:GMPKhfeE/mg/2g4RytIqN9+Cb2I1s+VA
    MD5:91CEF992FD88A3938A7B8EBFA2957BBE
    SHA1:0E5BB1CB87D26A1519C6C20E4084227630962118
    SHA-256:C7C02FC4813DFE506C8E60285854BD4FC7D99CBB20262CC99E42C6596783FEEE
    SHA-512:1D74264B78EB2693A44812770035BF02827956CE946FE1922F9AFB181C73A3ED5822F1C3354F992B48FD4F048D4DE5381BD4247634C8BC7729159FAFAEB20357
    Malicious:false
    Preview:GIF87a.................99.......JJB,........@......0.I..8...`(..g(.a..0.B..EZ.p....9]A...}.cmXl:..tJ......u..m......m.6s}_...v..xz~....Bx.7:.C.B.C..........32,.././(V.......Nhv.r.idstof.m.q..zox.........k.l.............3.2.......................2.................7o.y...;HP^.z...C..!.n.2>.G...;...U;q..L..`......(M.H.].....Spb....z2..........8r..P.J.J...X.j.:.c@.3.5.....sG.%-.....g...q..t....T_..h..M.c....+^.j..!3z.)V....3..l7g.:+..8Z.Cm(K.^....'c.9...|.C{5....|.i..L.8...+_.....;g'.!..%.....xo...........K_.....A*.?.2YK..<.......db..-h...g..R.............X..a.T`.-(....Xb.5....1 .C5....c-.(!..}g.\7..:...>..Rh".'..7.FJ...n.9I.n.Qi..;.^.@v..^...bz.du..9...i.Rn..R...w..NR9_..a..F.I...-U&.....}~F...L.f.[....=...._...R...)....yed.ny........._.Y.I.....Y..ZE...k.....A...jC....,.{.*....h.u.~...&..M..$..R'Zz.*Kj7F.....+...ko.LM.o..B..>.fl....I.,..R.Be).F...........V......\.x..*..%G...s.p..Wyn..^<n6.s.sT...3.^K[...g.B.D.G/......2......a}..^.]

    C:\Program Files\WinHTTrack\html\img\is-SB2TI.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 680 x 104
    Category:dropped
    Size (bytes):4846
    Entropy (8bit):7.913146904390617
    Encrypted:false
    SSDEEP:96:IlyPGdb9+63sgqvk21b6KUH9Hs+iAtzK/VSci5kMr+EgFunNoZHjjcesm:Ilnj+6Z2h6391iJ/tiWMWuN1m
    MD5:786D3E954394F4094A1B8377EC57092B
    SHA1:8D7C8517358382FAF4BA2F6463B845941B5AB14C
    SHA-256:4D7A51AF4895CC3527DAAFB1C394BE6E4D62FDEEF76C4850393C65663C4B29DF
    SHA-512:2B4F2C815D58EEECFE01E17BC86FAF88BF9C8DEB470E8A48B3E1E6CAABDD9102BFFB5B2D33102F110A1C4AA49FB4BD0CB551F15D8963933D710A9ACB6EDCDCB0
    Malicious:false
    Preview:GIF87a..h............;..x.....`.....N........joe............,......h......I..8...`(.di.h..l.p,.tW.A..|....pH,...r.l:..tJ.Z..v+\....xL....z.n.A./.@.....~......t...............................................................................................................................x.1.....,P..!...I.H..!F.2....D..@n.I.$...R.<.r..V.\...&L\8s..%../b>}.....a.6M..m...J.j.m...5.t....H......!H..p..UP..]A..\..#..@.V$I.H..1}:)i.bO._Jf.*..^]...3N..v.....O........2..b?..4[..Z......a.J..=w^.]..`.yF..\...B...6.p.!............T8..L.#.g<.e.-.o.O..L...B..,...LiB%8.Q.(.k.H..l.Y3[m.H.NS....9..&"....qc.U.._..bs0...<3....q.4Pu.`.@..).PB.4..xH...|..Qz...Q{..^|.M.XJ...%e.eV.M...`...&...)...5..3."S!l.q..z~..8...\.]..b...\....h=5....7n.....%..>..P.D.I..G.Q*.t......:..:*^.%T^...5.`..f...Xc..[../.I&g..yf.Ni...h."x.k.6.QuVh!.....}f.g8.y..p#.[.*J...{...X....;A..h.V..y*.E...........j K2r.O.J...........|..kl..!..Ma...L..|.,lN..C%...:o.-.@.i..Q.{....pL.x

    C:\Program Files\WinHTTrack\html\img\is-SNEP7.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 681 x 521
    Category:dropped
    Size (bytes):12992
    Entropy (8bit):7.968420811131012
    Encrypted:false
    SSDEEP:192:3vVUlYZwQO1KkaO/nD5mMgb8AIN24BC1CoDkAj5qWxtiek0bcuXEWsSXk4Y5yZxy:36l4wz1KkZkQsJjDkwq2FY5yZxf3X6R
    MD5:6B10786F3901D1B9D3FC8FDDBE26D918
    SHA1:34263D2526864E90B0CE1FF49C96595C99190212
    SHA-256:415404D03A64926F106F74DE203AB94CFDE155E6CE87112140FB64C2BCEA16CE
    SHA-512:085E950D693C189151A9AB86E222F94FAF4EB652B09D8C5B03A78008A098DA826896826B6AA1C1DD4FB694917BE35416D77A922AFE200743B700B15E7D69EEA9
    Malicious:false
    Preview:GIF87a...................k...c..R..s..B..)..9..!.....1.....Z..{..J........k.....{.....c..J..!.......1..1..B.....{..c.............k.......1..11.{k..1)!.c..1..c...1.......c1.....{.11B1............kJ)1..99)!!.B9!.{sR).!...sc..s...........))...........RR..1......cB!RB!...RB1.111!.........!))..cc.c.....!!))!.)!.{scscRR9).skJ9!Z9.c11c1.cJ)kJ!ZJ9.c1..{91).1.B)..................................,........@....4S4AAOOVLLVd9gWm>TtEEY9UUiB99B@.r..c].4R..Sa.Wofe7;6MMKJII-JK66H.;;7q77C,.,F,GG.hF.........).)...................................H......&Dg.^=m.....;..$...n^C. C....I..RnT.Q.D-..P.0bD..&...I..O.Pf..:..L.E).].ti..O.J.:.i..U.b..!...X.N.:V...0.}0.-..l...M....v.........2. 8...}.l8..b..+x<Y.d...d.Y....8.<Z.i..G;......_{X-...._..m..n..~..N<....#G.`y....D.N=....g. ].t...O ......../......../A......?......@.....H....h@.... ..:...B@...R...f`...d..".Xb..T@b.,...,..@...h..2.xc....c....#.D...H.....L.....<.d..D.A.WZ.e."XYe..dYe...iA...i&....f..Xs.t.M.....L#.p....C:5..C.D..

    C:\Program Files\WinHTTrack\html\img\is-UG70T.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 89a, 430 x 247
    Category:dropped
    Size (bytes):9834
    Entropy (8bit):7.970745894312722
    Encrypted:false
    SSDEEP:192:5pM19FKVX/r7BOUOLKD1ic5afH03s/dPapI+9/OR2QKmktUGLbV7Gz:6cVX/rFtOOUc5av0CYIU/ydKR3V78
    MD5:BDB8103FCE5ABE82BA509851192C6FDC
    SHA1:9DB9D3244D453AFD62EF53C39D05F6E013E5B8CF
    SHA-256:B02A59502AA72342CB6638F517AAB88767B4D119B85927766BC102CFEF565072
    SHA-512:6D6E9D19166EB43F541C61DEC2C21E87EBA68325BF7F3527DF56B6D767489538274843FE67DBCDF1A474FB982138D19F6899F0AADD5428DB8817FA4395400AF8
    Malicious:false
    Preview:GIF89a..........B99.......BB.......,........@..H...0.I..8...`(..w.BQ.....+..j..p....9.A.....^axl:..tJ.Z....X.v._..;....t.lF/.;t\....w.~...i:.C..............2(-........W.......8_.l..v.oyu.rgw.q..x|.y.t.~....t...B.7......(.3(.............................................._.k....d...j..X.0c.E..#..(..#.'.... d.K.....@c>l...I...8s....OH........,.HT.e..-.z...j9m...|..T.(c...`,..%.XT; m#.J.$=.....e..\{.m...m..j.d.6B.hdc.h.u.......).K..h1C.tY._.x.. ..u.e.2...!=.aC..}{(.V...x. U.%.+_.9s.V.....,p....'z..o{...>.<.......{......OO.;.............7.n.M..IJ. @Wt........%..e....5..C.0.j.r..Y...!.%:8.R!...-....@..Z.5".......1...sD.i.Hj..F.fe.L...PoS...@X.7.QWZ.q.i...d.if..Q..;MZ..A0-.....p.i...y.BK?.*.M..y....9m.g.G+&.`.!...a.M..Ws..&.U"......'....l..J...|..:N...^~v.G%.{~.d.. ....(.....(..=T..._...Jj}.i....+..k..{...6+.....l..c+.X.E...&......V..$...F..{....JS..V.:.B+....,.A....z..<..C.2[J...LkZ,.....O..M...&.......v<.gt..N...4.lq..J.t..R...Vg]..Xs.

    C:\Program Files\WinHTTrack\html\img\is-UTR8A.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 652 x 394
    Category:dropped
    Size (bytes):2024
    Entropy (8bit):7.80916033240804
    Encrypted:false
    SSDEEP:48:Yr/7fCrnTGCHUMImKg7yqrrb+ShPKAclu//28x/rs:YrTfW6qUDmJGsb+Sheu/Pxjs
    MD5:89341E052D474BA78E4D2071B6D563E8
    SHA1:F7CDC5A4C1811695A3C4983656D1F3AD33E00AF9
    SHA-256:04F7AE17EE142D0246CA5DA6BE31BF660C3BAD7114E6B1DEF197CFB73BB0F0AD
    SHA-512:A9E52A3C6C7D1F7B5F58B030C9302DC2AEEF6FC25C74BAB3B937ECB0D24588BE7964DD7D63EFB68ED931C23391E35058563EB5C9466E148C52F88EF35CA51D79
    Malicious:false
    Preview:GIF87a...................k.........,........@......0.I..8...`(.di.h..l.p,.tm.x..|....pH,...r.l:...@.Z..v..z..xL.....x.n[...|N.....~....v......r...............................l....qp...t.....s.............................<.*.........................u...............P..|....0 ?E..>.G.......i`0..>..z.Z.c.i..U\...0c.I...8s.....@...J...H.*]...P.J.J...X.j....`..K...h.]...p..K...x..........L.....+^....#K.L....3k.....C..M....S.^....c.M....s..........N..Km.]..........J:%.....&%.._&..[n......o..>.vY.0\...>F..%r.N.|.....( +...^>~$.....h..F(!1....{...].$I....N.C..6qQ........gB.....:.....H.<...@.).D.i.H&..L6..PF).TVi.Xf..\v..`.).d.i.h...l...p.).t.i.x..|....*..j.&..6..F*.Vj.f....v........X..PdH.x. ._7..*.>'jz..bj..Y`...>..@..3.9.....r+z."..5....B..........$...;..E..q.2...t........&....K+...:....l.....7....G.Z0x`.....K..`....:....F.......1~..$.G.../2.....RRC.1.2...WK.:.m......"_Br.(U.....K....7..,'.

    C:\Program Files\WinHTTrack\html\img\is-V16QJ.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 128 x 128
    Category:dropped
    Size (bytes):4721
    Entropy (8bit):7.90271334735674
    Encrypted:false
    SSDEEP:96:FHRN+dMwytQofzXS15iFz9jPOA4l+8dfK3EP+kWyTBCWSmLEhN5WP4yM4:FxcMtTfzCimAeC8JWX1Hvib
    MD5:66DEB0046BE9541CF50FCA416816D375
    SHA1:9ED9AD2CD21C7561B892494917E4E37CA033B471
    SHA-256:6AC5FADF79B93E9A00BDF495DEDCD1C45A68A5BB43192C913D5FF3FAC4322B87
    SHA-512:DCAA63259B2EB25BF2EC76F36C34C71F77C45E7B23ABBA07E3F0EEC25CE65A76439C54B7D1395C908A0ED97B22725984A3B4B95AAFEE7712D66D5665D4C2F91A
    Malicious:false
    Preview:GIF87a...............................,............ ...E7j...0!.Rm.F...J$.....E.1O..K...T.!......iv`..".AU\...V.,....3r.......R..p..E..%....YK..c v})>@O3..=.=Q1..q..uK>..!.*r..yX.H ..........*hr8:#HPc......)_ q..%..OK.U.B..6....k:..HTp...OH..{*....y....V.......P.F$..f..7.W'2O.... ..O.B..D..$L..8....qr.....6Je...b....4..!.2..a......G.,i...I.l....O.j.Q.4.(..e......U8..A5s..L.X.UF.Ih..+f..&.`..B......j....R.&.6".....Z.h.tUd../>......Y>.l..@.<+`2....."..|.L....(..... .lZ........)#.....&.T.S.Y..].ETamFM..8x.%.].Q..R.]S..;...!..>!.o5....l...(....H.T R......GZ/...3!.`..+Pr.B....E..ID..PJ...q.fB.uM1.4..!Px..z.....H...J....!..Q..W$9Q.....E{.r.R]=C..fy.q..&Ki.. %o.. &7P...D:|....'.'+.H.TU..%!....H[.....|...kA..51P^0D..I2e.F.S0w.$.....b.i......K.]..g7..4T..V.|E.%B R.W6R.0...h.uQd8kl..c.c.c.b.?4.ci.*.TH.eB..`.L....%...N...#k.(..Ar.L"=. ....gi.. .dH...e.#>7.3...,..'...a..D. #..pE....^9rD..............'.[(Q$.u.".8.T.8qT.|n....p.mi..e(.....W.3....&hS%..3...I....2

    C:\Program Files\WinHTTrack\html\img\is-VQUEO.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 465 x 326
    Category:dropped
    Size (bytes):8975
    Entropy (8bit):7.963190799983512
    Encrypted:false
    SSDEEP:192:9VtKVARaISvocl7p9ZNxhXHSZhc4EP2WPuPkf07ExgtsgsCd9hJH+:9PXRfShl7ZNDCZhZ22WWMfKExqUCd8
    MD5:8609E3C23B733DF7B0885AD80CE4F5EA
    SHA1:A3C6BCF7652A3F05E4486AF240737879E93E39ED
    SHA-256:1375024A5C7F04FE8DAAB657764998B0AC9A4F2BDA41264B8E3559BCE7B6111C
    SHA-512:9CD2F06E010FD1868403CDEB80A1BF7C59788F3A21B2CAC94380BB465770E9AD4264732C62004D4054F8B766B03A2B93E4A196EF48C766B577AA798F02D4A6B8
    Malicious:false
    Preview:GIF87a..F.................k...c..R..s..B.....)..9........1..!..Z..J..{...........k..{..c..J........!..1..1..B..{..c...............1..11.c..c..1...1.11.c1......1..........1.RR.11c11.1....c1..c...c1.cc...,......F.@..@.pH,...r.l:..tJ.Z..v..z...` ..H...tr.\l.nL.7..z~?h..{..~................................................................................................ .......................................4p.a...#>40."E..3....F..:b.I.@..!..P......^....M..h..`gN......!....F.".`a...M..."@...C..x....1dt.hA...D6H.h@.O.;.. .0.Q......d.Q_D...84..`..3!.....6@V...... ........B...K..a..![..X.g..M.mm..k..e....q...{...;x...[~..>.....(.......|.}b..#d..~.y..M..i..J.(W..reM./o.....@.5.Q@...S."..S.L.V\y....Vh..f...v..a..~(.$.h.(..a.OXe..R.8..P.H.UY.HU.7V...?...D..".N...32).UK....3.8e.X6..RRyU.\2..;^I&V]j.d.F...[ ..t.i.xJ!g.|...v.g...j..1h..6..)...Vji..^J.V.t...*..j......*._!.U.Md*$.W..&.d...Np....k..&...1.K......P@..Z...v....m..k.............k

    C:\Program Files\WinHTTrack\html\img\snap1_a.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 491 x 271
    Category:dropped
    Size (bytes):9925
    Entropy (8bit):7.967000588880026
    Encrypted:false
    SSDEEP:192:K2DDV6LgwGvhXO7nfOoAc3aKjuKvMRoosskwYBg5/JUQpHdqijSXt:7wLgV6fAcXjuIsHYcJfvK
    MD5:DB0B92408C8553AD23F70CAF152F13EB
    SHA1:114E6AA89B238DFFF07E270FAC9DA385F05F1201
    SHA-256:70E91FB67497EA5EFEADE36584BD5B0898CCC744C12FFF7765BE8160F074A809
    SHA-512:FF4A959B342AC43EC2D49322F14FDD783F454062134D3990D55BEBA9AD90D558409C5D06FA5674F48BE147ED7B1005FBB8FB38D8EE0EEA1EEDCB523739D9FF93
    Malicious:false
    Preview:GIF87a..........-TPYd\..{R..o............................,........@..P.I..8...`(.di.h..l..@..\.M.;N....vh.|.[..<6..F..0&.G^sk.b...wL....t.pd'....N.....>.....z............................................................HZ.^4C>..Y?Fb.]`TVebL.._.g.j....mhqqxyr.}..................0.`........< ..A..0!H5...P.0.2%J@.....\.h ....T.e.....4bT.......$(........*3#....]..iQ.Fe"....S.W.j...k.\.z...,.`.M..j.^...*..q..=....|?.B.7/.c..N|..b....l..d...gVk..g.f?[..j...S.V.z...Y.~=;6..s....w...........+7......K.N}z..x?.......{..=<y...O..{...._..>..................."....*.`..2h`..J.(...\u.v....:.Rf.%.\.(....,....Z.a*..8....W.0...<..c.D.I.(..h.8..c^&.r.rQ.)......\v..`.Y].b..e.......a.......O....5...a).SF.......`.^"%`KP....K.*..5%.f-.h.f.q.di..h.(N..b../.R..Fb....8........@..*h.`........l(,t...@........i..9...b.l......P{...,...~+..v.i....;....(..b."J.."@..%`g....'..Z.p.F...o...'.U,...G.1.._....o.1...lr.(....'..2./.,..,.<s..o.....\..:".......H....$y

    C:\Program Files\WinHTTrack\html\img\snap1_b.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 497 x 268
    Category:dropped
    Size (bytes):10567
    Entropy (8bit):7.9717467125194394
    Encrypted:false
    SSDEEP:192:qw4RZ2gkjgxRJqp9QPLYPGwQRXnchmieJ8ZseJsyURECmapEbMx:qwfgk8xRMzQp5n4miEAC1/x
    MD5:A0B43835BABD7AA353E5F832CB05934B
    SHA1:D879E66990B710DBA484745545FDBEBF89AC40C2
    SHA-256:C7E273A238EF922051865E14592081E9D6A2605442798B22EFEAD31B9A363D9D
    SHA-512:6BCF462E46C6F4338539823E3E776844C2FF207C7E4B5745726228D4775914DA19F34AB18C804EE478E4A67D2D5BBB6532C8741FC82E22A1B333B9EF5E2F1121
    Malicious:false
    Preview:GIF87a..................f.....C..~zn.+).....<NJ.........,........@..0.I..8...`(.di.h..l..R..l..=.9....,..(x...l&.F.!!H.j.hS.]..x.....z.n...r<~...x.\o......s~.}.......................................................................2:>?6=..E.aL.NJZI.].\.Z.`h\.b^..o...kwvpb.y{............Q.G..*\.0.'I."..51.EV.He.H... .C.R.L..f...|...J..b.)...........N./a...C...1..R.......X..VS.L..d..*._.z.....h.5.6m.n.....\.t.............N.}k.^...N...3..y...)k..93..C.%.K4..O.6.:u..c.......o..6..........I.X.....O.p`....k........O......_.......J.,......n....."......h`...E...5h.t..(..&H..fX.h-... ..J....[0q.!.*......(.4.h.8..s.X@...U........5p.,.P../8...2...1.(...,Yg...qi.,...e.,.....QA.p.).pN7.c....sB......o..`.&.h..a..~.*i.....3..Q@.8$....p...NAj.B(`.......3.*......}l.*.7x.C..j.*4..k..&....,...T...q....b.-`M-@...+n....\..L..r.dFm.#...TX..@I.(.@/Z...S.,./N...@2.`y..h.r.8.@...p...&p......J.;..r..,.U..+..@2.2.*..2...<..8...s."......2Q...nu.qs.|

    C:\Program Files\WinHTTrack\html\img\snap1_c.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 495 x 266
    Category:dropped
    Size (bytes):21952
    Entropy (8bit):7.985504184139934
    Encrypted:false
    SSDEEP:384:SBymXu+8dvRC53hHKPuoSXEqD68/ulWAPu3jYsj9iSit7m6NuC1QJdJ5xPhC7bi:SBnXu+6RCLqPuotqjWPq8y9Hi4C1oTPX
    MD5:71ED743738E9F1B5A1C357E05F6B5882
    SHA1:66E7D7BFD54ACA0F1336F75FA54617A6C12671E7
    SHA-256:96250D72E9336365C89FD43F0062052F8794A4F206783A3D9BD4C54E7DD84350
    SHA-512:5159AACFF98EEE32810791838C8AB659D0CCBA1ED707C14D85E8F6E5ED83A0FD0006261A60EC9EC17F449980F95D3F7CBF3A98E826E97A8BEF68A3BEE883AA86
    Malicious:false
    Preview:GIF87a..........2okekb...R..n...........................,........@....I..8...`(.di.h..l....sM.v...3...c.+..;.p.| i..N*.U.V*2..v........z.n..g<N.....<....u..y................................................................4F..GAN.GSB.:.OQV6T.c..iY..e..hb`o....rf~x.{}..............]...P.P...,.S.Y.#J.X@.D....2. U.....4P`....Z..u.....^.,..... .tT...T..............k.J....4Uj..%.Z.....S'M......[K.]K.-..P.u.V..i..Kv..T....W....*.........q..f._...jd.R.[v,.-.&.....VP]..R.J[._.e[....Y.....7f.^}s>...a..s.N.7x.U.....vg....r...k..><.....-.1........n....w.|..E`y....`..h.g.6..z.UH.`.u. ..B..R.!...h.'B.`i!.H..(..c.2.hb.8.#.;...>...$N. [.-..d|]F.d....q.a.....$h.Y.....ft...\ib..z...\.....QNig.u.W.{....R....y.:(.w..(..>G...<..VJ.f........*..j........*..j............+....D....u..b.^..>+-..:K..f.-..j[m..~+...zK......[n..+/....kk../..F!._i.`...k........7L...C...Gl...wKa....1..*($.=!.@G^^.S..=.e..r.r.4....5.is.....Im...D.m..H'...L7.

    C:\Program Files\WinHTTrack\html\img\snap2_a.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 633 x 395
    Category:dropped
    Size (bytes):49389
    Entropy (8bit):7.965162467088538
    Encrypted:false
    SSDEEP:768:bwU5bfah1CFrVOGRi6VPFmYwjvf5+EX4L66/MyJEn9CmQB0FsLn2ES14AC/+G1:M0ivCF5Ow4YwFpIvMX9CmQSF+2m
    MD5:DDA2FC21ECF67EB257182EA34110D498
    SHA1:E8311BE446B7B52A57423D366B0D5EB64CEF79A6
    SHA-256:68F7CB26859449F57E7AAFD7796209C9CE804456460AD5B60C7DC1EC20D25188
    SHA-512:635B88E51A9610D863D36EECCF6339C33EC9707BE502C306EAEB85FBA21AF329923E5EEE04A9A08EBE9CA9681FE57CF2C96C7A83F53DFE00604BC610C3E0D20D
    Malicious:false
    Preview:GIF87ay...........................................B....{s..9.....)..c..1...........!!.{{{...R.....!..Z...sRBBBJJJRRR...!.....111......Z.....k..))!J.....k.......RJ1..R..J..ZZRJ.....RJJccZ..{......cZB...RRJokcsog-{{c......c..-)){.....9..ZZZ.....................s.{s...k....B{{{sk......kgZ........sB..)!!......B=9.......sZs....c..ZRR1..kkk1........!..c{{.....!!!cZN...{..!))...B.....11)sssRJB.........1!!obFJBB...JJBJ..v...........R........s<1*{{k.!!9!!).....sskR...!!...{kR......{...Z..)!...............................{.))B....s...JB9............k..R.................{{............k.....c.....9..Z..........Vuu..............ZNA...{{s...!....RB1..........k....!!......9))........kR99R..R....s.dd!...{ZB.....{..{........k.....................,....y...@...... ......*4.0a..#B....D../j......;..).d.$Q.L.r.K.0[.|).&.3s...`...~.M..'.E.*%....N..J.*...b}Z....]=x..v.X.f.N8..G.Mf..$.n......Wo...O.0A......A..B...W.3..../c.9.f.L0.......+.N..t...U...:...

    C:\Program Files\WinHTTrack\html\img\snap2_b.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 586 x 401
    Category:dropped
    Size (bytes):41328
    Entropy (8bit):7.9677210443728
    Encrypted:false
    SSDEEP:768:XucKNjH67nGI0xfzhucOUzhOlfzieQL5tTyBVai7wJ7ufBMmfh:X9wunorwcpsogBomwMGmp
    MD5:80ADA7D9FA9E9C37377B7723628E79C6
    SHA1:A21630B0E22BDE483D57AACB019C93658BD58CA1
    SHA-256:835DC7FDDA5493F29BAABA37E86FE5DA57AE057F772F7C0564377F8DDAA52DB1
    SHA-512:F427312028B7D39E54678F007934F2A827517A865F4503155AE9F8F81616E9B0A1F858B25E8D3A1C0F5F58FD119A95BB8C38BAA3674282357D1EED8E758062AF
    Malicious:false
    Preview:GIF87aJ................................{........B..)..9..!!.c..1..Z..))!R.....{sk..!.........cZBZ........k..J..k..R.......)!!J..J.....ssk......scJc........9.....999kcZkZB...BBB.....{B..kcJ..........skck..!!!......91!...s..1..BB9!.......)))..sZZR!!....c..ccZ1..kkc..s..k111...!..B91...s..cZR................{s...9911)){....{{{RRR......91)......B..B99JJJ11)...JJB...cccJBB.....{kJ911R..kkk..{sss..{s........ZJ9...B..ZRJ.....{)..k..Z.......RRJ.......k..s.....ZZZ......sscZR9...cRB.........ZRR...{{s{{kR....{..RJB........JB9s..kkZ...J.....RJJ...............JB1....skcBc...................RJ9.........RJ1skR.....................9..Z........{...c......{c...............!..ZRBRRB.{c.sR.{Z..k.....kcRs........................................................,....J...@......H......*\....#J.H....3j.... Cf...I.N@.`....-a.t.a...@.tR..N.:kr....(.=5.E....C.>@.(...Sy....&..Ua`}0....h.].h.Z.J..u.....J.N.....J...+8.....B..x..%.#;.<#2e..+c..93...3..0c4..S.vp..k.y..@.l.

    C:\Program Files\WinHTTrack\html\img\snap3_a.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 89a, 584 x 408
    Category:dropped
    Size (bytes):6114
    Entropy (8bit):7.950320594924544
    Encrypted:false
    SSDEEP:96:8oflPaZzOzgAuaoGfIy3lkBAPKlq3AKfIDRsDoC/q2kJ11aTQPMnH9XQvX1rsL4:Vdi4o4V3aeKQQtqcC/q2kJ2uKdAvFT
    MD5:D85FCF63724BDCC5D8D5322C008DAD57
    SHA1:468881C9D5587542B0DEABDDF5016A7C890B3C84
    SHA-256:63EA044CDAC143A481F34075237B251C123AB172E7C6884F34D2E586C4C5DB66
    SHA-512:C2B61FE295892E40C470EAC7EAF349D66768B2700EA5EBFD6A29580A054B9062EF309100A418AE806A404A3E966D189F17427E847FB47AD95357D030C8FBD969
    Malicious:false
    Preview:GIF89aH...........h.........................................,....H......P.I..8...`(.di.h..l.p,.tm.x..|....pH,...r.l:..tJ.Z..v..z..xL....z.n...S`N.....~................|.q.*...............................&....D........3.......%.........p......k.....f...q..a...i..\.....h...Z..S...R..9.(........ .....J.Hq.../j..q... ?..Ir..('f........y.....2k..As'.......S.C$E..L..i..>},.8............0.F....U....P..m.'n....on..G.V.J4.......0`....&..._.C.+F......cn..rR.EA.<z....+.K..P.....J.C..?...7..w.fL|.......m..i..)J..k.-b[.V.s.;....7o.G...;......<...g..?..x..1...#.ig.2s.6.w..V.p.J...U...Y..z.IX.t....{ga.....W.u+.X.3A. #.A.U..&.. .y!..t<..\.....A..a....#...R.......3.(.kLI..f.}y_j}..fM..X.*..f......f$......c...L.Qy.]W....[v...q.$S...0..(.....E.f....XD*...bi..9....j$..j.......W.j..V.J......h...z..q.%{..c..1VJ...\..Cz.U.`h'..,..*.h.QH;...LB...........,...._..m...0M%.D.f...Y.Q......v&.m....a.&f.[.^E.....s...f.n. Lu.{).....?. ...k&u.A.d.:.;a.m.g...!...\

    C:\Program Files\WinHTTrack\html\img\snap4_a.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 650 x 466
    Category:dropped
    Size (bytes):37989
    Entropy (8bit):7.986287510180498
    Encrypted:false
    SSDEEP:768:IN99dSapP7hy71GTNufQ+VWEWL+BxIN/J2Pfnq2p4Fb/5txKwvBC/:IN99capP7ha1GZb+AE6+BxI1J2PX6/5a
    MD5:F563D2EC8523D9AA2AA8EB132116F7CA
    SHA1:0279BCC0F65B6891574C83AEE9178C8EAD25365F
    SHA-256:1DAF6B5735028617D4B32846376A006E88AD394E183D92F9966F49460905705E
    SHA-512:339325CF5250544FA1B7874829ABEB4E538990F3CB4BE732E9BAB1E7AFF19A962C932808280FB08DE7265C1790CDB4DD4CA632E07F71EA95C12722219DE4BACB
    Malicious:false
    Preview:GIF87a.................`]Q...J.. ....s...&nj..............,........@....I..8...`(.di.h..l.p,.bp.....;..n.x..;\..\8...JU...,oAezw.-...&}glrM.9....E...o../..s.............\.....e..~.n..\.........................................................................CjjP...YgK..M9z..].~;m|u{y.0....}..(..0.!.."J.HQ"%Q.*iT..b......$*.&S.S.\.r%.Y.~..IJ.0\.....k..@qU.J..P.F... M....2H..*......p@..d..LM.@.5.O.4.P.)S.S.R].L.2.j'|......Z...j..a...^-...a..#Kfl....O..x.f./..,..h.+c6.....=.~=[6..[..{tn.....L.bp..Z..{yj..3.:.t..o.o.Z....ak...vv.._..|x....'N......cg...a.....}..6.~.!(.x.6...........w..Gaz.v.`..N...9X.. ..!..i.b.)N.....X.#.w`.%...>..!..$.:......!..:.$./.ie.2.w$.W.'..`.)...`..8#.7...f.p.).t.i.x..|....*..j.&..6.....1..`.f...k...1....2Wd.....RB..K..j....$..............Z...h......&.]."#..$.z....H.....m..~+...k..k....m.../c..k..>.L....-YO.p.|PE..pd.Y..._...+q...;....{q..v.....V........%u..E@..)..5..|...0.sV0#0._....3..E@.x......|

    C:\Program Files\WinHTTrack\html\img\snap5_a.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 682 x 391
    Category:dropped
    Size (bytes):14993
    Entropy (8bit):7.974640290885835
    Encrypted:false
    SSDEEP:384:lpWZHjraxJA+YGSfkfujsZ6gS3LPMfaUgznTu:rADrQJfsUOny
    MD5:9E9B36A3A4B2F171DAEDC38F16D5DE37
    SHA1:365435395CBCE3B98247B6AF1D0DE2B0EA6FDDA6
    SHA-256:A701CE4D04CC0C7977D8D5CD18867BA955EB63E6A8F51D62FD1D4B73DD5B5C0F
    SHA-512:4ED16E26938743EF3F1AC094647EEA86235EA41B15DC69BBA846157138E549455EBE5B9B25955E4B76C9B8A88313A11BE06776B6C7FF37D966DC04AE6485F9E4
    Malicious:false
    Preview:GIF87a.......# .)..^`X..zK..j............................,........@..P.I..8...`(.di.h..l.p,...A...s.B....F...........l@J.F.[.0<....G...9..nNN..u.@w.......u..z................................................................................................................7...g....<..P..8g..!.p`A-.. .....~*.!4.#.E......id#J.6.\.r.K.H5Z....r......X>q...4h.eH.*-....iK.I..,.6.T.N.j....`.~.$v..s..3`..7.m. ..6.7..... @...g...........mK..8.......7v..;.l.qg.C.v...i.G.^...kq._.n.z.m.i...;...}.>...p.........C.Fn...w....x....{']/8....S_..}.....O..x......|......|.g`}.C`..6....>(a..Bh..V...v....H....hb.(...+.......0.(.....<...=6.N..u.......L6..PF).TVi.Xf..\v..`.).d.i.h..f.....p6..\tV..HJ..|..g......J.&z[......t..:.........v....i..........Qj......m...y."..c.:V.g.....jl.......2xj...:.....w.u.=.l..`..G.........7..s.....I...{.+.....n:.......L.....0.>.m....j....\j.U...B.V=...q...5.....Y...$`..LO;|...5k.$^z.*+....[....o.8..3..2.

    C:\Program Files\WinHTTrack\html\img\snap9.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 680 x 104
    Category:dropped
    Size (bytes):4846
    Entropy (8bit):7.913146904390617
    Encrypted:false
    SSDEEP:96:IlyPGdb9+63sgqvk21b6KUH9Hs+iAtzK/VSci5kMr+EgFunNoZHjjcesm:Ilnj+6Z2h6391iJ/tiWMWuN1m
    MD5:786D3E954394F4094A1B8377EC57092B
    SHA1:8D7C8517358382FAF4BA2F6463B845941B5AB14C
    SHA-256:4D7A51AF4895CC3527DAAFB1C394BE6E4D62FDEEF76C4850393C65663C4B29DF
    SHA-512:2B4F2C815D58EEECFE01E17BC86FAF88BF9C8DEB470E8A48B3E1E6CAABDD9102BFFB5B2D33102F110A1C4AA49FB4BD0CB551F15D8963933D710A9ACB6EDCDCB0
    Malicious:false
    Preview:GIF87a..h............;..x.....`.....N........joe............,......h......I..8...`(.di.h..l.p,.tW.A..|....pH,...r.l:..tJ.Z..v+\....xL....z.n.A./.@.....~......t...............................................................................................................................x.1.....,P..!...I.H..!F.2....D..@n.I.$...R.<.r..V.\...&L\8s..%../b>}.....a.6M..m...J.j.m...5.t....H......!H..p..UP..]A..\..#..@.V$I.H..1}:)i.bO._Jf.*..^]...3N..v.....O........2..b?..4[..Z......a.J..=w^.]..`.yF..\...B...6.p.!............T8..L.#.g<.e.-.o.O..L...B..,...LiB%8.Q.(.k.H..l.Y3[m.H.NS....9..&"....qc.U.._..bs0...<3....q.4Pu.`.@..).PB.4..xH...|..Qz...Q{..^|.M.XJ...%e.eV.M...`...&...)...5..3."S!l.q..z~..8...\.]..b...\....h=5....7n.....%..>..P.D.I..G.Q*.t......:..:*^.%T^...5.`..f...Xc..[../.I&g..yf.Ni...h."x.k.6.QuVh!.....}f.g8.y..p#.[.*J...{...X....;A..h.V..y*.E...........j K2r.O.J...........|..kl..!..Ma...L..|.,lN..C%...:o.-.@.i..Q.{....pL.x

    C:\Program Files\WinHTTrack\html\img\snap9_a.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 652 x 394
    Category:dropped
    Size (bytes):2559
    Entropy (8bit):7.886439900004965
    Encrypted:false
    SSDEEP:48:irscRiPmfnzd4U1r+WpG4ybrUQISNMrj6E61FHdOrGv6fuX5nU4p7O6AvRn:irvx5J+WMlMQISNVE6DHoVuX5nHA5
    MD5:8AA03F3A0A2289B26D06C655F3265BA9
    SHA1:DF2BC05064959FB56A97912673881A508F0F38B2
    SHA-256:498A739F5AAB413052C213CA2743964EBCB598E2A880CD61EF55BFD8FA0ACE46
    SHA-512:00D9EEE3D2B435E4EA2848B368F4D7757BC0D683C3605004EF22EB56181D36B98959858D27638AA8F7C4F2CAE31EDC2EA382F82E6C3BAB9FC727C3E66FE6127A
    Malicious:false
    Preview:GIF87a...................k.........,........@......0.I..8...`(.di.h..l.p,.tm.x..|....pH,...r.l:..tJ.Z.X.! .....`..,.....n..h...>7..z}....r}t.rs|xwvv...n..y.z..g....|............p.......Y..D..#...a...0.+.................@[_..c...........f....w.................Zi..H.?V.....Cd..{H....3j..... C..I...(S.\...0c.I..5k..@..N...x,.7.].B...;.h[....~.G.)U..jj..W....r.K...h.]...p.........r[.7+^.e0..K.....t.^....#K.L....3k.....C..M....S.^....c.M....s..........N.....+_.....K.N.....k........O......{."...d..L..`..{117#?....e7.....)G..)....A.@X.=G1. %Ka.`<..q..Jm.U..n.a..vx"S..$a>.h..z4.h...^........_..Q..".._.}..8.FD..8n0.].:.T.(...]{..MR.....%...>%u"|j.....H.S`LBU./T..f.U.*..j.&..6..I:...^u....5_..J@e..R..W\.S.`.I!.Dy...rV..].*c.zj.j.0...i..'...k..&....nejN.E.c.l.i.pH)d@...i...+..k........+...k..........,....l...'....7....G,...Wl...g....w... .,..$.l.]...O\.0T..f .K^0..7.|..7...s.S`.BJ.....Ew.......|..P..g.m.h

    C:\Program Files\WinHTTrack\html\img\snap9_b.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 650 x 396
    Category:dropped
    Size (bytes):4425
    Entropy (8bit):7.9208525283536675
    Encrypted:false
    SSDEEP:96:9Cxf33IuAvt9JLS1TBEymRO375z3jAIYeaES0AlCxhw700nFKa8f:EAuAvvJXAYeaES0ECxqy
    MD5:53CF2816321698C42DA17334EA593C4C
    SHA1:58D3C1172A02BE42AB311446EBD91CD137DDBA8A
    SHA-256:405E176424164FDF38054766683C5B38C1182DEC78651911F8EF0663BE7932D9
    SHA-512:2F75ED7511D2B8B8FC7E08B380FA5E7F8B80A0D604BE1D280EB20B880146293BEA1037CC0F93353D587C7583222E89A3379BFA99B2E8AB70B1C1A169AE5B292E
    Malicious:false
    Preview:GIF87a...................k.........,...............0.I..8...`(.di.h..l.p,.tm.x..|....pH,...r.l:..tJ.Z..v..z..xL....z.n...|N.....~...................................................................................m.................................................g......P..!... .............8x..@...d..&.P..%F..>..9f\..vR>@ih..@..| .f.....S...O.J.2...S...R.J..T.S.v.{.fV.a.....g...:(j.&.<.r.[u.].L.&..7..{...|.1b.......e.r....,..h%...._..M.6=..k.#.~.z...3..,.......N=y5..Y7-..q...b/...v...23....p.._#..xr.e.g..1....T.N.ft..sQ..<...P.W.|..7.c..w....g.}..3Th..........q.y....rf.Tb....Yz*=.a}3)T....tR$.x.v..H.06B.. 9.......c/Ku0. E........D).OT*..P...e]Z..h9&KeR..z...n.x..u.9gE.ec&.......f..B..n.6.FG.F*.Vj.:..v...*..j....$...V...!.;...^.Z.@.J(?.....#a...&-..y.;.>.Mj.)$....4..u=.9-..Vi,.'.%......).t..'.....Z....p}.. hXE.VS.Yu.._..Wm..K/..^.o.....t....s.)(....<.h.L.....f...{.Y..w`z.........s@.......]...lX,.%.......(.lspA.'4.a.M

    C:\Program Files\WinHTTrack\html\img\snap9_c.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 652 x 394
    Category:dropped
    Size (bytes):2555
    Entropy (8bit):7.904546130614872
    Encrypted:false
    SSDEEP:48:Yr6nMq+/Lgc+9TZfx164RPU0G400qfHMe19M10tjPECkiSmFghRchsJt4hEivR:YrAWDr+3f/64RPuTHF9bBjSmghRayt4P
    MD5:E652732C2EF083923916AECD742DE194
    SHA1:C36ECFA9507A80F42123F92B81F35B5565998AB9
    SHA-256:3FD7AF6C76DA310124ABC057A6D2CD46EEAEFAD6D1DD662194287352C1A9CBE8
    SHA-512:9EAC6A1EFC9B68F2E12EF7F48C93842F715CA5AE1C6FC9318BEC5349487EC2E03265B24ED72CD602C88749871AD7210FCB82D18966424720AEFE4C47A835B8DE
    Malicious:false
    Preview:GIF87a...................k.........,........@......0.I..8...`(.di.h..l.p,.tm.x..|....pH,...r.l:..t.!X..v..z...xL...g@:.V..n.Z.o..x..>...xw~u..e..............a..................g..............%_........B.}y.{......<...............*.....................$..h...z....H..Ac...,(.!....I.H....3j....,^ C......(.....I....l..Z..8s.h.OF5...I...H.*.!..S-$.J.q.N..v....L..nP.....0.].i....HA'.54..]Om...........L.....R..l..d..9.{....9lS.+..C..M....S.^....c.M....s..........N.....+_.....K.N.....k........O......_.......O..f...z....7..{....C..Lc.@D.Wa....A.ad....6..,..H./w.h..Nt.!\_.D.,.._.-E. ./.e...%b...a..0.VW.YXcQ7.H..B....<F.B.JR..Rf.....\6....Z. &..y...:X..e.Yf.d.HW..4$$e.....*.r`.I..Ub...%'...i!k.*.O.N2.)......}m*.9...g*.....fb=U......*.*..g.E..Y2n>:.V)].e1..j.+...*...$......@[..v..k.9....E....0A......+...k..........,....l...'....7....G,...Wl...g....w... .,..$.l..(....,.pm..h.......9.dvH..U|.\..[.]'..b......*.i....O.5..Q#C.e...

    C:\Program Files\WinHTTrack\html\img\snap9_d.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 652 x 394
    Category:dropped
    Size (bytes):5688
    Entropy (8bit):7.946597529905821
    Encrypted:false
    SSDEEP:96:VrBfbYd5OU8VBUXkUqWJFIk/Nn50Jqq2KnXpRx4rZtBGUxYHfshwq92jUT8XmJnc:VtzYdmViT9Ik/NnCIe5Rx+tBJYH0hBkB
    MD5:100F1F9F6DD4624F9ECEB68E9ABC3ACE
    SHA1:D36B29B5151ECF55612D532CB9B4C863A16D2589
    SHA-256:C3233057C47AB4ADDF70466D8ED3A5D6D06860E5F592E182C6099ED55AB6B8EA
    SHA-512:75DA865951B86725C331363E1F3C7BCE695992FFA265E2EEB126D63E243E3FAEA568C03B2F733DD065D179DD59E1DF6DA037556CC788734F86C6230098374842
    Malicious:false
    Preview:GIF87a.......................k.{{...,........@......0.I..8...`(.di.h..l.p,.tm.x..|....pH,.Y.G..\B.P@S1]T.N).U2...c....${..._8...{..u\..V.uG.............0ftr.w|xx~.b.[o{...a..si...u.y.z...O.................v......b.............................H.d.m......]QS..Z..N....A.Q(pBFk.=x...s6....3j..... C..I...(S.\...0o..i....6......@...J.'Q.H..0.T..L.Fu:u..?...zUh.....K...h.]...p..0..M...(.N.*Pd...(..*..N....R._.J..U)...f.<.qQ.......i.'GV..s.K...V...s..6...I...N3.b.9y+_.....K.N]....c.[.[.....O.............O........^......'....h ..i.......o...`..&....T..5.p.. .(.%..E4....V. .0.(......+..".<........9..#.H&....9..E.r$.TVi.N.....^..`.%.[.2e.h...uBjY..g.).t.5...Y.|.y'.....R.'...Z.....h..V..z.Ef..hj..N.*..j.........i..l."w........+...k......Bz..F.H..P....8.J..T...Z.C..h......P..B.-...2.`.X!.'."........PX...B8....p.l......E...lo.....&.Y.,. [\...,1...{p.)[....+m2\..(......||3.>.l.>.<..^.+n.3.....x;K.Q?..%..5p..k.

    C:\Program Files\WinHTTrack\html\img\snap9_d2.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 465 x 326
    Category:dropped
    Size (bytes):8975
    Entropy (8bit):7.963190799983512
    Encrypted:false
    SSDEEP:192:9VtKVARaISvocl7p9ZNxhXHSZhc4EP2WPuPkf07ExgtsgsCd9hJH+:9PXRfShl7ZNDCZhZ22WWMfKExqUCd8
    MD5:8609E3C23B733DF7B0885AD80CE4F5EA
    SHA1:A3C6BCF7652A3F05E4486AF240737879E93E39ED
    SHA-256:1375024A5C7F04FE8DAAB657764998B0AC9A4F2BDA41264B8E3559BCE7B6111C
    SHA-512:9CD2F06E010FD1868403CDEB80A1BF7C59788F3A21B2CAC94380BB465770E9AD4264732C62004D4054F8B766B03A2B93E4A196EF48C766B577AA798F02D4A6B8
    Malicious:false
    Preview:GIF87a..F.................k...c..R..s..B.....)..9........1..!..Z..J..{...........k..{..c..J........!..1..1..B..{..c...............1..11.c..c..1...1.11.c1......1..........1.RR.11c11.1....c1..c...c1.cc...,......F.@..@.pH,...r.l:..tJ.Z..v..z...` ..H...tr.\l.nL.7..z~?h..{..~................................................................................................ .......................................4p.a...#>40."E..3....F..:b.I.@..!..P......^....M..h..`gN......!....F.".`a...M..."@...C..x....1dt.hA...D6H.h@.O.;.. .0.Q......d.Q_D...84..`..3!.....6@V...... ........B...K..a..![..X.g..M.mm..k..e....q...{...;x...[~..>.....(.......|.}b..#d..~.y..M..i..J.(W..reM./o.....@.5.Q@...S."..S.L.V\y....Vh..f...v..a..~(.$.h.(..a.OXe..R.8..P.H.UY.HU.7V...?...D..".N...32).UK....3.8e.X6..RRyU.\2..;^I&V]j.d.F...[ ..t.i.xJ!g.|...v.g...j..1h..6..)...Vji..^J.V.t...*..j......*._!.U.Md*$.W..&.d...Np....k..&...1.K......P@..Z...v....m..k.............k

    C:\Program Files\WinHTTrack\html\img\snap9_d3.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 467 x 325
    Category:dropped
    Size (bytes):7411
    Entropy (8bit):7.953665463307132
    Encrypted:false
    SSDEEP:192:f5WKqgRqFDeJzE/5iTZB6s/1Co1WiAgIV/d2l:f5lRqFah3/1CosiA9/8l
    MD5:E128D56A7E0FB7CF99A9E9249C3B146C
    SHA1:8046D03400958FAB29DBC0C02022EA8D739E0908
    SHA-256:E01439E7984F38C6C23E672A4BA60ACD683E6E603FFDD7249D53A128432A857E
    SHA-512:FB2BEFFF5E74B62CA205AE948B8825AA69FB9BE85F8AA15D1C6205913B77E6A9880E0852CF20A11993A15892C13D926342D1D660EF5642C7561FAF2E44D10A41
    Malicious:false
    Preview:GIF87a..E..............k...c..R..s..B..)..9........1..!..Z.....J..{...........k..{..c..J........!..1..1..B.....{..c...............1..11.c..c..1...1.11.c11...............RR..1.11c11.1....c1..c...c1.cc...,......E.@..@.pH,...r.l:..tJ.Z..v..z.B......$R.v:.P..kG..A F]....|................................................................................................................................... `A....,X.@....J.X.b..0b(.1c..-x.(.d...D.(..eJ......Sf.1%.....O...$...bh....*M*....P.J.#D..!V.......0c....D.4.l.0....;w.@H..P"=w.(24..#..$.........kJ.S...Gi...r...f9X..V.[.n.....].R.K.`.2e.b?.F...l.r{........!@...v........}....8p.A...BD..;E..#>.pQ<..#A.<..<J.'S..9.&K.1a.....<....E.u.SO...TMU@..[u....za..f...v... b8a.!.h.(...,.8".W..c.3VE.U5....8...;....-.i.Hzu..K..>....OR...T.(e.\N)..V..e.`B)f.?n.eVa.Y.I.).[.H.x..|Rag...*...g..&...qh..F*.F>J.f.i.Kn*.V.X%.U..............*.........Z+.I|.d..>.$.[....Qb......*...k..b....J.m..[...z........{....+/.."!

    C:\Program Files\WinHTTrack\html\img\snap9_d4.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 466 x 326
    Category:dropped
    Size (bytes):7344
    Entropy (8bit):7.958779929908501
    Encrypted:false
    SSDEEP:192:xVWKqg1vqPBkeRNi6boPJYUSIUFI6y3S0v:xVl1vqkeR46bjjmVFv
    MD5:71B2D81B94520773E0D45EE8AD212FA4
    SHA1:F740A3645D288886F604D07A620D8880E9E7F98D
    SHA-256:D2B651F44D97719ED855C3B2FBCBA2D6B523BE3315AE2BBD8FE19DB95693AC04
    SHA-512:18183025606F128CF4B6B85E06F5CF9883A8E578B6DD76223871E10C82B70A0D3AEE984DFB2F36DC7EBDEAB9E8DF539FDAC8A88A9EC02F6820CE9A4DB752A929
    Malicious:false
    Preview:GIF87a..F..............k...c..R..s..B..)..9........1..!..Z.....J..{...........k..{..c..J........!..1..1..B.....{..c...............1..11.c..c..1...1.11.c11...............RR..1.11c11.1....c1..c...c1.cc...,......F.@..@.pH,...r.l:..tJ.Z..v..z........$R.v:.P..kG..A F]....|................................................................................................................................... `A....,X.@....J.X.b..0b(.1c..-x.(.d...D.(..eJ......Sf.1%.....O...$...bh....*M*....P.J.#D..!V.......0c....D.4.l.0....;w.@H..P"=w.(24..#..$.........kJ.S...Gi...r...f9X..V.[.n.....].R.K.`.2e.b?.F...l.r{........!@...v........}....8p.A...BD..;E..#>.pQ<..#A.<..<J.'S..9.&K.1a.....<....E.u.SO...TMU@..[u..^Th..f...v....N..$.h.(..".">qU./F.cUT\5#.7Na#.8v...?...D.i.W`P..L...X...NB).PN.e.0rI.Xn.`>.c.Vf...U.y.p.E.r.i.x...t....*(.}.j.&.h.....F:d..Vj.jAi..n..U.Z............z....*..J......G.+$.Y.ic.\..&...jk......J.m...j*..B...Z.................2.

    C:\Program Files\WinHTTrack\html\img\snap9_d5.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 466 x 326
    Category:dropped
    Size (bytes):9558
    Entropy (8bit):7.972771128719367
    Encrypted:false
    SSDEEP:192:iV0egZvPvA0QHQ1+syWLOeb3SPBdZV5hryN2Zm/LVymv7Zw6nuN7Z:iSZvPYfZsKs3ST5hr3SB57huNN
    MD5:572495656567B130346412CC1110CEA4
    SHA1:5DC9F028CE567329891E5AC214FA2E19B5AF297E
    SHA-256:3E4A2685D49F013AEC6B9E2C55E2DF54C5F7FBA40FDDA4B674D62DB4904D73B4
    SHA-512:656F7687DFD3F1B37B3E51A57CE006BE9DB8AD21C275042E7A20EF2C87E32E47F886ADF4FDA83FC7A3016D496F60E093D9E4AD5BC9217B4ACBF74E8760D79415
    Malicious:false
    Preview:GIF87a..F.................k...c..R..s..B..).....9.....1..!..Z.....J..{...........k..{..c..J........!..1..1..B..{..c...............1..11.c..c..1...1.11.c1......1..........1.RR.11c11.1....c1..c...c1.cc...,......F.@..@.pH,...r.l:..tJ.Z..v..z...`0...$R.v:.P..kG..#.F]..D..|................................................................................................... ...............................!`.....,h.@C...J.h.b..0f0.1c../x.(.....D"0..e.......Sf.1'.....O...&...b.....*M:..S.P.J.#D..!V.......0c....D.4.l.0....;w..H4.P"=w.(24..#..$.........kJ.S'..Gm...r...f=X..V.[.n.....].R.K.`.2e.b?.F...l.r{........%@...v........}....8p.A...BD..;E..#B.pQ<..#A.<..<J.'S..9.&K.1a.....<....E.u.SO...TMY@..[u..^Th..f...v....N..$.h.(..".">qU./F.cUT\5#.7Na#.8v...?...D.i.W`P..L...X...NB).PN.e.0rI.Xn.`>.c.Vf...U.y.p.E.r.i.x...t....*(.}.j.&.h.....F:d..Vj.jAi..n..U.Z............z....*..J......G.+$.Y.ic.\..&...jk......J.m...j*..B...Z.................2.

    C:\Program Files\WinHTTrack\html\img\snap9_d6.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 465 x 326
    Category:dropped
    Size (bytes):7970
    Entropy (8bit):7.961428141397612
    Encrypted:false
    SSDEEP:192:AbIXLs8N34pTJ/m6IDByh9saEo+CI7KIprG70DoGRemg:AbIX4pT1m6AUsiYv8NGRemg
    MD5:135A41D8918737A1F99E9AC308904879
    SHA1:561FD30BC38545A0196A2FC14E9637E66633971A
    SHA-256:7CBDEE92358F5D7A627E62C60117AA83FBFA721B739C2E639FC677060DD5B303
    SHA-512:CEC595957A901BBAF8E0479AD67048A062D81B6FC4A750A63F235FC76C742F25E38FDF67CFA7A5B763AAAC06D810A14E18B734E80E719B59B8E01E995BEEA289
    Malicious:false
    Preview:GIF87a..F..............k...c..R..s..B..)..9........1..!..Z.....J..{...........k..{..c..J........!..1..1..B.....{..c...............1..11.c..c..1...1.11.c11...............RR..1.11c11.1....c1..c...c1.cc...,......F.@..@.pH,...r.l:..tJ.Z..v..v...."..H...tr.\l.nL..@.z~....{..~...............................................................................................................................|........,`....#>,0."...1....F..:b.I.@I.!..P......^....M..h..y`g.......!....F.".Pai..M..."@...C..x.@k.1"t.hA...D6H..A.O.;. .0.Q......d.Q_D...84.....3!....4@V............-..B...K..a..!K..X.g..M.mm..k..e....q...{...;x...[~..>.....(.......|.}b...`..~.y..M..i..J.(W..reM./o.....@.%.Q@...S."..S.L.V\y...Vh..f...v......(.$.h.(....V.../..#.-.xU.5RU....x..?.(.D....4.$.1.../:...T.(.S>I.[^yU.M...:J.$.gj.%.F...[...t.i.xJ!g.|...v.g...j..1h..6..)...Vji..^J.V.T.....J...J....**......*..j.&...Fh........a.Ie.Xi.)....j".*-..z.b{m..Z...j.n..k....+...D........[

    C:\Program Files\WinHTTrack\html\img\snap9_d7.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 466 x 326
    Category:dropped
    Size (bytes):8024
    Entropy (8bit):7.9632528194415215
    Encrypted:false
    SSDEEP:192:xVWKqgoSVSKEXO6otNcE4jvDgEUso1egI1KAbn:xVloCSKuoLcEqvUskeg2Ks
    MD5:0829EE35F2F2C83C656B4936BEAF4189
    SHA1:848703D664B31D5086008F076B752CC179C6A4A4
    SHA-256:A7B531AF9671F753327B997EBF869FBFD66762BB967F8FDC10A14D6674CC6F87
    SHA-512:187B8E561CA6D222EEAC75A2B6EA14163A281BCF77CF376560CF11790B63D0B056AD57A4920ED20742EA5095A4AE1CAE7386E8C377C1A86A008F35755714B309
    Malicious:false
    Preview:GIF87a..F..............k...c..R..s..B..)..9........1..!..Z.....J..{...........k..{..c..J........!..1..1..B.....{..c...............1..11.c..c..1...1.11.c11...............RR..1.11c11.1....c1..c...c1.cc...,......F.@..@.pH,...r.l:..tJ.Z..v..z........$R.v:.P..kG..A F]....|................................................................................................................................... `A....,X.@....J.X.b..0b(.1c..-x.(.d...D.(..eJ......Sf.1%.....O...$...bh....*M*....P.J.#D..!V.......0c....D.4.l.0....;w.@H..P"=w.(24..#..$.........kJ.S...Gi...r...f9X..V.[.n.....].R.K.`.2e.b?.F...l.r{........!@...v........}....8p.A...BD..;E..#>.pQ<..#A.<..<J.'S..9.&K.1a.....<....E.u.SO...TMU@..[u..^Th..f...v....N..$.h.(..".">qU./F.cUT\5#.7Na#.8v...?...D.i.W`P..L...X...NB).PN.e.0rI.Xn.`>.c.Vf...U.y.p.E.r.i.x...t....*(.}.j.&.h.....F:d..Vj.jAi..n..U......|Z..:*......*..j.."`!......d.d.H,.j......l..F...:..>...B[-..*B..k....+.I>...@....;

    C:\Program Files\WinHTTrack\html\img\snap9_d8.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 89a, 525 x 191
    Category:dropped
    Size (bytes):3525
    Entropy (8bit):7.935733264757919
    Encrypted:false
    SSDEEP:96:Aoiuuy4DWJ3iqiYR9FbJ8p/hcQxmVGCyBKDKBz4k/:AoiDy4DwiKuAQxmVGCyBKz8
    MD5:4CA5AE42CF68E307DF1FBFD7DAA1FBAA
    SHA1:AABF0D8B5F3B23214AFDA824DA79A4E396023809
    SHA-256:10211930CB3AB40C76DEB7E0508D6387AC94507057202C3988BDF4EC2FE90405
    SHA-512:E732B029E099E81C56F4A7B1F607E6946F60B79DE1E234DBC895DED80414675B9D84A587AE556F52E8F228B96E2DA124C4DF2C73972A2DA6B6B3559777BB0FDA
    Malicious:false
    Preview:GIF89a..............{J..............,........@..8.....'G.8.m..`.}.).de.l.p,.t.^f!.:....P......RID:;..g|B}.+.7.....3..I..5..].mN.....~....................+(...G...".r,........5an.o*qZ..WUg.KCj.m.p..+.[._I.T.;....D..............................2.................'.....H0 A....\.....JD8..E...^..m... C..I.....,..R...nb...eU.1hba...?.....80b.E."....R.J.FmJ..P.N.b.jR..`..KV"..h.|..O....Kwl.x...+R..m7....... .!^..^.j.k.L....3g..];.t=+.M...%..U..>...+..m.s...;5[._n>aSs..[.X........K..;0.. .O...w...........f..x..!..L...............(..)..{.....6.`..F(..Vh..f....vx`. .(.$.h.(.8.LV4......K.0...3.h.q3..c.A...(...+f.\.,"..q1%.%r*Vi.Xfy".Q.)G.=.C.. w..R.d.g.9$.pN"..`.....i..|....*..j.~.&...'.J.)g0..cqT.!.j.&.F6..q.....&.....".&.......i[......x..y....7.&.....`.F;.O.q@.lB=..QV9..US..T..j.TSJUE.V.n..H^)+.n.T/$.....y.dX..a{X...\Zx.t....7....;.M...l.7.gl..V....},.s..X...2d..,....0.\r.tv...Ac.'.[q.@.-4H3k..k0.L..L7.tEE...TW.4..Nm..\.|

    C:\Program Files\WinHTTrack\html\img\snap9_e.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 650 x 396
    Category:dropped
    Size (bytes):3458
    Entropy (8bit):7.912655822071319
    Encrypted:false
    SSDEEP:96:JCxf33Puy+8pfR1b5kqU4+4bB6EJHhXhqqvMhABzud2ZUKLue:AnuCVbeUyIHDqqDFud2W63
    MD5:5FD00C7325AE9D596F2A88FC7BD005FE
    SHA1:F59CAE6F5B217C280F71153FA576550857BB9742
    SHA-256:20112ABBC3DF0FB63AC09278B0C638AD1F49A63160D2BEF42520D2BD4FF77663
    SHA-512:CE6CBB27F94555D1238E44DFF956F81770B9E5951227A46F15B3CC44A20655AD9E0195720AB255E110E80FBAAEF7C4F3F3945C1725E1235FB9D890A1AB3A6BC1
    Malicious:false
    Preview:GIF87a......................k......,...............0.I..8...`(.di.h..l.p,.tm.x..|....pH,...r.l:..tJ.Z..v..z..xL....z.n...|N.....~...................................................................................................%.....8...$.. ....N...............D.[0..;z..j..P.B....8.BaD"....w..AG.....Wn...!S....$D....9s%.w.O...S.M..]........&..P.Fx0y6..$.t:......Zo...5iU.Y.R.z.'.jGf.*.,.Nw....W.c....k?....M;...|....s'b...*.....7...ypd....5L.f..m..FM.*T....{.o..q.&my1d..I...9-.......u.^._......?g..j.......q...M..y..a.u..9.[..-e.n*...T.q%TW.).VqJ.(..5.G.{..V.Z.fH.~.bF.w....Y.....&...e......8.k.U@c.;..I.@.).D.i.H&..L6..PF).TVi.Xf..\v.%.....d.i.h...l...p.).t.i.x..|......9....j.&..6..F*.Vj.f..v..B..a.0@.........*..j........+...;........Ij...+..Vk..f...v[+..>.l..................................*....0..+l+..',...W....~C.........k.FL...3...,.....b...t.......";.*.8..4.D.m4.27@s...0..C..P.j...W=...^]

    C:\Program Files\WinHTTrack\html\img\snap9_f.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 650 x 394
    Category:dropped
    Size (bytes):3347
    Entropy (8bit):7.921811353296926
    Encrypted:false
    SSDEEP:96:Uxf33rTWYXy+qFFE2AizBrAHZqUWqRcv/T1iYpn9Ig:0jTDy+qrzeZGbkYWg
    MD5:6D81EB66A71CA9FA8B804122B332BB16
    SHA1:E642B44C95FBF0FC3683C82B3D6D7310303EDE02
    SHA-256:530A9BEB02665408AFBA77FA8B16C10D368D7A0034ECBDCD597BED7B18E8FC35
    SHA-512:E60CDF597F56ADF165AB09B4619C7D9C4F93A891562B7B908CFE13FCAD1B42F088FCE7E5D091DD67BF83B3758B3ABA68768099DDEFB9EE777424432E1ED1FCB6
    Malicious:false
    Preview:GIF87a...................k.........,...............0.I..8...`(.di.h..l.p,.tm.x..|....pH,...r.l:..tJ.Z..v..z..xL....z.n...|N.....~..................................................................................................................H.............(. ....' .......H.a...#..g.\.....C.@........8..H.!9~.dI..c..W......l..../.....$.H..5....fh...S.N.G.....kK.E...J6.T.U7.....Z.Y....2.[.e..6m.........J....X...5..T..(Q...^f:7...C_yl./e.*S.M-.lG.U....g]....09.......N.8....+..|....K.N.....k........O......_.......O...............(....h...&._o.5b.Z.F(..Vh..f...v...b.#..f.(...,...0.(./R.........1S".@.).D.id...W.9"...=bU.P..x.Xf..36Y...%..QF....E..l..f.^..$..8$.[uy4.LJ.'W%..ZJx.Skx....o6.....a...g.)..g.~..a......V.c....l...E..j...P...\..W..z.[.b*j....(...$...[2...S.*.d........U...+O.......v. .B.l..^....JK..N.6.....W....f,..m".........Tj.....2\Z.T5l.Z.#.k_......Eo..zkrSh.......-.q..........3..C..A@........@.4.D..iN...........l.j..

    C:\Program Files\WinHTTrack\html\img\snap9_g.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 652 x 394
    Category:dropped
    Size (bytes):2024
    Entropy (8bit):7.80916033240804
    Encrypted:false
    SSDEEP:48:Yr/7fCrnTGCHUMImKg7yqrrb+ShPKAclu//28x/rs:YrTfW6qUDmJGsb+Sheu/Pxjs
    MD5:89341E052D474BA78E4D2071B6D563E8
    SHA1:F7CDC5A4C1811695A3C4983656D1F3AD33E00AF9
    SHA-256:04F7AE17EE142D0246CA5DA6BE31BF660C3BAD7114E6B1DEF197CFB73BB0F0AD
    SHA-512:A9E52A3C6C7D1F7B5F58B030C9302DC2AEEF6FC25C74BAB3B937ECB0D24588BE7964DD7D63EFB68ED931C23391E35058563EB5C9466E148C52F88EF35CA51D79
    Malicious:false
    Preview:GIF87a...................k.........,........@......0.I..8...`(.di.h..l.p,.tm.x..|....pH,...r.l:...@.Z..v..z..xL.....x.n[...|N.....~....v......r...............................l....qp...t.....s.............................<.*.........................u...............P..|....0 ?E..>.G.......i`0..>..z.Z.c.i..U\...0c.I...8s.....@...J...H.*]...P.J.J...X.j....`..K...h.]...p..K...x..........L.....+^....#K.L....3k.....C..M....S.^....c.M....s..........N..Km.]..........J:%.....&%.._&..[n......o..>.vY.0\...>F..%r.N.|.....( +...^>~$.....h..F(!1....{...].$I....N.C..6qQ........gB.....:.....H.<...@.).D.i.H&..L6..PF).TVi.Xf..\v..`.).d.i.h...l...p.).t.i.x..|....*..j.&..6..F*.Vj.f....v........X..PdH.x. ._7..*.>'jz..bj..Y`...>..@..3.9.....r+z."..5....B..........$...;..E..q.2...t........&....K+...:....l.....7....G.Z0x`.....K..`....:....F.......1~..$.G.../2.....RRC.1.2...WK.:.m......"_Br.(U.....K....7..,'.

    C:\Program Files\WinHTTrack\html\img\snap9_g2.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 537 x 284
    Category:dropped
    Size (bytes):8457
    Entropy (8bit):7.960530540972922
    Encrypted:false
    SSDEEP:192:cfT21qnBWYzodRF67nQTAlzoD4Yy6aicJ1FR6I+:QTTn0NPTQYyAC+
    MD5:B924FFDFB4F979215AF65F1DF87700EC
    SHA1:CB65B548A7BCB58CD892AABD2256B2667FE33CC5
    SHA-256:AE37F35E84C4568A96A57E561CB30F92F05A8A7F22E5DD3AB6D0253784F799BF
    SHA-512:2757AE1651391C2FD0A886A3D7B39575BF51BEAF8B962795DB646FF58DA571B9CC5B43EF4B8A47CBA8ADA83280ED2971A35117435D1EBF5EE4788C7C76CD44EC
    Malicious:false
    Preview:GIF87a.................k......R..c..s..B..)..9.....!..1..Z.....J.....{.....k.....{..c..J.....!.....1..1..B.....{..c...............1..11.c..c..1...1.11.c11...............RR..1.11c11.1....c1..c...c1.cc...,........@..@.pH,...r.l:..tJ.Z..v..z.`....@D......N......|@of.!~................................................................................................................................".....?..."...!...H.H.....-j............H.(..4..@..\.).e..7s.<.3.M..:."8 ....F."=.i..G.JE......b.5.V.....pal.....k........2@@Z.u...#@....p.`....w pJ..O.@.8.....e.....l..'E.)H...3...8|..Zt..._.~...l.F..-...X...R.!.0`.3....3h..I.F.z.m...}\8t..kG~.z...L.._@...)....?...>..?....}.QI*}..I.bp`L-....3.d.M7.SP<U..D.e...B..TRN...YI.b.V]e.U^...Xh.E.[6....u.W.@.).D.i.H&..[...PF).TVi.\8..\.Y.\`.).d.i.h...l...p.).t....Fj.D\G......1.[...(...Zh.o.)....uq"@.`.v.f..fpm....Z.).......j........j........zg.zNj.VT:j.....B...Vk..f..H.....+...m.....e...g.....KH.

    C:\Program Files\WinHTTrack\html\img\snap9_g3.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 681 x 521
    Category:dropped
    Size (bytes):12992
    Entropy (8bit):7.968420811131012
    Encrypted:false
    SSDEEP:192:3vVUlYZwQO1KkaO/nD5mMgb8AIN24BC1CoDkAj5qWxtiek0bcuXEWsSXk4Y5yZxy:36l4wz1KkZkQsJjDkwq2FY5yZxf3X6R
    MD5:6B10786F3901D1B9D3FC8FDDBE26D918
    SHA1:34263D2526864E90B0CE1FF49C96595C99190212
    SHA-256:415404D03A64926F106F74DE203AB94CFDE155E6CE87112140FB64C2BCEA16CE
    SHA-512:085E950D693C189151A9AB86E222F94FAF4EB652B09D8C5B03A78008A098DA826896826B6AA1C1DD4FB694917BE35416D77A922AFE200743B700B15E7D69EEA9
    Malicious:false
    Preview:GIF87a...................k...c..R..s..B..)..9..!.....1.....Z..{..J........k.....{.....c..J..!.......1..1..B.....{..c.............k.......1..11.{k..1)!.c..1..c...1.......c1.....{.11B1............kJ)1..99)!!.B9!.{sR).!...sc..s...........))...........RR..1......cB!RB!...RB1.111!.........!))..cc.c.....!!))!.)!.{scscRR9).skJ9!Z9.c11c1.cJ)kJ!ZJ9.c1..{91).1.B)..................................,........@....4S4AAOOVLLVd9gWm>TtEEY9UUiB99B@.r..c].4R..Sa.Wofe7;6MMKJII-JK66H.;;7q77C,.,F,GG.hF.........).)...................................H......&Dg.^=m.....;..$...n^C. C....I..RnT.Q.D-..P.0bD..&...I..O.Pf..:..L.E).].ti..O.J.:.i..U.b..!...X.N.:V...0.}0.-..l...M....v.........2. 8...}.l8..b..+x<Y.d...d.Y....8.<Z.i..G;......_{X-...._..m..n..~..N<....#G.`y....D.N=....g. ].t...O ......../......../A......?......@.....H....h@.... ..:...B@...R...f`...d..".Xb..T@b.,...,..@...h..2.xc....c....#.D...H.....L.....<.d..D.A.WZ.e."XYe..dYe...iA...i&....f..Xs.t.M.....L#.p....C:5..C.D..

    C:\Program Files\WinHTTrack\html\img\snap9_h.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 650 x 346
    Category:dropped
    Size (bytes):2841
    Entropy (8bit):7.889280901260727
    Encrypted:false
    SSDEEP:48:J5zpaWs/PKalYzuv9KTTA/zkeV6Rd3EpRca1vZ/TwjQmPl5KwZS+dHn8PoAyHCJw:JlY5+zX8/TGqqQm98YScHztHmw
    MD5:321C19589311041E02F9D4F0BF0CF13C
    SHA1:C28F469244BDCDBB363CAB07F9BD650BFEB1D159
    SHA-256:4060785F14123937080B852210130FABE4FA1BDE9127F4971C1993B60ED06D61
    SHA-512:82CD20EBFC41B67721DF7AC3871DD6753D112322B88681AFF794214718F20E29F64C4C4A3AABC3F758A7EB99AD0DAE3BEB43BA2716B6151D9DC0D9F75A607670
    Malicious:false
    Preview:GIF87a..Z...................k.{{...,......Z.@......0.I..8...`(.di.h..l.p,.tm.x..|....pH,...r.l:...W.Z..v..z..xL....z.no.S.1....|....~.z.w}w....q ................................................................p.....@.........................s........................*\....#J.H..EI...,....G<.8... ....?..0.Q1.....).e.6......K.>Y..zShPe@.&-..N.-.2=zl.P.@i:.:.h.Y.....i..c.nU{.+DxR.@...n.......-.m....u.2x...]....#K.L....3k.....C..M....S.^....c.M....s..........N.....+_.....K.N.....k........O......_.......O...............(....h...&....6....F(..v...|.RR......X..$.h.(......b.(.O\......hcK.Jp..?.h.........d'...6O.b.).(..V6.$.IF...Sz....`i...H.J..\.J)Z:..I......"_0."c.9.e...j.&...^h..F*)w"uHG..8..Tyl*$...&.Y1.E.^Im5.`.*..L4.*.C...*2.~E#....ZS..SVE.{(...9......XX).m.\)...iA..YCY.....[...^...k.u-.Mm..}=....,C.2..0..oet.+....l...'....7....G,...Wl...g....w... .,..$.l..(....,....0.,..4.l..8...<....@.-..D.m..H'...L7...PG-..TWm..H....\w.

    C:\Program Files\WinHTTrack\html\img\snap9_i.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 650 x 396
    Category:dropped
    Size (bytes):2427
    Entropy (8bit):7.886297117808314
    Encrypted:false
    SSDEEP:48:9C6+7fTL37qJ762Fr7x72Fo4EjxVY0th9Tb6jA0YiUy8fL60UBOI7UtE:9Cxf33U62FH6o4Sltb6c3iyeBOI7UtE
    MD5:C7C338DB2F7B01CDDD96818AAC2F25DB
    SHA1:9BC0845FC47C4C2841EF266EB5E21179EF3B12C3
    SHA-256:1F4948711AE967171ED568100442A8A9BE654E0D2898CC8A37CA167FBEEA1531
    SHA-512:F9777E8B42E521423E30F5145BAF63FCFE26A75D616D60DA27D79F604FCF533732A7EA3E905B3AFBA1C5C0C478E71AB305B014AAD5AFA8294ECA9F5AA22DC8A2
    Malicious:false
    Preview:GIF87a...................k.........,...............0.I..8...`(.di.h..l.p,.tm.x..|....pH,...r.l:..tJ.Z..v..z..xL....z.n...|N.....~...................................................................................................................(..........&...S.......].{$...@...."6.8p`....@.`..^...}l.H..../z<xN.:..]....A.-..l..G{._j..'PyDK*.q..J.!.......tR..kU..cJ.....K..hZ.i..d..i...Z.f%..%Q._..L..Ev......K. ..c.x...[..LJ.s...._.....7#...z.h.Wf.L.........*..Z.X..].......n7#O*.3.'....z..gN5..g..&.L..}...................(....h...&....6....F(..Vh..f...v.. .(.$.H.7(....,.a.d3....h]P..}y0..X.. .E.c.7VP$.G..V.>.0d.?........^D~0$.M..d..LYey=Vg.y5........ef....P........{..w}.)..(.6.V..\O..F.Xv...v..7......b......u..v..dls...6..k..v)....cc..G.P..W.d.^I.....j_."..]..B*....lX.Z&.|...o......Q.r...j.8.P..FkkF.bF.uA..ok..e.q.......V.j.\.Vz......;.......zk.....m.4..l......9..i.{ri........r.'...X..)....)>.ltBE....L7...PG-..TWm..Xg...\w.

    C:\Program Files\WinHTTrack\html\img\snap9_j.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 652 x 394
    Category:dropped
    Size (bytes):3949
    Entropy (8bit):7.921309663854937
    Encrypted:false
    SSDEEP:96:Yr58Nf4vrcy3dU3DMPrIbTMF5COI97he7SInCbqFeGlvQ:Y6NwjcqZYFOI97U7jnIqFy
    MD5:365586D3CC453A85499650D20152E8B6
    SHA1:F302DEE259F6499ABD174ECA0A8CAAE6BDD1DB48
    SHA-256:7A9A5BE9CFD033AB4EEE7DEC4E5365024F8AE0A7A6BB00A2CF93ECB3535E383E
    SHA-512:77B95CC5ADFB990382AA242701F54AE07A1D6876D57DDB1DA8C4A923590C4821233AF428D9B2661D845428C9DFCF4C8259F3176839C701975C5CCF84B58A3922
    Malicious:false
    Preview:GIF87a...................k.........,........@......0.I..8...`(.di.h..l.p,.tm.x..|....pH,._.FR.\2.J....6.R..2.R.[0v.~..Xm^o.m........zN...xxcyG.....................#.....x....z.V...z`.L...b..e..iqW..I.M........;.................................h1.!...:.{.....{........H../....UJ.-......O. .r.i..... C..I...(S.\...0Q...i&.87u.....>....j.P.G.."..(....4....1.j.....r....#.h.]..G........x..................L......!<1#...2.f...C.~I!IX..G.^....^.uF.4...;9..3..V....n.?...^|.T..[.\...."yS..}...XqW].U<....G...m....'..{..q.w......I..Z..V.[.F..H.5.`........5!.m5....u.. .(.$.h.(...,..@..hx...D...Q...><....o...!......,.. ..I#B..h..TV..E.I0....2P.V.).d.i.h...l...p.).t.i.x..|....*..j.&..6..F*.Vj.f..v...*..j........p.......9b@.a7.....z3XD...e-.<t.D........8.E6*.l..>.dE...m.S".....,.."..a......%/...k..f...c:j.n@7.XC........Y..6....G,...Wl..9P.n..L.p+.RGQ-.......|Y.N&.2..+..4.l..8...<....@..W.0.]T....S..D_.M#.\.T.$....MVj.I}

    C:\Program Files\WinHTTrack\html\img\snap9_k.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 650 x 394
    Category:dropped
    Size (bytes):4901
    Entropy (8bit):7.9177808199843245
    Encrypted:false
    SSDEEP:96:cxf33EgUnCGi+sOprjsWtrDLSD6Ky6JUyBP+WhHAuvbha1g:sai+swjFZnSD6Kv7RguvbM6
    MD5:844AA7CF56C5CE9AFC1C8023800A5225
    SHA1:B5583C68BAC2DF1D5075D0D705D5CE1518800FBF
    SHA-256:A3185E3D227A2C0811543F942967E69B47421EC52E0BB447024EC4D53F88679C
    SHA-512:C95FAF412ADE2AFA6AA82405E6B0637F0E9F8A178FA141E124746B66F446750E8DF4129EE0B6A75237F65D133FBE6398E0515C02A0CBEF497FC4FC1703D95DC0
    Malicious:false
    Preview:GIF87a.................k............,...............0.I..8...`(.di.h..l.p,.tm.x..|....pH,...r.l:..tJ.Z..v..z..xL....z.n...|N.....~......................................................................................................2...........B..........C.....-....<s....WN\......1!....j..-.".....t...A| ...x0.Kx.On..f..7Ez....J.$[....AE.EE......P.J.J...X.j....`..K.,X.l..X.v..<}&.`r.C.o...K..Q.m...L.....+^....#K.L....%.M...\...zV.Ro_.+...[...k`.%-..?.~e....4.]W....i.a.,9..]..%.m..!...?.=....t.N..x2....^L...g.>.}/..........'`..nQ....q`..&.`..^....0a..V.a..N.. ..a.#.hb.%.W.,.............m-V.b.1.S....8.;f.O....D..M@d(..A}]0e..1y..K@..Q.d.Rth..H.1Y..P\24.@.9w..=y...J...o..T.....H.3.*.r.UT.j...'...h...-..jHF..o;I..sA....P....2.i.vYd.Aj....i[R......K..Lu.)..5......zd...e.....u.6..(M..u."..B.b+..'Vk...z.w=.l .&7..Q....j....0...n....p....k.....Q%.|0..+.........w.0g"......l.......,S...3.`.<.h..<....=.-..C....;.,..L7...PG-.....!.Xg...\w.

    C:\Program Files\WinHTTrack\html\index.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):5902
    Entropy (8bit):5.148986821335878
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKFAzAOt4ReI:5ym/JPNV+4GTzMNINTIszWb+HF8ohq
    MD5:2217A89008707B601D67C0FB4154EDBC
    SHA1:FB55B1A28A3A10EAE2ABBB9FFB3C7E68BC2B3010
    SHA-256:F205310773168A054BCE587C26A72FAB8B66466261FBFDF71B4F19C13C787301
    SHA-512:DA6478457E86BC6E33FEAEA8CE2DA52B090F234D8145CF461158F4F8D8B0B6464D6C67E34A13AF3876494A6F22718B910DDF385501EF3205DA96CA255FAB7483
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\is-0EDNS.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):14581
    Entropy (8bit):4.892170439137315
    Encrypted:false
    SSDEEP:192:5ym/JPNV+4GTzMNINTIwKHFw2m3bRZv5Umgvke6v676qLFmtMInZTD9UF8ohq:l/fV+l2HFuZRUmgvkjv6HLFmtMInTf+q
    MD5:2D5B1DEAC6B2858C7DFCCC87CC50D62B
    SHA1:F03E861C752E42E8D6783EC6A97B69967FB072E2
    SHA-256:A2354DEE389E777EE2D2BA7DCFE6AD13F29643256A80E120C5CFDFA29E86648B
    SHA-512:78524561760AA463525EDA08BB66F8C6C1A0D3EA75C38B122FB3134ADEE1396A53DF80389F5770AC66498FD8552E76C7EAF074099BB1FAEE048CA693FE189623
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\is-0G133.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):5082
    Entropy (8bit):5.1378491179635795
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKFd+LfseyA8:5ym/JPNV+4GTzMNINTIcF8ohq
    MD5:13B398AEC04517877B083BF62FC25385
    SHA1:507A74627233C3D6A130D96F9C6A2D281F094446
    SHA-256:21266709503C15FFAE6497CDA0C808FFCAE11737B2A9996A71199E7D2ADF12F3
    SHA-512:35A495DFD247CBF6F0773FFD78D972B1F829A18A4CD521C591116AC6D29DB355ADC5311A363895B46C1A02DE9D70E6C6473985ACC104B22221F692B8B806FEC5
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\is-0PTKM.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):21071
    Entropy (8bit):5.207250860239461
    Encrypted:false
    SSDEEP:384:l/fV+lHoSQi8d+Xw5Kfwepw5Cmuhklshnd3v6px/+U:pV+A/dOqK0CdhhRvUL
    MD5:1D89A9A7547179DAAE778DCC0EF908B5
    SHA1:289F614D8AEBBA9A3E7BD8E5D4D788E34330AB35
    SHA-256:282770D2A8BD03CA4083F7453001A9E827958408019C6CBFD940AC65D213B149
    SHA-512:3887C5994764ED4C2EAF37DBC5770D26146C7053D2CC153CD306519C204206BD88558C622EAC5849AD99530D5C34B62F627EC6D2C8881F05D3DA65112AD4C757
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\is-16PQ1.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):5583
    Entropy (8bit):5.107715249572924
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKFBskKQZbg9:5ym/JPNV+4GTzMNINTIVFKeOgF8ohg
    MD5:D00CB59EB5E64E6FD3FFC10962C8E114
    SHA1:BB55E0AD538A9CDE7556F9794EBC3A0F74A1402C
    SHA-256:EFF26868A40711316674C7889982A1C8442CC5D2AEB18422B56CF16BE9566A04
    SHA-512:76BA275B71CD1BDCA676575C1A1C8AAE99F74E9D9DC759CE0A785FABEDC111FC4B0C287AD1430A4768CA5D67510327EABDF10D9E1222EB0768DF3FD3872EE4BD
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\is-1THD9.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):19497
    Entropy (8bit):4.887832798018361
    Encrypted:false
    SSDEEP:384:l/fV+lvUEXSzs6T/J3EVcxVkZxdPJmJ3KQI5w53u+q:pV+SzruQIiE
    MD5:B5E54867B9FFF5C98C6BBCDE4D0EB4C7
    SHA1:A68B98F540E58247BED1011204C087AB5C2B4BEB
    SHA-256:367A51005B6D0FAAE37EB34022F7B46DF4FDA08FABA82937C28E8D9645270C8C
    SHA-512:15B823764C1C13FC628D3328821E0317CFBB8A9FB628204652DFE3EBB9434064776F51AE637ABB65F1B729ADDF1818F67E47A897A2DC150B726A740F4FC9C066
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\is-1UK74.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):52811
    Entropy (8bit):5.011530968063998
    Encrypted:false
    SSDEEP:768:DV+RlfcF/sfnMDue+huC1zjWUDbQFeBcF/Oyf/dJVJLqoMUg:glUF/sfXewF1zxD+eiFlHdbJLm
    MD5:46AE64FEDE879BDF5D6AF403917B4EB8
    SHA1:07D45D7820C63F49C64962DC5005205A1385BB96
    SHA-256:BA4118706C37CEA29B890550E591A84ABA5BB50D49B952B6BA8D78322CD5950E
    SHA-512:7FC19CC9AD4B390BF593139680F77B331011CC0F351FDBDD750D13F0039CF60536822FD6A778F75917A529A88E8B49BD49E246C0117895055D827F746B123634
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\is-5EDKI.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text
    Category:dropped
    Size (bytes):1914
    Entropy (8bit):4.959904245247355
    Encrypted:false
    SSDEEP:48:19JZI7XKWsee++XvX7aT2ypOuGq1F5HVf/sebfj:19JuLKO+fLy2yY70XH1z
    MD5:2E4FD7238B05CE0F73F8D70D10A66D84
    SHA1:4E03F2DBCA1B307C658156ACD7BF30FBF866A774
    SHA-256:9A1BBE9E472DFFE9888230C0FF017E21295334B17273D30DDCF1381E4358C6EB
    SHA-512:2DADE3F6EE54FDE1145204EE8DA331DA248FB633E8D8009AC34A1952807BF8F4881B9BDC9C1C251348E48B16B6CEB375B55C485414021AD7176C15FF46C74E8B
    Malicious:false
    Preview:.body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 0.96em/1.3em "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}../*..Width for "#siteNavigation td" based on number of buttons..Six: 16.6%.*/.#siteNavigation td { width: 16.6%; }.#siteNavigation a {..display: block; padding: 2px;..text-align: center; font-weight: bold; color: #448; /* font-size: 12px; */ background-color: #99c;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }.#siteNavigation a:hover { text-decoration: none; background-color: #fff; color: #000; }.#siteNavigation a:active { text-decoration: none; background-color: #ccc; }..a:link { text-decoration: underline; color: #00f; }.a:visited { text-decoration: underline; color: #000; }.a:hover { text-decoration: underline; color: #c00; }.a:active { te

    C:\Program Files\WinHTTrack\html\is-61SD2.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ISO-8859 text, with very long lines (603), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):9216
    Entropy (8bit):5.136800918131365
    Encrypted:false
    SSDEEP:192:5ym/lPPNV+4GTzMNINTIo/QWVowNLGgmdacz66JjDLkg7NRCF8ohq:l/ltV+lN11I6MBR+q
    MD5:D37B41E109339F58F83B2757DF7E4E1B
    SHA1:019D63317AD3D51A325896C44ABAFCEACFD356C5
    SHA-256:FA67041648CADF9B7D099F35A8E34A09925B80F5F192F9ABDEC2ED25C0259D22
    SHA-512:FF293D947D3373B57C60C080018D2BD160F214894D628AD28A949651972386629798463B0642D8E889F494A2AAFEB9F0FC013BAB188630871822DA3C13B18009
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\is-6NO1S.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):6881
    Entropy (8bit):5.087315019198017
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKFn8Nyw7S2l:5ym/JPNV+4GTzMNINTIDRz5F8ohq
    MD5:D29F1679E8493204CF78E871BB6A2968
    SHA1:1CFF7395CFCCB57A2090305C4C18D0BD9341F971
    SHA-256:CAE386AB3EB83C29734377EEBAD4B4DE39706560B92B983992616A47FA30A02F
    SHA-512:3B8FA0880048CE174B0766672C21BFF2C0D4B6C3B478B1FACA510CED46DF003B7D0EB10C592AB6D1836BCA4A6BBA35DC9A5A3DDB313BB03C42FB02FBB004F673
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\is-91HPQ.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):6785
    Entropy (8bit):5.140199862331452
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKFiLLEg27xv:5ym/JPNV+4GTzMNINTI2LwEZJCiF8ohq
    MD5:9EC9042498D911C03E00836630573CB7
    SHA1:4461059E3A18044A2C47AC0E53DD21D4FD28F919
    SHA-256:5664FB4E1DD919E4805A3D3FAAC9AA035979A9751D4D7622EB3DCD7D9DA5515E
    SHA-512:3064993184BBF4BC61156A169889236035D369EF85A29D65E7522444E7A4F904E3626B89ACFE4D5B6FBF504C69DED52AA6427075CB4CF6A3E4E241C77A90B4FE
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\is-A9RF2.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):5989
    Entropy (8bit):5.102975863203544
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKFdLi90Pk7i:5ym/JPNV+4GTzMNINTIRLBPky4F8ohU
    MD5:BBCA457D37B7DF6FB2BDB2EF9AEF0364
    SHA1:DA6A7AFA664DF08BC5575B03A85030C9DC73792E
    SHA-256:E721CB45E7A3C58B8EBB8F49504E27A0EF7B64D6C1589C83448FE371C64A3922
    SHA-512:D79E2602AF98E1EC709006D5B827A31535C0A2AEB63B2DD4519AF646A89BF10C324E5349FB20EA50E86A21D09D189638A9405D43AF6078C71ED5BCB40E263045
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\is-CCLHE.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):5701
    Entropy (8bit):5.116863383225489
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKFkuThDZ5e+:5ym/JPNV+4GTzMNINTIQuTVZiF8ohq
    MD5:52A1B01BF1E9D6DD2567BF7EE15A1678
    SHA1:6D107258BF2915F931097D644B00011D9DB0E301
    SHA-256:8548D05E99345C5C8CF09F025436F5FB37792967C7A6AF7ACE228FCC4B752412
    SHA-512:FCDC799AF3B41B04E86F32F441587DA847311C116A1FDCFC1A022B28B092131B495FA7B21A9D2E9BD5DD7BB88D073338D1F698EC07B98D4C59DD3041EA55B01F
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\is-DG2N0.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):6590
    Entropy (8bit):5.052587812341036
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKF8LQLcxdFE:5ym/JPNV+4GTzMNINTIALQLbqF8ohq
    MD5:86EAACDE54D528C06E5556DB64855477
    SHA1:0902C07F89CE3B83686CBE4C540ACF313741936B
    SHA-256:FF2E12949518EDC4789D41A9F65FED83A802C538DB9DD1CC7CD4BAEC55CFF7EA
    SHA-512:115D54453DFA831262D5415BFF1EC2294F7C38A3766FE7A67C84EE09BD4DE34BE543EB40363FF937089ADFE69C277F9E4BCED74FC69700E684E2D3BDFD21AF57
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\is-DH7AM.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):8223
    Entropy (8bit):5.1989705397727395
    Encrypted:false
    SSDEEP:192:5ym/JPNV+4GTzMNINTIfBqcVZVVjCWXV17OlbDFbnFVVfoZwyFy765Ry57IgBcFs:l/fV+lMUofnI+q
    MD5:1BA13E15A0065558E6022DE7520443E9
    SHA1:99C0EAC45948C3CE53175DBAE69804C163A6425B
    SHA-256:87895C5628CF7896795FE0F2BB92055C54D9D3E98B0D642A7963DB1A70F875C5
    SHA-512:ECEAFF9E115428BF7F3CBFF02055C210C7952589EBC0D2AA85D4DC9290DB87DB4E0BBD904F98F7F2655ABE61DE76EF7BFD3CE25C107079D7A04E72C5374B58F0
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\is-E5KSU.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):6758
    Entropy (8bit):5.087172942162259
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKF/L3DUrlG9:5ym/JPNV+4GTzMNINTILLwemF8ohq
    MD5:ABCA405372E3AAF015BF05D1B201EEA4
    SHA1:BC72469310DF3CB1A4676D26DE2B45946DF37595
    SHA-256:23E13ED4A7ED57BC1B07838FBC61F2ECC15BE50D76587107A1129A2119B171B1
    SHA-512:DD43C76DA4046C28AD1343912B077EFDD95AF7C4D6C8C9953C6F85159F8669C1BB26B30DAD6C7121C66312E723E1FEB15FC83B852DDA9C298ADABC39AD75E1EA
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\is-G5TC6.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (1045), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):25023
    Entropy (8bit):5.033695513036823
    Encrypted:false
    SSDEEP:384:l/fV+ljYkKrwMub2DtpyZVNyaGNaG1AREeUBIc4gxmNBveV8Q+q:pV+hYky3xSVNpjo0EeUBUxWD
    MD5:A0B93FFABDEEFC6EF618FDBB7A97F72F
    SHA1:AFF7E86FD2A6B854F4FCB1E4480D32BABA43DF15
    SHA-256:4BAEB0AA5E3439AD5EF6A0550385D1BA6646272B18340CC0EDB4CBE3B59DCE12
    SHA-512:9AE24F933A28933703960AF97461103E0837FFAA9B0C222B2D459A3C65A9629293EC2B79A6EDEAFC47D1AB5B5A0596B682A1C163472E65CAC07F89210145AADD
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\is-GKSLV.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):6009
    Entropy (8bit):5.087851881989229
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKFc3L1fJD5o:5ym/JPNV+4GTzMNINTI+Lv5tF8ohq
    MD5:74082C3E6A48A21F737E0F4B82DC1A3B
    SHA1:421BE006C9445E83309A2C487FEFF84468B15558
    SHA-256:DBB8099E16535C18427D0B67BF93B614A6B392E0861D978768BE114076370AB6
    SHA-512:064A151C84530C350B09214181C8727C0D24ACC0DA5348F9CD64DBD27124E46D4D9FC67A4AC84EC32D766D15B5C6469EFD7C7D693161A419A21A6DDC58D49566
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\is-GOS7L.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):11067
    Entropy (8bit):5.1919349581405525
    Encrypted:false
    SSDEEP:192:5ym/KPNV+4GTzMNINTIhsM7ESZR7jtupdxmuSJuEHr6l29CIRToMLsAF8ohq:l/+V+lJWzXMprmu1EL6KCI1oXL+q
    MD5:1EBA20582A075D281CD488A5ED143E30
    SHA1:C91FAE90607BDA9CD335B340DD5E55C3E3DBA7E5
    SHA-256:A25B9AC3791C5CAC30EDAD325296B3C83D1B6731E9CE48A606DC2592EE33BE0B
    SHA-512:1F2A5D0C1B58CA4884B2392050861A3B36AC6CBF33E63F66E97B38B777D8DD67B16EA0A07E301F742C9C341FBFB8922460C774A5CD2ABEE3E023F88205E56E56
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\is-H5JG7.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):5774
    Entropy (8bit):5.3539583356646485
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKF9LPjFo71y:5ym/JPNV+4GTzMNINTIhL70F8ohq
    MD5:75A931EEB73C630CB5A7F8B26BC1CBAC
    SHA1:1C4B9FEBE199084D8EF324CA68F6C270B3A5C553
    SHA-256:4293E0F9181C36F2378CA06E7775CFCD5CAD50F0B05F9DB5DAEF4E60B4422C2E
    SHA-512:69FEF70288898DB0BEFE6549EB85489A28105B647D5BC46B80A57082818FB721193DC7D2C7F48A2A8B32B5333BD5265469D7C7618E15AB3D7067D1150D03D31C
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\is-H7UBN.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):6191
    Entropy (8bit):5.122083201033882
    Encrypted:false
    SSDEEP:192:5ym/JPNV+4GTzMNINTIiL5IziEdXF8ohq:l/fV+lPT+q
    MD5:1B8EA00279E61F3CF3D8978F5F4A7693
    SHA1:645A68AA035DCBA83378DD804CC7E93543AE9C8B
    SHA-256:6F8109C62EFFC6CC574594DA37874B7F3422FF3AE9C9A2514366574858FE8207
    SHA-512:039A87F5CD3FEFF237E310F34C61B90304E53B31E7DF5D249AF36360ADA52FD3758FC6230FDFFC64C3C154D6E932E3215510847C2E5253E5A19DCDA09E6950FA
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\is-HFAKT.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):6090
    Entropy (8bit):5.07524061632939
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKF5AhLDxCGR:5ym/JPNV+4GTzMNINTI10LlC9WWWqF8l
    MD5:39C8C0F5A2B8EF1063A0164A7C4F5CF4
    SHA1:C60CE25D56B24F39B50627DED35A85B4FCEF54E1
    SHA-256:84497DC79554FB550D911483A579EE80406E7BD18615CBC14DC5DD56850AC2CE
    SHA-512:60D6AD3A32373DE6628928367825D215654E1EF1EB5F569B8EB9D9386BB4C4D24E784C5B9BD322C086CA57A40C8846C3A7E5DAED74624E5B447DE00E8A00BCE4
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\is-HJI7C.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603), with CRLF line terminators
    Category:dropped
    Size (bytes):5976
    Entropy (8bit):5.156102956812129
    Encrypted:false
    SSDEEP:96:w8LRopoU/UvyGmiq+JdGn+6H+dvJcWX++kV8yzobCy6zryIry3sEs/BBO5vbZgji:fy5/Aq2sDXefCbzrzyXNv10E
    MD5:96C0964BF527C0996CB5CCF964074CDF
    SHA1:78E819826D8F1BBF11399BAAAA5D88916365268F
    SHA-256:4E5CD4698863CF25ED2086E62456BB070AAF78870204710913D3D6485820A51C
    SHA-512:45ED78B51BF86E46B0B9EF86F5E2FD622035128AE527C22AD1DA23DEE4DAD856A0192B47F684B8319C677237D0B6BE3A77054215ADDAD89E51B9F21DC4DDD2BC
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">....<head>...<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />...<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />...<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, as

    C:\Program Files\WinHTTrack\html\is-HMR29.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):105472
    Entropy (8bit):4.921317320877524
    Encrypted:false
    SSDEEP:1536:L+hCmFkDMpZH0rFCi0FZdaTkO7Z+/y+dFwOs3jT:L+hnFOMvS0FbaTkA+a+dFwOYv
    MD5:24A8361EB3C63D5478671BE9D4D908AD
    SHA1:16FC30299A7D83FD626A33E36E003BFD706748E1
    SHA-256:EACC80E42F205270587FA18A4C912C7FEAA18B460634961D01EB6C253258A345
    SHA-512:6B28396CD2E4E316F15EB134542EC354F8D23C10EA7574C91E6F6ABB8541DC2AAF97A751D527E1BF685FAC9C51E0A30483D254CD5C3B0A58B07635959DBE4C4E
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\is-I623L.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):5785
    Entropy (8bit):5.120838398191975
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKFEju7fxlLu:5ym/JPNV+4GTzMNINTIHfbF8ohq
    MD5:FDD1D618AAC1BE97B2F14D52AFAAA5F6
    SHA1:CB31CF4E9031AC01BFB1D2CEBF3038BB23E07EE9
    SHA-256:0FD76E56BF1C7C123B8C1B3B3C93FE6FAFBD294A70445B719161C7665835B318
    SHA-512:B8A0AFAFC077FBF4D3C06F18599F1706D68DCAE5C4E61A52CFE13B529038370A43623A6562AC65206D8706624B5E226E25E236D25E8EC2B28FC49BF171C90C0E
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\is-J7N7G.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:makefile script, ASCII text, with very long lines (349)
    Category:dropped
    Size (bytes):19796
    Entropy (8bit):5.544815629624758
    Encrypted:false
    SSDEEP:384:wN152iTtmSQI+vDT3HYjY3AF9BawN+1IY2fQgOUK+JzpTZNC:Cv2iTtmSGvDT3HYjY3AF9BawN+1IY2fg
    MD5:0F45F34AD50E36C29E2C1D5F8E97282B
    SHA1:0597D4CABA0763901F11A182489A92565CB35BF2
    SHA-256:21C9D2C7704F95CF90667567B9E87EC8D021C3A9BBC179B40B52D4C80374B91F
    SHA-512:3716F47BF06D37D29EC3056BBBF48AFAEDA498AEAF098181EA9AE86453CAA3E9FFE2C3FAD42B437DAA14F9361CED716F5BEAB1D66E4F27C449C46539B8F0FB47
    Malicious:false
    Preview:# Makefile.in generated by automake 1.7.9 from Makefile.am..# @configure_input@..# Copyright 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003.# Free Software Foundation, Inc..# This Makefile.in is free software; the Free Software Foundation.# gives unlimited permission to copy and/or distribute it,.# with or without modifications, as long as this notice is preserved...# This program is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY, to the extent permitted by law; without.# even the implied warranty of MERCHANTABILITY or FITNESS FOR A.# PARTICULAR PURPOSE...@SET_MAKE@..srcdir = @srcdir@.top_srcdir = @top_srcdir@.VPATH = @srcdir@.pkgdatadir = $(datadir)/@PACKAGE@.pkglibdir = $(libdir)/@PACKAGE@.pkgincludedir = $(includedir)/@PACKAGE@.top_builddir = ....am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd.INSTALL = @INSTALL@.install_sh_DATA = $(install_sh) -c -m 644.install_sh_PROGRAM = $(install_sh) -c.install_sh_SCRIPT = $(install_sh) -c.INST

    C:\Program Files\WinHTTrack\html\is-K81A9.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text
    Category:dropped
    Size (bytes):53435
    Entropy (8bit):5.18614897584775
    Encrypted:false
    SSDEEP:192:dHwmAurWhLcKEbxKdlvkZe6GAbDIVjoFJsbDUGzo2X4ObDjEaRMOubDasaHDfiND:rrUUAdgae5Y9T8ZnVUFVWZYaOnlYqE1X
    MD5:E71DB8F1C20E497DD44B96B14F731C91
    SHA1:4AFDC9FACB43B93F2724BDAC4BFB6141F2639957
    SHA-256:C0A508B8B4290283990C90306A5DC6D3578D820DAA41D4F80AFE43332A3AF4B4
    SHA-512:6A143553DB5AA6126D103FB45AD942749D5C82C9C8C40B5CB6009AB43B89CFFC7DB4074669EAB45DCA63E830351B2C12BCF4E8CCFF1567566824BDB462FEA4A1
    Malicious:false
    Preview: Creator : groff version 1.20.1 -->.<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"."http://www.w3.org/TR/html4/loose.dtd">.<html>.<head>.<meta name="generator" content="groff -Thtml, see www.gnu.org">.<meta http-equiv="Content-Type" content="text/html; charset=US-ASCII">.<meta name="Content-Style" content="text/css">.<style type="text/css">. p { margin-top: 0; margin-bottom: 0; vertical-align: top }. pre { margin-top: 0; margin-bottom: 0; vertical-align: top }. table { margin-top: 0; margin-bottom: 0; vertical-align: top }. h1 { text-align: center }.</style>.<title>httrack</title>..</head>.<body>..<h1 align="center">httrack</h1>..<a href="#NAME">NAME</a><br>.<a href="#SYNOPSIS">SYNOPSIS</a><br>.<a href="#DESCRIPTION">DESCRIPTION</a><br>.<a href="#EXAMPLES">EXAMPLES</a><br>.<a href="#OPTIONS">OPTIONS</a><br>.<a href="#FILES">FILES</a><br>.<a href="#ENVIRONMENT">ENVIRONMENT</a><br>.<a href="#DIAGNOSTICS">DIAGNOSTICS</a><br>

    C:\Program Files\WinHTTrack\html\is-KTCGT.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):5801
    Entropy (8bit):5.126247365425569
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKFvLUoIHXvf:5ym/JPNV+4GTzMNINTIbLUbH/6F8ohq
    MD5:6F8C2CAA661EE18CEA5AB95ACCC04DA7
    SHA1:B97846B9BFC88BD3B0CDC1BF62801777CA325C01
    SHA-256:008A8DC73B2A6DC065BA20C47EF4DA2C3657248EC624D2BB2FDEC1BDDD6156BD
    SHA-512:77A365B84C3E1CA62A7A824582739F2C61DDE1F7E7F52812715CB65F20AD4C4226ECEC5728C8BD497C5798749C7C6AF482204D0CD9513EA2C32807371543457B
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\is-LJR0H.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):5992
    Entropy (8bit):5.128161981291414
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKFzEgL4HAEl:5ym/JPNV+4GTzMNINTIsiKc27j2zF8oA
    MD5:9597BC7F175505FDD558FA22EACD654C
    SHA1:2787B672148BEC3F7234BB4C0F952C098C9CFFDC
    SHA-256:7B7DDB0A96CA2850E10E95A4967C7A8F01BEA4249A9BC293713A3833E7629ECA
    SHA-512:AF7E866692FEEB833995E848CEFDBA502863258019AD90C8D979EB86C2E9392F5EA7365F2F07FA247C229059131164760D8D625C6CD34794BB603E75840F5912
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\is-LTFET.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):4949
    Entropy (8bit):5.143754279515313
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKFqsepLfses:5ym/JPNV+4GTzMNINTI78F8ohq
    MD5:B0B75EB6851FD7DD7DA5FAAAADB130B7
    SHA1:52ABEDBB5AF1E5E0C6D14825EB80842486BD7921
    SHA-256:0E1554759910A13E663EA6395A483F01F11DBAFF4E4413F09611B45D8D88A305
    SHA-512:9EAF58EE8CC489BC37A09B61A16E0DA0B6E95ACB176DAF5386C2C340DC2EB8AD81089FD65B09B8FC1C096B9A36559D1178BFC529E46E223DBB3878BED2F185C9
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\is-M41SM.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):7074
    Entropy (8bit):5.065540927502246
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKFxLwIdNDD7:5ym/JPNV+4GTzMNINTItL/9RWF8ohq
    MD5:6EB8F9B635438605256FDD415743D374
    SHA1:D51A11F60A0CDA408ACA03340578AEE4932B82F6
    SHA-256:4897CFF8FE61F0BC63031EB4ABDDC40FCE50EA85AF72AD0EBF721B34402DAB32
    SHA-512:E5E8DC845A8B1EB36A99BF20DBEE63008A859E398F891F423678B01986E4EFB3E7C06E87F775BB156895EF51A05129141764D6B6DF0DA956C84B8B4C1EAB1FAC
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\is-MGLSD.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):6524
    Entropy (8bit):5.098053272449948
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKF6LHQs7vEz:5ym/JPNV+4GTzMNINTIGLNEsTF8ohq
    MD5:93D91CC2FCBA281B630DB35153A02776
    SHA1:28014CF6FE07487E26885F27A68C7E59C904CBE5
    SHA-256:02BCF233877DBE43DB815A9D0A1E51BAA4651116E183DED8938BABBF49C3F0FC
    SHA-512:4071BEC821046A53DF45BCFBC2FAAEDE2B898C7141A0FEE18D138FF6B37FDE5DE1F9EC40EFB2889C8A8282BD5DD6F511BC099B648F2BD1DABD42F208F45719AA
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\is-OHOS2.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):5518
    Entropy (8bit):5.12808025471695
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKFSx85frn9I:5ym/JPNV+4GTzMNINTI2y+rsF8ohq
    MD5:A1EF66F291F93A62FD5D4DA45043BAF9
    SHA1:AED3AA610EC3A65BFB8976CC15BEAB38B26FB14F
    SHA-256:14A54C2960B1E54BA3442BA958DE074CACB60F8AB29C70F4C46C74EDFE323B07
    SHA-512:0FDF9B3BBA0CE352015C368DD3BE2E86B6D0F504995E45D0E71F08E06F210E958811CAFFE2D6F288B332361A1A04976DBFEE74AE14C86405D7791AE45EE6724D
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\is-ONNHP.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):7922
    Entropy (8bit):5.039914813791609
    Encrypted:false
    SSDEEP:192:5ym/JPNV+4GTzMNINTIbLP5hxnncPF8ohq:l/fV+lilnnX+q
    MD5:35C51A20C4738A3F07F90B1633B6C204
    SHA1:FE5BC2F6FE3C3505AE270429795413C16E930DC3
    SHA-256:518D5F313C5C4194813C1F87418ACB24E46FE5956C2505EAE91CD3EF3308210B
    SHA-512:358EEB6E3EA1888E3591FF598A5BFAAB9E5CB0986D19F4A250CB2367D572256EDF46B0E71816F0E7888F656348BF9A885D82238B357FAA2DB0B29F900683AD18
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\is-OQNA2.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):4825
    Entropy (8bit):5.142345894689179
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKFsfseyAsoA:5ym/JPNV+4GTzMNINTIGF8ohq
    MD5:539A1551100FB38281C2F0393D8EF8CB
    SHA1:AA85B3D7016DC7310FA90CA2C23AC3498CF9E8F1
    SHA-256:84333B570767A616E37257A94754D1AA1EE21DDA13DE07C8188C361377C050FC
    SHA-512:D5B3CDE2B81106EB44D199A63D825CBE91A343AC79B78F8B1E833D87B37C3680E5393C5D52105683C6B9293340487545D66BDAD49F59F285A1DE26030485F6CB
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\is-RRCD1.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):5902
    Entropy (8bit):5.148986821335878
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKFAzAOt4ReI:5ym/JPNV+4GTzMNINTIszWb+HF8ohq
    MD5:2217A89008707B601D67C0FB4154EDBC
    SHA1:FB55B1A28A3A10EAE2ABBB9FFB3C7E68BC2B3010
    SHA-256:F205310773168A054BCE587C26A72FAB8B66466261FBFDF71B4F19C13C787301
    SHA-512:DA6478457E86BC6E33FEAEA8CE2DA52B090F234D8145CF461158F4F8D8B0B6464D6C67E34A13AF3876494A6F22718B910DDF385501EF3205DA96CA255FAB7483
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\is-SCDGC.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text
    Category:dropped
    Size (bytes):320
    Entropy (8bit):4.96105473424349
    Encrypted:false
    SSDEEP:6:qFBdMKx/Hp/Q6M8cxnEEdHcicd3JWdPxsaOxAWH3dAL/M8/UEHpKm4QL:oRx/C6M8cxnEy8icHUxsDGPZUIItQL
    MD5:043CB02AFA2B665479B36E7FBEBFFC0E
    SHA1:47C8187600F92ADCCF03955586036051759DD16E
    SHA-256:9EA2ADB4045018C1FA8AC388C341C7DD7AC3BC87698691F755C0F8DF477CF18A
    SHA-512:E30DAE65F202CC6C1518A3AC49E3FFE5F9D1028504F5E89747763C9D6BF0A8CA5556B46B25713F6C569C02B35C39C874FA6D6E2C4F879F8967AFF645AA840A2E
    Malicious:false
    Preview:<html>..<head>.<title>HTTrack documentation</title>.<script language="JavaScript">. .window.open("index.html","WinHTTrackHelp","toolbar=yes,location=no,directories=no,status=no,menubar=no,scrollbars=yes,resizable=yes");.document.close();.window.close();.// -->.</script>..<body>.HTTrack documentation.</body>.</html>.

    C:\Program Files\WinHTTrack\html\is-TUS52.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (989), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):19033
    Entropy (8bit):4.984781948185675
    Encrypted:false
    SSDEEP:384:l/fV+lEtY3kKCEOzIOZTaJ2aJDZRiTsmg37s9eS+q:pV++tY0KCrznZWjh/iTsmf9eS
    MD5:74CB7B61DAC5985C91E927BC692E2905
    SHA1:5F974F52F889CF20A8260E47CB3AFA01C6353DF5
    SHA-256:B8EA0E352EAF6B4C71B61B400B5DD501919A3DAB1340224A722ADA5AED3CD0A5
    SHA-512:CDEC678180C45E16FC1159B41E39882C31F163FCCE94D7B1D4B9CDBAFA821BE74FFE511973B7CE7D92EBF2817A885413C40C977F001F8D37A89781C9CA9015EA
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\is-UB5T0.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):5040
    Entropy (8bit):5.156043009786556
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKF0L+m0aLfW:5ym/JPNV+4GTzMNINTIYL+mpF8ohq
    MD5:D98611EE816A732996CD8A12CFC9669C
    SHA1:A5E4CAA396E8AAD26209B925D826A525359A37AC
    SHA-256:2CA9AF35A5C1F5E788DF263D0C865657C36FCEF37869E2F17EDFA3F78805C3C4
    SHA-512:E745C8D2E8EABDAC3B6C6DFAC2DC626DD6172CCB35AB24C25A4F1A76E0C0A5F1CACA70FCED83F6F82039B143B1194E440AD397ADD80D85451DF2957F4793374F
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\is-V9TL3.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):5429
    Entropy (8bit):5.173404268702969
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKFNUdrlCLld:5ym/JPNV+4GTzMNINTIxACLlEF8ohq
    MD5:41D299BBD6A281D5E76B734DC89830AC
    SHA1:11664474B8DC15048DBAE6A2A390DADE973D9D5C
    SHA-256:AB8304407686B197522732B1AFE581D073999ABBCB79F7B2A2EE6DF3016A3A76
    SHA-512:2F24661276394775CEE79B761070FDBBD36FB3A0B9586246597C2F96AEEDC9C55512D2B61C8A1131304464DE26BB551A569C67DD2120403B3ED60FD3F9071621
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\library.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):4825
    Entropy (8bit):5.142345894689179
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKFsfseyAsoA:5ym/JPNV+4GTzMNINTIGF8ohq
    MD5:539A1551100FB38281C2F0393D8EF8CB
    SHA1:AA85B3D7016DC7310FA90CA2C23AC3498CF9E8F1
    SHA-256:84333B570767A616E37257A94754D1AA1EE21DDA13DE07C8188C361377C050FC
    SHA-512:D5B3CDE2B81106EB44D199A63D825CBE91A343AC79B78F8B1E833D87B37C3680E5393C5D52105683C6B9293340487545D66BDAD49F59F285A1DE26030485F6CB
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\options.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):14581
    Entropy (8bit):4.892170439137315
    Encrypted:false
    SSDEEP:192:5ym/JPNV+4GTzMNINTIwKHFw2m3bRZv5Umgvke6v676qLFmtMInZTD9UF8ohq:l/fV+l2HFuZRUmgvkjv6HLFmtMInTf+q
    MD5:2D5B1DEAC6B2858C7DFCCC87CC50D62B
    SHA1:F03E861C752E42E8D6783EC6A97B69967FB072E2
    SHA-256:A2354DEE389E777EE2D2BA7DCFE6AD13F29643256A80E120C5CFDFA29E86648B
    SHA-512:78524561760AA463525EDA08BB66F8C6C1A0D3EA75C38B122FB3134ADEE1396A53DF80389F5770AC66498FD8552E76C7EAF074099BB1FAEE048CA693FE189623
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\overview.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):5518
    Entropy (8bit):5.12808025471695
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKFSx85frn9I:5ym/JPNV+4GTzMNINTI2y+rsF8ohq
    MD5:A1EF66F291F93A62FD5D4DA45043BAF9
    SHA1:AED3AA610EC3A65BFB8976CC15BEAB38B26FB14F
    SHA-256:14A54C2960B1E54BA3442BA958DE074CACB60F8AB29C70F4C46C74EDFE323B07
    SHA-512:0FDF9B3BBA0CE352015C368DD3BE2E86B6D0F504995E45D0E71F08E06F210E958811CAFFE2D6F288B332361A1A04976DBFEE74AE14C86405D7791AE45EE6724D
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\plug.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (1045), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):25023
    Entropy (8bit):5.033695513036823
    Encrypted:false
    SSDEEP:384:l/fV+ljYkKrwMub2DtpyZVNyaGNaG1AREeUBIc4gxmNBveV8Q+q:pV+hYky3xSVNpjo0EeUBUxWD
    MD5:A0B93FFABDEEFC6EF618FDBB7A97F72F
    SHA1:AFF7E86FD2A6B854F4FCB1E4480D32BABA43DF15
    SHA-256:4BAEB0AA5E3439AD5EF6A0550385D1BA6646272B18340CC0EDB4CBE3B59DCE12
    SHA-512:9AE24F933A28933703960AF97461103E0837FFAA9B0C222B2D459A3C65A9629293EC2B79A6EDEAFC47D1AB5B5A0596B682A1C163472E65CAC07F89210145AADD
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\plug_330.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (989), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):19033
    Entropy (8bit):4.984781948185675
    Encrypted:false
    SSDEEP:384:l/fV+lEtY3kKCEOzIOZTaJ2aJDZRiTsmg37s9eS+q:pV++tY0KCrznZWjh/iTsmf9eS
    MD5:74CB7B61DAC5985C91E927BC692E2905
    SHA1:5F974F52F889CF20A8260E47CB3AFA01C6353DF5
    SHA-256:B8EA0E352EAF6B4C71B61B400B5DD501919A3DAB1340224A722ADA5AED3CD0A5
    SHA-512:CDEC678180C45E16FC1159B41E39882C31F163FCCE94D7B1D4B9CDBAFA821BE74FFE511973B7CE7D92EBF2817A885413C40C977F001F8D37A89781C9CA9015EA
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\scripting.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):8223
    Entropy (8bit):5.1989705397727395
    Encrypted:false
    SSDEEP:192:5ym/JPNV+4GTzMNINTIfBqcVZVVjCWXV17OlbDFbnFVVfoZwyFy765Ry57IgBcFs:l/fV+lMUofnI+q
    MD5:1BA13E15A0065558E6022DE7520443E9
    SHA1:99C0EAC45948C3CE53175DBAE69804C163A6425B
    SHA-256:87895C5628CF7896795FE0F2BB92055C54D9D3E98B0D642A7963DB1A70F875C5
    SHA-512:ECEAFF9E115428BF7F3CBFF02055C210C7952589EBC0D2AA85D4DC9290DB87DB4E0BBD904F98F7F2655ABE61DE76EF7BFD3CE25C107079D7A04E72C5374B58F0
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\server\about.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text
    Category:dropped
    Size (bytes):4329
    Entropy (8bit):5.312753047904929
    Encrypted:false
    SSDEEP:96:QGkJuB2+fT+ygyY7kXuo8jyfekeyezMseyAkNyUs5sKj8iUV8UJmfseyA5+hq:QP2V+4fSTzMFwNTIaUFJ+hq
    MD5:00CFBAD9BF4ACFC6122B43467BC3E64B
    SHA1:E78A1DEC930A38C8FDC1BA401B7B3C248915DEC6
    SHA-256:0DC90EF24295AF2526CE40D807D85477178AB1017D1CF99060C3ED6F8371E37C
    SHA-512:EA382DE24FBF9AAE485F3B04F759A2B0A7AA3C72FA15CC414E8200249B1DEB33EFDC1A711BAF5406C54F497AAA270CB77FD4FF53F732796FE03CFE4820920AD1
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}...tabCtrl {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; bac

    C:\Program Files\WinHTTrack\html\server\addurl.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text
    Category:dropped
    Size (bytes):6758
    Entropy (8bit):5.385836519223747
    Encrypted:false
    SSDEEP:96:QGkJuu2+fT+ygyY7kXuo8jy3ttY91sekeyezMNyTzcm4M8xFkJSjNyUs5sKj8ieR:QPNV+4Y91sSTzMN9kojNTIlOAkF9+hq
    MD5:BECE9AD4D4788F93529FF925DBD61588
    SHA1:41A45DE69C90F47A87E6DA0FC0D1532701376D8E
    SHA-256:903621BE0CB394637732B51C74D7035BA14DD3B054C268733234626AA8EE1D0F
    SHA-512:E8D0FD981022F254B0AFCE2690E677DD34A8BD641E8DE8D44528E0A0A61655915A693D56A9AAA6693E6F382913CC5FC30428715BBF7F405C80E0C374693F9D95
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; background-color: #fff; color: #000; }.#siteNavigation a:active { text-decoration: no

    C:\Program Files\WinHTTrack\html\server\error.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text
    Category:dropped
    Size (bytes):3904
    Entropy (8bit):5.294866883809983
    Encrypted:false
    SSDEEP:96:QGkJuu2+fT+ygyY7kXuo8jyfekeyezMseyAkNyUs5sKR3fseyA5+hq:QPNV+4fSTzMFwNTIDPFJ+hq
    MD5:DC9E1AD58BE0731D33A50F0A14DF7043
    SHA1:51BAF039B056FF71AB31BBAD8E473C4135AB8A67
    SHA-256:2AF5E0FBC588BB2E45D1230B80362B0793812BD58AFDDCA98A2E1492CE99B24E
    SHA-512:85644F27E9E47366E7529B04594536371BA109E4CF59E5B2DC695056C3F4B65D166AB9B2BC5B43DC6416C01C27DD625F0BA4A64FB7DEC5092A13B06AC3D7F801
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; background-color: #fff; color: #000; }.#siteNavigation a:active { text-decoration: no

    C:\Program Files\WinHTTrack\html\server\exit.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):676
    Entropy (8bit):5.5253540890729145
    Encrypted:false
    SSDEEP:12:B5I76QclfRh2pXE2dkGr67uBTSa+YUTCb+I5Wxw0/Zo5FEJLBggrGL:B5As+rWhihaTC6I5ioQQgrq
    MD5:F2E2D22B0E98FBC23587A56ADCE982AF
    SHA1:1FA8497ADF38D95CE892F61251B3C45091C912BA
    SHA-256:71C65A792390B388BF7352C8D7477BC8889A806F50463F065267D4EAB7B8383A
    SHA-512:A03331CBD5603BBC7A8101388A9B542415555C0A9465161F7A98EAEE46EC7E192747FA08E96739A752AF00E43D813204DB9BF4CB1DA548FF336447FCDB8738CC
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>..<script language="javascript">. ..function do_load() {..window.status=' ';..window.close();..}.function do_unload() {.}.function info(str) {..window.status = str;.}.// -->.</script>..</head>.<body onLoad="do_load();" onUnload="do_unload();">..${LANG_SERVEND}.&nbsp;.<a href="javascript:window.close();">.${LANG_CANCLSWND}..</a>..</body>..</html>...

    C:\Program Files\WinHTTrack\html\server\file.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text
    Category:dropped
    Size (bytes):4592
    Entropy (8bit):5.283164606680434
    Encrypted:false
    SSDEEP:96:QGkJuB2+fT+ygyY7kXuo8jyfekeyezMseyAkNyUs5sKj8ix8qVYePmVnfseyA5+A:QP2V+4fSTzMFwNTIUPfFJ+hq
    MD5:6110CE5ABD2B097CDC602DEB4AE78B95
    SHA1:C37FB4144AFA73E8E55148AD62E77AE459F80E4A
    SHA-256:B6890A8B6703DC362EE5F37A729DA5D6526E88EEA193830C47A3EC14B73BB86F
    SHA-512:6F7CA9D8DA2F130FBF3DCF37C90A2EDF6B9D540171A53C6B69F997D1C2289C2FA9701D89CB34C0C91E7F49E5A8C0FEBAB3AADF9F3B9A1E7AF5DA61637DA13863
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}...tabCtrl {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; bac

    C:\Program Files\WinHTTrack\html\server\finished.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):6067
    Entropy (8bit):5.393421080518081
    Encrypted:false
    SSDEEP:96:QGkJuu2+fT+ygyY7kXuo8jyfekeyezMNyTzcm4M8xFkJSjNyUs5sK+L8iQnskyVO:QPNV+4fSTzMN9kojNTIvgjS5FJ+hq
    MD5:B5E1F31F4DBE94282A9126E48FFD70A3
    SHA1:5936CCEEDC6B641F2F4338791B470C0ACEBC697A
    SHA-256:0447C2BE12FF7CEF779EE38B656BE98101C538FAB297C6E00E510EE1F4AD721A
    SHA-512:18BD5E6F3E57DC09809BD549405979178E2BCEEE0BEEF4F5062E8D70E92E18E9BC7370AD96ADF8068D8F0D3A69B3F78D80C2B2AA8FD81E7F98ED48B86058EA9F
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; background-color: #fff; color: #000; }.#siteNavigation a:active { text-decoration: no

    C:\Program Files\WinHTTrack\html\server\help.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text
    Category:dropped
    Size (bytes):5036
    Entropy (8bit):5.369779255944153
    Encrypted:false
    SSDEEP:96:QGkJuB2+fT+ygyY7kXuo8jyfekeyezMseyAkNyUs5sKj8ix8CMLblx4M8b/DjfsC:QP2V+4fSTzMFwNTImljuD7FJ+hq
    MD5:E07D4F0A6C0EEFCF3D6542542C41F6D6
    SHA1:415F9B111D9A5888CC1601D0F438E148E71AA891
    SHA-256:79842D047271192AE21F0A78EA7DF290773FA3CBCA47A0B21585B66EDA6A4E9D
    SHA-512:E419F8EBA0B37878BE4FD0DB21057236BDF50E1B1AFC1F6FF4A4BBACB01897DB048F6EE3751993D1ABF269DF294F7752627C29AD7F8D2787898E4C26CC9DA1A6
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}...tabCtrl {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; bac

    C:\Program Files\WinHTTrack\html\server\images\bg_rings.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 501 x 456
    Category:dropped
    Size (bytes):4235
    Entropy (8bit):7.944071402073359
    Encrypted:false
    SSDEEP:96:KqFHZj0KbQWaccNykXUzdSDJRXi3GIvl4M0MiiVQCve:KqVZj5bH0yGUcRy/q6QD
    MD5:89901B7113B4D2B7D1AC3AD5B59D297F
    SHA1:A7F90C09ECA9295C52260B2B6F3E04CED0BDE6D2
    SHA-256:184A19682D4439A94400329411B5CB4ACC5500CCD4E802A7E284F546894DCB9D
    SHA-512:96D310FC8E302F51D19194A28C2FBF2B5A1CB380B1E67EE23D32576155ABEE4CD9C9F9A608F4BF76FF70AC139DA38DC8BE7FFA2E39D490A7328C4FBC3ADA70B0
    Malicious:false
    Preview:GIF87a............................,........@......0.I..8...`(.di.h..l.p,.tm."!.C....pH,....8h....tJ..t..v..z..0.i-..hBO.n...](@...y=...BM;wz.O;M.m..........C.....X.....$...n....<s...Y..[.... ..b..(...C....6|].........g.\...........I.3........Kv).....:..q....F.......^?....a...|...3..\.q.{q.3...E... L.1.\K2.....)#..|.G...Z.QI3EL`3{.kG..K.bp..Gr...=..E...S.?K...u*./\I.T..l..r.z..N...Y.Z{.a,.......WR[.:...`fv..-.G........U...I.[.M`..7.%......6K.............?.fW.j....M/xo0...>..x...4....su.+...x.w.A..{.....<..DK._....-..g.;`:...........C.....Z.'.M..!...<a.!...C.S.`.Z\v.J ..V.%...}..8.a(....R.C..]..r.X.K..c.>.i$=....L.........<..9dP.%$V^...O.w.a[>..h.Y.4g..fmk^E.t..'qs.'.w..W.{B..)."d.}0B#.....F.h..Vj..R.!......fx.C...6......ZD..R....S@...ph.>(:.=...k.;".`..l...#.:,.6.b..K."...".{...`......Ut......!xgX....n9+.2.....f`!.......r...\Ip.....Sd....e..p.\.....q...F..q......(.R...v0.-......0qa.o.S9X..M.l..$.,....sd@. ..5.d].5.,W.e.,!.RH...n-}

    C:\Program Files\WinHTTrack\html\server\images\fade.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 89a, 8 x 8
    Category:dropped
    Size (bytes):53
    Entropy (8bit):4.204243331880868
    Encrypted:false
    SSDEEP:3:CNKPcC/xlHlLHVu45nSae:OyZO45nU
    MD5:8750A2C079D1DCB3D999F074FD06933B
    SHA1:18F0BA788553D1ECAF6CC23043E8577B51591140
    SHA-256:1E66F43615924C2C61411D5679D200512209E6710D5C55FFA38DB8838A382ED9
    SHA-512:99DD61D923080F0D929754995F922382194C6A5CA9CFDB4FEE7350816A2711ECC41BE23FE303370A483B3FC72D0935055D6FC9C7E4B8302BCC95811A76E44E8E
    Malicious:false
    Preview:GIF89a.......!.....!.......,.............p.....*...;

    C:\Program Files\WinHTTrack\html\server\images\header_title_4.gif (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 89a, 400 x 34
    Category:dropped
    Size (bytes):1986
    Entropy (8bit):7.832106548232159
    Encrypted:false
    SSDEEP:48:XD7LljQ9Cs7mlPRe28j18AkqFv1RO766kVzfJzrssiyejst7yHve:Xzlc9Cs7GPvQ1TkWVZ4xyGY+HG
    MD5:8E8BC9C63A59AC8BF23CC894C96E4405
    SHA1:BE6B7FACD7830EDD612499F971E2CC3B03681082
    SHA-256:0E2E5B02984BDD88B9ECDB4A03D017877793F768B4DE88169EC10AEA660B5F2E
    SHA-512:F3142CC72F68CDD353C852FB98F70E0778C76837AA726F973DB58F9AA05BB69285B9736A096BF2C1CB8AD59D9AC0FE0107B69C7E45ADEC43D76C16C8D5F60151
    Malicious:false
    Preview:GIF89a.."..........kk.??_...{{....++AUU....44Nvv.JJo..-``....!.......,......!.@....I..8...`%.$..h..l.p..Am..m..._MF..~..r.l:.).pJ..2.P#......ji.m..q..0....tA...{ -..}....5t.6....kW.b|.:,;.....z.......j<a_...:.R79B..Y ..b;..[......k6If?.+.5....q.......~......6.......)......o.x.5........b.......~.........p..&Q.!...0....2B*.8...;,^...H@...]S.Q....8/.6.......U...D.X.{cJ..Q.$...~><...R.?....M..X.j.'0`.....$.C...n....T....+R...2.&.r@@BM..%N..ha..;.F..V....=.>&A.....:.T....."..E.d..}%...+.:..c....P.Yc[.PY!]m..& ....\*.C`.9.....&.|...L..HlP..P.g.W..#..5.9...rA+xV.....:........v.Z.....T.Q.......{#.0`r.....U.$....0.4.Y`.|..#.D)8p....5."+EU.R....4=..Q@...SP.Ol.(.D....+v%..L9...Fv.`.TVi.UH^.e,.R../...d...S...5].E.6.Qq......}d..hM....<.g."...MKND.+...$.f..A.~,.CLq.b.D..a..q&`.=.j.h3..`.kh..%A....l.H8.I..t...0......?...I.B}..\..N.G...f..Gb...X..x.hQ|..Aj..T+F..%....z..n..W!..i.].B....N..=..B..H...M.~K......!.|.P..^..R.Pj.#...n.#O@i..fz-...c.=.4..En......m3.T6o..`2.. "D.~

    C:\Program Files\WinHTTrack\html\server\images\is-IOOIR.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 89a, 8 x 8
    Category:dropped
    Size (bytes):53
    Entropy (8bit):4.204243331880868
    Encrypted:false
    SSDEEP:3:CNKPcC/xlHlLHVu45nSae:OyZO45nU
    MD5:8750A2C079D1DCB3D999F074FD06933B
    SHA1:18F0BA788553D1ECAF6CC23043E8577B51591140
    SHA-256:1E66F43615924C2C61411D5679D200512209E6710D5C55FFA38DB8838A382ED9
    SHA-512:99DD61D923080F0D929754995F922382194C6A5CA9CFDB4FEE7350816A2711ECC41BE23FE303370A483B3FC72D0935055D6FC9C7E4B8302BCC95811A76E44E8E
    Malicious:false
    Preview:GIF89a.......!.....!.......,.............p.....*...;

    C:\Program Files\WinHTTrack\html\server\images\is-LUU1F.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 87a, 501 x 456
    Category:dropped
    Size (bytes):4235
    Entropy (8bit):7.944071402073359
    Encrypted:false
    SSDEEP:96:KqFHZj0KbQWaccNykXUzdSDJRXi3GIvl4M0MiiVQCve:KqVZj5bH0yGUcRy/q6QD
    MD5:89901B7113B4D2B7D1AC3AD5B59D297F
    SHA1:A7F90C09ECA9295C52260B2B6F3E04CED0BDE6D2
    SHA-256:184A19682D4439A94400329411B5CB4ACC5500CCD4E802A7E284F546894DCB9D
    SHA-512:96D310FC8E302F51D19194A28C2FBF2B5A1CB380B1E67EE23D32576155ABEE4CD9C9F9A608F4BF76FF70AC139DA38DC8BE7FFA2E39D490A7328C4FBC3ADA70B0
    Malicious:false
    Preview:GIF87a............................,........@......0.I..8...`(.di.h..l.p,.tm."!.C....pH,....8h....tJ..t..v..z..0.i-..hBO.n...](@...y=...BM;wz.O;M.m..........C.....X.....$...n....<s...Y..[.... ..b..(...C....6|].........g.\...........I.3........Kv).....:..q....F.......^?....a...|...3..\.q.{q.3...E... L.1.\K2.....)#..|.G...Z.QI3EL`3{.kG..K.bp..Gr...=..E...S.?K...u*./\I.T..l..r.z..N...Y.Z{.a,.......WR[.:...`fv..-.G........U...I.[.M`..7.%......6K.............?.fW.j....M/xo0...>..x...4....su.+...x.w.A..{.....<..DK._....-..g.;`:...........C.....Z.'.M..!...<a.!...C.S.`.Z\v.J ..V.%...}..8.a(....R.C..]..r.X.K..c.>.i$=....L.........<..9dP.%$V^...O.w.a[>..h.Y.4g..fmk^E.t..'qs.'.w..W.{B..)."d.}0B#.....F.h..Vj..R.!......fx.C...6......ZD..R....S@...ph.>(:.=...k.;".`..l...#.:,.6.b..K."...".{...`......Ut......!xgX....n9+.2.....f`!.......r...\Ip.....Sd....e..p.\.....q...F..q......(.R...v0.-......0qa.o.S9X..M.l..$.,....sd@. ..5.d].5.,W.e.,!.RH...n-}

    C:\Program Files\WinHTTrack\html\server\images\is-TDQVS.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:GIF image data, version 89a, 400 x 34
    Category:dropped
    Size (bytes):1986
    Entropy (8bit):7.832106548232159
    Encrypted:false
    SSDEEP:48:XD7LljQ9Cs7mlPRe28j18AkqFv1RO766kVzfJzrssiyejst7yHve:Xzlc9Cs7GPvQ1TkWVZ4xyGY+HG
    MD5:8E8BC9C63A59AC8BF23CC894C96E4405
    SHA1:BE6B7FACD7830EDD612499F971E2CC3B03681082
    SHA-256:0E2E5B02984BDD88B9ECDB4A03D017877793F768B4DE88169EC10AEA660B5F2E
    SHA-512:F3142CC72F68CDD353C852FB98F70E0778C76837AA726F973DB58F9AA05BB69285B9736A096BF2C1CB8AD59D9AC0FE0107B69C7E45ADEC43D76C16C8D5F60151
    Malicious:false
    Preview:GIF89a.."..........kk.??_...{{....++AUU....44Nvv.JJo..-``....!.......,......!.@....I..8...`%.$..h..l.p..Am..m..._MF..~..r.l:.).pJ..2.P#......ji.m..q..0....tA...{ -..}....5t.6....kW.b|.:,;.....z.......j<a_...:.R79B..Y ..b;..[......k6If?.+.5....q.......~......6.......)......o.x.5........b.......~.........p..&Q.!...0....2B*.8...;,^...H@...]S.Q....8/.6.......U...D.X.{cJ..Q.$...~><...R.?....M..X.j.'0`.....$.C...n....T....+R...2.&.r@@BM..%N..ha..;.F..V....=.>&A.....:.T....."..E.d..}%...+.:..c....P.Yc[.PY!]m..& ....\*.C`.9.....&.|...L..HlP..P.g.W..#..5.9...rA+xV.....:........v.Z.....T.Q.......{#.0`r.....U.$....0.4.Y`.|..#.D)8p....5."+EU.R....4=..Q@...SP.Ol.(.D....+v%..L9...Fv.`.TVi.UH^.e,.R../...d...S...5].E.6.Qq......}d..hM....<.g."...MKND.+...$.f..A.~,.CLq.b.D..a..q&`.=.j.h3..`.kh..%A....l.H8.I..t...0......?...I.B}..\..N.G...f..Gb...X..x.hQ|..Aj..T+F..%....z..n..W!..i.].B....N..=..B..H...M.~K......!.|.P..^..R.Pj.#...n.#O@i..fz-...c.=.4..En......m3.T6o..`2.. "D.~

    C:\Program Files\WinHTTrack\html\server\index.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text
    Category:dropped
    Size (bytes):5817
    Entropy (8bit):5.381278847212913
    Encrypted:false
    SSDEEP:96:5GkJuu2+fT+ygyY7kXuo8jyulUkeyezMNyTzcm4M8xFkJSjNyUs5sKj8iZxUBC89:5PNV+4ul0TzMN9kojNTI/87TKUb5FJ+A
    MD5:F860C4E3C7A283D6A329559179A2BE23
    SHA1:FC2220CA35765BDB52BD30BB7E0D2725CD238315
    SHA-256:9C904DC25235151BA0764BC32EE1C8DD42777C256FB1BF7F00FC912D102160B8
    SHA-512:77E0DB1FF4599F47CBE8947EB4B23ABC53EF8B97526C6CE9D0902E5F205EEEC3B520463617CD337309484158FE522C4AEDB57724E839D117AAF8E49B9674CA2E
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>HTTrack Website Copier - Offline Browser</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; background-color: #fff; color: #000; }.#siteNavigation a:active { text-decoration:

    C:\Program Files\WinHTTrack\html\server\is-6C1UG.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (302), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):8947
    Entropy (8bit):5.394665842009512
    Encrypted:false
    SSDEEP:192:QP2V+4LSTzMFwNTIfpXnncthQc1QdW23vHFJ+hq:vV+6GyaHQ3vn4q
    MD5:F950F319216D104F117058EE9AED3770
    SHA1:597EDCA74EB1935FF7403ECC57100C8333B70695
    SHA-256:90632437D7D7D64B092B9E6B2FCB169F04B1218428FF292CC44A1F0373C77058
    SHA-512:51A8A6D1723B9C04F199859FCE848F2D57148BE80EDF93AE0065EDA7BBBAB4697D06C818E3BAACF8A3A69CFFC77DB2825B2C268BFD9806D7F9EB3E7A7647378D
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}...tabCtrl {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; bac

    C:\Program Files\WinHTTrack\html\server\is-7JJPQ.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (302), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):9170
    Entropy (8bit):5.393685446634136
    Encrypted:false
    SSDEEP:192:QP2V+4LSTzMFwNTIK3nncthQc1Qz23vHFJ+hq:vV+6G4HQWvn4q
    MD5:EE5CFBB73AD0AE6E9B60F9918DB8354F
    SHA1:37D922CDAE679D8BB80131E6C70FACC4F1FBA504
    SHA-256:37B24DE575A4AC7203CE770D36B63682FE1900E85DEF512EF5769E7E714315B4
    SHA-512:127B0313F43C1C984A4B337322780FA4D35122DB178A3CF9DAA618A13D22939B74F4B68096D0B6A0B527163BA71941ABB43A719DB01E38A861F2B43B05D31064
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}...tabCtrl {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; bac

    C:\Program Files\WinHTTrack\html\server\is-7L8JU.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):5749
    Entropy (8bit):5.405005005709028
    Encrypted:false
    SSDEEP:96:QGkJuB2+fT+ygyY7kXuo8jyL5AkeyezMseyAkNyUs5sKj8i34M8on0P2l/h8g/QT:QP2V+4LiTzMFwNTIlP22VRuFJ+hq
    MD5:78D7BCBD184548D272E1247D12938132
    SHA1:0E8EC9484AF3557F27EDC1CF77346D6AE25D0A71
    SHA-256:857D646B7633435F3E572EA25FC105A705A166621A5F9E6F85D87FC67A335097
    SHA-512:EBEDDC601B0D09E2C50AE4DEFE92DE1BF65CDB4EE19C8555DFC8ABBF4B83154450DA40F659C236F3915F3637D5E7A18CDF66E9BEA78D2AC9FA997BC5011381C5
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}...tabCtrl {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; bac

    C:\Program Files\WinHTTrack\html\server\is-7QC5C.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text
    Category:dropped
    Size (bytes):4592
    Entropy (8bit):5.283164606680434
    Encrypted:false
    SSDEEP:96:QGkJuB2+fT+ygyY7kXuo8jyfekeyezMseyAkNyUs5sKj8ix8qVYePmVnfseyA5+A:QP2V+4fSTzMFwNTIUPfFJ+hq
    MD5:6110CE5ABD2B097CDC602DEB4AE78B95
    SHA1:C37FB4144AFA73E8E55148AD62E77AE459F80E4A
    SHA-256:B6890A8B6703DC362EE5F37A729DA5D6526E88EEA193830C47A3EC14B73BB86F
    SHA-512:6F7CA9D8DA2F130FBF3DCF37C90A2EDF6B9D540171A53C6B69F997D1C2289C2FA9701D89CB34C0C91E7F49E5A8C0FEBAB3AADF9F3B9A1E7AF5DA61637DA13863
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}...tabCtrl {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; bac

    C:\Program Files\WinHTTrack\html\server\is-8J0BM.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (302), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):9772
    Entropy (8bit):5.386086828053972
    Encrypted:false
    SSDEEP:192:QP2V+4LSTzMFwNTIzPfnncthQc1QZKLL23vHFJ+hq:vV+6G3HQf3vn4q
    MD5:4688A337FC372BEA7C0960433CACC1EB
    SHA1:D2C2A6C002F0E9459F0AB2936F7C45F5BA86D13A
    SHA-256:0F86EE3D0768086758256271DE08FD3D02658C58732368DC9AD0A7DFC2520049
    SHA-512:CF0939C8396937A9EF7AAB0D7797F9AEA14B02D910D9D09532AAB9934856E2D6D60345FAE3733D82B430B2E84AE7688EB0007A36E01729930B3D358C584DE3BE
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}...tabCtrl {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; bac

    C:\Program Files\WinHTTrack\html\server\is-AQ7IS.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text
    Category:dropped
    Size (bytes):5036
    Entropy (8bit):5.369779255944153
    Encrypted:false
    SSDEEP:96:QGkJuB2+fT+ygyY7kXuo8jyfekeyezMseyAkNyUs5sKj8ix8CMLblx4M8b/DjfsC:QP2V+4fSTzMFwNTImljuD7FJ+hq
    MD5:E07D4F0A6C0EEFCF3D6542542C41F6D6
    SHA1:415F9B111D9A5888CC1601D0F438E148E71AA891
    SHA-256:79842D047271192AE21F0A78EA7DF290773FA3CBCA47A0B21585B66EDA6A4E9D
    SHA-512:E419F8EBA0B37878BE4FD0DB21057236BDF50E1B1AFC1F6FF4A4BBACB01897DB048F6EE3751993D1ABF269DF294F7752627C29AD7F8D2787898E4C26CC9DA1A6
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}...tabCtrl {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; bac

    C:\Program Files\WinHTTrack\html\server\is-CS1NI.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (302), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):9747
    Entropy (8bit):5.40702503511706
    Encrypted:false
    SSDEEP:192:QP2V+4LSTzMFwNTIj/nncthQc1QA23vHFJ+hq:vV+6GPHQzvn4q
    MD5:CA10D17D2C9C4D4A4409BFA8C607D573
    SHA1:C333B5AF5F6E0DF0F664DD1CCF156EB6956E2E7E
    SHA-256:2C0B394C3527967AC2D6F7C0653346A41756F26F855D06803AF977C446C23E5B
    SHA-512:76C2A9FFB7834E78B773A2E65DC37B119C96BE14296DDEE9856D03B460226871A0AD12109FECE9F7B1DC96BC27E64B8DCECE95BD4CBE2D9053438F1DAB492DCB
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}...tabCtrl {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; bac

    C:\Program Files\WinHTTrack\html\server\is-D63RQ.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text
    Category:dropped
    Size (bytes):3904
    Entropy (8bit):5.294866883809983
    Encrypted:false
    SSDEEP:96:QGkJuu2+fT+ygyY7kXuo8jyfekeyezMseyAkNyUs5sKR3fseyA5+hq:QPNV+4fSTzMFwNTIDPFJ+hq
    MD5:DC9E1AD58BE0731D33A50F0A14DF7043
    SHA1:51BAF039B056FF71AB31BBAD8E473C4135AB8A67
    SHA-256:2AF5E0FBC588BB2E45D1230B80362B0793812BD58AFDDCA98A2E1492CE99B24E
    SHA-512:85644F27E9E47366E7529B04594536371BA109E4CF59E5B2DC695056C3F4B65D166AB9B2BC5B43DC6416C01C27DD625F0BA4A64FB7DEC5092A13B06AC3D7F801
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; background-color: #fff; color: #000; }.#siteNavigation a:active { text-decoration: no

    C:\Program Files\WinHTTrack\html\server\is-EOFRO.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text
    Category:dropped
    Size (bytes):8122
    Entropy (8bit):5.397696123708322
    Encrypted:false
    SSDEEP:192:QPNV+43allxTzMN9kojNTI8h73u5F9+hq:UV+eyl5Sjk4q
    MD5:A66BCAE4F870CE9AE3752C1A1D6207B8
    SHA1:DAA55668539CEC438734E038953A395C858C468D
    SHA-256:CC0F4784D80C36394CF3885F677787B9CC33241CD421AD1FF7E7FA7ACA342F1E
    SHA-512:9174D7D6576A00F7489DB1D193EE18300E3406E2B2D698C14FCA33574ADDA1943FCF1CE1051AC17F284108E42D457884964D6104394E28276B4B6D03B1A3848A
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; background-color: #fff; color: #000; }.#siteNavigation a:active { text-decoration: no

    C:\Program Files\WinHTTrack\html\server\is-FLDT2.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (345), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):11614
    Entropy (8bit):5.483516417785494
    Encrypted:false
    SSDEEP:192:gPNV+4o28QjJTzMN9kojNTIYfuWu/W4PSAWQ83Yksv4Wh0kzR5FJ+hq:kV+l28QjRODk4q
    MD5:DE99E4EDF048A6EF6EF927D712DF8158
    SHA1:CCCE0F25DDD49B47169ABACE838E4CC8468167E3
    SHA-256:4ED6E3BFC5CE94CE800D36ECFDEFED56CBC786DD3006D3BB1092F7AB345A011F
    SHA-512:E2F670878602218852584F3E0C873B690FB9D1BF8227867A77D6CFDB9567B2168C8E02A4486CC51F8B33CC31E890B3D075FE5074CEB997541CD58A54AE515790
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<META http-equiv="refresh" content="30; URL=finished.html">..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; background-color: #fff; c

    C:\Program Files\WinHTTrack\html\server\is-FOJB9.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (302), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):10095
    Entropy (8bit):5.402137579411384
    Encrypted:false
    SSDEEP:192:QP2V+4LSTzMFwNTIgPnncthQc1QEKKEI423vHFJ+hq:vV+6GWHQGKKEIdvn4q
    MD5:35AEF4FC1377BE0D41EE066245508392
    SHA1:AB7B2F2EE3698A8D2ACA79DDB262D5F0188633AF
    SHA-256:E5CD759AE7DED02D48448D4BBCD61A31B5857B267A95ECD9338AB61BC0703E97
    SHA-512:ED0932C9110A1C5E19B2B3EFF7D1D3FED5DCB65300B0F228D9BF90B6E0DD372CF37F8DDF91FE1F7C442C635F8DD60EB0F09441A1A10365944647D7A12FB59A9A
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}...tabCtrl {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; bac

    C:\Program Files\WinHTTrack\html\server\is-G0F9U.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (302), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):9225
    Entropy (8bit):5.397851198593292
    Encrypted:false
    SSDEEP:192:QP2V+4LSTzMFwNTIzRPnncthQc1Qrou23vHFJ+hq:vV+6GXHQgvn4q
    MD5:A26FBD1E4D7DB4BE3D773EB32F3F51E8
    SHA1:40AEC9A660DB740C539A8E650C4AC4FEEACB51A6
    SHA-256:0786AA65E67B307E66AF4AB86CD9A11F0FCBC23764B50BF88F0EA22D5DAF0C29
    SHA-512:B942550BE13197CAB7ACC723267E5CFB8A1FAE502CF292C0B94C753815D02E63DB5E21582E789F4D2E49F352F77402D139C27F4428744D715821789752214D90
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}...tabCtrl {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; bac

    C:\Program Files\WinHTTrack\html\server\is-G0RF7.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text
    Category:dropped
    Size (bytes):6758
    Entropy (8bit):5.385836519223747
    Encrypted:false
    SSDEEP:96:QGkJuu2+fT+ygyY7kXuo8jy3ttY91sekeyezMNyTzcm4M8xFkJSjNyUs5sKj8ieR:QPNV+4Y91sSTzMN9kojNTIlOAkF9+hq
    MD5:BECE9AD4D4788F93529FF925DBD61588
    SHA1:41A45DE69C90F47A87E6DA0FC0D1532701376D8E
    SHA-256:903621BE0CB394637732B51C74D7035BA14DD3B054C268733234626AA8EE1D0F
    SHA-512:E8D0FD981022F254B0AFCE2690E677DD34A8BD641E8DE8D44528E0A0A61655915A693D56A9AAA6693E6F382913CC5FC30428715BBF7F405C80E0C374693F9D95
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; background-color: #fff; color: #000; }.#siteNavigation a:active { text-decoration: no

    C:\Program Files\WinHTTrack\html\server\is-G4GB8.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):6067
    Entropy (8bit):5.393421080518081
    Encrypted:false
    SSDEEP:96:QGkJuu2+fT+ygyY7kXuo8jyfekeyezMNyTzcm4M8xFkJSjNyUs5sK+L8iQnskyVO:QPNV+4fSTzMN9kojNTIvgjS5FJ+hq
    MD5:B5E1F31F4DBE94282A9126E48FFD70A3
    SHA1:5936CCEEDC6B641F2F4338791B470C0ACEBC697A
    SHA-256:0447C2BE12FF7CEF779EE38B656BE98101C538FAB297C6E00E510EE1F4AD721A
    SHA-512:18BD5E6F3E57DC09809BD549405979178E2BCEEE0BEEF4F5062E8D70E92E18E9BC7370AD96ADF8068D8F0D3A69B3F78D80C2B2AA8FD81E7F98ED48B86058EA9F
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; background-color: #fff; color: #000; }.#siteNavigation a:active { text-decoration: no

    C:\Program Files\WinHTTrack\html\server\is-GES95.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text
    Category:dropped
    Size (bytes):4329
    Entropy (8bit):5.312753047904929
    Encrypted:false
    SSDEEP:96:QGkJuB2+fT+ygyY7kXuo8jyfekeyezMseyAkNyUs5sKj8iUV8UJmfseyA5+hq:QP2V+4fSTzMFwNTIaUFJ+hq
    MD5:00CFBAD9BF4ACFC6122B43467BC3E64B
    SHA1:E78A1DEC930A38C8FDC1BA401B7B3C248915DEC6
    SHA-256:0DC90EF24295AF2526CE40D807D85477178AB1017D1CF99060C3ED6F8371E37C
    SHA-512:EA382DE24FBF9AAE485F3B04F759A2B0A7AA3C72FA15CC414E8200249B1DEB33EFDC1A711BAF5406C54F497AAA270CB77FD4FF53F732796FE03CFE4820920AD1
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}...tabCtrl {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; bac

    C:\Program Files\WinHTTrack\html\server\is-HKL4A.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (302), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):10673
    Entropy (8bit):5.411575700902384
    Encrypted:false
    SSDEEP:192:QP2V+4LSTzMFwNTI/PnncthQc1QzJfm23vAFJ+hq:vV+6GzHQXfXvs4q
    MD5:85A4DEFAEC245027C575D0B6A33B9F4B
    SHA1:B2D65DDC108CB61DA4DEF172E0EE27E796643C25
    SHA-256:013089EF8002643E3332840D1883FCE28892182D4F1D9D41F4E7544C0CC89E74
    SHA-512:D04F29BF03AA09A8127DFF4D097F21B901A4479374E69710797A6979791C5AFCCBE1F8EAF6594A4B31D296B90E39A601D6E13DEB24D87441FF9D699AD9C5667A
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}...tabCtrl {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; bac

    C:\Program Files\WinHTTrack\html\server\is-IT7Q5.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (302), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):10623
    Entropy (8bit):5.415748805161305
    Encrypted:false
    SSDEEP:192:QP2V+4ivTzMFwNTIWfnncthQc1QCK/gL2396FJ+hq:vV+ZvEHQL9O4q
    MD5:88385D16E3834B3455253E60A815965E
    SHA1:DA5AC4BB0F208D12062CD48C510DADFEDE3C0D90
    SHA-256:CDA7D7DB0AEF14D798DEEA416F32E25787FC174E0DAE17F1C2049D1974F2D305
    SHA-512:CFE867E42CE242E1BC7744A45F78E3D7B61809AE5254EA5348FD77CE752FCA91BD34A9C5A2141DCA201A2D086F60E376F0D4E7D3E1BF2EF360CC4EA6DE5838A7
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}...tabCtrl {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; bac

    C:\Program Files\WinHTTrack\html\server\is-M8FCA.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text
    Category:dropped
    Size (bytes):5817
    Entropy (8bit):5.381278847212913
    Encrypted:false
    SSDEEP:96:5GkJuu2+fT+ygyY7kXuo8jyulUkeyezMNyTzcm4M8xFkJSjNyUs5sKj8iZxUBC89:5PNV+4ul0TzMN9kojNTI/87TKUb5FJ+A
    MD5:F860C4E3C7A283D6A329559179A2BE23
    SHA1:FC2220CA35765BDB52BD30BB7E0D2725CD238315
    SHA-256:9C904DC25235151BA0764BC32EE1C8DD42777C256FB1BF7F00FC912D102160B8
    SHA-512:77E0DB1FF4599F47CBE8947EB4B23ABC53EF8B97526C6CE9D0902E5F205EEEC3B520463617CD337309484158FE522C4AEDB57724E839D117AAF8E49B9674CA2E
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>HTTrack Website Copier - Offline Browser</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; background-color: #fff; color: #000; }.#siteNavigation a:active { text-decoration:

    C:\Program Files\WinHTTrack\html\server\is-MROK4.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (302), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):10142
    Entropy (8bit):5.41785358323598
    Encrypted:false
    SSDEEP:192:QP2V+4LSTzMFwNTIEPnncthQc1QFBg23vHFJ+hq:vV+6GqHQrBFvn4q
    MD5:36DF656695DA7208EA9A2E1998A4CA38
    SHA1:6B0F631E73F25027273534366C80841066EBB3B1
    SHA-256:5091E20EF65ADA3632262544217050521F930184BD53E5F2FF0E1442229F47D3
    SHA-512:9E42F319BB67083F7ECD84079050DAFE79A111225F424C3E5D78D3FE64F5FE061C45029B1180B6C768031DF173BDB47D341865BBD3A95BFA4ABAC0AEB9CB5C0E
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}...tabCtrl {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; bac

    C:\Program Files\WinHTTrack\html\server\is-P2GKL.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):11479
    Entropy (8bit):5.445686781146878
    Encrypted:false
    SSDEEP:192:QPNV+41leTzMN9kojNTIWFgHqKKAIP1J3bNl9Ac24slqbMP9ckZRN+mu5FJ+hq:UV+yCNqKo3BAH4fbim6tw4q
    MD5:8BEE8451F028D2AF2838429F8883BC2E
    SHA1:49923CCDA8C4612F1B18C8E1B0320265963FB639
    SHA-256:44BED6B128565A259C1505B514CF95784BC8D0A37D6D53A7DE93AFBF39B83F4F
    SHA-512:7A4149AF520983EB2F7B9C3BA0BFC2BB2F70D91CA0E3A1367F9898E1C1CD7041E59F2A55E0FFC7FA094006E8D5C6DAF5B0FA18D0B31FFD9B3260629AF41D9582
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; background-color: #fff; color: #000; }.#siteNavigation a:active { text-decoration: no

    C:\Program Files\WinHTTrack\html\server\is-QFK21.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):676
    Entropy (8bit):5.5253540890729145
    Encrypted:false
    SSDEEP:12:B5I76QclfRh2pXE2dkGr67uBTSa+YUTCb+I5Wxw0/Zo5FEJLBggrGL:B5As+rWhihaTC6I5ioQQgrq
    MD5:F2E2D22B0E98FBC23587A56ADCE982AF
    SHA1:1FA8497ADF38D95CE892F61251B3C45091C912BA
    SHA-256:71C65A792390B388BF7352C8D7477BC8889A806F50463F065267D4EAB7B8383A
    SHA-512:A03331CBD5603BBC7A8101388A9B542415555C0A9465161F7A98EAEE46EC7E192747FA08E96739A752AF00E43D813204DB9BF4CB1DA548FF336447FCDB8738CC
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>..<script language="javascript">. ..function do_load() {..window.status=' ';..window.close();..}.function do_unload() {.}.function info(str) {..window.status = str;.}.// -->.</script>..</head>.<body onLoad="do_load();" onUnload="do_unload();">..${LANG_SERVEND}.&nbsp;.<a href="javascript:window.close();">.${LANG_CANCLSWND}..</a>..</body>..</html>...

    C:\Program Files\WinHTTrack\html\server\is-RIV24.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (302), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):10014
    Entropy (8bit):5.418117756155918
    Encrypted:false
    SSDEEP:192:QP2V+4LSTzMFwNTINPnncthQc1QwN1R23vHFJ+hq:vV+6GlHQkkvn4q
    MD5:0268227F3F72FA8B1ECBDDDDED9B4F87
    SHA1:22A9C4604EA06EEF559D35114C88E4DA0DE1E502
    SHA-256:AE0D53368612E90064BEC84A2539D70D1EEFAF32131E543A2F998B43455D1130
    SHA-512:316180532EF0B056DF30AF35F54B28B48000DDE895AC20D1FED66646D262DC5599A21EBF691E41414DFB2195E27A13084571AA3A6556D19DA4E4B0D32328D7F5
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}...tabCtrl {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; bac

    C:\Program Files\WinHTTrack\html\server\is-S8BTQ.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):10189
    Entropy (8bit):5.488650988602808
    Encrypted:false
    SSDEEP:192:QPNV+4tJVPvxceTzMN9kojNTIWON1AH+WF4Y55zB65FJ+hq:UV+sICt1U4YbBs4q
    MD5:0CB700FB4BE6337BBFD1EF01FC18A9E5
    SHA1:8664DC9B179A725E7058FA5E49389B8EDD56465C
    SHA-256:D66F2CC092C7F7DDEA2D1AD4B48851DAB892B14CFCDFC0D0863F517B33375568
    SHA-512:AB0539DA56B6E6FBCDC6B7879F476FB58B573470725630630A41F38C0976A707439DD0346C605FBC071E839E67462433D889C9D65462836D171550890F4661CF
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; background-color: #fff; color: #000; }.#siteNavigation a:active { text-decoration: no

    C:\Program Files\WinHTTrack\html\server\is-V947E.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (302), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):11706
    Entropy (8bit):5.3978849622291865
    Encrypted:false
    SSDEEP:192:QP2V+4LSTzMFwNTIzq/nncthQc1QF+b023vHFJ+hq:vV+6GSHQSbRvn4q
    MD5:D5DF878BDF5035B1FA54F2F07E7E7611
    SHA1:D0506620019F629349FF1ECD7D7F5FB2C298CE5F
    SHA-256:0B6076B0979DDDB5AE65D48DAD19BFC36360BDDAEBCE0D26731218F62762DA60
    SHA-512:8BD758952AFFEAE78D61D060A364D44DDE44FB9FFC70DE672F00B790A7B8E8F26678E65870C6FF318BDD1E386BBA31A66EDCC519808EF57FBAD439A2330F8107
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}...tabCtrl {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; bac

    C:\Program Files\WinHTTrack\html\server\option1.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (302), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):9772
    Entropy (8bit):5.386086828053972
    Encrypted:false
    SSDEEP:192:QP2V+4LSTzMFwNTIzPfnncthQc1QZKLL23vHFJ+hq:vV+6G3HQf3vn4q
    MD5:4688A337FC372BEA7C0960433CACC1EB
    SHA1:D2C2A6C002F0E9459F0AB2936F7C45F5BA86D13A
    SHA-256:0F86EE3D0768086758256271DE08FD3D02658C58732368DC9AD0A7DFC2520049
    SHA-512:CF0939C8396937A9EF7AAB0D7797F9AEA14B02D910D9D09532AAB9934856E2D6D60345FAE3733D82B430B2E84AE7688EB0007A36E01729930B3D358C584DE3BE
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}...tabCtrl {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; bac

    C:\Program Files\WinHTTrack\html\server\option10.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (302), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):9225
    Entropy (8bit):5.397851198593292
    Encrypted:false
    SSDEEP:192:QP2V+4LSTzMFwNTIzRPnncthQc1Qrou23vHFJ+hq:vV+6GXHQgvn4q
    MD5:A26FBD1E4D7DB4BE3D773EB32F3F51E8
    SHA1:40AEC9A660DB740C539A8E650C4AC4FEEACB51A6
    SHA-256:0786AA65E67B307E66AF4AB86CD9A11F0FCBC23764B50BF88F0EA22D5DAF0C29
    SHA-512:B942550BE13197CAB7ACC723267E5CFB8A1FAE502CF292C0B94C753815D02E63DB5E21582E789F4D2E49F352F77402D139C27F4428744D715821789752214D90
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}...tabCtrl {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; bac

    C:\Program Files\WinHTTrack\html\server\option11.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (302), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):11706
    Entropy (8bit):5.3978849622291865
    Encrypted:false
    SSDEEP:192:QP2V+4LSTzMFwNTIzq/nncthQc1QF+b023vHFJ+hq:vV+6GSHQSbRvn4q
    MD5:D5DF878BDF5035B1FA54F2F07E7E7611
    SHA1:D0506620019F629349FF1ECD7D7F5FB2C298CE5F
    SHA-256:0B6076B0979DDDB5AE65D48DAD19BFC36360BDDAEBCE0D26731218F62762DA60
    SHA-512:8BD758952AFFEAE78D61D060A364D44DDE44FB9FFC70DE672F00B790A7B8E8F26678E65870C6FF318BDD1E386BBA31A66EDCC519808EF57FBAD439A2330F8107
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}...tabCtrl {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; bac

    C:\Program Files\WinHTTrack\html\server\option2.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (302), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):10623
    Entropy (8bit):5.415748805161305
    Encrypted:false
    SSDEEP:192:QP2V+4ivTzMFwNTIWfnncthQc1QCK/gL2396FJ+hq:vV+ZvEHQL9O4q
    MD5:88385D16E3834B3455253E60A815965E
    SHA1:DA5AC4BB0F208D12062CD48C510DADFEDE3C0D90
    SHA-256:CDA7D7DB0AEF14D798DEEA416F32E25787FC174E0DAE17F1C2049D1974F2D305
    SHA-512:CFE867E42CE242E1BC7744A45F78E3D7B61809AE5254EA5348FD77CE752FCA91BD34A9C5A2141DCA201A2D086F60E376F0D4E7D3E1BF2EF360CC4EA6DE5838A7
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}...tabCtrl {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; bac

    C:\Program Files\WinHTTrack\html\server\option2b.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):5749
    Entropy (8bit):5.405005005709028
    Encrypted:false
    SSDEEP:96:QGkJuB2+fT+ygyY7kXuo8jyL5AkeyezMseyAkNyUs5sKj8i34M8on0P2l/h8g/QT:QP2V+4LiTzMFwNTIlP22VRuFJ+hq
    MD5:78D7BCBD184548D272E1247D12938132
    SHA1:0E8EC9484AF3557F27EDC1CF77346D6AE25D0A71
    SHA-256:857D646B7633435F3E572EA25FC105A705A166621A5F9E6F85D87FC67A335097
    SHA-512:EBEDDC601B0D09E2C50AE4DEFE92DE1BF65CDB4EE19C8555DFC8ABBF4B83154450DA40F659C236F3915F3637D5E7A18CDF66E9BEA78D2AC9FA997BC5011381C5
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}...tabCtrl {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; bac

    C:\Program Files\WinHTTrack\html\server\option3.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (302), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):10014
    Entropy (8bit):5.418117756155918
    Encrypted:false
    SSDEEP:192:QP2V+4LSTzMFwNTINPnncthQc1QwN1R23vHFJ+hq:vV+6GlHQkkvn4q
    MD5:0268227F3F72FA8B1ECBDDDDED9B4F87
    SHA1:22A9C4604EA06EEF559D35114C88E4DA0DE1E502
    SHA-256:AE0D53368612E90064BEC84A2539D70D1EEFAF32131E543A2F998B43455D1130
    SHA-512:316180532EF0B056DF30AF35F54B28B48000DDE895AC20D1FED66646D262DC5599A21EBF691E41414DFB2195E27A13084571AA3A6556D19DA4E4B0D32328D7F5
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}...tabCtrl {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; bac

    C:\Program Files\WinHTTrack\html\server\option4.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (302), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):10095
    Entropy (8bit):5.402137579411384
    Encrypted:false
    SSDEEP:192:QP2V+4LSTzMFwNTIgPnncthQc1QEKKEI423vHFJ+hq:vV+6GWHQGKKEIdvn4q
    MD5:35AEF4FC1377BE0D41EE066245508392
    SHA1:AB7B2F2EE3698A8D2ACA79DDB262D5F0188633AF
    SHA-256:E5CD759AE7DED02D48448D4BBCD61A31B5857B267A95ECD9338AB61BC0703E97
    SHA-512:ED0932C9110A1C5E19B2B3EFF7D1D3FED5DCB65300B0F228D9BF90B6E0DD372CF37F8DDF91FE1F7C442C635F8DD60EB0F09441A1A10365944647D7A12FB59A9A
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}...tabCtrl {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; bac

    C:\Program Files\WinHTTrack\html\server\option5.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (302), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):10673
    Entropy (8bit):5.411575700902384
    Encrypted:false
    SSDEEP:192:QP2V+4LSTzMFwNTI/PnncthQc1QzJfm23vAFJ+hq:vV+6GzHQXfXvs4q
    MD5:85A4DEFAEC245027C575D0B6A33B9F4B
    SHA1:B2D65DDC108CB61DA4DEF172E0EE27E796643C25
    SHA-256:013089EF8002643E3332840D1883FCE28892182D4F1D9D41F4E7544C0CC89E74
    SHA-512:D04F29BF03AA09A8127DFF4D097F21B901A4479374E69710797A6979791C5AFCCBE1F8EAF6594A4B31D296B90E39A601D6E13DEB24D87441FF9D699AD9C5667A
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}...tabCtrl {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; bac

    C:\Program Files\WinHTTrack\html\server\option6.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (302), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):9170
    Entropy (8bit):5.393685446634136
    Encrypted:false
    SSDEEP:192:QP2V+4LSTzMFwNTIK3nncthQc1Qz23vHFJ+hq:vV+6G4HQWvn4q
    MD5:EE5CFBB73AD0AE6E9B60F9918DB8354F
    SHA1:37D922CDAE679D8BB80131E6C70FACC4F1FBA504
    SHA-256:37B24DE575A4AC7203CE770D36B63682FE1900E85DEF512EF5769E7E714315B4
    SHA-512:127B0313F43C1C984A4B337322780FA4D35122DB178A3CF9DAA618A13D22939B74F4B68096D0B6A0B527163BA71941ABB43A719DB01E38A861F2B43B05D31064
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}...tabCtrl {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; bac

    C:\Program Files\WinHTTrack\html\server\option7.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (302), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):8947
    Entropy (8bit):5.394665842009512
    Encrypted:false
    SSDEEP:192:QP2V+4LSTzMFwNTIfpXnncthQc1QdW23vHFJ+hq:vV+6GyaHQ3vn4q
    MD5:F950F319216D104F117058EE9AED3770
    SHA1:597EDCA74EB1935FF7403ECC57100C8333B70695
    SHA-256:90632437D7D7D64B092B9E6B2FCB169F04B1218428FF292CC44A1F0373C77058
    SHA-512:51A8A6D1723B9C04F199859FCE848F2D57148BE80EDF93AE0065EDA7BBBAB4697D06C818E3BAACF8A3A69CFFC77DB2825B2C268BFD9806D7F9EB3E7A7647378D
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}...tabCtrl {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; bac

    C:\Program Files\WinHTTrack\html\server\option8.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (302), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):10142
    Entropy (8bit):5.41785358323598
    Encrypted:false
    SSDEEP:192:QP2V+4LSTzMFwNTIEPnncthQc1QFBg23vHFJ+hq:vV+6GqHQrBFvn4q
    MD5:36DF656695DA7208EA9A2E1998A4CA38
    SHA1:6B0F631E73F25027273534366C80841066EBB3B1
    SHA-256:5091E20EF65ADA3632262544217050521F930184BD53E5F2FF0E1442229F47D3
    SHA-512:9E42F319BB67083F7ECD84079050DAFE79A111225F424C3E5D78D3FE64F5FE061C45029B1180B6C768031DF173BDB47D341865BBD3A95BFA4ABAC0AEB9CB5C0E
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}...tabCtrl {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; bac

    C:\Program Files\WinHTTrack\html\server\option9.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (302), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):9747
    Entropy (8bit):5.40702503511706
    Encrypted:false
    SSDEEP:192:QP2V+4LSTzMFwNTIj/nncthQc1QA23vHFJ+hq:vV+6GPHQzvn4q
    MD5:CA10D17D2C9C4D4A4409BFA8C607D573
    SHA1:C333B5AF5F6E0DF0F664DD1CCF156EB6956E2E7E
    SHA-256:2C0B394C3527967AC2D6F7C0653346A41756F26F855D06803AF977C446C23E5B
    SHA-512:76C2A9FFB7834E78B773A2E65DC37B119C96BE14296DDEE9856D03B460226871A0AD12109FECE9F7B1DC96BC27E64B8DCECE95BD4CBE2D9053438F1DAB492DCB
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}...tabCtrl {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; bac

    C:\Program Files\WinHTTrack\html\server\refresh.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (345), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):11614
    Entropy (8bit):5.483516417785494
    Encrypted:false
    SSDEEP:192:gPNV+4o28QjJTzMN9kojNTIYfuWu/W4PSAWQ83Yksv4Wh0kzR5FJ+hq:kV+l28QjRODk4q
    MD5:DE99E4EDF048A6EF6EF927D712DF8158
    SHA1:CCCE0F25DDD49B47169ABACE838E4CC8468167E3
    SHA-256:4ED6E3BFC5CE94CE800D36ECFDEFED56CBC786DD3006D3BB1092F7AB345A011F
    SHA-512:E2F670878602218852584F3E0C873B690FB9D1BF8227867A77D6CFDB9567B2168C8E02A4486CC51F8B33CC31E890B3D075FE5074CEB997541CD58A54AE515790
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<META http-equiv="refresh" content="30; URL=finished.html">..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; background-color: #fff; c

    C:\Program Files\WinHTTrack\html\server\sfx\finished.wav (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 11025 Hz
    Category:dropped
    Size (bytes):29840
    Entropy (8bit):6.922509516527645
    Encrypted:false
    SSDEEP:768:E2oYpP9oW4oGXDAwMBnmUay1u6rKLgzgW0gNGaSEs:bP9oW4bqmU5wEUg4aSZ
    MD5:B1A2040335B778ED27E4B7ABE32DCD8C
    SHA1:D584EF98851C8DC99788C7C38BC9807A9D8A44D6
    SHA-256:007C6BE7DBEBDCAAEA8F98ECA3DBF6CDC17AE32E3E48AB0D8D78A0290374220F
    SHA-512:A3B66DF1BE9F0091ADE61E4C4A9FE2DB26D86A3F9384690EC63FBC3426D837A5C28A5DD65181E1E0E02E8513AAA4BBAD9204902919F0149C483DF92B2D2AFF93
    Malicious:false
    Preview:RIFF.t..WAVEfmt .........+..D.......datadt..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

    C:\Program Files\WinHTTrack\html\server\sfx\is-FP3GA.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 11025 Hz
    Category:dropped
    Size (bytes):29840
    Entropy (8bit):6.922509516527645
    Encrypted:false
    SSDEEP:768:E2oYpP9oW4oGXDAwMBnmUay1u6rKLgzgW0gNGaSEs:bP9oW4bqmU5wEUg4aSZ
    MD5:B1A2040335B778ED27E4B7ABE32DCD8C
    SHA1:D584EF98851C8DC99788C7C38BC9807A9D8A44D6
    SHA-256:007C6BE7DBEBDCAAEA8F98ECA3DBF6CDC17AE32E3E48AB0D8D78A0290374220F
    SHA-512:A3B66DF1BE9F0091ADE61E4C4A9FE2DB26D86A3F9384690EC63FBC3426D837A5C28A5DD65181E1E0E02E8513AAA4BBAD9204902919F0149C483DF92B2D2AFF93
    Malicious:false
    Preview:RIFF.t..WAVEfmt .........+..D.......datadt..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

    C:\Program Files\WinHTTrack\html\server\sfx\is-SI4EP.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 48000 Hz
    Category:dropped
    Size (bytes):44
    Entropy (8bit):3.526280481683625
    Encrypted:false
    SSDEEP:3:Ul/ykzb19LnR/ll:UA6PTRX
    MD5:5AB0578FD62CF62BC0E82CF4CCE9FA75
    SHA1:740A337516F7980D80AF5C22F7A342D0C824A53A
    SHA-256:4872B61C768DFF943F9E021453D816F06E35ADC8EDD88EF183301F03E31B94A5
    SHA-512:97CDCD9472B9425BDCF5643F91064AA707F980243C8E3960BAC77C66E23521A96ADA49186BC1F2DAC2DCB78F55E1A35A2280B3CD8FFF508D4DC05E0CFB697847
    Malicious:false
    Preview:RIFF$...WAVEfmt ....................data....

    C:\Program Files\WinHTTrack\html\server\sfx\silent.wav (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 48000 Hz
    Category:dropped
    Size (bytes):44
    Entropy (8bit):3.526280481683625
    Encrypted:false
    SSDEEP:3:Ul/ykzb19LnR/ll:UA6PTRX
    MD5:5AB0578FD62CF62BC0E82CF4CCE9FA75
    SHA1:740A337516F7980D80AF5C22F7A342D0C824A53A
    SHA-256:4872B61C768DFF943F9E021453D816F06E35ADC8EDD88EF183301F03E31B94A5
    SHA-512:97CDCD9472B9425BDCF5643F91064AA707F980243C8E3960BAC77C66E23521A96ADA49186BC1F2DAC2DCB78F55E1A35A2280B3CD8FFF508D4DC05E0CFB697847
    Malicious:false
    Preview:RIFF$...WAVEfmt ....................data....

    C:\Program Files\WinHTTrack\html\server\step2.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):10189
    Entropy (8bit):5.488650988602808
    Encrypted:false
    SSDEEP:192:QPNV+4tJVPvxceTzMN9kojNTIWON1AH+WF4Y55zB65FJ+hq:UV+sICt1U4YbBs4q
    MD5:0CB700FB4BE6337BBFD1EF01FC18A9E5
    SHA1:8664DC9B179A725E7058FA5E49389B8EDD56465C
    SHA-256:D66F2CC092C7F7DDEA2D1AD4B48851DAB892B14CFCDFC0D0863F517B33375568
    SHA-512:AB0539DA56B6E6FBCDC6B7879F476FB58B573470725630630A41F38C0976A707439DD0346C605FBC071E839E67462433D889C9D65462836D171550890F4661CF
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; background-color: #fff; color: #000; }.#siteNavigation a:active { text-decoration: no

    C:\Program Files\WinHTTrack\html\server\step3.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text
    Category:dropped
    Size (bytes):8122
    Entropy (8bit):5.397696123708322
    Encrypted:false
    SSDEEP:192:QPNV+43allxTzMN9kojNTI8h73u5F9+hq:UV+eyl5Sjk4q
    MD5:A66BCAE4F870CE9AE3752C1A1D6207B8
    SHA1:DAA55668539CEC438734E038953A395C858C468D
    SHA-256:CC0F4784D80C36394CF3885F677787B9CC33241CD421AD1FF7E7FA7ACA342F1E
    SHA-512:9174D7D6576A00F7489DB1D193EE18300E3406E2B2D698C14FCA33574ADDA1943FCF1CE1051AC17F284108E42D457884964D6104394E28276B4B6D03B1A3848A
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; background-color: #fff; color: #000; }.#siteNavigation a:active { text-decoration: no

    C:\Program Files\WinHTTrack\html\server\step4.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):11479
    Entropy (8bit):5.445686781146878
    Encrypted:false
    SSDEEP:192:QPNV+41leTzMN9kojNTIWFgHqKKAIP1J3bNl9Ac24slqbMP9ckZRN+mu5FJ+hq:UV+yCNqKo3BAH4fbim6tw4q
    MD5:8BEE8451F028D2AF2838429F8883BC2E
    SHA1:49923CCDA8C4612F1B18C8E1B0320265963FB639
    SHA-256:44BED6B128565A259C1505B514CF95784BC8D0A37D6D53A7DE93AFBF39B83F4F
    SHA-512:7A4149AF520983EB2F7B9C3BA0BFC2BB2F70D91CA0E3A1367F9898E1C1CD7041E59F2A55E0FFC7FA094006E8D5C6DAF5B0FA18D0B31FFD9B3260629AF41D9582
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="${LANGUAGE_ISO}">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=${LANGUAGE_CHARSET}" />..<meta name="description" content="${LANG_METADESC}" />..<meta name="keywords" content="${LANG_METAKEYW}" />..<title>'${projname}' - HTTrack Website Copier</title>...<style type="text/css">.. ..body {..margin: 0; padding: 0; margin-bottom: 15px; margin-top: 8px;..background: #77b;.}.body, td {..font: 14px "Trebuchet MS", Verdana, Arial, Helvetica, sans-serif;..}..#subTitle {..background: #000; color: #fff; padding: 4px; font-weight: bold; ..}..#siteNavigation a, #siteNavigation .current {..font-weight: bold; color: #448;..}.#siteNavigation a:link { text-decoration: none; }.#siteNavigation a:visited { text-decoration: none; }..#siteNavigation .current { background-color: #ccd; }..#siteNavigation a:hover { text-decoration: none; background-color: #fff; color: #000; }.#siteNavigation a:active { text-decoration: no

    C:\Program Files\WinHTTrack\html\shelldoc.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603), with CRLF, LF line terminators
    Category:dropped
    Size (bytes):5429
    Entropy (8bit):5.173404268702969
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKFNUdrlCLld:5ym/JPNV+4GTzMNINTIxACLlEF8ohq
    MD5:41D299BBD6A281D5E76B734DC89830AC
    SHA1:11664474B8DC15048DBAE6A2A390DADE973D9D5C
    SHA-256:AB8304407686B197522732B1AFE581D073999ABBCB79F7B2A2EE6DF3016A3A76
    SHA-512:2F24661276394775CEE79B761070FDBBD36FB3A0B9586246597C2F96AEEDC9C55512D2B61C8A1131304464DE26BB551A569C67DD2120403B3ED60FD3F9071621
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\start.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text
    Category:dropped
    Size (bytes):320
    Entropy (8bit):4.96105473424349
    Encrypted:false
    SSDEEP:6:qFBdMKx/Hp/Q6M8cxnEEdHcicd3JWdPxsaOxAWH3dAL/M8/UEHpKm4QL:oRx/C6M8cxnEy8icHUxsDGPZUIItQL
    MD5:043CB02AFA2B665479B36E7FBEBFFC0E
    SHA1:47C8187600F92ADCCF03955586036051759DD16E
    SHA-256:9EA2ADB4045018C1FA8AC388C341C7DD7AC3BC87698691F755C0F8DF477CF18A
    SHA-512:E30DAE65F202CC6C1518A3AC49E3FFE5F9D1028504F5E89747763C9D6BF0A8CA5556B46B25713F6C569C02B35C39C874FA6D6E2C4F879F8967AFF645AA840A2E
    Malicious:false
    Preview:<html>..<head>.<title>HTTrack documentation</title>.<script language="JavaScript">. .window.open("index.html","WinHTTrackHelp","toolbar=yes,location=no,directories=no,status=no,menubar=no,scrollbars=yes,resizable=yes");.document.close();.window.close();.// -->.</script>..<body>.HTTrack documentation.</body>.</html>.

    C:\Program Files\WinHTTrack\html\step.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):5040
    Entropy (8bit):5.156043009786556
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKF0L+m0aLfW:5ym/JPNV+4GTzMNINTIYL+mpF8ohq
    MD5:D98611EE816A732996CD8A12CFC9669C
    SHA1:A5E4CAA396E8AAD26209B925D826A525359A37AC
    SHA-256:2CA9AF35A5C1F5E788DF263D0C865657C36FCEF37869E2F17EDFA3F78805C3C4
    SHA-512:E745C8D2E8EABDAC3B6C6DFAC2DC626DD6172CCB35AB24C25A4F1A76E0C0A5F1CACA70FCED83F6F82039B143B1194E440AD397ADD80D85451DF2957F4793374F
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\step1.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):5701
    Entropy (8bit):5.116863383225489
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKFkuThDZ5e+:5ym/JPNV+4GTzMNINTIQuTVZiF8ohq
    MD5:52A1B01BF1E9D6DD2567BF7EE15A1678
    SHA1:6D107258BF2915F931097D644B00011D9DB0E301
    SHA-256:8548D05E99345C5C8CF09F025436F5FB37792967C7A6AF7ACE228FCC4B752412
    SHA-512:FCDC799AF3B41B04E86F32F441587DA847311C116A1FDCFC1A022B28B092131B495FA7B21A9D2E9BD5DD7BB88D073338D1F698EC07B98D4C59DD3041EA55B01F
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\step2.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):6881
    Entropy (8bit):5.087315019198017
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKFn8Nyw7S2l:5ym/JPNV+4GTzMNINTIDRz5F8ohq
    MD5:D29F1679E8493204CF78E871BB6A2968
    SHA1:1CFF7395CFCCB57A2090305C4C18D0BD9341F971
    SHA-256:CAE386AB3EB83C29734377EEBAD4B4DE39706560B92B983992616A47FA30A02F
    SHA-512:3B8FA0880048CE174B0766672C21BFF2C0D4B6C3B478B1FACA510CED46DF003B7D0EB10C592AB6D1836BCA4A6BBA35DC9A5A3DDB313BB03C42FB02FBB004F673
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\step3.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603), with CRLF line terminators
    Category:dropped
    Size (bytes):5976
    Entropy (8bit):5.156102956812129
    Encrypted:false
    SSDEEP:96:w8LRopoU/UvyGmiq+JdGn+6H+dvJcWX++kV8yzobCy6zryIry3sEs/BBO5vbZgji:fy5/Aq2sDXefCbzrzyXNv10E
    MD5:96C0964BF527C0996CB5CCF964074CDF
    SHA1:78E819826D8F1BBF11399BAAAA5D88916365268F
    SHA-256:4E5CD4698863CF25ED2086E62456BB070AAF78870204710913D3D6485820A51C
    SHA-512:45ED78B51BF86E46B0B9EF86F5E2FD622035128AE527C22AD1DA23DEE4DAD856A0192B47F684B8319C677237D0B6BE3A77054215ADDAD89E51B9F21DC4DDD2BC
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">....<head>...<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />...<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />...<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, as

    C:\Program Files\WinHTTrack\html\step4.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):5082
    Entropy (8bit):5.1378491179635795
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKFd+LfseyA8:5ym/JPNV+4GTzMNINTIcF8ohq
    MD5:13B398AEC04517877B083BF62FC25385
    SHA1:507A74627233C3D6A130D96F9C6A2D281F094446
    SHA-256:21266709503C15FFAE6497CDA0C808FFCAE11737B2A9996A71199E7D2ADF12F3
    SHA-512:35A495DFD247CBF6F0773FFD78D972B1F829A18A4CD521C591116AC6D29DB355ADC5311A363895B46C1A02DE9D70E6C6473985ACC104B22221F692B8B806FEC5
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\step5.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):4949
    Entropy (8bit):5.143754279515313
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKFqsepLfses:5ym/JPNV+4GTzMNINTI78F8ohq
    MD5:B0B75EB6851FD7DD7DA5FAAAADB130B7
    SHA1:52ABEDBB5AF1E5E0C6D14825EB80842486BD7921
    SHA-256:0E1554759910A13E663EA6395A483F01F11DBAFF4E4413F09611B45D8D88A305
    SHA-512:9EAF58EE8CC489BC37A09B61A16E0DA0B6E95ACB176DAF5386C2C340DC2EB8AD81089FD65B09B8FC1C096B9A36559D1178BFC529E46E223DBB3878BED2F185C9
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\step9.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):5774
    Entropy (8bit):5.3539583356646485
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKF9LPjFo71y:5ym/JPNV+4GTzMNINTIhL70F8ohq
    MD5:75A931EEB73C630CB5A7F8B26BC1CBAC
    SHA1:1C4B9FEBE199084D8EF324CA68F6C270B3A5C553
    SHA-256:4293E0F9181C36F2378CA06E7775CFCD5CAD50F0B05F9DB5DAEF4E60B4422C2E
    SHA-512:69FEF70288898DB0BEFE6549EB85489A28105B647D5BC46B80A57082818FB721193DC7D2C7F48A2A8B32B5333BD5265469D7C7618E15AB3D7067D1150D03D31C
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\step9_opt1.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):6009
    Entropy (8bit):5.087851881989229
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKFc3L1fJD5o:5ym/JPNV+4GTzMNINTI+Lv5tF8ohq
    MD5:74082C3E6A48A21F737E0F4B82DC1A3B
    SHA1:421BE006C9445E83309A2C487FEFF84468B15558
    SHA-256:DBB8099E16535C18427D0B67BF93B614A6B392E0861D978768BE114076370AB6
    SHA-512:064A151C84530C350B09214181C8727C0D24ACC0DA5348F9CD64DBD27124E46D4D9FC67A4AC84EC32D766D15B5C6469EFD7C7D693161A419A21A6DDC58D49566
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\step9_opt10.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):5989
    Entropy (8bit):5.102975863203544
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKFdLi90Pk7i:5ym/JPNV+4GTzMNINTIRLBPky4F8ohU
    MD5:BBCA457D37B7DF6FB2BDB2EF9AEF0364
    SHA1:DA6A7AFA664DF08BC5575B03A85030C9DC73792E
    SHA-256:E721CB45E7A3C58B8EBB8F49504E27A0EF7B64D6C1589C83448FE371C64A3922
    SHA-512:D79E2602AF98E1EC709006D5B827A31535C0A2AEB63B2DD4519AF646A89BF10C324E5349FB20EA50E86A21D09D189638A9405D43AF6078C71ED5BCB40E263045
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\step9_opt11.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):6785
    Entropy (8bit):5.140199862331452
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKFiLLEg27xv:5ym/JPNV+4GTzMNINTI2LwEZJCiF8ohq
    MD5:9EC9042498D911C03E00836630573CB7
    SHA1:4461059E3A18044A2C47AC0E53DD21D4FD28F919
    SHA-256:5664FB4E1DD919E4805A3D3FAAC9AA035979A9751D4D7622EB3DCD7D9DA5515E
    SHA-512:3064993184BBF4BC61156A169889236035D369EF85A29D65E7522444E7A4F904E3626B89ACFE4D5B6FBF504C69DED52AA6427075CB4CF6A3E4E241C77A90B4FE
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\step9_opt2.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):7922
    Entropy (8bit):5.039914813791609
    Encrypted:false
    SSDEEP:192:5ym/JPNV+4GTzMNINTIbLP5hxnncPF8ohq:l/fV+lilnnX+q
    MD5:35C51A20C4738A3F07F90B1633B6C204
    SHA1:FE5BC2F6FE3C3505AE270429795413C16E930DC3
    SHA-256:518D5F313C5C4194813C1F87418ACB24E46FE5956C2505EAE91CD3EF3308210B
    SHA-512:358EEB6E3EA1888E3591FF598A5BFAAB9E5CB0986D19F4A250CB2367D572256EDF46B0E71816F0E7888F656348BF9A885D82238B357FAA2DB0B29F900683AD18
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\step9_opt3.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):6090
    Entropy (8bit):5.07524061632939
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKF5AhLDxCGR:5ym/JPNV+4GTzMNINTI10LlC9WWWqF8l
    MD5:39C8C0F5A2B8EF1063A0164A7C4F5CF4
    SHA1:C60CE25D56B24F39B50627DED35A85B4FCEF54E1
    SHA-256:84497DC79554FB550D911483A579EE80406E7BD18615CBC14DC5DD56850AC2CE
    SHA-512:60D6AD3A32373DE6628928367825D215654E1EF1EB5F569B8EB9D9386BB4C4D24E784C5B9BD322C086CA57A40C8846C3A7E5DAED74624E5B447DE00E8A00BCE4
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\step9_opt4.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):7074
    Entropy (8bit):5.065540927502246
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKFxLwIdNDD7:5ym/JPNV+4GTzMNINTItL/9RWF8ohq
    MD5:6EB8F9B635438605256FDD415743D374
    SHA1:D51A11F60A0CDA408ACA03340578AEE4932B82F6
    SHA-256:4897CFF8FE61F0BC63031EB4ABDDC40FCE50EA85AF72AD0EBF721B34402DAB32
    SHA-512:E5E8DC845A8B1EB36A99BF20DBEE63008A859E398F891F423678B01986E4EFB3E7C06E87F775BB156895EF51A05129141764D6B6DF0DA956C84B8B4C1EAB1FAC
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\step9_opt5.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):6758
    Entropy (8bit):5.087172942162259
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKF/L3DUrlG9:5ym/JPNV+4GTzMNINTILLwemF8ohq
    MD5:ABCA405372E3AAF015BF05D1B201EEA4
    SHA1:BC72469310DF3CB1A4676D26DE2B45946DF37595
    SHA-256:23E13ED4A7ED57BC1B07838FBC61F2ECC15BE50D76587107A1129A2119B171B1
    SHA-512:DD43C76DA4046C28AD1343912B077EFDD95AF7C4D6C8C9953C6F85159F8669C1BB26B30DAD6C7121C66312E723E1FEB15FC83B852DDA9C298ADABC39AD75E1EA
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\step9_opt6.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):6524
    Entropy (8bit):5.098053272449948
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKF6LHQs7vEz:5ym/JPNV+4GTzMNINTIGLNEsTF8ohq
    MD5:93D91CC2FCBA281B630DB35153A02776
    SHA1:28014CF6FE07487E26885F27A68C7E59C904CBE5
    SHA-256:02BCF233877DBE43DB815A9D0A1E51BAA4651116E183DED8938BABBF49C3F0FC
    SHA-512:4071BEC821046A53DF45BCFBC2FAAEDE2B898C7141A0FEE18D138FF6B37FDE5DE1F9EC40EFB2889C8A8282BD5DD6F511BC099B648F2BD1DABD42F208F45719AA
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\step9_opt7.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):5801
    Entropy (8bit):5.126247365425569
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKFvLUoIHXvf:5ym/JPNV+4GTzMNINTIbLUbH/6F8ohq
    MD5:6F8C2CAA661EE18CEA5AB95ACCC04DA7
    SHA1:B97846B9BFC88BD3B0CDC1BF62801777CA325C01
    SHA-256:008A8DC73B2A6DC065BA20C47EF4DA2C3657248EC624D2BB2FDEC1BDDD6156BD
    SHA-512:77A365B84C3E1CA62A7A824582739F2C61DDE1F7E7F52812715CB65F20AD4C4226ECEC5728C8BD497C5798749C7C6AF482204D0CD9513EA2C32807371543457B
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\step9_opt8.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):6191
    Entropy (8bit):5.122083201033882
    Encrypted:false
    SSDEEP:192:5ym/JPNV+4GTzMNINTIiL5IziEdXF8ohq:l/fV+lPT+q
    MD5:1B8EA00279E61F3CF3D8978F5F4A7693
    SHA1:645A68AA035DCBA83378DD804CC7E93543AE9C8B
    SHA-256:6F8109C62EFFC6CC574594DA37874B7F3422FF3AE9C9A2514366574858FE8207
    SHA-512:039A87F5CD3FEFF237E310F34C61B90304E53B31E7DF5D249AF36360ADA52FD3758FC6230FDFFC64C3C154D6E932E3215510847C2E5253E5A19DCDA09E6950FA
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\html\step9_opt9.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603)
    Category:dropped
    Size (bytes):6590
    Entropy (8bit):5.052587812341036
    Encrypted:false
    SSDEEP:96:tfLRoioU/UvyGm/GkJuu2+fT+ygyY7kXuo8jy/eyezMNyAMNyUs5sKF8LQLcxdFE:5ym/JPNV+4GTzMNINTIALQLbqF8ohq
    MD5:86EAACDE54D528C06E5556DB64855477
    SHA1:0902C07F89CE3B83686CBE4C540ACF313741936B
    SHA-256:FF2E12949518EDC4789D41A9F65FED83A802C538DB9DD1CC7CD4BAEC55CFF7EA
    SHA-512:115D54453DFA831262D5415BFF1EC2294F7C38A3766FE7A67C84EE09BD4DE34BE543EB40363FF937089ADFE69C277F9E4BCED74FC69700E684E2D3BDFD21AF57
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />..<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />..<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\htsjava.dll (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
    Category:dropped
    Size (bytes):73800
    Entropy (8bit):6.164704991365051
    Encrypted:false
    SSDEEP:1536:2wJ15cl/+6yzQ4z29HNd940k34+fEkSymVwBd6bbsMrfsC5Ehskf:2wJ15s/nyzX27kB4+fEbV2IbbsMrfsCS
    MD5:AB3D8C6BCB32EDEB1B650F62CB26F38F
    SHA1:36B3DF21002D418DE1CF9468E4F33C7FAE108A0D
    SHA-256:11C593FC3B67EA68D6402D507708A4964D914D04D5599F90A38F826B8FBF19B9
    SHA-512:4D94DDA1DBFDE694C44F6DEEDB3A23A0791F5AC429A4D0F19BEA5B71C91CA7F3EBD3764168C76511D7CF65617DDB77BEBC07F4F0B88DB117998C2AAECCD1DA3B
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 0%
    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C...-I..-I..-IZ..I..-I.I..-I.I..-I.I..-I.6VI..-I..,I..-I.I..-I.I..-I.I..-IRich..-I........PE..d..... Y.........." .........R.......2.......................................p.......1..............................................0...G.......<....P.......@..........H....`.......................................................................................text...}........................... ..`.rdata..w'.......(..................@..@.data...X9..........................@....pdata.......@......................@..@.rsrc........P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................

    C:\Program Files\WinHTTrack\htsswf.dll (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
    Category:dropped
    Size (bytes):207944
    Entropy (8bit):6.366241518925159
    Encrypted:false
    SSDEEP:3072:+aeZoRO5RRlyrZmR81EjKw48BNkEXflcE8s65NoV7yU7r5ANFmJuS:+a9klylajKwfB6WfuE89NMvuNI
    MD5:B9BEA3AB41F56CCBACCB83EA588B4534
    SHA1:5191A3887BA80FAB9958EF545ABFAE9F81058AA2
    SHA-256:5CEB9BAA1256051BE9D7D6D46EA3A7E238B88D2E9D64F978CA74192CC99E5891
    SHA-512:CFEDF991228C89E6D48B5F52375C7C2ED2B4648CC11193F5084F2ED5C22CEB9DF8C36FF7D321A764DEDF5B85BB7AD151701489AD8BB38064E6CC67F62CD539B6
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 0%
    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............Q..Q..Q..4Q..Q.."Q..Q.".Q..Q..$Q..Q..Q..Q..3Q..Q..%Q..Q..&Q..QRich..Q................PE..d..... Y.........." .....J..........H........................................p..........................................................F.......P....P....... ..$$......H....`..T...`c...............................................`...............................text....H.......J.................. ..`.rdata.......`.......N..............@..@.data....8..........................@....pdata..$$... ...&..................@..@.rsrc........P......................@..@.reloc..0....`......................@..B........................................................................................................................................................................................................................................................................

    C:\Program Files\WinHTTrack\httrack-doc.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):190
    Entropy (8bit):4.987627012501287
    Encrypted:false
    SSDEEP:3:qVowBSGBJeKGQIeBMKRMBECxNq2XRPaQKLd5Qby0NhtoAcMBDqDgKd5Qb3sBMKEz:qKGWSIHHq2XRPaQMOrh0Mr8OZNHXfGu
    MD5:859069099CB1644DE2ABC70362F360FA
    SHA1:C69D6900F6C2791FE6FA6637B972F0D096E7A120
    SHA-256:851B6818879073187301101A5FFF17735DA88F04CEEAEF1B1C0E325D3C67BEBC
    SHA-512:7388F34BEBA259BF44672B5733C11C57682D47A6175D20E50013C4E96E3CB87A43937ACC0B8906A9817D553952896CD1334DD29932E7221242273391CDB18612
    Malicious:false
    Preview:<html>....<head>..<title>Documentation</title>..<meta HTTP-EQUIV="Refresh" CONTENT="0; URL=html/index.html">..</head>..<body>..<a HREF="html/index.html">Documentation</a>..</body>..</html>..

    C:\Program Files\WinHTTrack\httrack.exe (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:PE32+ executable (console) x86-64, for MS Windows
    Category:dropped
    Size (bytes):27136
    Entropy (8bit):5.708116978006823
    Encrypted:false
    SSDEEP:384:091dc8qZHvw1yMT3SexXRkhKNIBAuXGo7cf99PCIqSyx4R8xV7+9lCCaEAcOf53g:y1dc8w4QMTBxXe/Bu9PCrR6R8nGO52rx
    MD5:2668CB3BE97FA21EC397ACB359758CDD
    SHA1:DF80027D1B728D8A1E15A12ED0AACC4A254AE326
    SHA-256:8EEA328AC9D0A22F08FFD58AA173C04C404D94212A0FF0AD214F20D8817F01B0
    SHA-512:591A9E3AE0176274D7BADFA2182B70D472105CED262211FC12A5D297333387D7D52C454570DEACE017542E32E3E0A8E0349EED6633696E553E44D786FBC51BFB
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 0%
    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.t.r...r...r......s...{...p...{...p...{...v...U.a.w...r...4...{...`...{...s...Richr...................PE..d..... Y..........#......B...$.......J.........@....................................tP......................................................0r..d....................................b...............................................`..P............................text....@.......B.................. ..`.rdata..4....`.......F..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@................................................................................................................................................................................................................................................................................................................

    C:\Program Files\WinHTTrack\install (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):747
    Entropy (8bit):4.838060868880873
    Encrypted:false
    SSDEEP:12:3sqWhyr9XH9963D1qWpXoHd3DZA8F0WppXN7CAhg/3ChwL9y2XEr30bGOGRy2XEx:85E9XiIWpcZF0W3XNeAy3COL9y2XE7Ep
    MD5:C686C994751EAA55D6F839421AF8A7B7
    SHA1:5D48914BEDDFC3783E4AE68256617CA29F530C80
    SHA-256:80CCF44991CC48ECE0D2541F98CE08A498ACCD025462E99396172FF39A462746
    SHA-512:9AEEC35549035EB5659D51BF69A1C17559C93B71081891351D7F99C844F47B31AE3DB39E3FFBE348AF5FC6BDE4AEF24AACC206A55785FA7B204B8A0D6E3D28F6
    Malicious:false
    Preview:HTTrack Website Copier, Offline Browser for Windows and Unix..Copyright (C) Xavier Roche and other contributors......Quick install (Linux/Unix): ..---------------------------...../configure..make..make install....you can also use something like:.../configure --prefix=/usr/local && make && make install......Quick install (Windows): ..------------------------....* How to install (Windows with installshield) :.. extract all files from the ZIP file and launch 'setup.exe'.. after installing, launch WinHTTrack.exe....* How to install (Windows without installshield) :.. unzip all files in an empty folder.. launch WinHTTrack.exe......See other readme and doc files for more information!....Have fun with HTTrack Website Copier!..The authors...

    C:\Program Files\WinHTTrack\is-0M32E.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):747
    Entropy (8bit):4.838060868880873
    Encrypted:false
    SSDEEP:12:3sqWhyr9XH9963D1qWpXoHd3DZA8F0WppXN7CAhg/3ChwL9y2XEr30bGOGRy2XEx:85E9XiIWpcZF0W3XNeAy3COL9y2XE7Ep
    MD5:C686C994751EAA55D6F839421AF8A7B7
    SHA1:5D48914BEDDFC3783E4AE68256617CA29F530C80
    SHA-256:80CCF44991CC48ECE0D2541F98CE08A498ACCD025462E99396172FF39A462746
    SHA-512:9AEEC35549035EB5659D51BF69A1C17559C93B71081891351D7F99C844F47B31AE3DB39E3FFBE348AF5FC6BDE4AEF24AACC206A55785FA7B204B8A0D6E3D28F6
    Malicious:false
    Preview:HTTrack Website Copier, Offline Browser for Windows and Unix..Copyright (C) Xavier Roche and other contributors......Quick install (Linux/Unix): ..---------------------------...../configure..make..make install....you can also use something like:.../configure --prefix=/usr/local && make && make install......Quick install (Windows): ..------------------------....* How to install (Windows with installshield) :.. extract all files from the ZIP file and launch 'setup.exe'.. after installing, launch WinHTTrack.exe....* How to install (Windows without installshield) :.. unzip all files in an empty folder.. launch WinHTTrack.exe......See other readme and doc files for more information!....Have fun with HTTrack Website Copier!..The authors...

    C:\Program Files\WinHTTrack\is-1B14P.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
    Category:dropped
    Size (bytes):3681
    Entropy (8bit):4.91086945664726
    Encrypted:false
    SSDEEP:96:Lk08iZKCbRV6GaedI5G88jIBRm3Z3GhmEk4RGYSqB7fUo:LPKCbxa6I5GpUBRm3Z3xqSILj
    MD5:DA381B4B0BFF110C5654C77721F5D282
    SHA1:45E0596071DD281171168DADB632ECB6000BA8F8
    SHA-256:DB6FBC85BE077AEF218D1688BFAD1D9022B799FC053B32AD063AE60A739F2CFF
    SHA-512:F1404063991E9B8BE4F1B213DFBCBD5CB497AA1CB243C893AE58B5A92073AAAD3B8B88B90373DA5F81D4226F8AF113894F60A1EBE8235EF7FF5D9F5226AA5C1B
    Malicious:false
    Preview:.Informations on this project:....This project has been developed by:..Xavier Roche (xroche at httrack.com).. project leader.. core engine, Windows/Linux GUI..Yann Philippot (yphilippot at lemel.fr).. for the java binary .class parser....With the help of:..Leto Kauler (molotov at tasmail.com).. for the site/logos design.. http://kauler.com/..Christian Marillat (marillat.christian at wanadoo.fr).. for autoconf compliance and .deb package..Fred Cohen (fc at all.net).. for HTTrack user's guide.. http://all.net/....And the help of the following third party developers:..Nicolas Benoit (nbenoit at tuxfamily.org), SDP Multimedia and Major MMS.. for the mms plugin core routines (MMSRIP).. http://nbenoit.tuxfamily.org/..Jean-loup Gailly from gzip.org.. for the help provided with Zlib.. http://www.zlib.net/..Eric A. Young (eay at cryptsoft.com).. for SSL cryptographic material (OpenSSL).. http://www.openssl.org/..Jordan Russell.. for the Windows setup tool (Inno Setup).. http:/

    C:\Program Files\WinHTTrack\is-27IFU.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (2003), with CRLF line terminators
    Category:dropped
    Size (bytes):2356
    Entropy (8bit):5.364713684629331
    Encrypted:false
    SSDEEP:48:3SlK+1gbm09kkK5jMzgwBoP09kkKqzxu09kkKezl309kkK1AFzY:CltFXkAIMw6XkX0XkXp3XkbF8
    MD5:FB7000534D403608EBC2DF6321E3A89B
    SHA1:8929595B79DD8F0C452A7BAC17C21343B3D89F1C
    SHA-256:186ADFA33201DF5A23B2ADD63B5F54B667BA64DD2802925650600F69ABC3A84C
    SHA-512:4C3B5851CE365D166694513E0C9D6906EA16E578EE90A951FB1A1841B949F655E9BD84F4C93DAD7917BB1FB177611A608F94E5C5C2410AF6C409260289810E37
    Malicious:false
    Preview:.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC90.MFC" version="9.0.21022.8" processorArchitecture="amd64" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="mfc90.dll" hashalg="SHA1" hash="1c1e72f1f8d28681a86e901ddc41d492396f9bed"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>rkU3K0zhnHc9Yn+d+Cn8FnAv6EA=</dsig:DigestValue></asmv2:hash></file> <file name="mfc90u.dll" hashalg="SHA1" hash="bffa184672fbcbff765794e7093f261ce7805ae9"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig=

    C:\Program Files\WinHTTrack\is-2D1ET.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
    Category:dropped
    Size (bytes):763392
    Entropy (8bit):6.468360677194401
    Encrypted:false
    SSDEEP:12288:41CtaoPETgXcRufekHHXCg13wVqOaR5bC0vCd0LCFDYlYpTuN:XtaosgXcRufNSg1pOF02wYpy
    MD5:2929F0ED54071CCD72EDEC565E6DB0C7
    SHA1:4E650F285F47CD6267DB33AE304C7D01E2A77D19
    SHA-256:3AEFE2B0DCEECAA2A865AB9B30095B23BAA9C817B75147561500DC45E13DCAD0
    SHA-512:909A7967CB0CF97D978F1E103FAF68071DEAD14661D439E4A21F1EEC568FA7351D326EF0C37C4AA41851C211A9493DFC6B1DAEFBCBAD8BDCA1FFC8D1E85C5E2B
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 0%
    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........M..b#..b#..b#.n-...b#......b#......b#......b#...X..b#..b"..b#......b#......b#......b#.Rich.b#.................PE..d..... Y.........." ................\...............................................................................................)......D................... :......................................................................`............................text............................... ..`.rdata...j.......l..................@..@.data...0:...@...*...(..............@....pdata.. :.......<...R..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

    C:\Program Files\WinHTTrack\is-4BTMC.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
    Category:dropped
    Size (bytes):1671160
    Entropy (8bit):6.040721295924078
    Encrypted:false
    SSDEEP:49152:1/DtPxTK+ZnGfnpYuLupNdadHuDg2QhZg5mPwkn9n83dyMCwb7L6QXBiZj2KOYSf:1/DDNnGfnzS
    MD5:60B030677185841817FA38BDA0DA6473
    SHA1:AE45372B4CE19C773D627F9DF829FC16702FE840
    SHA-256:2A527EEF7D5CBC295E5B3CEEF5C5E1C34BF9FBA51335102B44D73B67F5DBBE86
    SHA-512:CE1A560E372E2E35E092A7C6F823CACE40D38A96246A27E5025172D418164471B0CBA0319C8E83A6FF4D693F9D9250CC9D279154ACF0AE9D5F9A81CC2C4F9BF0
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 0%
    Joe Sandbox View:
    • Filename: bjYuQcovwE.exe, Detection: malicious, Browse
    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q...5.5.5..&-.4..&..%.+.?.7...:.4.+./.(.+.(.=..&.<.5.U.+.9.1.+.&...+.>.4.+.8.4.+.=.4.Rich5.........PE..d....K1G.........." ..........................mx..........................................@..........................................K...`..H...x.......x....`..P3...\...#...P..lr..0(......................................................p........................text............................... ..`.rdata..............................@..@.data...........`..................@....pdata..P3...`...4..................@..@.rsrc...x............(..............@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

    C:\Program Files\WinHTTrack\is-4VIBD.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Intel 80386 COFF object file, not stripped, 2 sections, symbol offset=0xc18, 78 symbols, created Sat May 20 08:50:02 2017, 1st section name ".edata"
    Category:dropped
    Size (bytes):5189
    Entropy (8bit):4.233136455639894
    Encrypted:false
    SSDEEP:96:aAxgGKnaDAn9KAsmLb4fyMOdMxuYIeaQz8G4yFjrddjWNGesBuIv6fdQBHMqB4Ax:aAmGKnaEYyMOmBdaDLXI1
    MD5:F8EE798B1D36AB6C3068BFC7CB14F372
    SHA1:27D60F1E0D94D3F21C5074AE4E72D51A3E686515
    SHA-256:3DBA02F0A6BD8DAAB43CFE509EA558DFDD3CF3B3992B78552C5B3F2DE6EB5AD9
    SHA-512:90FED658A8C969E83B35B967F37FC810882B9D9F8BC23E6760AAC7E82D37FC228B8432893F9B4FC15E50EF7190D7FFA7143393A406A314857CBEBCD5D25FB095
    Malicious:false
    Preview:L...:. Y....N........edata..........(...d...........L...@..@.debug$S............................@..B....:. Y............$...$............................................................................................................................................................................................................................................................................................................................................................................... .!.".#.webhttrack.exe.coucal_add.coucal_add_pvoid.coucal_calc_hashes.coucal_created.coucal_dec.coucal_delete.coucal_enum_new.coucal_enum_next.coucal_exists.coucal_fetch_value.coucal_fetch_value_hashes.coucal_get_intptr.coucal_get_name.coucal_get_pvoid.coucal_hash_data.coucal_hash_size.coucal_hash_string.coucal_inc.coucal_memory_size.coucal_new.coucal_nitems.coucal_read.coucal_read_pvoid.coucal_read_value.coucal_readptr.coucal_remove.coucal_set_assert_handler.coucal_set_global_assert_handler.coucal_set_

    C:\Program Files\WinHTTrack\is-6ARK1.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Intel 80386 COFF object file, not stripped, 2 sections, symbol offset=0xc1e, 78 symbols, created Sat May 20 08:49:45 2017, 1st section name ".edata"
    Category:dropped
    Size (bytes):5195
    Entropy (8bit):4.237970051993339
    Encrypted:false
    SSDEEP:96:qqxgGKnaDAlbKy8mLb4fyMOdMxuYIeaQz8G4yFjrddjWNGesBuIv6fdQBHMqB4Ax:qqmGKnaCYyMOmBdaDLXI1
    MD5:C2840C47DCF683F82A8ED9AC93A09745
    SHA1:68FEC368076B06B55C3971797EB839BB9A3F7223
    SHA-256:26EDD315898E6906D55E112BCAD23B8CCDE0B20AB94033CB1518C9F4E54D502F
    SHA-512:32CF61CCBE5A62694A8561B63C9C4A34E188D7587AC22C53323B4E7129ECCB632A38627ADD61CE32F193926C3D9D9F392DD1EB6D3AB0E031AEB69479D772B4D8
    Malicious:false
    Preview:L...). Y....N........edata..........(...d...........L...@..@.debug$S............................@..B....). Y............$...$............................................................................................................................................................................................................................................................................................................................................................................... .!.".#.proxytrack.exe.coucal_add.coucal_add_pvoid.coucal_calc_hashes.coucal_created.coucal_dec.coucal_delete.coucal_enum_new.coucal_enum_next.coucal_exists.coucal_fetch_value.coucal_fetch_value_hashes.coucal_get_intptr.coucal_get_name.coucal_get_pvoid.coucal_hash_data.coucal_hash_size.coucal_hash_string.coucal_inc.coucal_memory_size.coucal_new.coucal_nitems.coucal_read.coucal_read_pvoid.coucal_read_value.coucal_readptr.coucal_remove.coucal_set_assert_handler.coucal_set_global_assert_handler.coucal_set_

    C:\Program Files\WinHTTrack\is-6KT95.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text
    Category:dropped
    Size (bytes):35147
    Entropy (8bit):4.573442652974749
    Encrypted:false
    SSDEEP:768:Mo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A7D:Mhcycsrfrnoue
    MD5:D32239BCB673463AB874E80D47FAE504
    SHA1:8624BCDAE55BAEEF00CD11D5DFCFA60F68710A02
    SHA-256:8CEB4B9EE5ADEDDE47B31E975C1D90C73AD27B6B165A1DCD80C7C545EB65B903
    SHA-512:7633623B66B5E686BB94DD96A7CDB5A7E5EE00E87004FAB416A5610D59C62BADAF512A2E26E34E2455B7ED6B76690D2CD47464836D7D85D78B51D50F7E933D5C
    Malicious:false
    Preview: GNU GENERAL PUBLIC LICENSE. Version 3, 29 June 2007.. Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>. Everyone is permitted to copy and distribute verbatim copies. of this license document, but changing it is not allowed... Preamble.. The GNU General Public License is a free, copyleft license for.software and other kinds of works... The licenses for most software and other practical works are designed.to take away your freedom to share and change the works. By contrast,.the GNU General Public License is intended to guarantee your freedom to.share and change all versions of a program--to make sure it remains free.software for all its users. We, the Free Software Foundation, use the.GNU General Public License for most of our software; it applies also to.any other work released this way by its authors. You can apply it to.your programs, too... When we speak of free software, we are referring to

    C:\Program Files\WinHTTrack\is-6MJN9.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):385
    Entropy (8bit):4.703745881432501
    Encrypted:false
    SSDEEP:6:VMmRpseVj9R3XnoBMkztyFR4EQov3THcLeHJXQemBok773JisJtVQITc59vL+9A0:3UeVJhnJkzEr4EJef8sbVLTM9vC9A0
    MD5:7F7F0ED10E9B84002C9E7B33AF461902
    SHA1:69EC63D38AB1435FA7B4B5E5C5517543219F3BE9
    SHA-256:476379735FA66AD196CD62F6D225A247E2A53B3C2BB3F7B67BDA4DD72D00E815
    SHA-512:720303E77955418C95E09BBF7A51DF2B53BD3D343D46B233A9DA7E15EF10C16C0B9127A41017143D78E786EDE9E83E4E5931FED19B3EE397F73644F84DAB5EAC
    Malicious:false
    Preview:HTTrack Website Copier III..This program is an offline browser for..Windows and Unix/Linux. ..It allows you to transfer one or several..websites from the Internet to your hard ..disk. The robot is fully configurable,..with a LOT of parameters: possibility ..of update/continue, multiple ..connections, filters, proxy, wizard.....Windows interface + command-line release..Freeware/GPL..

    C:\Program Files\WinHTTrack\is-6RASL.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
    Category:dropped
    Size (bytes):207944
    Entropy (8bit):6.366241518925159
    Encrypted:false
    SSDEEP:3072:+aeZoRO5RRlyrZmR81EjKw48BNkEXflcE8s65NoV7yU7r5ANFmJuS:+a9klylajKwfB6WfuE89NMvuNI
    MD5:B9BEA3AB41F56CCBACCB83EA588B4534
    SHA1:5191A3887BA80FAB9958EF545ABFAE9F81058AA2
    SHA-256:5CEB9BAA1256051BE9D7D6D46EA3A7E238B88D2E9D64F978CA74192CC99E5891
    SHA-512:CFEDF991228C89E6D48B5F52375C7C2ED2B4648CC11193F5084F2ED5C22CEB9DF8C36FF7D321A764DEDF5B85BB7AD151701489AD8BB38064E6CC67F62CD539B6
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 0%
    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............Q..Q..Q..4Q..Q.."Q..Q.".Q..Q..$Q..Q..Q..Q..3Q..Q..%Q..Q..&Q..QRich..Q................PE..d..... Y.........." .....J..........H........................................p..........................................................F.......P....P....... ..$$......H....`..T...`c...............................................`...............................text....H.......J.................. ..`.rdata.......`.......N..............@..@.data....8..........................@....pdata..$$... ...&..................@..@.rsrc........P......................@..@.reloc..0....`......................@..B........................................................................................................................................................................................................................................................................

    C:\Program Files\WinHTTrack\is-7UNFS.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:PE32+ executable (console) x86-64, for MS Windows
    Category:dropped
    Size (bytes):94280
    Entropy (8bit):6.324698229368409
    Encrypted:false
    SSDEEP:1536:1J/NVuxg/PRjTPVhfOJMyITuPM6Vj6+Cos7YQ00xSRcaYr2xOYtZhW8+aELDRo5v:1ll9hmW5oCPSoSuW/XyW
    MD5:B3A7851BAB37169B83735B19BFD6EB3D
    SHA1:23A7D5ADD5C148473F478ABA3A77875D150C41F8
    SHA-256:6E976D98F868F5178F098242134EB96A2BCE4142AAD8F1B4D822F4589BE96B85
    SHA-512:13F96F7EE83822748D087578876E20DCDC3591EAC5DFAFD46DB99F8835F5BA2DEE708934AA8E188D3871817BF3A5E6C98F1DF67ED37D46AE7FDA1E3FFE27428B
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 0%
    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y..k*..k*..k*...*..k*...*..k*...*..k*...*..k*...*..k*..j*&.k*...*..k*...*..k*...*..k*Rich..k*........................PE..d..... Y..........#..........^......$..........@.....................................................................................V..(...`K..d............p..8....X..H...............................................................`............................text...A........................... ..`.rdata...J.......L..................@..@.data...H....`.......F..............@....pdata..8....p.......H..............@..@.rsrc................T..............@..@................................................................................................................................................................................................................................................................................................

    C:\Program Files\WinHTTrack\is-9STV2.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Intel amd64 COFF object file, not stripped, 2 sections, symbol offset=0xc08, 78 symbols, created Sat May 20 08:55:26 2017, 1st section name ".edata"
    Category:dropped
    Size (bytes):5137
    Entropy (8bit):4.226430345309816
    Encrypted:false
    SSDEEP:96:Eqxg1CRJJC1QKQ8mtwcAH1JNMxuYIeaQz8G4yFjrddjWNGesBuIv6fdQBHMqB4A/:Eqm1E6qwhJWBdFmi
    MD5:3F9B61D3D9C2B2F43C2551A7854E9FD7
    SHA1:685395652173193AB8239182163E00DC13DFE9D6
    SHA-256:4BCBC6A200E4BDF72843DB881363EE7E11EE222B4EA07F2C8B1452D7E8B9D74D
    SHA-512:80DB7FFC427B43BD73DDF9DAD4AE50EB216AAE9CB222C44131E0FBB54ED6242622547C900BB2B681D9B16B1DA7FE11C111BBC6C8C8B0BE6A47D1D759156D1F6C
    Malicious:false
    Preview:d...~. Y....N........edata..........(...d...........L...@..@.debug$S............................@..B....~. Y............$...$............................................................................................................................................................................................................................................................................................................................................................................... .!.".#.proxytrack.exe.coucal_add.coucal_add_pvoid.coucal_calc_hashes.coucal_created.coucal_dec.coucal_delete.coucal_enum_new.coucal_enum_next.coucal_exists.coucal_fetch_value.coucal_fetch_value_hashes.coucal_get_intptr.coucal_get_name.coucal_get_pvoid.coucal_hash_data.coucal_hash_size.coucal_hash_string.coucal_inc.coucal_memory_size.coucal_new.coucal_nitems.coucal_read.coucal_read_pvoid.coucal_read_value.coucal_readptr.coucal_remove.coucal_set_assert_handler.coucal_set_global_assert_handler.coucal_set_

    C:\Program Files\WinHTTrack\is-BL7PO.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:current ar archive
    Category:dropped
    Size (bytes):9256
    Entropy (8bit):5.018361783727661
    Encrypted:false
    SSDEEP:192:7X9/9gq2WPJbDqTmGjAjwWKEnOM/RQM1XwfhwVKDjAqrSjQusrOlExYULh3v+VZl:7X91gPWPpWTmGjAjwXEnOM/RQM1Xwpw9
    MD5:2638E15786C3EF89F84845BACD1D8F0A
    SHA1:11171068B4FDA769405D8D8D19B0EE23C099C238
    SHA-256:804FC051C7A2BE0F16427ECA32ADF426902047DB54113C20A2088DB718542569
    SHA-512:D45E5DF05E3D805A876059327B04AEAB3743C7942FA0ED457B6D3EEB0541947B3D1984E3EDCB05F25A2EB00E02AEA315281A979E05077BF56E6D9C1069DC129E
    Malicious:false
    Preview:!<arch>./ 1495270365 0 1902 `....K...f...........t...t...T...T...4...4...........................8...8..........................!h..!h.. ... ..."Z.."Z.......... ... ....................................8...8.. ... ....................Z...Z..........................!...!....Z...Z..#...#....6...6..#D..#D.........."...".................__IMPORT_DESCRIPTOR_webhttrack.__NULL_IMPORT_DESCRIPTOR..webhttrack_NULL_THUNK_DATA.__imp_coucal_get_name.coucal_get_name.__imp_coucal_hash_data.coucal_hash_data.__imp_coucal_hash_string.coucal_hash_string.__imp_coucal_calc_hashes.coucal_calc_hashes.__imp_coucal_fetch_value_hashes.coucal_fetch_value_hashes.__imp_coucal_fetch_value.coucal_fetch_value.__imp_coucal_read_value.coucal_read_value.__imp_coucal_exists.coucal_exists.__imp_coucal_new.coucal_new.__imp_coucal_created.coucal_created.__imp_coucal_value_is_malloc.coucal_value_is_malloc.__imp_coucal_set_name.coucal_set_name.__imp_coucal_value_set_value_handler.coucal_va

    C:\Program Files\WinHTTrack\is-C2PFI.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
    Category:dropped
    Size (bytes):627200
    Entropy (8bit):6.599563273610714
    Encrypted:false
    SSDEEP:12288:1y+a/N+bAH6nDjnBRsjZ6iIzKq+dKEN1WeAIYcPmqy7A0g:1yr0UH2DrsjkiC4L1WeAIzPmqy7A/
    MD5:23B134891C08C7F04C1747F6BCEC06EA
    SHA1:26A77CCF0E62FAA436255E47A0C3C8A818733193
    SHA-256:E11CE4B90DB815359B2D76F95F623FC26924C5A254F0540224FA6FEB623817E5
    SHA-512:30C89F058B3B9DDD39ED7A3E3C470C2DF08940DBC3EA0CF72CF271FA76EE19D956EE503A3FA2839458FBD2A61658FF3AA7F8326E6ECCAE9C11AC78B4C2B84C14
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 0%
    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........2K..aK..aK..al;.aH..aK..a...aU.Ca...aU.UaS..aU.Da...aU.RaJ..aU.TaJ..aU.QaJ..aRichK..a........PE..d....>1G.........." .....n...&.......&........bx..........................................@.........................................0q..Cx..._..(............`...E...n...$.............................................................. ............................text....m.......n.................. ..`.rdata..si.......j...r..............@..@.data....d.......<..................@....pdata...E...`...F..................@..@.rsrc................^..............@..@.reloc...............b..............@..B................................................................................................................................................................................................................................................................................

    C:\Program Files\WinHTTrack\is-EGSJE.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
    Category:dropped
    Size (bytes):357376
    Entropy (8bit):6.107476818924725
    Encrypted:false
    SSDEEP:6144:dEn/jiRtgk9NHoj2Q6yr6lIBLsy0IfMFPL+Ehy7OtdbDC7VMsNORJjd542Ki6hS5:dE/jiRtgk9NHoaQ6yr6uBLsy0IfMFT+E
    MD5:A96DB1B339924E6DF3FA369615DA2DE2
    SHA1:4CBDC505B5B248A8C20BE4B317029C32E28487A9
    SHA-256:7CA267B4E6CCEDFF8DD3730033C14A7237DECB7AAC721ABD3F286E41F38FC983
    SHA-512:752AAA9A8F9A1503534910C8D0C4E1BFDF79F054FF34932752A4A7DA848F1A84FFAC58F1ADA3E637EC1F0F89225D25801A27DE991BD9C7246556AE822EB65938
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 0%
    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........aB9..,j..,j..,j.x.j..,j.x.j..,j.x.j..,j..-j..,j.x.j..,j.x.j..,j.x.j..,j.x.j..,jRich..,j................PE..d...G.>T.........." ................D..............................................._Z..............................................@/..p$......P............`..H'..............D...p...................................................H............................text............................... ..`.rdata..............................@..@.data........`.......>..............@....pdata..H'...`...(...4..............@..@.rsrc................\..............@..@.reloc..<............d..............@..B........................................................................................................................................................................................................................................................................

    C:\Program Files\WinHTTrack\is-ET9FQ.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Intel amd64 COFF object file, not stripped, 2 sections, symbol offset=0xc02, 78 symbols, created Sat May 20 08:52:45 2017, 1st section name ".edata"
    Category:dropped
    Size (bytes):5131
    Entropy (8bit):4.219418587062425
    Encrypted:false
    SSDEEP:96:QAxg1CRJJCrupK+smtwcAH1JNMxuYIeaQz8G4yFjrddjWNGesBuIv6fdQBHMqB4s:QAm1E6KHwhJWBdFmi
    MD5:DE1788B65EDC942D9DCF8852D0A200B5
    SHA1:6A835FD2B386399418532ECBFD88AF8D3339E776
    SHA-256:B1194E1F848E0A5E8B97ABE6ACB1302B5483C1F128E73517A07A2CD05961893F
    SHA-512:4A5D2A53D48218210174EAD18B82C649B2C8BC7376807BF76E28077A58BC4CFE237F9FC4A3F120BFC17E8FD6FC9B726F28CA612E757000F5741B57662ECDD6A9
    Malicious:false
    Preview:d..... Y....N........edata..........(...d...........L...@..@.debug$S........~...................@..B...... Y............$...$............................................................................................................................................................................................................................................................................................................................................................................... .!.".#.webhttrack.exe.coucal_add.coucal_add_pvoid.coucal_calc_hashes.coucal_created.coucal_dec.coucal_delete.coucal_enum_new.coucal_enum_next.coucal_exists.coucal_fetch_value.coucal_fetch_value_hashes.coucal_get_intptr.coucal_get_name.coucal_get_pvoid.coucal_hash_data.coucal_hash_size.coucal_hash_string.coucal_inc.coucal_memory_size.coucal_new.coucal_nitems.coucal_read.coucal_read_pvoid.coucal_read_value.coucal_readptr.coucal_remove.coucal_set_assert_handler.coucal_set_global_assert_handler.coucal_set_

    C:\Program Files\WinHTTrack\is-FO2NV.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
    Category:dropped
    Size (bytes):154112
    Entropy (8bit):5.796445452784198
    Encrypted:false
    SSDEEP:3072:w5ske1vfuO+n11R1k4RwGluix00aQXxVPtp3HBgfatznPcTBfbK27:wSke1nuO+n11R1k4RwGThVPcmnPcTBDr
    MD5:2BD6884CCB700BE46F755C8673456A71
    SHA1:7CCB15712F69034D3B5BF131C901C9C8A6AD7A30
    SHA-256:9A03096691E21118EF74D0CDEB77A6149EBDD00003490CC01BAF0E1E0871400F
    SHA-512:00E91FECB29794D5D931D975BADBEF03369DFFDE82771D601FB4747D9C1259C6EEACC8BB8DA762B10C6CFE59978DA455C660C03533C0DEEF72D48212F8F000E8
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 0%
    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........|K.r/K.r/K.r/B../I.r/.../N.r/B../J.r/B../B.r/B../I.r/lv./H.r/K.s/q.r/B../_.r/B../J.r/U../J.r/B../J.r/RichK.r/................PE..d..... Y.........." .........n......|.....................................................@..........................................M.......G..<............p..................P....................................................................................text............................... ..`.rdata...Y.......Z..................@..@.data........`.......F..............@....pdata.......p.......H..............@..@.rsrc................T..............@..@.reloc..8............X..............@..B................................................................................................................................................................................................................................................

    C:\Program Files\WinHTTrack\is-FQSUO.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:PE32+ executable (GUI) x86-64, for MS Windows
    Category:dropped
    Size (bytes):683592
    Entropy (8bit):5.877637795516158
    Encrypted:false
    SSDEEP:6144:+bqdIUfdNaQJHr1jUMOWN8y+463aOvrU1fjuGGTpTOJKAOooaHP:tWc14MTy463aOvrwyooM
    MD5:1222165410734DB4A128E0B6F37EB89C
    SHA1:557D871D9F3CBE79D3B2B872E17F780C5FBE2638
    SHA-256:D37CC42BD29FF5046097DCA847967F59A6A1625829CD6DFAC387BDC4134F48A6
    SHA-512:8BA4B7114B7AE6566251AE287F6789335A65699DA050BE57C95E5421723162D088EA464CA56969D640DE35330457F42868888D4F8D3767E651A5CDF9F0B5E339
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 0%
    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........oM...................g.......................z.........................................Rich............................PE..d..... Y..........#......J...........v.........@.....................................3...............................................................P..(.......4t...V..H............z...............................................`...............................text...,I.......J.................. ..`.rdata.......`.......N..............@..@.data.......0......................@....pdata..4t.......v...(..............@..@.rsrc...(....P......................@..@........................................................................................................................................................................................................................................................................................

    C:\Program Files\WinHTTrack\is-G01MI.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
    Category:dropped
    Size (bytes):718008
    Entropy (8bit):6.534479221871629
    Encrypted:false
    SSDEEP:12288:NQszP8NRMXpc/rPx37/zHBA66pE+4p1YR71CERdH6rN9by7HaOMeImx9M8:NQQP8YXpc/rPx37/zHBA6plp+51CErzt
    MD5:BE92B50BF16F68E185DF0AD85936EE03
    SHA1:11FD2A8CB8744540DD5257F7A9F22AA2C7BB4DE3
    SHA-256:8114CFC2B266A56C9A98911A5EFA603E967838227B519F35E573182E49470B16
    SHA-512:C24F552DE5136BB9F8836B26D9690534B6EE23A1D9CFC4099C1A9681A57358221613D00B595F05A7B278C42B1EFA747259700B35D7E056DEE38E45905F2FBE55
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 2%
    Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................T...................@.................................1 ...........@...............................%...........................0............................... ......................................................CODE....,........................... ..`DATA................................@...BSS......................................idata...%.......&..................@....tls.....................................rdata....... ......................@..P.reloc..(....0......................@..P.rsrc...............................@..P.....................Z..............@..P........................................................................................................................................

    C:\Program Files\WinHTTrack\is-G0QI5.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
    Category:dropped
    Size (bytes):73800
    Entropy (8bit):6.164704991365051
    Encrypted:false
    SSDEEP:1536:2wJ15cl/+6yzQ4z29HNd940k34+fEkSymVwBd6bbsMrfsC5Ehskf:2wJ15s/nyzX27kB4+fEbV2IbbsMrfsCS
    MD5:AB3D8C6BCB32EDEB1B650F62CB26F38F
    SHA1:36B3DF21002D418DE1CF9468E4F33C7FAE108A0D
    SHA-256:11C593FC3B67EA68D6402D507708A4964D914D04D5599F90A38F826B8FBF19B9
    SHA-512:4D94DDA1DBFDE694C44F6DEEDB3A23A0791F5AC429A4D0F19BEA5B71C91CA7F3EBD3764168C76511D7CF65617DDB77BEBC07F4F0B88DB117998C2AAECCD1DA3B
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 0%
    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C...-I..-I..-IZ..I..-I.I..-I.I..-I.I..-I.6VI..-I..,I..-I.I..-I.I..-I.I..-IRich..-I........PE..d..... Y.........." .........R.......2.......................................p.......1..............................................0...G.......<....P.......@..........H....`.......................................................................................text...}........................... ..`.rdata..w'.......(..................@..@.data...X9..........................@....pdata.......@......................@..@.rsrc........P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................

    C:\Program Files\WinHTTrack\is-G2MAL.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
    Category:dropped
    Size (bytes):1651712
    Entropy (8bit):6.5374178803224705
    Encrypted:false
    SSDEEP:49152:M1NPj4YL4gHLjZjRyDA33FaMzjEOZjrp+VtGHPd:JYjjROA3GErp+VtG
    MD5:FC596FDC33C5F8B95560C5A31FA379D9
    SHA1:F731BFF62C51BA00387E762F8BB3F9525DEDA4E6
    SHA-256:AD991E0F64758987BF266094DB94A5DC615FDEDBD6B4472AB3B54DAA31ACFFA9
    SHA-512:E12C7D9DCF738C32E44BAA498FDE2EC741ED1E799BD3E8C7C044ACD3439DFFE7DA284A7DCFD669BEBF4C3583660C3C1B66A17292E6BC2E2295F7C8A70C4F8EAD
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 0%
    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........I.............W......@.........p....F......P......A......G......B.....Rich............PE..d...7.>T.........." ................._...............................................................................................|..Q....o.......@....... ...............P...?..`5...............................................0..(............................text............................... ..`.rdata.......0......................@..@.data...8....0......................@....pdata....... ......................@..@.rsrc........@......................@..@.reloc...L...P...N..................@..B................................................................................................................................................................................................................................................................................

    C:\Program Files\WinHTTrack\is-IBDRI.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):190
    Entropy (8bit):4.987627012501287
    Encrypted:false
    SSDEEP:3:qVowBSGBJeKGQIeBMKRMBECxNq2XRPaQKLd5Qby0NhtoAcMBDqDgKd5Qb3sBMKEz:qKGWSIHHq2XRPaQMOrh0Mr8OZNHXfGu
    MD5:859069099CB1644DE2ABC70362F360FA
    SHA1:C69D6900F6C2791FE6FA6637B972F0D096E7A120
    SHA-256:851B6818879073187301101A5FFF17735DA88F04CEEAEF1B1C0E325D3C67BEBC
    SHA-512:7388F34BEBA259BF44672B5733C11C57682D47A6175D20E50013C4E96E3CB87A43937ACC0B8906A9817D553952896CD1334DD29932E7221242273391CDB18612
    Malicious:false
    Preview:<html>....<head>..<title>Documentation</title>..<meta HTTP-EQUIV="Refresh" CONTENT="0; URL=html/index.html">..</head>..<body>..<a HREF="html/index.html">Documentation</a>..</body>..</html>..

    C:\Program Files\WinHTTrack\is-NKRDO.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
    Category:dropped
    Size (bytes):357376
    Entropy (8bit):6.107476818924725
    Encrypted:false
    SSDEEP:6144:dEn/jiRtgk9NHoj2Q6yr6lIBLsy0IfMFPL+Ehy7OtdbDC7VMsNORJjd542Ki6hS5:dE/jiRtgk9NHoaQ6yr6uBLsy0IfMFT+E
    MD5:A96DB1B339924E6DF3FA369615DA2DE2
    SHA1:4CBDC505B5B248A8C20BE4B317029C32E28487A9
    SHA-256:7CA267B4E6CCEDFF8DD3730033C14A7237DECB7AAC721ABD3F286E41F38FC983
    SHA-512:752AAA9A8F9A1503534910C8D0C4E1BFDF79F054FF34932752A4A7DA848F1A84FFAC58F1ADA3E637EC1F0F89225D25801A27DE991BD9C7246556AE822EB65938
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 0%
    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........aB9..,j..,j..,j.x.j..,j.x.j..,j.x.j..,j..-j..,j.x.j..,j.x.j..,j.x.j..,j.x.j..,jRich..,j................PE..d...G.>T.........." ................D..............................................._Z..............................................@/..p$......P............`..H'..............D...p...................................................H............................text............................... ..`.rdata..............................@..@.data........`.......>..............@....pdata..H'...`...(...4..............@..@.rsrc................\..............@..@.reloc..<............d..............@..B........................................................................................................................................................................................................................................................................

    C:\Program Files\WinHTTrack\is-O26L8.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Non-ISO extended-ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):46897
    Entropy (8bit):4.695250476503557
    Encrypted:false
    SSDEEP:768:aSmnirui5zaqHu2MucO4wgUL5Xwgfq2IF71B8XF5AYcZuR42ygr0Hd1u:aSme5e2u2c+L5XwgfqPF70SZuhEzu
    MD5:671572ED27A6963687B00C9806B315AD
    SHA1:9704FC5366531840B8FF0972A675980AB4A79532
    SHA-256:E0ACC9B46E7BECE51C63550852ED353C5358CD7D365FB562DBA573FF93B8539B
    SHA-512:2BAD416FBDAD788501BB153B6CB5F4374F946A5A723B228BB8C258469C576364C8347A6CC5997765E12C8EEBB27BEB02BFACF757D03475D41381402F1A0F44AF
    Malicious:false
    Preview:.. LICENCE PUBLIQUE G.N.RALE GNU.. Version 3, du 29 juin 2007.....Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>....Chacun est autoris. . copier et distribuer des copies conformes de ce..document de licence, mais toute modification en est proscrite.....Traduction fran.aise par Philippe Verdy..<verdy_p (.) wanadoo (point) fr>, le 30 juin 2007....._______________________________________________________________________....Avertissement important au sujet de cette traduction fran.aise..._______________________________________________________________________....Ceci est une traduction en fran.ais de la licence .GNU General Public..License. (GPL). Cette traduction est fournie ici dans l.espoir qu.elle..facilitera sa compr.hension, mais elle ne constitue pas une traduction..officielle ou approuv.e d.un point de vue juridique.....La Free Software Foundation (FSF) ne publie pas cette traduction et ne..l.a pas approuv.e en tant

    C:\Program Files\WinHTTrack\is-PEA28.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1506), with CRLF line terminators
    Category:dropped
    Size (bytes):1859
    Entropy (8bit):5.368960172138106
    Encrypted:false
    SSDEEP:48:3SlK+6gc209kkKVzp09kkKxzWaA/09kkK4kzY:CltK2XkwNXkIWXkjk8
    MD5:CFDFB365D8F581E80292124EEB97854F
    SHA1:7CF6859AE9693EAD128A40F7F36B2EBAF9CE923F
    SHA-256:F20BC224A6E3EF391C67FD91378E2EC9734E450EA30AC1D6B84E5ACB4AC9A087
    SHA-512:309D66CF8A3D026A00B90E635BE2535F9E13489CD35A89532D304AB3FF026B914AC508C4F1314BBD72CEFEC8303402F45FF63EA31E66CFE9480F586F8688720A
    Malicious:false
    Preview:.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC90.CRT" version="9.0.21022.8" processorArchitecture="amd64" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="msvcr90.dll" hashalg="SHA1" hash="b2f60c4aac5e14a70e51af1adfb7a3e3c8d78974"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>Jqd8zw5i+qQ2JV5HoMPIqBhzMZM=</dsig:DigestValue></asmv2:hash></file> <file name="msvcp90.dll" hashalg="SHA1" hash="a41203d30322a6320bfef2ba29f48899a5b1d608"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:ds

    C:\Program Files\WinHTTrack\is-SUP1E.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:PE32+ executable (console) x86-64, for MS Windows
    Category:dropped
    Size (bytes):27136
    Entropy (8bit):5.708116978006823
    Encrypted:false
    SSDEEP:384:091dc8qZHvw1yMT3SexXRkhKNIBAuXGo7cf99PCIqSyx4R8xV7+9lCCaEAcOf53g:y1dc8w4QMTBxXe/Bu9PCrR6R8nGO52rx
    MD5:2668CB3BE97FA21EC397ACB359758CDD
    SHA1:DF80027D1B728D8A1E15A12ED0AACC4A254AE326
    SHA-256:8EEA328AC9D0A22F08FFD58AA173C04C404D94212A0FF0AD214F20D8817F01B0
    SHA-512:591A9E3AE0176274D7BADFA2182B70D472105CED262211FC12A5D297333387D7D52C454570DEACE017542E32E3E0A8E0349EED6633696E553E44D786FBC51BFB
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 0%
    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.t.r...r...r......s...{...p...{...p...{...v...U.a.w...r...4...{...`...{...s...Richr...................PE..d..... Y..........#......B...$.......J.........@....................................tP......................................................0r..d....................................b...............................................`..P............................text....@.......B.................. ..`.rdata..4....`.......F..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@................................................................................................................................................................................................................................................................................................................

    C:\Program Files\WinHTTrack\is-TKJ11.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Unicode text, UTF-8 text, with CRLF line terminators
    Category:dropped
    Size (bytes):40386
    Entropy (8bit):4.9587924480464265
    Encrypted:false
    SSDEEP:768:0wEtyOjgiKgKkd4EfzOe770GxE3o6Hvt4i7Yh3CRte9qTI5ytwtBC:0wEtrdD7KRtNE5yS43
    MD5:58ACFD2B4ABF9AABB8273AF3E1D5AE5F
    SHA1:6F27FD88A6E827B4D1DCEE15AC6B1C5D0BFBF79F
    SHA-256:A962C6B5C7284C7993C6FD8359361F077FBC730762F55187E2C02B17F198B5BC
    SHA-512:75CF7D9E5BD56DC5A267937ACD2496C712AFB562ECE86771FEAE89716F35103F1BD55D7836743EFCAF6301A1287B9B9B7F486BEF895145BABB4BDCFB4476DB1E
    Malicious:false
    Preview:..HTTrack Website Copier release history:..--------------------------------------....This file lists all changes and fixes that have been made for HTTrack....3.49-2..+ Fixed: Buffer overflow in output option commandline argument (VL-ID 2068) (Hosein Askari)..+ Fixed: Minor fixes....3.48-23..+ Fixed: on Linux, FTBFS with openssl 1.1.0....3.48-22..+ Fixed: on Windows, fixed possible DLL local injection (Tunisian Cyber)..+ Fixed: various typos....3.48-21..+ Fixed: Google RPMs use /usr/bin/google-chrome as program location (Cickumqt)..+ Fixed: Fixed htsserver not dying (immediately) on quit..+ New: Updated WIN32 OpenSSL to 1.0.1j (Evgeniy)..+ Fixed: webhttrack incompatibility with Chrome..+ Fixed: assertion failure at htslib.c:3458 (strlen(copyBuff) == qLen) seen on Linux..+ Fixed: infamous crashes inside the DNS cache due to a corruption within the option structure (E.Kalinowski/karbofos)..+ New: added minimalistic crash reporting on Windows and Linux..+ Fixed: URL list not working anymor

    C:\Program Files\WinHTTrack\is-U4QQV.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:current ar archive
    Category:dropped
    Size (bytes):9256
    Entropy (8bit):5.003873416310285
    Encrypted:false
    SSDEEP:96:U9i3q9g527ZXB+vbJbwwqTxggCJKmJKLKUU7wX2K+uVADlKMO:U9B9g52mvbJbDqTmx7wm7cAxKz
    MD5:FAB5BC9E4EF8C981075E5E8EA5A7E01C
    SHA1:E2FF8C46298C545E82E001C600D6C437405D5047
    SHA-256:44E7D5712E4EFD66A2DE0B76D8F8CDAA75E20FFC8EDAA1C4B9FCFE8B6B363C98
    SHA-512:80F4790A6CCBE2F54AACEE8CB0010B0A5C327C8AD955BE768E85A153B526C5387100333ED9A1800F675D9C52F0DBEDB7987DFB16F5E20FD1A25F1DDF382672CE
    Malicious:false
    Preview:!<arch>./ 1495270526 0 1902 `....K...f...........t...t...T...T...4...4...................8...8..........#D..#D..#...#..........."..."............6...6...Z...Z..................................................................................!h..!h.. ... ..."Z.."Z..!...!........... ... ....................Z...Z...........8...8.. ... .__IMPORT_DESCRIPTOR_proxytrack.__NULL_IMPORT_DESCRIPTOR..proxytrack_NULL_THUNK_DATA.__imp_coucal_get_name.coucal_get_name.__imp_coucal_hash_data.coucal_hash_data.__imp_coucal_hash_string.coucal_hash_string.__imp_coucal_calc_hashes.coucal_calc_hashes.__imp_coucal_read_pvoid.coucal_read_pvoid.__imp_coucal_read_value.coucal_read_value.__imp_coucal_get_pvoid.coucal_get_pvoid.__imp_coucal_write_pvoid.coucal_write_pvoid.__imp_coucal_write_value.coucal_write_value.__imp_coucal_add_pvoid.coucal_add_pvoid.__imp_coucal_write.coucal_write.__imp_coucal_memory_size.coucal_memory_size.__imp_coucal_add.coucal_add.__imp_coucal_read.couc

    C:\Program Files\WinHTTrack\is-UN52E.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1740
    Entropy (8bit):4.895194912247934
    Encrypted:false
    SSDEEP:24:85zSQhMkL+zOXri36Cm6KBq0m6qWxyR/iAA12mfh17fWy82UgWX04alu:2eAiQ0JpKJpq01/fDfWy8VlL
    MD5:43606C066E329E5C72504BFB5214C7D6
    SHA1:81A418AF97C7D28BF1A29053886C3F483A71DFD9
    SHA-256:5EBE86AB8C969915FFDC1DE04E1810CA17F1FDFB1C0B5E78E46463A3C251E7B2
    SHA-512:E84893728E2D056FD6B8C06C6145D336DD0A67B987EA4422DD46233EB1A19DCD3331CB3D16742904A89F1E2CB834229081C81BCA26DD5B4B26E27ABC14E63E3E
    Malicious:false
    Preview:HTTrack Website Copier, Offline Browser for Windows and Unix..Copyright (C) Xavier Roche and other contributors....Welcome to HTTrack Website Copier!......Information:....The folder html/ contains the documentation..You might want to read these files, especially for installing HTTrack:.. - See INSTALL file for installation information (NO WARRANTY).. - See license.txt file for license information......Contacting us:....If you want to ask any question, feel free to contact us!..email: httrack@httrack.com......Donations:....HTTrack Website Copier is free software, but if you can, please donate to the Free Software Foundation (FSF) to support free software!....(Europe)..http://www.fsfeurope.org/help/donate.html....(World)..http://www.fsf.org/help/donate.html......Engine limits:....These are the principals limits of HTTrack for that moment. Note that we did not heard about any other utility..that would have solved them.....- Several scripts generating complex filenames may not find them

    C:\Program Files\WinHTTrack\is-UP2NT.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:current ar archive
    Category:dropped
    Size (bytes):9438
    Entropy (8bit):5.0085497805109584
    Encrypted:false
    SSDEEP:96:n8x3I+ONzEwG3T+vGNiqGv94EI9JGKi3K6K0n7I5M8q3jOWaf06DjBW:n8xzONzEwZvGNinv9XISU5g6WajDjBW
    MD5:E75184B756EC91F3FE2A9894E7689F43
    SHA1:C92CD3EED04652E40E86CBF718958DF8CF054A57
    SHA-256:B40199859E233ED9B5858ADD37D2AC9DA89A55A21348339353288311D549F235
    SHA-512:24A2BA1444CABD960741F2F9D7B31E16EC0931DA452EEAECBDA965267029312B7D2C449AA7C378F9E4F004DB214A71ED7C039A192BE16BDD4CFA83C52203DC9E
    Malicious:false
    Preview:!<arch>./ 1495270185 0 1974 `....K.......,...f...................................j...j...........z...z..#...#...$j..$j...*...*..#...#............................................D...D...........<...<...........N...N...........$...$.........."..."...!(..!(..#...#..."..."... ,.. ,..!...!............^...^...........Z...Z.......... ... .__IMPORT_DESCRIPTOR_proxytrack.__NULL_IMPORT_DESCRIPTOR..proxytrack_NULL_THUNK_DATA.__imp__coucal_get_name._coucal_get_name.__imp__coucal_hash_data._coucal_hash_data.__imp__coucal_hash_string._coucal_hash_string.__imp__coucal_calc_hashes._coucal_calc_hashes.__imp__coucal_read_pvoid._coucal_read_pvoid.__imp__coucal_read_value._coucal_read_value.__imp__coucal_get_pvoid._coucal_get_pvoid.__imp__coucal_write_pvoid._coucal_write_pvoid.__imp__coucal_write_value._coucal_write_value.__imp__coucal_add_pvoid._coucal_add_pvoid.__imp__coucal_write._coucal_write.__imp__coucal_memory_size._coucal_memory_size.__imp__coucal_add._coucal_

    C:\Program Files\WinHTTrack\is-UUKLU.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:PE32+ executable (console) x86-64, for MS Windows
    Category:dropped
    Size (bytes):345160
    Entropy (8bit):6.10696498882204
    Encrypted:false
    SSDEEP:6144:ecazHJuRnMknZaZge8kR4m7uHSxL10GVAHIdb8DL4hyTf7Y:ecazJuRnMknZaZgevamCyxRAyb8X0
    MD5:C0D6AB75459485DB4B579B136DCDDA1A
    SHA1:54290B7DC8DBB9782BB5A7F4F6E84472D0B7FD60
    SHA-256:8D5A9FBAE93A834FEE926D90118DE2A13E8C55C45F13A3B3D38924636F380F12
    SHA-512:C2E1CA67357C75479BEE593549CE480CA5B886C827FF8304A54EEA73B3C6818E2B04A163DBDE6A8433431BF2C8C5364FD02C6EE92F3EB5E4BE30974EE2A05FE4
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 0%
    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........QC...C...C.....:.F...J.(.m...J.9.O...J.?.A...d...F...C.......J./.....J.>.B...J.=.B...RichC...................PE..d...~. Y..........#............................@....................................................................................0y..(....l..P....p.......P.......,..H............4...............................................0..h............................text............................... ..`.rdata..XM...0...N..................@..@.data................h..............@....pdata.......P... ..................@..@.rsrc........p.......*..............@..@........................................................................................................................................................................................................................................................................................................

    C:\Program Files\WinHTTrack\is-V04TG.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:current ar archive
    Category:dropped
    Size (bytes):9438
    Entropy (8bit):5.0017954547659516
    Encrypted:false
    SSDEEP:192:z8vONEEaHCWNinv9XIXWql/y4qL7EjYrg:z82NT8TUv94mqlqLXEjL
    MD5:3998D1D6AF700578E715A82EDFCC3505
    SHA1:9D8FD625D321580A75403F4D5A559FBA146BE3CC
    SHA-256:ADA7F81CA950B23DD9929F71651A0154D06064AEE06D4A015F6025DC77BC1F36
    SHA-512:890464B0A99A01C4A4896A3A47A0AAD709456882E9519553A152F7B6D6D28FF90825D1A8A1390519BA84AC8266D1CB1312A7581B923A0FA9DAF5521FA3599879
    Malicious:false
    Preview:!<arch>./ 1495270202 0 1974 `....K.......,...f...........................................................<...<...$...$.........."..."...!(..!(..#...#... ,.. ,..!...!....................^...^...Z...Z.......... ... ....j...j...z...z...................N...N.........."..."...........$j..$j..........#...#....*...*..#...#....D...D........__IMPORT_DESCRIPTOR_webhttrack.__NULL_IMPORT_DESCRIPTOR..webhttrack_NULL_THUNK_DATA.__imp__coucal_get_name._coucal_get_name.__imp__coucal_hash_data._coucal_hash_data.__imp__coucal_hash_string._coucal_hash_string.__imp__coucal_calc_hashes._coucal_calc_hashes.__imp__coucal_fetch_value_hashes._coucal_fetch_value_hashes.__imp__coucal_fetch_value._coucal_fetch_value.__imp__coucal_read_value._coucal_read_value.__imp__coucal_exists._coucal_exists.__imp__coucal_new._coucal_new.__imp__coucal_created._coucal_created.__imp__coucal_value_is_malloc._coucal_value_is_malloc.__imp__coucal_set_name._coucal_set_name.__imp__coucal_value_se

    C:\Program Files\WinHTTrack\is-V2QNV.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):35821
    Entropy (8bit):4.622128610438848
    Encrypted:false
    SSDEEP:768:A7Y+tNdSz3ZlqXOWoInuzx3Y8N3WiYD0v:AVtNIq1uzZY1C
    MD5:3C34AFDC3ADF82D2448F12715A255122
    SHA1:7713A1753CE88F2C7E6B054ECC8E4C786DF76300
    SHA-256:0B383D5A63DA644F628D99C33976EA6487ED89AAA59F0B3257992DEAC1171E6B
    SHA-512:4937848B94F5B50EA16C51F9E98FDCD3953ACA63D63CA3BB05D8A62C107E382B71C496838D130AE504A52032398630B957ACAEA6C48032081A6366D27CBA5EA9
    Malicious:false
    Preview: GNU GENERAL PUBLIC LICENSE.. Version 3, 29 June 2007.... Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>.. Everyone is permitted to copy and distribute verbatim copies.. of this license document, but changing it is not allowed..... Preamble.... The GNU General Public License is a free, copyleft license for..software and other kinds of works..... The licenses for most software and other practical works are designed..to take away your freedom to share and change the works. By contrast,..the GNU General Public License is intended to guarantee your freedom to..share and change all versions of a program--to make sure it remains free..software for all its users. We, the Free Software Foundation, use the..GNU General Public License for most of our software; it applies also to..any other work released this way by its authors. You can apply it to..your programs, too..... When we speak of free software

    C:\Program Files\WinHTTrack\is-VG0G2.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with very long lines (736), with CRLF line terminators
    Category:dropped
    Size (bytes):22820
    Entropy (8bit):5.349998647036786
    Encrypted:false
    SSDEEP:384:tSWbjhJxxNURJLht70tHR99rw1AOydkuDm4MEqpp+LMQTRQYGUFSCMBA0i7npYHo:g0LxxAFSh6COWDm4g/+fQVK0opp
    MD5:22E0FD7224DC1FDE2586931ADB5304AD
    SHA1:EE8EBA7FDE496B706D90F3153F7976DF6EC2BA40
    SHA-256:FA2FCD8D754F34E5654DB45190AC82377B4D79B6AD62EDD79EEBBE02A5101393
    SHA-512:195EE38EED545C1503002566280EEB7009756691F3DD3C52C9FF7441517341B6813819D2DBEA1721CCAF2E6CA4CE6E821EE88EAF50ADF98D314E4155C6F44F63
    Malicious:false
    Preview:English..LANGUAGE_1..Francais..LANGUAGE_2..Castellano..LANGUAGE_3..Deutsch..LANGUAGE_4..Nederlands..LANGUAGE_5..Polski..LANGUAGE_6..Portugues..LANGUAGE_7..Russian..LANGUAGE_8..Italiano..LANGUAGE_9..Turkish..LANGUAGE_10..Magyar..LANGUAGE_11..Portugues-Brasil..LANGUAGE_12..Chinese-Simplified..LANGUAGE_13..Chinese-BIG5..LANGUAGE_14..Dansk..LANGUAGE_15..Eesti..LANGUAGE_16..Svenska..LANGUAGE_17..Macedonian..LANGUAGE_18..Japanese..LANGUAGE_19..Slovak..LANGUAGE_20..Cesky..LANGUAGE_21..Ukrainian..LANGUAGE_22..Norsk..LANGUAGE_23..Slovenian..LANGUAGE_24..Romanian..LANGUAGE_25..Greek..LANGUAGE_26..Bulgarian..LANGUAGE_27..Finnish..LANGUAGE_28..Croatian..LANGUAGE_29..Uzbek..LANGUAGE_30..LANGUAGE_NAME..LANGUAGE_NAME..LANGUAGE_FILE..LANGUAGE_FILE..LANGUAGE_ISO..LANGUAGE_ISO..LANGUAGE_AUTHOR..LANGUAGE_AUTHOR..LANGUAGE_CHARSET..LANGUAGE_CHARSET..LANGUAGE_WINDOWSID..LANGUAGE_WINDOWSID..LANG_OK..OK..LANG_CANCEL..Cancel..LANG_QUIT..Exit..LANG_CLOSE..Close..LANG_TIPCANCEL..Cancel changes..LANG_TIPOK..Click

    C:\Program Files\WinHTTrack\is-VRSCH.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1722
    Entropy (8bit):4.8064255563665474
    Encrypted:false
    SSDEEP:24:yE5F+EDDWkyEOkH5CTbVpT6omBLqXDKdUrJzwyC5vFvW4/mFTxUE8MF/:yOFPDDNygHWT6omsTlURFvWJUM/
    MD5:3C90E2EF4D1FC4FE138058A817C617DE
    SHA1:13B1AFFD0C53106FC8DC8A11F4553E493F51BFEE
    SHA-256:4CC1F5C6070370832842EBC1512650D52811CE052182CE93FD0FCB5DD22BCFE8
    SHA-512:B50D13137EF647959DE50C0A1F0BEF1B2A1703A746696076E84162079E4056FF84E2574D6501B0106844B33D6559425B2A24C4130E461EEB60AFFBB723B3825A
    Malicious:false
    Preview:HTTrack Website Copier License Agreement:....HTTrack Website Copier, Offline Browser for Windows and Unix..Copyright (C) Xavier Roche and other contributors....This program is free software; you can redistribute it and/or..modify it under the terms of the GNU General Public License..as published by the Free Software Foundation; either version 3..of the License, or any later version.....This program is distributed in the hope that it will be useful,..but WITHOUT ANY WARRANTY; without even the implied warranty of..MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the..GNU General Public License for more details.....You should have received a copy of the GNU General Public License..along with this program; if not, write to the Free Software..Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.....In addition, as a special exception, Xavier Roche gives permission to..link the code of this program with the openSSL library (or with..modified versions of openSSL

    C:\Program Files\WinHTTrack\lang.def (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with very long lines (736), with CRLF line terminators
    Category:dropped
    Size (bytes):22820
    Entropy (8bit):5.349998647036786
    Encrypted:false
    SSDEEP:384:tSWbjhJxxNURJLht70tHR99rw1AOydkuDm4MEqpp+LMQTRQYGUFSCMBA0i7npYHo:g0LxxAFSh6COWDm4g/+fQVK0opp
    MD5:22E0FD7224DC1FDE2586931ADB5304AD
    SHA1:EE8EBA7FDE496B706D90F3153F7976DF6EC2BA40
    SHA-256:FA2FCD8D754F34E5654DB45190AC82377B4D79B6AD62EDD79EEBBE02A5101393
    SHA-512:195EE38EED545C1503002566280EEB7009756691F3DD3C52C9FF7441517341B6813819D2DBEA1721CCAF2E6CA4CE6E821EE88EAF50ADF98D314E4155C6F44F63
    Malicious:false
    Preview:English..LANGUAGE_1..Francais..LANGUAGE_2..Castellano..LANGUAGE_3..Deutsch..LANGUAGE_4..Nederlands..LANGUAGE_5..Polski..LANGUAGE_6..Portugues..LANGUAGE_7..Russian..LANGUAGE_8..Italiano..LANGUAGE_9..Turkish..LANGUAGE_10..Magyar..LANGUAGE_11..Portugues-Brasil..LANGUAGE_12..Chinese-Simplified..LANGUAGE_13..Chinese-BIG5..LANGUAGE_14..Dansk..LANGUAGE_15..Eesti..LANGUAGE_16..Svenska..LANGUAGE_17..Macedonian..LANGUAGE_18..Japanese..LANGUAGE_19..Slovak..LANGUAGE_20..Cesky..LANGUAGE_21..Ukrainian..LANGUAGE_22..Norsk..LANGUAGE_23..Slovenian..LANGUAGE_24..Romanian..LANGUAGE_25..Greek..LANGUAGE_26..Bulgarian..LANGUAGE_27..Finnish..LANGUAGE_28..Croatian..LANGUAGE_29..Uzbek..LANGUAGE_30..LANGUAGE_NAME..LANGUAGE_NAME..LANGUAGE_FILE..LANGUAGE_FILE..LANGUAGE_ISO..LANGUAGE_ISO..LANGUAGE_AUTHOR..LANGUAGE_AUTHOR..LANGUAGE_CHARSET..LANGUAGE_CHARSET..LANGUAGE_WINDOWSID..LANGUAGE_WINDOWSID..LANG_OK..OK..LANG_CANCEL..Cancel..LANG_QUIT..Exit..LANG_CLOSE..Close..LANG_TIPCANCEL..Cancel changes..LANG_TIPOK..Click

    C:\Program Files\WinHTTrack\lang\Bulgarian.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (828), with CRLF line terminators
    Category:dropped
    Size (bytes):36862
    Entropy (8bit):5.743754276673443
    Encrypted:false
    SSDEEP:768:5YPWsKAxNFVdLfTcgUcQcxcH+XJvwrB3QzuuKD9siCNZ3QNR3pT:56WsKAD1LfTcNXocHkweuuKD9/NR3pT
    MD5:2D72148555DE5406C42AED1DE12E1A62
    SHA1:B0E3EB55FD1BFD20163E10532B2F7490DECDB5E1
    SHA-256:5A47832F2BE8B03A1B30B9B52A7785B1921F289F4DCEA9977A5AC51537CAAD31
    SHA-512:620F04F8ED14AD3211E9BE354126CC58F5F2CC125EE5DA3AFE6B3484079307181E54C238FD740FC9A8D88DECA13BE4AD3A73C58A66CD15B3563D6ED0EE0C239C
    Malicious:false
    Preview:LANGUAGE_NAME..Bulgarian..LANGUAGE_FILE..Bulgarian..LANGUAGE_ISO..bg..LANGUAGE_AUTHOR...... ...... [ilia@infomat-bg.com]\r\n..LANGUAGE_CHARSET..windows-1251..LANGUAGE_WINDOWSID..Bulgarian..OK......Cancel.........Exit.........Close...........Cancel changes........ ...........Click to confirm............Click to get help!.... .......Click to return to previous screen......... ... .......... ..........Click to go to next screen..... ......... ..........Hide password....... ..........Save project........ .........Close current project?......... ....... ........?..Delete this project?........ .......?..Delete empty project %s?........ ....... ...... %s?..Action not yet implemented............ . .............Error deleting this project........ ... ........... .. .........Select a rule for the filter........ ....... .. .........Enter keywords for the filter........ ....... .... .. .........Cancel.........Add this rule........ .... .........Please enter one or several keyword(s) for the rule..

    C:\Program Files\WinHTTrack\lang\Castellano.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (930), with CRLF line terminators
    Category:dropped
    Size (bytes):37554
    Entropy (8bit):4.942746405092299
    Encrypted:false
    SSDEEP:768:0cNTxNx/nFzBawT7QhPcHpgnEpRpXhJv7X7HO2R0L3TBL:0cNTD1nFz3T3HpzzJXHO2R0L3TBL
    MD5:CB6AC9470A0208EBDE3456EFC1259821
    SHA1:CE03AE3725AAE1B66E7AE42F3018ECB0C8868447
    SHA-256:2A3788FC0C8765C52BBA51BC49F8EFB8D16815F2D8EB413F4C66AF3CC636EFE3
    SHA-512:29A94F0E934A1BC52C41EDB728061A1FD7BC378F729CBA49339005653FF3AE36BDC4BA4C902298EF8577A571B81FD031C430D6E15B57007E1CB8D5F045DB09DA
    Malicious:false
    Preview:LANGUAGE_NAME..Castellano..LANGUAGE_FILE..Castellano..LANGUAGE_ISO..es..LANGUAGE_AUTHOR..Juan Pablo Barrio Lera (Universidad de Le.n) \r\n..LANGUAGE_CHARSET..ISO-8859-1..LANGUAGE_WINDOWSID..Spanish (Spain, Modern Sort)..OK..Ya..Cancel..Cancelar..Exit..Salir..Close..Cerrar..Cancel changes..Cancelar los cambios..Click to confirm..Haga click para confirmar..Click to get help!..Haga click para obtener ayuda..Click to return to previous screen..Haga click para volver atr.s..Click to go to next screen..Haga click para pasar a la siguiente pantalla..Hide password..Ocultar palabra clave..Save project..Guardar proyecto..Close current project?...Cerrar el proyecto actual?..Delete this project?...Borrar este proyecto?..Delete empty project %s?...Borrar el proyecto vac.o %s?..Action not yet implemented..Acci.n a.n no implementada..Error deleting this project..Error al borrar este proyecto..Select a rule for the filter..Escoja una regla para el filtro..Enter keywords for the filter..Escriba aqu. u

    C:\Program Files\WinHTTrack\lang\Cesky.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Non-ISO extended-ASCII text, with very long lines (828), with CRLF line terminators
    Category:dropped
    Size (bytes):34268
    Entropy (8bit):5.244722862876783
    Encrypted:false
    SSDEEP:384:/4SxylChXNxxNWKUGSZbjXhtEgt0tE/9druCx0dlj0zn4xAHkpZnquXTXSK/56Gu:A0NxxNWfRiedmxPXXTjI0gnp7COIOWS
    MD5:0C41D3081FD68F89B4847E27D050C7B1
    SHA1:AC0BA078F0F7CF3399CFC9AD6ADDE75BA8CDA359
    SHA-256:8476A06593C3261F4098DDA7CBF0983F8AFCDAEFDB6B6BEFEAE3B854E62C8269
    SHA-512:B6553A50ECDC69180DB61ACC1964B44FE33E84269568B5AC6D811987A0A727258B8E676462F0BCCF3E67D330398C03CCE137E24CB151148A61280577514AAB92
    Malicious:false
    Preview:LANGUAGE_NAME...esky..LANGUAGE_FILE..Cesky..LANGUAGE_ISO..cs..LANGUAGE_AUTHOR..Anton.n Mat.j..k (matejcik@volny.cz) \r \n..LANGUAGE_CHARSET..WINDOWS-1250..LANGUAGE_WINDOWSID..Czech..OK..Ano..Cancel..Zru.it..Exit..Konec..Close..Zav..t..Cancel changes..Zru.it zm.ny..Click to confirm..Klikni pro potvrzen...Click to get help!..Klikni pro n.pov.du..Click to return to previous screen..Klikni pro n.vrat do p.edchoz.ho okna..Click to go to next screen..Klikni pro pokra.ov.n. na n.sleduj.c.m okn...Hide password..Skr.t heslo..Save project..Ulo.it projekt..Close current project?..Zav..t aktu.ln. projekt?..Delete this project?..Smazat tento projekt?..Delete empty project %s?..Smazat pr.zdn. projekt %s?..Action not yet implemented..Akce nen. je.t. implementov.na..Error deleting this project..Chyba p.i maz.n. tohoto projektu..Select a rule for the filter..V.b.r pravidla pro filtr..Enter keywords for the filter..Zadej kl..ov. slova pro filtr..Cancel..Zru.it..Add this rule..P.idat toto pravidlo..Pleas

    C:\Program Files\WinHTTrack\lang\Chinese-BIG5.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (736), with CRLF line terminators
    Category:dropped
    Size (bytes):29327
    Entropy (8bit):6.147590111579792
    Encrypted:false
    SSDEEP:768:20gN4xNGGDU+3DSMcOx7/twlYoguZt8NRy9:27N4Dxw+zOm7menqYRy9
    MD5:CE5200A7B620A5AF0E1526D21442CA2E
    SHA1:E46B50D7EB271F778206699C48B3F87063C88A60
    SHA-256:2D4097840F32DFAC291439D720C53CBDCC084A46061B819636BDEA0A6166543F
    SHA-512:B71CBFC628D2246B925E8AC8D054DC98A7A62CDB14489509AD4C4B90E0DA623053F00009E18187430C58B09FFEFDFA44DF0CE064F4444101791FA696ECFF33C2
    Malicious:false
    Preview:LANGUAGE_NAME..Chinese-BIG5..LANGUAGE_FILE..Chinese-BIG5..LANGUAGE_ISO..zh_TW..LANGUAGE_AUTHOR..David Hing Cheong Hung (DAVEHUNG@mtr.com.hk)\r\n..LANGUAGE_CHARSET..BIG5..LANGUAGE_WINDOWSID..Chinese (Taiwan)..OK...T.w..Cancel........Exit.....}..Close........Cancel changes...........Click to confirm...I...H.T.{..Click to get help!...I...H.......!..Click to return to previous screen...I...H..^.e.@....Click to go to next screen...I...H..F.U.@....Hide password......K.X..Save project...O.s.M....Close current project?...O._......e.M..?..Delete this project?...R.....M..?..Delete empty project %s?...R......M.. %s?..Action not yet implemented....@..........Error deleting this project...R....M...X....Select a rule for the filter.....L.o......W.h..Enter keywords for the filter.....L.o....J.......Cancel........Add this rule...W.[..W.h..Please enter one or several keyword(s) for the rule........W.h..J.@..X.........Add Scan Rule...W.[...y.W.h..Criterion....h..String...r....Add...W

    C:\Program Files\WinHTTrack\lang\Chinese-Simplified.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (736), with CRLF line terminators
    Category:dropped
    Size (bytes):28797
    Entropy (8bit):6.213415445008274
    Encrypted:false
    SSDEEP:768:725gANDxNVSY67iTrTd/EmT2hfUjCXxTcx4MFWTVxUXnR5H:i5gANDD8NudsK2hfUj2Tcx4XqnR5H
    MD5:8AB741CB6657E809BEB6EB10913B263D
    SHA1:33DF5D0F1C3B7DDEF3CF463DD4CFDA4706D7F60D
    SHA-256:56B1EFCF8516DC8099F308C6924B38E49A5685C40BFB9821179C028BA1FC3403
    SHA-512:5128F2A8A12D250152325B7B27F112D421AFE411A97EABF1D892F874402A490EF9ED72F4E303896A878EF222641B6B85AD12723125A876702281BD1108CE275E
    Malicious:false
    Preview:LANGUAGE_NAME..Chinese-Simplified..LANGUAGE_FILE..Chinese-Simplified..LANGUAGE_ISO..zh..LANGUAGE_AUTHOR..Brook Qin (brookqwr at sina.com) \r\n..LANGUAGE_CHARSET..gb2312..LANGUAGE_WINDOWSID..Chinese (PRC)..OK.......Cancel.......Exit.......Close.......Cancel changes...........Click to confirm............Click to get help!.............!..Click to return to previous screen.................Click to go to next screen..................Hide password...........Save project..........Close current project?.............?..Delete this project?..........?..Delete empty project %s?........... %s?..Action not yet implemented..............Error deleting this project.................Select a rule for the filter.................Enter keywords for the filter...................Cancel.......Add this rule...........Please enter one or several keyword(s) for the rule............................Add Scan Rule.............Criterion.......String.........Add.

    C:\Program Files\WinHTTrack\lang\Croatian.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Non-ISO extended-ASCII text, with very long lines (841), with CRLF line terminators
    Category:dropped
    Size (bytes):37875
    Entropy (8bit):5.045677541370703
    Encrypted:false
    SSDEEP:768:pkKh7FtNTVxNf1fXHsaWeVrPHLk1s+y3nkYv1KpR8:pnBNRDf1kCU4hGK
    MD5:7EFADB4D1085E0E7FF9B85468D9D55F5
    SHA1:89997CE905DBED759638FB965641B33ED9DD3845
    SHA-256:F46EF0CB2A03A85D7A2B10790DFA9E3707C50A386D5E2AF522051B42C2B13DA0
    SHA-512:FCDAA18C3BA8294A274D49ED591455F2529E9851D405B44B21E0E53FD1424189853735535991D85F7AC956F738525C1BAB5003FD71ECC794CFB90D5ACE4C8610
    Malicious:false
    Preview:LANGUAGE_NAME..Hrvatski..LANGUAGE_FILE..Croatian..LANGUAGE_ISO..hr..LANGUAGE_AUTHOR..Dominko A.daji. (domazd@mail.ru) \r\n..LANGUAGE_CHARSET..ISO-8859-2..LANGUAGE_WINDOWSID..Croatian..OK..U redu..Cancel..Odustati..Exit..Svr.etak..Close..Zatvoriti..Cancel changes..Opozvati izmjene..Click to confirm..Preuzeti izmjene..Click to get help!..Kliknuti za pomo.!..Click to return to previous screen..Kliknuti za povratak na prethodni prikaz..Click to go to next screen..Kliknuti za povratak na slijede.i prikaz..Hide password..Sakriti lozinku..Save project..Pohraniti projekt..Close current project?..Zatvoriti teku.i projekt?..Delete this project?..Izbrisati taj projekt?..Delete empty project %s?..Izbrisati prazni projekt %s?..Action not yet implemented..Funkcija jo. nije raspolo.iva..Error deleting this project..Pogre.ka tijekom brisanja tog projekta..Select a rule for the filter..Izaberite neko pravilo za taj filtar..Enter keywords for the filter..Unesite klju.ne rije.i za taj filtar..Cancel..Odu

    C:\Program Files\WinHTTrack\lang\Dansk.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (742), with CRLF line terminators
    Category:dropped
    Size (bytes):35496
    Entropy (8bit):5.011239563232116
    Encrypted:false
    SSDEEP:768:Y2A/xz0PBxG+/kbSbnHRZkhmr/7g7CSZXe12KZgjmn:Y2A/9mxDb4Xpcg6
    MD5:6E25CDEAB13113D381A1E3764A2FEF91
    SHA1:58E25F47C4CD9C7F54F5826527CB56F12BC9080E
    SHA-256:10166AD5B0CFE62DA37D801B6A39457F6C8048BC235BDEA16B5EC273916E658D
    SHA-512:A29130678C21F5D9B705081644BB0F33EADEDF5DCD2B7598937FC7C6668BD8B2FC4BEBC662205F2C44E5F4C3C8DD7EB7924477805563B45DFBC769D44F0298C1
    Malicious:false
    Preview:LANGUAGE_NAME..Dansk..LANGUAGE_FILE..Dansk..LANGUAGE_ISO..da..LANGUAGE_AUTHOR..Jesper Bramm (bramm@get2net.dk)\r\nscootergrisen\r\n..LANGUAGE_CHARSET..ISO-8859-1..LANGUAGE_WINDOWSID..Danish..OK..OK..Cancel..Annull.r..Exit..Afslut..Close..Luk..Cancel changes..Annull.r .ndringer..Click to confirm..Klik OK for at godkende..Click to get help!..Klik for at f. hj.lp!..Click to return to previous screen..Klik for at se den forrige sk.rm..Click to go to next screen..Klik for at se den n.ste sk.rm..Hide password..Skjul adgangskode..Save project..Gem projekt..Close current project?..Vil du lukke det aktuelle projekt ?..Delete this project?..Slette dette projekt ?..Delete empty project %s?..Vil du slette det tomme projekt med navnet: %s?..Action not yet implemented..Denne handling er endnu ikke implementeret..Error deleting this project..Der opstod fejl under sletningen af dette projekt..Select a rule for the filter..V.lg en regel til filteret..Enter keywords for the filter..Indtast n.gleord til

    C:\Program Files\WinHTTrack\lang\Deutsch.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (761), with CRLF line terminators
    Category:dropped
    Size (bytes):36439
    Entropy (8bit):5.028879912422024
    Encrypted:false
    SSDEEP:768:v+N5xNVxTHBzAgWcrZOGGuryYe7x0MCvb/:v+N5DVzsA8VFKb/
    MD5:3F6B6BCDB3C9DA8ABA597BBEAA56B52E
    SHA1:D9CB582F9F02CF9DC9107641A8D45E5EC7A5AD68
    SHA-256:B292E21F92A0ECEA6B0FA8B423693C9A67E20FE938666B50BAB26E6A4C97B562
    SHA-512:07BBF2927128BDD2CDC666828720C849FCB4169EF9CA74B23F4D4E498D4DC530F6C452CC1745425920CDA17201886068F29C1E3A3C6382B9FCF187441DF057CE
    Malicious:false
    Preview:LANGUAGE_NAME..Deutsch..LANGUAGE_FILE..Deutsch..LANGUAGE_ISO..de..LANGUAGE_AUTHOR..Rainer Klueting (rk-htt at centermail.net) \r\nBastian Gorke (bastiang at yahoo.com) \r\nRudi Ferrari (Wyando at netcologne.de) \r\nMarcus Gaza (MarcusGaza at t-online.de) \r\n..LANGUAGE_CHARSET..ISO-8859-1..LANGUAGE_WINDOWSID..German (Standard)..OK..OK..Cancel..Abbrechen..Exit..Beenden..Close..Schlie.en..Cancel changes...nderungen verwerfen..Click to confirm...nderungen .bernehmen..Click to get help!..Hilfe aufrufen..Click to return to previous screen..Zur.ck zum letzten Schritt..Click to go to next screen..Weiter zum n.chsten Schritt..Hide password..Passwort nicht anzeigen..Save project..Projekt speichern..Close current project?..Aktives Projekt schlie.en?..Delete this project?..Dieses Projekt l.schen?..Delete empty project %s?..Leeres Projekt %s l.schen?..Action not yet implemented..Funktion noch nicht verf.gbar..Error deleting this project..Fehler beim L.schen des Projekts..Select a rule for the filt

    C:\Program Files\WinHTTrack\lang\Eesti.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (798), with CRLF line terminators
    Category:dropped
    Size (bytes):34394
    Entropy (8bit):5.029788650233175
    Encrypted:false
    SSDEEP:768:rv4MN6xNQduwGjtd9AUrj2mfkKW9wL6mlCmoej23pnNgWlf/1Cgp:rv4MN6DsuwGxd9P2kGwL63mpj25flf/R
    MD5:60F092A80A651B5A46CDE6CBA549925E
    SHA1:6BF29715F6A0BFE0C99B053FAED27302C85AAC02
    SHA-256:13930BCEBB6F94FECEE0D7721C2934F6E20C94843B8413ACB3156AD0A6E5EEAA
    SHA-512:C5B03A80CFB06C478E621A202D358874B70D57449727A5588E07179BD30966F02E4EB8CBDB21F8B86CA16FD54D18BB0831C80F7BE050190539C702E0F1397F93
    Malicious:false
    Preview:LANGUAGE_NAME..Eesti..LANGUAGE_FILE..Eesti..LANGUAGE_ISO..et..LANGUAGE_AUTHOR..T.nu Virma\r\n..LANGUAGE_CHARSET..ISO-8859-4..LANGUAGE_WINDOWSID..Estonian..OK..OK..Cancel..Loobu..Exit..V.lju..Close..Sulge..Cancel changes..Loobu muudatuste tegemisest..Click to confirm..Kliki kinnitamiseks..Click to get help!..Kliki abi saamiseks!..Click to return to previous screen..Tagasi eelmisele ekraanile..Click to go to next screen..Edasi j.rgmisele ekraanile..Hide password..Peida parool..Save project..Salvesta projekt..Close current project?..Kas sulgeda k.esolev projekt?..Delete this project?..Kas kustutada see projekt?..Delete empty project %s?..Kas kustutada t.hi projekt %s?..Action not yet implemented..Tegevus ei ole veel l.petatud..Error deleting this project..Viga selle projekti kustutamisel..Select a rule for the filter..Vali filtreerimisreegel..Enter keywords for the filter..Sisesta m.rks.nad filtri jaoks..Cancel..Loobu..Add this rule..Lisa see reegel..Please enter one or several keyword(s)

    C:\Program Files\WinHTTrack\lang\English.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with very long lines (736), with CRLF line terminators
    Category:dropped
    Size (bytes):35733
    Entropy (8bit):4.966728462500255
    Encrypted:false
    SSDEEP:768:eKUNnxNx27UUTDNyRTxHXVbYc/ZE7FcVqvcTF:eKUNnDU7UUYTPYBF8TF
    MD5:A14A4CA11CF545B5EACE077CDBC59E87
    SHA1:51F3046820B1114AB5896CC357554C6A4749EB96
    SHA-256:EEF49FF4DBBFC61BCCFCE89DA49DC8B46B3397EA504185A64069EBE1B033A75E
    SHA-512:263DB89EC7757DACE239234BC20C8050C9AB782F5F4222E730CDFB6EF4567E40372A56B1B66C33ABB40BE63C4D3F2F441B8F4B94911F1BC02A25F56A9FC38599
    Malicious:false
    Preview:LANGUAGE_NAME..English..LANGUAGE_FILE..English..LANGUAGE_ISO..en..LANGUAGE_AUTHOR..Xavier Roche (roche at httrack.com)\r\nRobert Lagadec (rlagadec at yahoo.fr) \r\n..LANGUAGE_CHARSET..ISO-8859-1..LANGUAGE_WINDOWSID..English (United States)..OK..OK..Cancel..Cancel..Exit..Exit..Close..Close..Cancel changes..Cancel changes..Click to confirm..Click to confirm..Click to get help!..Click to get help!..Click to return to previous screen..Click to return to previous screen..Click to go to next screen..Click to go to next screen..Hide password..Hide password..Save project..Save project..Close current project?..Close current project?..Delete this project?..Delete this project?..Delete empty project %s?..Delete empty project %s?..Action not yet implemented..Action not yet implemented..Error deleting this project..Error deleting this project..Select a rule for the filter..Select a rule for the filter..Enter keywords for the filter..Enter keywords for the filter..Cancel..Cancel..Add this rule..Add

    C:\Program Files\WinHTTrack\lang\Finnish.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (842), with CRLF line terminators
    Category:dropped
    Size (bytes):35134
    Entropy (8bit):5.020707210850664
    Encrypted:false
    SSDEEP:768:ynGopdeBxlkYf/SGigFiJBJf/32rXIbM2mVAdselBtQwIVz7R:ynGofeBvkYfaG/FOJHgINtQwIVz7R
    MD5:C4E1F53A1E8FB285E6A9F5C550C4EFEC
    SHA1:5F6BC8B8B965CCE2DD432C9C12C9936DC9E774A9
    SHA-256:A97F36836D1731AAD3E43B95A7BFF21FD0867E9B80B55ED12E02A5C75D3FC121
    SHA-512:1EB4D8A76709F79189F1144FEAF117902B43CB71787CA2B4500FF9F60237F5E6F3276D83989159775B5F944CE698D02BB09F6F9F848A9117A7DA71D393A2D1FB
    Malicious:false
    Preview:LANGUAGE_NAME..Finnish..LANGUAGE_FILE..Finnish..LANGUAGE_ISO..fi..LANGUAGE_AUTHOR..Mika K.hk.nen (mika.kahkonen at mbnet.fi)..LANGUAGE_CHARSET..ISO-8859-1..LANGUAGE_WINDOWSID..Finnish..OK..OK..Cancel..Peruuta..Exit..Poistu..Close..Sulje..Cancel changes..Peruuta muutokset..Click to confirm..Hyv.ksy..Click to get help!..Apua!..Click to return to previous screen..Palaa edelliseen ruutuun..Click to go to next screen..Mene seuraavaan ruutuun..Hide password..K.tke salasana..Save project..Tallenna projekti..Close current project?..Sulje nykyinen projekti?..Delete this project?..Poista projekti?..Delete empty project %s?..Poista tyhj. projekti %s?..Action not yet implemented..Toimintoa ei toteutettu viel...Error deleting this project..Virhe poistettaessa projektia..Select a rule for the filter..Valitse suodattimen s..nt...Enter keywords for the filter..Kirjoita suodattimen avainsanat..Cancel..Peruuta..Add this rule..Lis.. s..nt...Please enter one or several keyword(s) for the rule..Valitse yks

    C:\Program Files\WinHTTrack\lang\Francais.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (806), with CRLF line terminators
    Category:dropped
    Size (bytes):40421
    Entropy (8bit):4.934920714754602
    Encrypted:false
    SSDEEP:768:zbd0Cs4STNExNIaB0WHVRVvl2ODYRBFXzTLJlFP5Wruf0JDvcwQDlCaSA:zbdK4STNEDH0W1RVvl2ODYRBFXzfhPoa
    MD5:C4BCE8E0E8270CE0963D325509ECEF72
    SHA1:9BB9A2C8818533928FC453A14667DB5A577B6EE0
    SHA-256:3CEB18D6AA3FAE0F1E5F2B84669A7DDBB4341A0BB8F9739942431A57E2820EF1
    SHA-512:48E0FE5BF997681941A43631691E03FDD5A66B33BFBD5A2FB0EC7844F34D9470063BDB7459737C89C19A51640C94F24173C282C199B0263EBC555836AF8C28E2
    Malicious:false
    Preview:LANGUAGE_NAME..Fran.ais..LANGUAGE_FILE..Francais..LANGUAGE_ISO..fr..LANGUAGE_AUTHOR..Xavier Roche (roche at httrack.com)\r\nRobert Lagadec (rlagadec at yahoo.fr) \r\n..LANGUAGE_CHARSET..ISO-8859-1..LANGUAGE_WINDOWSID..French (Standard)..OK..Oui..Cancel..Annuler..Exit..Quitter..Close..Fermer..Cancel changes..Annuler les changements..Click to confirm..Cliquez pour confirmer..Click to get help!..Cliquez pour avoir de l'aide!..Click to return to previous screen..Pour revenir . la fen.tre pr.c.dente..Click to go to next screen..Pour passer . la fen.tre suivante..Hide password..Masquer le mot de passe..Save project..Enregistrer le projet..Close current project?..Fermer le projet courant?..Delete this project?..Supprimer ce projet?..Delete empty project %s?..Supprimer le projet vide %s?..Action not yet implemented..Cette fonction n'est pas encore disponible..Error deleting this project..Erreur lors de l'effacement de ce projet..Select a rule for the filter..Choisissez un crit.re pour le filtr

    C:\Program Files\WinHTTrack\lang\Greek.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (772), with CRLF line terminators
    Category:dropped
    Size (bytes):37842
    Entropy (8bit):5.853500752121118
    Encrypted:false
    SSDEEP:768:4AghuNcxNENYN73ZzO2sOn6T4K9aHB6+iluxbldBZ0G:4AguNcDf7ZO2Ri07FndBZN
    MD5:195324CB215A02DF643A2AE8A25ED3D2
    SHA1:52026D87B615ADE311BB81082DF807A8B85D9E45
    SHA-256:DBDA3FD92D55232FA3939A612BEBA641CFA1FCDD6251D47AFEEC646D79E1F008
    SHA-512:19CB82B607262DB77F3B0A8B9B97EE3E34B9A047944AEB196BC4312DAB3C3A8AD5AE7554196D01CE0A8778C44A1A573E0623F5AC177E4F8DA4DC542F5796395A
    Malicious:false
    Preview:LANGUAGE_NAME..Greek..LANGUAGE_FILE..Greek..LANGUAGE_ISO..el..LANGUAGE_AUTHOR..Michael Papadakis (mikepap at freemail dot gr)\r\n..LANGUAGE_CHARSET..ISO-8859-7..LANGUAGE_WINDOWSID..Greek..OK...........Cancel.........Exit..........Close............Cancel changes......... .........Click to confirm...... ... .............Click to get help!...... ... .. ...... .......!..Click to return to previous screen...... ... .. ........... .... ........... .......Click to go to next screen...... ... .. .... .... ....... .......Hide password.......... ..............Save project............ ..........Close current project?.... ........ ... ....... .......;..Delete this project?.... ....... ... ....... .......;..Delete empty project %s?......... ... ..... ........ %s;..Action not yet implemented... ........ .... ... .... .......... .......Error deleting this project.......... .... .. ....... ..... ... ..........Select a rule for the filter.......... ... ...... ... .. ........Enter keywords for the filte

    C:\Program Files\WinHTTrack\lang\Italiano.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (818), with CRLF line terminators
    Category:dropped
    Size (bytes):36664
    Entropy (8bit):4.896279859795108
    Encrypted:false
    SSDEEP:768:rO02ZBZNlxNgdzPoh3DT8GxDEJ0gcn+Sd7+kjMkxD3/jqrGr:rO02ZXNlDyPI3UGZgQZ/Lqqr
    MD5:52E391356D90AB78BDE70A89C5DBBE83
    SHA1:8D886E9179339BD110B5E6A551DF30AD68517232
    SHA-256:D887437151297DA21BF699529FAD5CD6747FB8C747DC97BCD24A48450549B032
    SHA-512:EB39BB8F618825AAA3665629B575DBB05E0520CF7884F30CF5E677EA3BBC00298D9D0BFDD3D17D9C067F03E800E6128781D86D88932367D08603F8EA140D9984
    Malicious:false
    Preview:LANGUAGE_NAME..Italiano..LANGUAGE_FILE..Italiano..LANGUAGE_ISO..it..LANGUAGE_AUTHOR..Witold Krakowski (wkrakowski at libero.it)\r\n..LANGUAGE_CHARSET..ISO-8859-1..LANGUAGE_WINDOWSID..Italian (Standard)..OK..Ok..Cancel..Annulla..Exit..Esci..Close..Chiudi..Cancel changes..Annulla modifiche..Click to confirm..Clicca per confermare..Click to get help!..Clicca qui per aiuto..Click to return to previous screen..Clicca per tornare indietro..Click to go to next screen..Clicca per passare allo schermo successivo..Hide password..Nascondi password..Save project..Salva il progetto..Close current project?..Chiudere il progetto corrente?..Delete this project?..Eliminare questo progetto?..Delete empty project %s?..Eliminare il progetto vuoto %s?..Action not yet implemented..Azione non ancora possibile..Error deleting this project..C'. stato un errore durante l'eliminazione di questo progetto..Select a rule for the filter..Seleziona le regole per il filtro..Enter keywords for the filter..Inserisci le

    C:\Program Files\WinHTTrack\lang\Japanese.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Non-ISO extended-ASCII text, with very long lines (829), with CRLF, NEL line terminators
    Category:dropped
    Size (bytes):34383
    Entropy (8bit):6.04371316296568
    Encrypted:false
    SSDEEP:768:/olJ4cnNmxNVI/1kp+ZAaHiYFbdEdhRs4qKIe3WIruEco4e7w93Tv:/olJ48NmDq/1kpsAaHicJEfRCfebr734
    MD5:10610B310BE04DEF9C97B33F896BA2F7
    SHA1:FF9F30476216DF80E809D9789F99BA1E1CC4530E
    SHA-256:A0A1CFD990C02D931CA8BB29DFFCFAF9FFD85D6022C75B84AF480DB2BFE798A8
    SHA-512:4DF5C36DDFAB0A1BAB448DCF71EA28E30AFB6343B319C79BF238D1366A79DAA8BA52E2A98F027E60314795C3F791C5C942C84314EC7121A4F34B6EAD982CC62B
    Malicious:false
    Preview:LANGUAGE_NAME..Japanese..LANGUAGE_FILE..Japanese..LANGUAGE_ISO..ja..LANGUAGE_AUTHOR..TAPKAL\r\n..LANGUAGE_CHARSET..shift-jis..LANGUAGE_WINDOWSID..Japanese..OK..OK..Cancel...L.....Z....Exit...I....Close.........Cancel changes....X...L.....Z....Click to confirm...N...b.N....m.F..Click to get help!...N...b.N....w...v!..Click to return to previous screen...N...b.N....O.........Click to go to next screen...N...b.N..........i....Hide password...p.X...[.h...B....Save project...v...W.F.N.g......Close current project?.......v...W.F.N.g...........?..Delete this project?......v...W.F.N.g...........?..Delete empty project %s?......v...W.F.N.g%s ...........?..Action not yet implemented...@.\.....................Error deleting this project......v...W.F.N.g.......s.........Select a rule for the filter...t.B...^....[....I...............Enter keywords for the filter...t.B...^...L.[...[.h.................Cancel...L.....Z....Add this rule........[.....

    C:\Program Files\WinHTTrack\lang\Macedonian.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Non-ISO extended-ASCII text, with very long lines (761), with CRLF line terminators
    Category:dropped
    Size (bytes):36643
    Entropy (8bit):5.676712460231925
    Encrypted:false
    SSDEEP:768:IviNzxNCGJUDtrKIuVEHkmDk4lESEQ7CiMVsU37MIKNzjpr+ap:IviNzDZJUhKIrExXa78VfMIoIap
    MD5:DFDF12CD078C65E3A30619F1DED5AADA
    SHA1:47413EE6B3293B09326A015512D254398E8731ED
    SHA-256:9866752CA7497015C124A3F8760E1D6CAE500B51023EC41243A98D8637E07890
    SHA-512:14FED6F15E5C9D9DAFD2F40A2004130227780C371E3C4FB1B7C59D724A80CBF965697B11027A455CCB225085B6BDF67CD36729638CF6E28B0E7B6F2AB36F78BA
    Malicious:false
    Preview:LANGUAGE_NAME..Macedonian..LANGUAGE_FILE..Macedonian..LANGUAGE_ISO..mk..LANGUAGE_AUTHOR............ .... (aleks@macedonia.eu.org) \r \n..LANGUAGE_CHARSET..ISO-8859-5..LANGUAGE_WINDOWSID..FYRO Macedonian..OK.........Cancel..........Exit.........Close...........Cancel changes........ .. ...........Click to confirm........ .. .........Click to get help!........ .. .......Click to return to previous screen........ .. ....... .. ........... .......Click to go to next screen........ .. ....... .......Hide password....... .. ...........Save project........ .. ..........Close current project?......... .. ........?..Delete this project?......... .. ........?..Delete empty project %s?......... .. ........ ...... %s?..Action not yet implemented......... ...... .. . ................Error deleting this project........ ... ........ .. ..........Select a rule for the filter.......... ....... .. ..........Enter keywords for the filter......... ...... ....... .. ..........Cancel..........Add this

    C:\Program Files\WinHTTrack\lang\Magyar.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (744), with CRLF line terminators
    Category:dropped
    Size (bytes):36454
    Entropy (8bit):5.213721439431982
    Encrypted:false
    SSDEEP:768:rNDNvxNFWyTfpdgBrhkTuthHUydhUuX2V:hDNvDMyT0iMndao2V
    MD5:C761F709A53C3F80E94B77644500878A
    SHA1:8AA674051E08DE990DC21288738435C1333255CE
    SHA-256:7A9AB192D1C5665D6C89889F260BCBCF266C3DA75416B60C3E1F1158BB341E4A
    SHA-512:733DCF277897F2180170E9E01A300B4DC4EB96CBD08E4B973CDEEFF1316DEA4D0AE366E5CE6A99C04D1B17AAE0217F230EE54040B455ED1D3EF9D3303D1EAE5E
    Malicious:false
    Preview:LANGUAGE_NAME..Magyar..LANGUAGE_FILE..Magyar..LANGUAGE_ISO..hu..LANGUAGE_AUTHOR..Jozsef Tamas Herczeg (hdodi at freemail.hu) \r\n..LANGUAGE_CHARSET..ISO-8859-2..LANGUAGE_WINDOWSID..Hungarian..OK..OK..Cancel..M.gse..Exit..Kil.p.s..Close..Bez.r.s..Cancel changes..T.rli a m.dos.t.sokat..Click to confirm..Kattintson r. a meger.s.t.shez..Click to get help!..Kattintson r. seg.ts.g.rt!..Click to return to previous screen..Az el.z. k.perny.h.z visz vissza..Click to go to next screen..A k.vetkez. k.perny.re visz..Hide password..Jelsz. titkos.t.sa..Save project..Projekt ment.se..Close current project?..Bez.rja az aktu.lis projektet?..Delete this project?..T.rli ezt a projektet?..Delete empty project %s?..T.rli a(z) %s .res projektet?..Action not yet implemented..A m.velet m.g nem haszn.lhat...Error deleting this project..Hiba a projekt t.rl.sekor..Select a rule for the filter..Jel.lj.n ki szab.lyt a sz.r.h.z..Enter keywords for the filter..Itt .rja be a sz.r. kulcsszavait..Cancel..M.gse..Add thi

    C:\Program Files\WinHTTrack\lang\Makefile.am (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):196
    Entropy (8bit):4.844601304020977
    Encrypted:false
    SSDEEP:6:ri7Na5QXqlYmq2BNa5K5FYakFfsx6h5ZBrBE:ric5Uety5nEK5rrBE
    MD5:94A99573D5811367E1FE93B1B2512A28
    SHA1:C21572C8A75248535A84D6AC52B2D02BC54DCEC2
    SHA-256:963CD5F2FC210EE382E77E9FB55F2F9EFCEE248BCFE1F1268814F8FA7533939F
    SHA-512:ED8CD6D14BCFA6A6BC4296CAD959DB070B9E8AE9A0DF98B9FC3B335FFCBB2E3B893AF27A08312690A8C7F5A5356BFBAB5087A29A09F563594957E8F68D7D431F
    Malicious:false
    Preview:..langdir = $(datadir)/httrack/lang..lang_DATA = *.txt..langrootdir = $(datadir)/httrack..langroot_DATA = ../lang.def ../lang.indexes....EXTRA_DIST = $(lang_DATA) $(langroot_DATA)....#dist-hook:..

    C:\Program Files\WinHTTrack\lang\Makefile.in (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:makefile script, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):16180
    Entropy (8bit):5.559217365808289
    Encrypted:false
    SSDEEP:384:wt4l3bfVcRBCfxEnoA4z+ZReTFkReT5RrwRJgURUmBeyrQK7:sGrfVcRBCfxg4z+ZReT+ReT3rwRJgURp
    MD5:E46E3DF5DBBE2A7CBEF5C32C3CEB1313
    SHA1:29F26C9FEF2D24FD9829E404DAE4FFC83DBD9FB1
    SHA-256:E88D0D817B7A1D86C31CDABBE318B8C77B3237AB799B290966E405AF6673E2D9
    SHA-512:D14BE9DA997CC30E6A9DD2B901FC82B97CC45240578CEB37A10BF58C0556BEEE3D0DE756821E9800341835D9F8DDC33A23924D42553B2875FA838A5B1598B1FC
    Malicious:false
    Preview:# Makefile.in generated by automake 1.14.1 from Makefile.am...# @configure_input@....# Copyright (C) 1994-2013 Free Software Foundation, Inc.....# This Makefile.in is free software; the Free Software Foundation..# gives unlimited permission to copy and/or distribute it,..# with or without modifications, as long as this notice is preserved.....# This program is distributed in the hope that it will be useful,..# but WITHOUT ANY WARRANTY, to the extent permitted by law; without..# even the implied warranty of MERCHANTABILITY or FITNESS FOR A..# PARTICULAR PURPOSE.....@SET_MAKE@....VPATH = @srcdir@..am__is_gnu_make = test -n '$(MAKEFILE_LIST)' && test -n '$(MAKELEVEL)'..am__make_running_with_option = \.. case $${target_option-} in \.. ?) ;; \.. *) echo "am__make_running_with_option: internal error: invalid" \.. "target option '$${target_option-}' specified" >&2; \.. exit 1;; \.. esac; \.. has_opt=no; \.. sane_makeflags=$$MAKEFLAGS; \.. if $(am__is_gnu_ma

    C:\Program Files\WinHTTrack\lang\Nederlands.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (741), with CRLF line terminators
    Category:dropped
    Size (bytes):35974
    Entropy (8bit):4.942435925293232
    Encrypted:false
    SSDEEP:768:H0pNExNgvpwNHhjZHNlAEGq/5XGfxozVjxPgeex:UpNEDGpaj2EGiXwGzzPKx
    MD5:56BBD1272E88D2A46E1C13B4ACF72ADB
    SHA1:E0A94AA8B6A1E1EF6A80C1A1380967424422616B
    SHA-256:B2465B6A29FF61FFB9B502BEB0D1A87552B799FE844BEBCF9A60D112E399F0B5
    SHA-512:9612888BAD9D2185CBD3FD003131274D49A662E7DF13F61FE4B8F8384637850162C962D88A4061C322F537E7317524B69A6224878DBE569842E6D2513678AF5A
    Malicious:false
    Preview:LANGUAGE_NAME..Nederlands..LANGUAGE_FILE..Nederlands..LANGUAGE_ISO..nl..LANGUAGE_AUTHOR..Rudi Ferrari (Wyando at netcologne.de) \r\n..LANGUAGE_CHARSET..ISO-8859-1..LANGUAGE_WINDOWSID..Dutch (Netherlands)..OK..OK..Cancel..Annuleren..Exit..Be.indigen..Close..Sluiten..Cancel changes..Veranderingen annuleren..Click to confirm..Veranderingen bevestigen..Click to get help!..Klik hier voor help..Click to return to previous screen..Klik voor vorig scherm..Click to go to next screen..Klik voor volgend scherm..Hide password..Verberg wachtwoord..Save project..Project wegschrijven..Close current project?..Actueel project sluiten?..Delete this project?..Dit project wissen?..Delete empty project %s?..Leeg project %s wissen?..Action not yet implemented..Functie nog niet ter beschikking...Error deleting this project..Fout bij het wissen van dit project...Select a rule for the filter..Kies een regel voor de filter..Enter keywords for the filter..Geef hier de sleutelwoorden voor deze filter..Cancel..Ann

    C:\Program Files\WinHTTrack\lang\Norsk.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (736), with CRLF line terminators
    Category:dropped
    Size (bytes):34783
    Entropy (8bit):5.006395891181154
    Encrypted:false
    SSDEEP:768:+u4FN8RxNaqxfUiz710AZzFHPsJpTCTeM/93vWnqHD701amzzX4:+u4FN8RDa2zBJsvTcsnqjgI
    MD5:22A730556E3B6C192B001706783E1FA1
    SHA1:94498E8663984CCE02FF975E0DEAEE2D37BF8E17
    SHA-256:049D8A87BABDABE29C254386B4016E410FC50A54F5A49C50E7336FC682CF7ED2
    SHA-512:C179CF53C5241C448ECE597213461BB4481FFC2BF84257955007736BC998EB825DFA0CAB0B1628A7805C0B40DFF0C71319E51BECCF3089E7006C4882D1477CA9
    Malicious:false
    Preview:LANGUAGE_NAME..Norsk..LANGUAGE_FILE..Norsk..LANGUAGE_ISO..no..LANGUAGE_AUTHOR..Tobias "Spug" Langhoff (Dark Spug at hazardlabs.com )\r\n[ spug_enigma@hotmail.com ] \r\n..LANGUAGE_CHARSET..ISO-8859-1..LANGUAGE_WINDOWSID..Norwegian (Nynorsk)..OK..OK..Cancel..Avbryt..Exit..Avslutt..Close..Lukk..Cancel changes..Angre endringer..Click to confirm..Klikk for . bekrefte..Click to get help!..Klikk her for . f. hjelp!..Click to return to previous screen..Klikk for . g. tilbake til forrige skjerm..Click to go to next screen..Klikk for . g. til neste skjerm..Hide password..Skjul passord..Save project..Lagre prosjekt..Close current project?..Vil du lukke prosjektet?..Delete this project?..Vil du slette dette prosjektet?..Delete empty project %s?..Vil du slette det tomme prosjektet %s?..Action not yet implemented..Denne funksjonen er ikke utviklet enda..Error deleting this project..Kunne ikke slette prosjektet..Select a rule for the filter..Velg en regel for dette filteret..Enter keywords for the fi

    C:\Program Files\WinHTTrack\lang\Polski.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Non-ISO extended-ASCII text, with very long lines (822), with CRLF, NEL line terminators
    Category:dropped
    Size (bytes):36449
    Entropy (8bit):5.179068415594699
    Encrypted:false
    SSDEEP:768:jjcsUE8JEx8k21A1vQmyAsDu52whDP6TBysHuw+vl:jjcsUE8JEO71AvPWKFh4Huwgl
    MD5:FF7C57587A4C98644040A427FD5EBB19
    SHA1:DF3F36C9050E6907EE8C5374639F99B049A86795
    SHA-256:4EDE4FFC4259276511C13335BA14FA5D918147FE790199610C163B1489DBD508
    SHA-512:05FE80928C497EDF65AE1E624D8AB098ECFD4A58EBDD3E3A24083DE696CF1A9DD571EBBB5BD8AA55090DE8E8E50F80A9C3AF256239AFF125C26AF6BCA04E97DE
    Malicious:false
    Preview:LANGUAGE_NAME..Polski..LANGUAGE_FILE..Polski..LANGUAGE_ISO..pl..LANGUAGE_AUTHOR..Lukasz Jokiel (Opole University of Technology, Lukasz.Jokiel at po.opole.pl) \r\n..LANGUAGE_CHARSET..ISO-8859-2..LANGUAGE_WINDOWSID..Polish..OK..OK..Cancel..Anuluj..Exit..Wyj.cie..Close..Zamknij..Cancel changes..Cofnij zmiany..Click to confirm..Kliknij aby potwierdzi...Click to get help!..Kliknij aby uzyska. pomoc..Click to return to previous screen..Kliknij aby wr.ci...Click to go to next screen..Kliknij aby kontynuowa...Hide password..Ukryj has.o..Save project..Zachowaj projekt..Close current project?..Czy zamkn.. ten projekt ?..Delete this project?..Czy usun.. ten projekt ?..Delete empty project %s?..Czy usun.. pusty projekt %s?..Action not yet implemented..Funcja jeszcze nie zaimplementowana...Error deleting this project..Wyst.pi. b..d podczas usuwania tego projektu...Select a rule for the filter..Wybierz regu.. dla tego filtra..Enter keywords for the filter..Podaj s.owa kluczowe dla filtra..Cancel..An

    C:\Program Files\WinHTTrack\lang\Portugues-Brasil.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (826), with CRLF line terminators
    Category:dropped
    Size (bytes):36935
    Entropy (8bit):5.006654717517556
    Encrypted:false
    SSDEEP:384:AHqBjhBQPxQiUPg5slht7g80tu9Gjb7h6zh2uLf+VsMIGXjrYLLpOmQzdYBRAK3z:AHG8xceg0LrLDTruLpuzewulAlhBK3J
    MD5:B319AA85AC5B40B678927EC646010E6B
    SHA1:357A120C1D1927477116CFCCAA6863177C039D9F
    SHA-256:D0B1868C3FC776367C3A0BB49E4A6217390860152FA26D29274257E0BCAAF788
    SHA-512:3D1DFC0D08AAE7F1FFDEC01145795FFBBF3B7B1DB4432546E2EC16C184B719597415860156396F55F781E442BA874AC76FEAA710A60B28B7F8747C3CADC3DC8B
    Malicious:false
    Preview:LANGUAGE_NAME..Portugu.s-Brasil..LANGUAGE_FILE..Portugues-Brasil..LANGUAGE_ISO..pt_BR..LANGUAGE_AUTHOR..Paulo Neto (layoutbr at lexxa.com.br) \r\n..LANGUAGE_CHARSET..ISO-8859-1..LANGUAGE_WINDOWSID..Portuguese (Brazil)..OK..OK..Cancel..Cancelar..Exit..Sair..Close..Fechar..Cancel changes..Cancelar altera..es..Click to confirm..Clique para confirmar..Click to get help!..Clique para obter ajuda..Click to return to previous screen..Clique para voltar..Click to go to next screen..Clique para prosseguir..Hide password..Ocultar senha..Save project..Salvar projeto..Close current project?..Fechar o projeto atual?..Delete this project?..Excluir este projeto?..Delete empty project %s?..Excluir o projeto vazio %s?..Action not yet implemented..A..o ainda n.o implementada..Error deleting this project..Erro ao excluir este projeto..Select a rule for the filter..Escolha uma regra para o filtro..Enter keywords for the filter..Digite aqui as palavras para filtrar..Cancel..Cancelar..Add this rule..Adicion

    C:\Program Files\WinHTTrack\lang\Portugues.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (822), with CRLF line terminators
    Category:dropped
    Size (bytes):35516
    Entropy (8bit):5.001355017327262
    Encrypted:false
    SSDEEP:768:OUg1yNSxNBB+JEWV6Y8YWhTrGQJMVhrSZE:1gENSDaJp9W8h2S
    MD5:EBECE93A3CB80D46A53BD059E2FA8834
    SHA1:254204BD4242D67F132AD29AA785D1CB33C0A35A
    SHA-256:F3F62EF0D30C2CFD8C025C571F58AAE4658913892B4E3F9451CD17A34F302BB4
    SHA-512:740F217B0230DF331E33F5010965EE55BF5D485F74FEBA0BF60C2757A887BC8B560E2B53172A5E023033984BBD8D0ADAC0463D8B575598333587B2624166D525
    Malicious:false
    Preview:LANGUAGE_NAME..Portugu.s..LANGUAGE_FILE..Portugues..LANGUAGE_ISO..pt..LANGUAGE_AUTHOR..Rui Fernandes (CANTIC, ruiefe at mail.malhatlantica.pt) \r\nPedro T. Pinheiro (Universidade Nova de Lisboa-FCT, ptiago at mail.iupi.pt) \r\n..LANGUAGE_CHARSET..ISO-8859-1..LANGUAGE_WINDOWSID..Portuguese (Portugal)..OK..OK..Cancel..Cancelar..Exit..Sair..Close..Fechar..Cancel changes..Cancelar altera..es..Click to confirm..Clique para confirmar..Click to get help!..Clique para obter ajuda..Click to return to previous screen..Clique para retroceder..Click to go to next screen..Clique para avan.ar..Hide password..Ocultar palavra-chave..Save project..Guardar projecto..Close current project?..Fechar o projecto em curso?..Delete this project?..Apagar este projecto?..Delete empty project %s?..Apagar o projecto vazio %s?..Action not yet implemented..Fun..o n.o dispon.vel..Error deleting this project..Erro ao apagar o projecto..Select a rule for the filter..Escolha uma regra para o filtro..Enter keywords for t

    C:\Program Files\WinHTTrack\lang\Romanian.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (876), with CRLF line terminators
    Category:dropped
    Size (bytes):37452
    Entropy (8bit):4.987636872468069
    Encrypted:false
    SSDEEP:768:roGCNDxN0Q4Ue44HGKElNmkIXNsW6oz1Kjyi9tGuEluA:roGCNDDD4B44m116NBIjyctGuM
    MD5:EDE7B2C37A0C3472D852CE02100358BB
    SHA1:4154D826B7538529EBBD83C68A5359D7285CD5AC
    SHA-256:BFD69281D5F4CD0A65A449DD5F7251F513C0019D7835AE81EFC8A11EE4A58CE8
    SHA-512:4969E992C3DB7B6EA94C4558FE7DFF24622F769C7A02EAFBA4FB3A35D099A9314E9D28275E9766B337D498E5263BD6F3A87520C4A76666D7E9D902848B01BD33
    Malicious:false
    Preview:LANGUAGE_NAME..Romanian..LANGUAGE_FILE..Romanian..LANGUAGE_ISO..ro..LANGUAGE_AUTHOR..Alin Gheorghe Miron (miron.alin@personal.ro)..LANGUAGE_CHARSET..ISO-8859-1..LANGUAGE_WINDOWSID..Romanian..OK..LANGUAGE_WINDOWSID..Cancel..Anuleaz...Exit..Ie.ire..Close...nchide..Cancel changes..Anuleaz. schimb.rile..Click to confirm..Click pentru confirmare...Click to get help!..Click pentru ajutor!..Click to return to previous screen..Click pentru revenire la fereastra precedent...Click to go to next screen..Click pentru a trece la fereastra urm.toare!..Hide password..Ascunde parola..Save project..Salveaz. proiect..Close current project?...nchid proiectul curent?..Delete this project?...terg acest proiect?..Delete empty project %s?...terg proiectul gol %s?..Action not yet implemented..Func.ia nu este .nc. implementat...Error deleting this project..Eroare la .tergerea acestui proiect..Select a rule for the filter..Selecta.i o regul. pentru filtrare..Enter keywords for the filter..Introduce.i un cuv.nt

    C:\Program Files\WinHTTrack\lang\Russian.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (863), with CRLF line terminators
    Category:dropped
    Size (bytes):36107
    Entropy (8bit):5.819976195985686
    Encrypted:false
    SSDEEP:768:QvN+xNt0gSoPIhjM5lHprRqj/GmTITnquTF3UNRVj:QvN+DFSe59pELYnfTwVj
    MD5:CD60AA19CC2D970F4DD6A7C2255C220D
    SHA1:AD223433866ECAAF331F1CCB0B1CDF93F47FED2F
    SHA-256:C1C8B5DBD1AAF244387D4B45B7BAF3DA3A4E059EC69310ECE7CAEF78569A0704
    SHA-512:045F3F426EA90EFC473E08A2319DBB7C00A80D69A1F21214CAA0E5C62FB046C48D2BE298F2481DE2A20865CBF927F27745B19029E769DB44B2C00041300962C6
    Malicious:false
    Preview:LANGUAGE_NAME..Russian..LANGUAGE_FILE..Russian..LANGUAGE_ISO..ru..LANGUAGE_AUTHOR..Andrei Iliev (iliev at vitaplus.ru) \r\n..LANGUAGE_CHARSET..windows-1251..LANGUAGE_WINDOWSID..Russian..OK..OK..Cancel..........Exit.........Close...........Cancel changes.......... ...........Click to confirm...............Click to get help!.......... .........Click to return to previous screen........... .......Click to go to next screen......... . .......... ........Hide password........ ........Save project........... ........Close current project?......... ....... ......?..Delete this project?......... .... ......?..Delete empty project %s?......... ...... ...... %s?..Action not yet implemented...... .. .............Error deleting this project........ ........ .........Select a rule for the filter......... ... .........Enter keywords for the filter......... ........ ....... .........Cancel..........Add this rule.......... ... .........Please enter one or several keyword(s) for the rule......... .....

    C:\Program Files\WinHTTrack\lang\Slovak.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Non-ISO extended-ASCII text, with very long lines (791), with CRLF line terminators
    Category:dropped
    Size (bytes):34711
    Entropy (8bit):5.242569056702732
    Encrypted:false
    SSDEEP:768:uGJBNmxNmgWuBTP+JGDl1rbSNrzosk0HjRKj8+bCB57Z:uqBNmD5xl+ClBY7K8+bCB57Z
    MD5:3193362CEF5A0C51EB04AE84B95A54FE
    SHA1:F35522E0ABFBEC87F4C8A8B1B7A919AD4AEB78B7
    SHA-256:33944345DF041E26ECF51156CB53B8FA21D4B526FF55806469152F7ED6DE4C2E
    SHA-512:F6EB73B42527993E3747FC7B7C0D22A382A7ACC2BCCC5F2D7EFE7C6AD6061F7D5DF0D855290FD45CB15EED3D42702D4578E577383391F1FD858E3F1A242A0E87
    Malicious:false
    Preview:LANGUAGE_NAME..Slovak..LANGUAGE_FILE..Slovak..LANGUAGE_ISO..sk..LANGUAGE_AUTHOR..Dr. Martin Sereday (sereday at stonline.sk)\r\n..LANGUAGE_CHARSET..ISO-8859-2..LANGUAGE_WINDOWSID..Slovak..OK...no..Cancel..Zru.i...Exit..Ukon.i...Close..Zatvori...Cancel changes..Zru.i. zmeny..Click to confirm..Potvrdi. zmeny..Click to get help!..Pomoc..Click to return to previous screen..Predch.dzaj.ca obrazovka..Click to go to next screen..Nasleduj.ca obrazovka..Hide password..Skry. heslo..Save project..Ulo.i. projekt..Close current project?..Zatvori. projekt?..Delete this project?..Vymaza. projekt?..Delete empty project %s?..Vymaza. pr.zdne projekty?..Action not yet implemented..Akcia zatia. nebola zaraden...Error deleting this project..Chyba pri mazan. projektu..Select a rule for the filter..Vybra. pravidlo filtra..Enter keywords for the filter..Vlo.i. k...ov. slovo pre filter..Cancel..Zru.i...Add this rule..Prida. toto pravidlo..Please enter one or several keyword(s) for the rule..Vlo. jedno alebo ni

    C:\Program Files\WinHTTrack\lang\Slovenian.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Non-ISO extended-ASCII text, with very long lines (736), with CRLF line terminators
    Category:dropped
    Size (bytes):34388
    Entropy (8bit):5.040392159560872
    Encrypted:false
    SSDEEP:768:IYpqnD5gN7BjxN7RgKXPKTjWlHxiy09Qpi9Mfmyh3ndFd5y7F:IYknDWN7BjD7qKXPDlRA6Glm/d07F
    MD5:54F59EDBBF80BCF2BE3569664BFF9752
    SHA1:FEA1F69385DCC035D9EE7CC4AA7F8CEDD0751396
    SHA-256:D8FE9C28315C794075392F4474A810408FDE6E191AFA190E3203076F84AAB876
    SHA-512:CAC5F817D8ECB28191C71E2621A0E0ECBD8B2CCA4351BBE2317C6C5EB88BE84EB21A87729203657DE0C6A9D6049F19F0612FE4002F39840981C420198E9E7E0B
    Malicious:false
    Preview:LANGUAGE_NAME..Slovenian..LANGUAGE_FILE..Slovenian..LANGUAGE_ISO..si..LANGUAGE_AUTHOR..Jadran Rudec,iur.\r\njrudec@email.si \r\n..LANGUAGE_CHARSET..ISO-8859-1..LANGUAGE_WINDOWSID..Slovenian..OK..Vredu..Cancel..Opusti..Exit..Izhod..Close..Zapri..Cancel changes..Opusti spremembe..Click to confirm..Klikni za potrditev..Click to get help!..Klikni za pomo.!..Click to return to previous screen..Klikni za vrnitev na prej.nji zaslon..Click to go to next screen..Klikni za prehod na naslednji zaslon..Hide password..Skrij geslo..Save project..Shrani projekt..Close current project?..Zaprem teko.i projekt?..Delete this project?..Zbri.em ta projekt?..Delete empty project %s?..Zbri.em prazen projekt %s?..Action not yet implemented..Dogodek .e ni predviden..Error deleting this project..Napaka med brisanjem tega projekta..Select a rule for the filter..Izberi pravilo za filtriranje..Enter keywords for the filter..Vpi.ite klju.no besedo filtriranja..Cancel..Opusti..Add this rule..Dodaj to pravilo..Please

    C:\Program Files\WinHTTrack\lang\Svenska.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (736), with CRLF line terminators
    Category:dropped
    Size (bytes):34729
    Entropy (8bit):5.05090467897492
    Encrypted:false
    SSDEEP:768:HdudNrxNoFRDyTSSx7YPUhg2R9QRlB3dqggGH:HdINrDQRGJtYJk9is1GH
    MD5:6F5F5907823AFCDB9570D09868650DA9
    SHA1:F7B449BEBA331E2C7C0A3C468D25F06CD9EAA35E
    SHA-256:013FA5AA8BABECDE21B3AF3AD14D8B27B87DF646A970143A60FD5BC7E3F00ADE
    SHA-512:C6765E10A90A49BC310EFA0802FC77C0C881CFA20FFD5BFD04D745CCD24D5F90300F32E2137B352F70AE1755F1A2DD9ACB5ACE455EF20D41D96B78C5ED3821EC
    Malicious:false
    Preview:LANGUAGE_NAME..Svenska..LANGUAGE_FILE..Svenska..LANGUAGE_ISO..sv..LANGUAGE_AUTHOR..Staffan Str.m (staffan at fam-strom.org) \r\n..LANGUAGE_CHARSET..ISO-8859-2..LANGUAGE_WINDOWSID..Swedish..OK..OK..Cancel..Annulera..Exit..Avsluta..Close..St.ng..Cancel changes...ngra .ndringarna..Click to confirm..Klicka f.r att bekr.fta..Click to get help!..Klicka f.r att f. hj.lp!..Click to return to previous screen..Klicka f.r att g. till f.reg.ende bild..Click to go to next screen..Klicka f.r att se n.sta bild..Hide password..D.lj l.senord..Save project..Spara projekt..Close current project?..St.ng aktuellt projekt?..Delete this project?..Radera detta projekt?..Delete empty project %s?..Radera tomt projekt %s?..Action not yet implemented..Denna funktion .r inte utvecklad .nnu..Error deleting this project..Ett fel uppstod vid radering av detta projekt..Select a rule for the filter..V.lj vilken regel som skall g.lla f.r detta filter..Enter keywords for the filter..Skriv in ett nyckelord f.r detta filte

    C:\Program Files\WinHTTrack\lang\Turkish.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (894), with CRLF line terminators
    Category:dropped
    Size (bytes):35827
    Entropy (8bit):5.096590190231921
    Encrypted:false
    SSDEEP:384:dCth6POWhmpxkcUfFtAhtt0t1RX58lwjoPivXuqP7Gn3yLIbBztFQKX57N2Awf1M:MaexKK0XRMa2qP7Gn3ykRtFzB5UfZz4P
    MD5:C7BDD1E8547EDAE639492932B0420933
    SHA1:D8240E8BFFF420B750221C7E076E74917FFE704D
    SHA-256:A136C01403A31D4AF914CC3AE339F8C933F7BAF0E47700F911B7DD4ABC96DE56
    SHA-512:F785FE3011F78E197E86AE2064B6CBDB9F7D43B339CA7538C6A1F8F5EC065686967D4D5E72565909AF5EDF5C47000FF51E36424377F35A00967DBDDD5A235F95
    Malicious:false
    Preview:LANGUAGE_NAME..Turkish..LANGUAGE_FILE..Turkish..LANGUAGE_ISO..tr..LANGUAGE_AUTHOR..Arman (Armish) Aksoy <armish@linux-sevenler.de>\r\n..LANGUAGE_CHARSET..ISO-8859-9..LANGUAGE_WINDOWSID..Turkish..OK..Tamam..Cancel..Vazge...Exit....k....Close..Kapat..Cancel changes..De.i.ikleri Kaydetme..Click to confirm..Onaylamak i.in T.klay.n..Click to get help!..Yard.m almak i.in T.klay.n..Click to return to previous screen...nceki ekrana d.nmek i.in t.klay.n..Click to go to next screen..Sonraki ekrana gitmek i.in t.klay.n..Hide password..Parolay. Gizle..Save project..Projeyi Kaydet..Close current project?..A..k proje kapat.ls.n m.?..Delete this project?..Bu proje silinsin mi?..Delete empty project %s?..%s bo. projesi silinsin mi?..Action not yet implemented..Eylem hen.z uygulanmad...Error deleting this project..Bu proje silinirken hata olu.tu..Select a rule for the filter..Filtre i.in bir kural se.in..Enter keywords for the filter..Filtre i.in anahtar kelimeleri giriniz..Cancel..Vazge...Add this rul

    C:\Program Files\WinHTTrack\lang\Ukrainian.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (807), with CRLF line terminators
    Category:dropped
    Size (bytes):35287
    Entropy (8bit):5.83471162156965
    Encrypted:false
    SSDEEP:768:vpfINRxNdEky6SlYejos8aw5RftXIXItLb9VWlUO+1t:vRINRDukLSPQa4NeI1xtt
    MD5:2C87BA4C71DB04DF5A2877980E2634A3
    SHA1:8CC30C3DDC6283434B35A9E898F9126AEEB93681
    SHA-256:61E00EE1D513E8B81C9D5CF5F153A57782EFC56EE30751DD5793943FD8775EE8
    SHA-512:DF12AA8604C5E1304F4AC341C5E9F36F637606E1FA54049D1BB31BD4799B7DEDD5A32E3EBA3DECF7A44561F3A12CF2EB5E55AE9D0BB327CB4EDDF6A608A66645
    Malicious:false
    Preview:LANGUAGE_NAME..Ukrainian..LANGUAGE_FILE..Ukrainian..LANGUAGE_ISO..uk..LANGUAGE_AUTHOR..Andrij Shevchuk (http://programy.com.ua, http://vic-info.com.ua) \r\n..LANGUAGE_CHARSET..ISO-8859-5..LANGUAGE_WINDOWSID..Ukrainian..OK......Cancel.............Exit.........Close...........Cancel changes........... ......Click to confirm..............Click to get help!.......... ........Click to return to previous screen............. .......Click to go to next screen......... .. .......... ........Hide password......... ........Save project.......... ........Close current project?......... ........ ......?..Delete this project?.......... ... ......?..Delete empty project %s?.......... ....... ...... %s?..Action not yet implemented...... .. ............Error deleting this project......... ......... .........Select a rule for the filter......... ... .........Enter keywords for the filter........ ........ .... .........Cancel.............Add this rule........ .. .......Please enter one or several k

    C:\Program Files\WinHTTrack\lang\Uzbek.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Non-ISO extended-ASCII text, with very long lines (863), with CRLF line terminators
    Category:dropped
    Size (bytes):36867
    Entropy (8bit):5.690145383517876
    Encrypted:false
    SSDEEP:768:w+jN+xNtF0pi15Ag+EcUHj/5KC/IgrWEGvSww:w+jN+DwpiECpLTqBBw
    MD5:380B8B3B9346B992D44E28F110B65C8D
    SHA1:00437F70B7F17AFE903C1BF306F7F97B2D9077C3
    SHA-256:CD9A531A626AB1D30B5A1E7BC670CABC019C89A842BF28CA5C0333210B5F3A64
    SHA-512:5E08766AA8DF076AE92BA7F0232423EF281FA52CBA03581A028B0E6075B5F909AFCB4F1EC5C3D624D98CCD6ABFD70A723C209FA8A52EB283EFAAC8D983ADA914
    Malicious:false
    Preview:LANGUAGE_NAME..Uzbek Latin..LANGUAGE_FILE..Uzbek..LANGUAGE_ISO..uz..LANGUAGE_AUTHOR..Shamsiddinov Zafar (zfrx94 at mail.ru) \r\n..LANGUAGE_CHARSET..windows-1251..LANGUAGE_WINDOWSID..Uzbek Latin..OK..OK..Cancel..Bekor qilmoq..Exit..Chiqish..Close..Yopmoq..Cancel changes..O.zgarishlarni bekor qilmoq..Click to confirm..Tasdiqlamoq..Click to get help!..Yordam olmoq..Click to return to previous screen..Ortga qaytmoq..Click to go to next screen..Keyingi ekranga o.tish..Hide password..Parolni berkitmoq..Save project..Loyihani saqlamoq..Close current project?..Joriy loyiha yopilsinmi?..Delete this project?..Ushbu loyiha o.chirilsinmi?..Delete empty project %s?..Bo.sh %s loyihasi o.chirilsinmi?..Action not yet implemented..Hozircha tadbiq etilmagan..Error deleting this project..Loyihani o.chirishda xatolik..Select a rule for the filter..Filtr turini tanlamoq..Enter keywords for the filter..Filtr uchun qiymat kiritish..Cancel..Bekor qilmoq..Add this rule..Bu shartni qo.shmoq..Please enter one or

    C:\Program Files\WinHTTrack\lang\is-11F9P.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with very long lines (736), with CRLF line terminators
    Category:dropped
    Size (bytes):35733
    Entropy (8bit):4.966728462500255
    Encrypted:false
    SSDEEP:768:eKUNnxNx27UUTDNyRTxHXVbYc/ZE7FcVqvcTF:eKUNnDU7UUYTPYBF8TF
    MD5:A14A4CA11CF545B5EACE077CDBC59E87
    SHA1:51F3046820B1114AB5896CC357554C6A4749EB96
    SHA-256:EEF49FF4DBBFC61BCCFCE89DA49DC8B46B3397EA504185A64069EBE1B033A75E
    SHA-512:263DB89EC7757DACE239234BC20C8050C9AB782F5F4222E730CDFB6EF4567E40372A56B1B66C33ABB40BE63C4D3F2F441B8F4B94911F1BC02A25F56A9FC38599
    Malicious:false
    Preview:LANGUAGE_NAME..English..LANGUAGE_FILE..English..LANGUAGE_ISO..en..LANGUAGE_AUTHOR..Xavier Roche (roche at httrack.com)\r\nRobert Lagadec (rlagadec at yahoo.fr) \r\n..LANGUAGE_CHARSET..ISO-8859-1..LANGUAGE_WINDOWSID..English (United States)..OK..OK..Cancel..Cancel..Exit..Exit..Close..Close..Cancel changes..Cancel changes..Click to confirm..Click to confirm..Click to get help!..Click to get help!..Click to return to previous screen..Click to return to previous screen..Click to go to next screen..Click to go to next screen..Hide password..Hide password..Save project..Save project..Close current project?..Close current project?..Delete this project?..Delete this project?..Delete empty project %s?..Delete empty project %s?..Action not yet implemented..Action not yet implemented..Error deleting this project..Error deleting this project..Select a rule for the filter..Select a rule for the filter..Enter keywords for the filter..Enter keywords for the filter..Cancel..Cancel..Add this rule..Add

    C:\Program Files\WinHTTrack\lang\is-1KI38.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (744), with CRLF line terminators
    Category:dropped
    Size (bytes):36454
    Entropy (8bit):5.213721439431982
    Encrypted:false
    SSDEEP:768:rNDNvxNFWyTfpdgBrhkTuthHUydhUuX2V:hDNvDMyT0iMndao2V
    MD5:C761F709A53C3F80E94B77644500878A
    SHA1:8AA674051E08DE990DC21288738435C1333255CE
    SHA-256:7A9AB192D1C5665D6C89889F260BCBCF266C3DA75416B60C3E1F1158BB341E4A
    SHA-512:733DCF277897F2180170E9E01A300B4DC4EB96CBD08E4B973CDEEFF1316DEA4D0AE366E5CE6A99C04D1B17AAE0217F230EE54040B455ED1D3EF9D3303D1EAE5E
    Malicious:false
    Preview:LANGUAGE_NAME..Magyar..LANGUAGE_FILE..Magyar..LANGUAGE_ISO..hu..LANGUAGE_AUTHOR..Jozsef Tamas Herczeg (hdodi at freemail.hu) \r\n..LANGUAGE_CHARSET..ISO-8859-2..LANGUAGE_WINDOWSID..Hungarian..OK..OK..Cancel..M.gse..Exit..Kil.p.s..Close..Bez.r.s..Cancel changes..T.rli a m.dos.t.sokat..Click to confirm..Kattintson r. a meger.s.t.shez..Click to get help!..Kattintson r. seg.ts.g.rt!..Click to return to previous screen..Az el.z. k.perny.h.z visz vissza..Click to go to next screen..A k.vetkez. k.perny.re visz..Hide password..Jelsz. titkos.t.sa..Save project..Projekt ment.se..Close current project?..Bez.rja az aktu.lis projektet?..Delete this project?..T.rli ezt a projektet?..Delete empty project %s?..T.rli a(z) %s .res projektet?..Action not yet implemented..A m.velet m.g nem haszn.lhat...Error deleting this project..Hiba a projekt t.rl.sekor..Select a rule for the filter..Jel.lj.n ki szab.lyt a sz.r.h.z..Enter keywords for the filter..Itt .rja be a sz.r. kulcsszavait..Cancel..M.gse..Add thi

    C:\Program Files\WinHTTrack\lang\is-28P7N.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Non-ISO extended-ASCII text, with very long lines (863), with CRLF line terminators
    Category:dropped
    Size (bytes):36867
    Entropy (8bit):5.690145383517876
    Encrypted:false
    SSDEEP:768:w+jN+xNtF0pi15Ag+EcUHj/5KC/IgrWEGvSww:w+jN+DwpiECpLTqBBw
    MD5:380B8B3B9346B992D44E28F110B65C8D
    SHA1:00437F70B7F17AFE903C1BF306F7F97B2D9077C3
    SHA-256:CD9A531A626AB1D30B5A1E7BC670CABC019C89A842BF28CA5C0333210B5F3A64
    SHA-512:5E08766AA8DF076AE92BA7F0232423EF281FA52CBA03581A028B0E6075B5F909AFCB4F1EC5C3D624D98CCD6ABFD70A723C209FA8A52EB283EFAAC8D983ADA914
    Malicious:false
    Preview:LANGUAGE_NAME..Uzbek Latin..LANGUAGE_FILE..Uzbek..LANGUAGE_ISO..uz..LANGUAGE_AUTHOR..Shamsiddinov Zafar (zfrx94 at mail.ru) \r\n..LANGUAGE_CHARSET..windows-1251..LANGUAGE_WINDOWSID..Uzbek Latin..OK..OK..Cancel..Bekor qilmoq..Exit..Chiqish..Close..Yopmoq..Cancel changes..O.zgarishlarni bekor qilmoq..Click to confirm..Tasdiqlamoq..Click to get help!..Yordam olmoq..Click to return to previous screen..Ortga qaytmoq..Click to go to next screen..Keyingi ekranga o.tish..Hide password..Parolni berkitmoq..Save project..Loyihani saqlamoq..Close current project?..Joriy loyiha yopilsinmi?..Delete this project?..Ushbu loyiha o.chirilsinmi?..Delete empty project %s?..Bo.sh %s loyihasi o.chirilsinmi?..Action not yet implemented..Hozircha tadbiq etilmagan..Error deleting this project..Loyihani o.chirishda xatolik..Select a rule for the filter..Filtr turini tanlamoq..Enter keywords for the filter..Filtr uchun qiymat kiritish..Cancel..Bekor qilmoq..Add this rule..Bu shartni qo.shmoq..Please enter one or

    C:\Program Files\WinHTTrack\lang\is-2PGQC.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Non-ISO extended-ASCII text, with very long lines (822), with CRLF, NEL line terminators
    Category:dropped
    Size (bytes):36449
    Entropy (8bit):5.179068415594699
    Encrypted:false
    SSDEEP:768:jjcsUE8JEx8k21A1vQmyAsDu52whDP6TBysHuw+vl:jjcsUE8JEO71AvPWKFh4Huwgl
    MD5:FF7C57587A4C98644040A427FD5EBB19
    SHA1:DF3F36C9050E6907EE8C5374639F99B049A86795
    SHA-256:4EDE4FFC4259276511C13335BA14FA5D918147FE790199610C163B1489DBD508
    SHA-512:05FE80928C497EDF65AE1E624D8AB098ECFD4A58EBDD3E3A24083DE696CF1A9DD571EBBB5BD8AA55090DE8E8E50F80A9C3AF256239AFF125C26AF6BCA04E97DE
    Malicious:false
    Preview:LANGUAGE_NAME..Polski..LANGUAGE_FILE..Polski..LANGUAGE_ISO..pl..LANGUAGE_AUTHOR..Lukasz Jokiel (Opole University of Technology, Lukasz.Jokiel at po.opole.pl) \r\n..LANGUAGE_CHARSET..ISO-8859-2..LANGUAGE_WINDOWSID..Polish..OK..OK..Cancel..Anuluj..Exit..Wyj.cie..Close..Zamknij..Cancel changes..Cofnij zmiany..Click to confirm..Kliknij aby potwierdzi...Click to get help!..Kliknij aby uzyska. pomoc..Click to return to previous screen..Kliknij aby wr.ci...Click to go to next screen..Kliknij aby kontynuowa...Hide password..Ukryj has.o..Save project..Zachowaj projekt..Close current project?..Czy zamkn.. ten projekt ?..Delete this project?..Czy usun.. ten projekt ?..Delete empty project %s?..Czy usun.. pusty projekt %s?..Action not yet implemented..Funcja jeszcze nie zaimplementowana...Error deleting this project..Wyst.pi. b..d podczas usuwania tego projektu...Select a rule for the filter..Wybierz regu.. dla tego filtra..Enter keywords for the filter..Podaj s.owa kluczowe dla filtra..Cancel..An

    C:\Program Files\WinHTTrack\lang\is-3BUKN.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):196
    Entropy (8bit):4.844601304020977
    Encrypted:false
    SSDEEP:6:ri7Na5QXqlYmq2BNa5K5FYakFfsx6h5ZBrBE:ric5Uety5nEK5rrBE
    MD5:94A99573D5811367E1FE93B1B2512A28
    SHA1:C21572C8A75248535A84D6AC52B2D02BC54DCEC2
    SHA-256:963CD5F2FC210EE382E77E9FB55F2F9EFCEE248BCFE1F1268814F8FA7533939F
    SHA-512:ED8CD6D14BCFA6A6BC4296CAD959DB070B9E8AE9A0DF98B9FC3B335FFCBB2E3B893AF27A08312690A8C7F5A5356BFBAB5087A29A09F563594957E8F68D7D431F
    Malicious:false
    Preview:..langdir = $(datadir)/httrack/lang..lang_DATA = *.txt..langrootdir = $(datadir)/httrack..langroot_DATA = ../lang.def ../lang.indexes....EXTRA_DIST = $(lang_DATA) $(langroot_DATA)....#dist-hook:..

    C:\Program Files\WinHTTrack\lang\is-476N1.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (828), with CRLF line terminators
    Category:dropped
    Size (bytes):36862
    Entropy (8bit):5.743754276673443
    Encrypted:false
    SSDEEP:768:5YPWsKAxNFVdLfTcgUcQcxcH+XJvwrB3QzuuKD9siCNZ3QNR3pT:56WsKAD1LfTcNXocHkweuuKD9/NR3pT
    MD5:2D72148555DE5406C42AED1DE12E1A62
    SHA1:B0E3EB55FD1BFD20163E10532B2F7490DECDB5E1
    SHA-256:5A47832F2BE8B03A1B30B9B52A7785B1921F289F4DCEA9977A5AC51537CAAD31
    SHA-512:620F04F8ED14AD3211E9BE354126CC58F5F2CC125EE5DA3AFE6B3484079307181E54C238FD740FC9A8D88DECA13BE4AD3A73C58A66CD15B3563D6ED0EE0C239C
    Malicious:false
    Preview:LANGUAGE_NAME..Bulgarian..LANGUAGE_FILE..Bulgarian..LANGUAGE_ISO..bg..LANGUAGE_AUTHOR...... ...... [ilia@infomat-bg.com]\r\n..LANGUAGE_CHARSET..windows-1251..LANGUAGE_WINDOWSID..Bulgarian..OK......Cancel.........Exit.........Close...........Cancel changes........ ...........Click to confirm............Click to get help!.... .......Click to return to previous screen......... ... .......... ..........Click to go to next screen..... ......... ..........Hide password....... ..........Save project........ .........Close current project?......... ....... ........?..Delete this project?........ .......?..Delete empty project %s?........ ....... ...... %s?..Action not yet implemented............ . .............Error deleting this project........ ... ........... .. .........Select a rule for the filter........ ....... .. .........Enter keywords for the filter........ ....... .... .. .........Cancel.........Add this rule........ .... .........Please enter one or several keyword(s) for the rule..

    C:\Program Files\WinHTTrack\lang\is-582RK.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (930), with CRLF line terminators
    Category:dropped
    Size (bytes):37554
    Entropy (8bit):4.942746405092299
    Encrypted:false
    SSDEEP:768:0cNTxNx/nFzBawT7QhPcHpgnEpRpXhJv7X7HO2R0L3TBL:0cNTD1nFz3T3HpzzJXHO2R0L3TBL
    MD5:CB6AC9470A0208EBDE3456EFC1259821
    SHA1:CE03AE3725AAE1B66E7AE42F3018ECB0C8868447
    SHA-256:2A3788FC0C8765C52BBA51BC49F8EFB8D16815F2D8EB413F4C66AF3CC636EFE3
    SHA-512:29A94F0E934A1BC52C41EDB728061A1FD7BC378F729CBA49339005653FF3AE36BDC4BA4C902298EF8577A571B81FD031C430D6E15B57007E1CB8D5F045DB09DA
    Malicious:false
    Preview:LANGUAGE_NAME..Castellano..LANGUAGE_FILE..Castellano..LANGUAGE_ISO..es..LANGUAGE_AUTHOR..Juan Pablo Barrio Lera (Universidad de Le.n) \r\n..LANGUAGE_CHARSET..ISO-8859-1..LANGUAGE_WINDOWSID..Spanish (Spain, Modern Sort)..OK..Ya..Cancel..Cancelar..Exit..Salir..Close..Cerrar..Cancel changes..Cancelar los cambios..Click to confirm..Haga click para confirmar..Click to get help!..Haga click para obtener ayuda..Click to return to previous screen..Haga click para volver atr.s..Click to go to next screen..Haga click para pasar a la siguiente pantalla..Hide password..Ocultar palabra clave..Save project..Guardar proyecto..Close current project?...Cerrar el proyecto actual?..Delete this project?...Borrar este proyecto?..Delete empty project %s?...Borrar el proyecto vac.o %s?..Action not yet implemented..Acci.n a.n no implementada..Error deleting this project..Error al borrar este proyecto..Select a rule for the filter..Escoja una regla para el filtro..Enter keywords for the filter..Escriba aqu. u

    C:\Program Files\WinHTTrack\lang\is-5LSTG.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (826), with CRLF line terminators
    Category:dropped
    Size (bytes):36935
    Entropy (8bit):5.006654717517556
    Encrypted:false
    SSDEEP:384:AHqBjhBQPxQiUPg5slht7g80tu9Gjb7h6zh2uLf+VsMIGXjrYLLpOmQzdYBRAK3z:AHG8xceg0LrLDTruLpuzewulAlhBK3J
    MD5:B319AA85AC5B40B678927EC646010E6B
    SHA1:357A120C1D1927477116CFCCAA6863177C039D9F
    SHA-256:D0B1868C3FC776367C3A0BB49E4A6217390860152FA26D29274257E0BCAAF788
    SHA-512:3D1DFC0D08AAE7F1FFDEC01145795FFBBF3B7B1DB4432546E2EC16C184B719597415860156396F55F781E442BA874AC76FEAA710A60B28B7F8747C3CADC3DC8B
    Malicious:false
    Preview:LANGUAGE_NAME..Portugu.s-Brasil..LANGUAGE_FILE..Portugues-Brasil..LANGUAGE_ISO..pt_BR..LANGUAGE_AUTHOR..Paulo Neto (layoutbr at lexxa.com.br) \r\n..LANGUAGE_CHARSET..ISO-8859-1..LANGUAGE_WINDOWSID..Portuguese (Brazil)..OK..OK..Cancel..Cancelar..Exit..Sair..Close..Fechar..Cancel changes..Cancelar altera..es..Click to confirm..Clique para confirmar..Click to get help!..Clique para obter ajuda..Click to return to previous screen..Clique para voltar..Click to go to next screen..Clique para prosseguir..Hide password..Ocultar senha..Save project..Salvar projeto..Close current project?..Fechar o projeto atual?..Delete this project?..Excluir este projeto?..Delete empty project %s?..Excluir o projeto vazio %s?..Action not yet implemented..A..o ainda n.o implementada..Error deleting this project..Erro ao excluir este projeto..Select a rule for the filter..Escolha uma regra para o filtro..Enter keywords for the filter..Digite aqui as palavras para filtrar..Cancel..Cancelar..Add this rule..Adicion

    C:\Program Files\WinHTTrack\lang\is-7GK14.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (741), with CRLF line terminators
    Category:dropped
    Size (bytes):35974
    Entropy (8bit):4.942435925293232
    Encrypted:false
    SSDEEP:768:H0pNExNgvpwNHhjZHNlAEGq/5XGfxozVjxPgeex:UpNEDGpaj2EGiXwGzzPKx
    MD5:56BBD1272E88D2A46E1C13B4ACF72ADB
    SHA1:E0A94AA8B6A1E1EF6A80C1A1380967424422616B
    SHA-256:B2465B6A29FF61FFB9B502BEB0D1A87552B799FE844BEBCF9A60D112E399F0B5
    SHA-512:9612888BAD9D2185CBD3FD003131274D49A662E7DF13F61FE4B8F8384637850162C962D88A4061C322F537E7317524B69A6224878DBE569842E6D2513678AF5A
    Malicious:false
    Preview:LANGUAGE_NAME..Nederlands..LANGUAGE_FILE..Nederlands..LANGUAGE_ISO..nl..LANGUAGE_AUTHOR..Rudi Ferrari (Wyando at netcologne.de) \r\n..LANGUAGE_CHARSET..ISO-8859-1..LANGUAGE_WINDOWSID..Dutch (Netherlands)..OK..OK..Cancel..Annuleren..Exit..Be.indigen..Close..Sluiten..Cancel changes..Veranderingen annuleren..Click to confirm..Veranderingen bevestigen..Click to get help!..Klik hier voor help..Click to return to previous screen..Klik voor vorig scherm..Click to go to next screen..Klik voor volgend scherm..Hide password..Verberg wachtwoord..Save project..Project wegschrijven..Close current project?..Actueel project sluiten?..Delete this project?..Dit project wissen?..Delete empty project %s?..Leeg project %s wissen?..Action not yet implemented..Functie nog niet ter beschikking...Error deleting this project..Fout bij het wissen van dit project...Select a rule for the filter..Kies een regel voor de filter..Enter keywords for the filter..Geef hier de sleutelwoorden voor deze filter..Cancel..Ann

    C:\Program Files\WinHTTrack\lang\is-88N9G.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Non-ISO extended-ASCII text, with very long lines (829), with CRLF, NEL line terminators
    Category:dropped
    Size (bytes):34383
    Entropy (8bit):6.04371316296568
    Encrypted:false
    SSDEEP:768:/olJ4cnNmxNVI/1kp+ZAaHiYFbdEdhRs4qKIe3WIruEco4e7w93Tv:/olJ48NmDq/1kpsAaHicJEfRCfebr734
    MD5:10610B310BE04DEF9C97B33F896BA2F7
    SHA1:FF9F30476216DF80E809D9789F99BA1E1CC4530E
    SHA-256:A0A1CFD990C02D931CA8BB29DFFCFAF9FFD85D6022C75B84AF480DB2BFE798A8
    SHA-512:4DF5C36DDFAB0A1BAB448DCF71EA28E30AFB6343B319C79BF238D1366A79DAA8BA52E2A98F027E60314795C3F791C5C942C84314EC7121A4F34B6EAD982CC62B
    Malicious:false
    Preview:LANGUAGE_NAME..Japanese..LANGUAGE_FILE..Japanese..LANGUAGE_ISO..ja..LANGUAGE_AUTHOR..TAPKAL\r\n..LANGUAGE_CHARSET..shift-jis..LANGUAGE_WINDOWSID..Japanese..OK..OK..Cancel...L.....Z....Exit...I....Close.........Cancel changes....X...L.....Z....Click to confirm...N...b.N....m.F..Click to get help!...N...b.N....w...v!..Click to return to previous screen...N...b.N....O.........Click to go to next screen...N...b.N..........i....Hide password...p.X...[.h...B....Save project...v...W.F.N.g......Close current project?.......v...W.F.N.g...........?..Delete this project?......v...W.F.N.g...........?..Delete empty project %s?......v...W.F.N.g%s ...........?..Action not yet implemented...@.\.....................Error deleting this project......v...W.F.N.g.......s.........Select a rule for the filter...t.B...^....[....I...............Enter keywords for the filter...t.B...^...L.[...[.h.................Cancel...L.....Z....Add this rule........[.....

    C:\Program Files\WinHTTrack\lang\is-A932F.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (863), with CRLF line terminators
    Category:dropped
    Size (bytes):36107
    Entropy (8bit):5.819976195985686
    Encrypted:false
    SSDEEP:768:QvN+xNt0gSoPIhjM5lHprRqj/GmTITnquTF3UNRVj:QvN+DFSe59pELYnfTwVj
    MD5:CD60AA19CC2D970F4DD6A7C2255C220D
    SHA1:AD223433866ECAAF331F1CCB0B1CDF93F47FED2F
    SHA-256:C1C8B5DBD1AAF244387D4B45B7BAF3DA3A4E059EC69310ECE7CAEF78569A0704
    SHA-512:045F3F426EA90EFC473E08A2319DBB7C00A80D69A1F21214CAA0E5C62FB046C48D2BE298F2481DE2A20865CBF927F27745B19029E769DB44B2C00041300962C6
    Malicious:false
    Preview:LANGUAGE_NAME..Russian..LANGUAGE_FILE..Russian..LANGUAGE_ISO..ru..LANGUAGE_AUTHOR..Andrei Iliev (iliev at vitaplus.ru) \r\n..LANGUAGE_CHARSET..windows-1251..LANGUAGE_WINDOWSID..Russian..OK..OK..Cancel..........Exit.........Close...........Cancel changes.......... ...........Click to confirm...............Click to get help!.......... .........Click to return to previous screen........... .......Click to go to next screen......... . .......... ........Hide password........ ........Save project........... ........Close current project?......... ....... ......?..Delete this project?......... .... ......?..Delete empty project %s?......... ...... ...... %s?..Action not yet implemented...... .. .............Error deleting this project........ ........ .........Select a rule for the filter......... ... .........Enter keywords for the filter......... ........ ....... .........Cancel..........Add this rule.......... ... .........Please enter one or several keyword(s) for the rule......... .....

    C:\Program Files\WinHTTrack\lang\is-AA268.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:makefile script, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):16180
    Entropy (8bit):5.559217365808289
    Encrypted:false
    SSDEEP:384:wt4l3bfVcRBCfxEnoA4z+ZReTFkReT5RrwRJgURUmBeyrQK7:sGrfVcRBCfxg4z+ZReT+ReT3rwRJgURp
    MD5:E46E3DF5DBBE2A7CBEF5C32C3CEB1313
    SHA1:29F26C9FEF2D24FD9829E404DAE4FFC83DBD9FB1
    SHA-256:E88D0D817B7A1D86C31CDABBE318B8C77B3237AB799B290966E405AF6673E2D9
    SHA-512:D14BE9DA997CC30E6A9DD2B901FC82B97CC45240578CEB37A10BF58C0556BEEE3D0DE756821E9800341835D9F8DDC33A23924D42553B2875FA838A5B1598B1FC
    Malicious:false
    Preview:# Makefile.in generated by automake 1.14.1 from Makefile.am...# @configure_input@....# Copyright (C) 1994-2013 Free Software Foundation, Inc.....# This Makefile.in is free software; the Free Software Foundation..# gives unlimited permission to copy and/or distribute it,..# with or without modifications, as long as this notice is preserved.....# This program is distributed in the hope that it will be useful,..# but WITHOUT ANY WARRANTY, to the extent permitted by law; without..# even the implied warranty of MERCHANTABILITY or FITNESS FOR A..# PARTICULAR PURPOSE.....@SET_MAKE@....VPATH = @srcdir@..am__is_gnu_make = test -n '$(MAKEFILE_LIST)' && test -n '$(MAKELEVEL)'..am__make_running_with_option = \.. case $${target_option-} in \.. ?) ;; \.. *) echo "am__make_running_with_option: internal error: invalid" \.. "target option '$${target_option-}' specified" >&2; \.. exit 1;; \.. esac; \.. has_opt=no; \.. sane_makeflags=$$MAKEFLAGS; \.. if $(am__is_gnu_ma

    C:\Program Files\WinHTTrack\lang\is-AEEAO.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (818), with CRLF line terminators
    Category:dropped
    Size (bytes):36664
    Entropy (8bit):4.896279859795108
    Encrypted:false
    SSDEEP:768:rO02ZBZNlxNgdzPoh3DT8GxDEJ0gcn+Sd7+kjMkxD3/jqrGr:rO02ZXNlDyPI3UGZgQZ/Lqqr
    MD5:52E391356D90AB78BDE70A89C5DBBE83
    SHA1:8D886E9179339BD110B5E6A551DF30AD68517232
    SHA-256:D887437151297DA21BF699529FAD5CD6747FB8C747DC97BCD24A48450549B032
    SHA-512:EB39BB8F618825AAA3665629B575DBB05E0520CF7884F30CF5E677EA3BBC00298D9D0BFDD3D17D9C067F03E800E6128781D86D88932367D08603F8EA140D9984
    Malicious:false
    Preview:LANGUAGE_NAME..Italiano..LANGUAGE_FILE..Italiano..LANGUAGE_ISO..it..LANGUAGE_AUTHOR..Witold Krakowski (wkrakowski at libero.it)\r\n..LANGUAGE_CHARSET..ISO-8859-1..LANGUAGE_WINDOWSID..Italian (Standard)..OK..Ok..Cancel..Annulla..Exit..Esci..Close..Chiudi..Cancel changes..Annulla modifiche..Click to confirm..Clicca per confermare..Click to get help!..Clicca qui per aiuto..Click to return to previous screen..Clicca per tornare indietro..Click to go to next screen..Clicca per passare allo schermo successivo..Hide password..Nascondi password..Save project..Salva il progetto..Close current project?..Chiudere il progetto corrente?..Delete this project?..Eliminare questo progetto?..Delete empty project %s?..Eliminare il progetto vuoto %s?..Action not yet implemented..Azione non ancora possibile..Error deleting this project..C'. stato un errore durante l'eliminazione di questo progetto..Select a rule for the filter..Seleziona le regole per il filtro..Enter keywords for the filter..Inserisci le

    C:\Program Files\WinHTTrack\lang\is-AVNH9.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (736), with CRLF line terminators
    Category:dropped
    Size (bytes):34729
    Entropy (8bit):5.05090467897492
    Encrypted:false
    SSDEEP:768:HdudNrxNoFRDyTSSx7YPUhg2R9QRlB3dqggGH:HdINrDQRGJtYJk9is1GH
    MD5:6F5F5907823AFCDB9570D09868650DA9
    SHA1:F7B449BEBA331E2C7C0A3C468D25F06CD9EAA35E
    SHA-256:013FA5AA8BABECDE21B3AF3AD14D8B27B87DF646A970143A60FD5BC7E3F00ADE
    SHA-512:C6765E10A90A49BC310EFA0802FC77C0C881CFA20FFD5BFD04D745CCD24D5F90300F32E2137B352F70AE1755F1A2DD9ACB5ACE455EF20D41D96B78C5ED3821EC
    Malicious:false
    Preview:LANGUAGE_NAME..Svenska..LANGUAGE_FILE..Svenska..LANGUAGE_ISO..sv..LANGUAGE_AUTHOR..Staffan Str.m (staffan at fam-strom.org) \r\n..LANGUAGE_CHARSET..ISO-8859-2..LANGUAGE_WINDOWSID..Swedish..OK..OK..Cancel..Annulera..Exit..Avsluta..Close..St.ng..Cancel changes...ngra .ndringarna..Click to confirm..Klicka f.r att bekr.fta..Click to get help!..Klicka f.r att f. hj.lp!..Click to return to previous screen..Klicka f.r att g. till f.reg.ende bild..Click to go to next screen..Klicka f.r att se n.sta bild..Hide password..D.lj l.senord..Save project..Spara projekt..Close current project?..St.ng aktuellt projekt?..Delete this project?..Radera detta projekt?..Delete empty project %s?..Radera tomt projekt %s?..Action not yet implemented..Denna funktion .r inte utvecklad .nnu..Error deleting this project..Ett fel uppstod vid radering av detta projekt..Select a rule for the filter..V.lj vilken regel som skall g.lla f.r detta filter..Enter keywords for the filter..Skriv in ett nyckelord f.r detta filte

    C:\Program Files\WinHTTrack\lang\is-CPA37.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (876), with CRLF line terminators
    Category:dropped
    Size (bytes):37452
    Entropy (8bit):4.987636872468069
    Encrypted:false
    SSDEEP:768:roGCNDxN0Q4Ue44HGKElNmkIXNsW6oz1Kjyi9tGuEluA:roGCNDDD4B44m116NBIjyctGuM
    MD5:EDE7B2C37A0C3472D852CE02100358BB
    SHA1:4154D826B7538529EBBD83C68A5359D7285CD5AC
    SHA-256:BFD69281D5F4CD0A65A449DD5F7251F513C0019D7835AE81EFC8A11EE4A58CE8
    SHA-512:4969E992C3DB7B6EA94C4558FE7DFF24622F769C7A02EAFBA4FB3A35D099A9314E9D28275E9766B337D498E5263BD6F3A87520C4A76666D7E9D902848B01BD33
    Malicious:false
    Preview:LANGUAGE_NAME..Romanian..LANGUAGE_FILE..Romanian..LANGUAGE_ISO..ro..LANGUAGE_AUTHOR..Alin Gheorghe Miron (miron.alin@personal.ro)..LANGUAGE_CHARSET..ISO-8859-1..LANGUAGE_WINDOWSID..Romanian..OK..LANGUAGE_WINDOWSID..Cancel..Anuleaz...Exit..Ie.ire..Close...nchide..Cancel changes..Anuleaz. schimb.rile..Click to confirm..Click pentru confirmare...Click to get help!..Click pentru ajutor!..Click to return to previous screen..Click pentru revenire la fereastra precedent...Click to go to next screen..Click pentru a trece la fereastra urm.toare!..Hide password..Ascunde parola..Save project..Salveaz. proiect..Close current project?...nchid proiectul curent?..Delete this project?...terg acest proiect?..Delete empty project %s?...terg proiectul gol %s?..Action not yet implemented..Func.ia nu este .nc. implementat...Error deleting this project..Eroare la .tergerea acestui proiect..Select a rule for the filter..Selecta.i o regul. pentru filtrare..Enter keywords for the filter..Introduce.i un cuv.nt

    C:\Program Files\WinHTTrack\lang\is-DPUQD.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Non-ISO extended-ASCII text, with very long lines (761), with CRLF line terminators
    Category:dropped
    Size (bytes):36643
    Entropy (8bit):5.676712460231925
    Encrypted:false
    SSDEEP:768:IviNzxNCGJUDtrKIuVEHkmDk4lESEQ7CiMVsU37MIKNzjpr+ap:IviNzDZJUhKIrExXa78VfMIoIap
    MD5:DFDF12CD078C65E3A30619F1DED5AADA
    SHA1:47413EE6B3293B09326A015512D254398E8731ED
    SHA-256:9866752CA7497015C124A3F8760E1D6CAE500B51023EC41243A98D8637E07890
    SHA-512:14FED6F15E5C9D9DAFD2F40A2004130227780C371E3C4FB1B7C59D724A80CBF965697B11027A455CCB225085B6BDF67CD36729638CF6E28B0E7B6F2AB36F78BA
    Malicious:false
    Preview:LANGUAGE_NAME..Macedonian..LANGUAGE_FILE..Macedonian..LANGUAGE_ISO..mk..LANGUAGE_AUTHOR............ .... (aleks@macedonia.eu.org) \r \n..LANGUAGE_CHARSET..ISO-8859-5..LANGUAGE_WINDOWSID..FYRO Macedonian..OK.........Cancel..........Exit.........Close...........Cancel changes........ .. ...........Click to confirm........ .. .........Click to get help!........ .. .......Click to return to previous screen........ .. ....... .. ........... .......Click to go to next screen........ .. ....... .......Hide password....... .. ...........Save project........ .. ..........Close current project?......... .. ........?..Delete this project?......... .. ........?..Delete empty project %s?......... .. ........ ...... %s?..Action not yet implemented......... ...... .. . ................Error deleting this project........ ... ........ .. ..........Select a rule for the filter.......... ....... .. ..........Enter keywords for the filter......... ...... ....... .. ..........Cancel..........Add this

    C:\Program Files\WinHTTrack\lang\is-HKRCI.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (742), with CRLF line terminators
    Category:dropped
    Size (bytes):35496
    Entropy (8bit):5.011239563232116
    Encrypted:false
    SSDEEP:768:Y2A/xz0PBxG+/kbSbnHRZkhmr/7g7CSZXe12KZgjmn:Y2A/9mxDb4Xpcg6
    MD5:6E25CDEAB13113D381A1E3764A2FEF91
    SHA1:58E25F47C4CD9C7F54F5826527CB56F12BC9080E
    SHA-256:10166AD5B0CFE62DA37D801B6A39457F6C8048BC235BDEA16B5EC273916E658D
    SHA-512:A29130678C21F5D9B705081644BB0F33EADEDF5DCD2B7598937FC7C6668BD8B2FC4BEBC662205F2C44E5F4C3C8DD7EB7924477805563B45DFBC769D44F0298C1
    Malicious:false
    Preview:LANGUAGE_NAME..Dansk..LANGUAGE_FILE..Dansk..LANGUAGE_ISO..da..LANGUAGE_AUTHOR..Jesper Bramm (bramm@get2net.dk)\r\nscootergrisen\r\n..LANGUAGE_CHARSET..ISO-8859-1..LANGUAGE_WINDOWSID..Danish..OK..OK..Cancel..Annull.r..Exit..Afslut..Close..Luk..Cancel changes..Annull.r .ndringer..Click to confirm..Klik OK for at godkende..Click to get help!..Klik for at f. hj.lp!..Click to return to previous screen..Klik for at se den forrige sk.rm..Click to go to next screen..Klik for at se den n.ste sk.rm..Hide password..Skjul adgangskode..Save project..Gem projekt..Close current project?..Vil du lukke det aktuelle projekt ?..Delete this project?..Slette dette projekt ?..Delete empty project %s?..Vil du slette det tomme projekt med navnet: %s?..Action not yet implemented..Denne handling er endnu ikke implementeret..Error deleting this project..Der opstod fejl under sletningen af dette projekt..Select a rule for the filter..V.lg en regel til filteret..Enter keywords for the filter..Indtast n.gleord til

    C:\Program Files\WinHTTrack\lang\is-I6TTS.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (772), with CRLF line terminators
    Category:dropped
    Size (bytes):37842
    Entropy (8bit):5.853500752121118
    Encrypted:false
    SSDEEP:768:4AghuNcxNENYN73ZzO2sOn6T4K9aHB6+iluxbldBZ0G:4AguNcDf7ZO2Ri07FndBZN
    MD5:195324CB215A02DF643A2AE8A25ED3D2
    SHA1:52026D87B615ADE311BB81082DF807A8B85D9E45
    SHA-256:DBDA3FD92D55232FA3939A612BEBA641CFA1FCDD6251D47AFEEC646D79E1F008
    SHA-512:19CB82B607262DB77F3B0A8B9B97EE3E34B9A047944AEB196BC4312DAB3C3A8AD5AE7554196D01CE0A8778C44A1A573E0623F5AC177E4F8DA4DC542F5796395A
    Malicious:false
    Preview:LANGUAGE_NAME..Greek..LANGUAGE_FILE..Greek..LANGUAGE_ISO..el..LANGUAGE_AUTHOR..Michael Papadakis (mikepap at freemail dot gr)\r\n..LANGUAGE_CHARSET..ISO-8859-7..LANGUAGE_WINDOWSID..Greek..OK...........Cancel.........Exit..........Close............Cancel changes......... .........Click to confirm...... ... .............Click to get help!...... ... .. ...... .......!..Click to return to previous screen...... ... .. ........... .... ........... .......Click to go to next screen...... ... .. .... .... ....... .......Hide password.......... ..............Save project............ ..........Close current project?.... ........ ... ....... .......;..Delete this project?.... ....... ... ....... .......;..Delete empty project %s?......... ... ..... ........ %s;..Action not yet implemented... ........ .... ... .... .......... .......Error deleting this project.......... .... .. ....... ..... ... ..........Select a rule for the filter.......... ... ...... ... .. ........Enter keywords for the filte

    C:\Program Files\WinHTTrack\lang\is-IEOSD.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (822), with CRLF line terminators
    Category:dropped
    Size (bytes):35516
    Entropy (8bit):5.001355017327262
    Encrypted:false
    SSDEEP:768:OUg1yNSxNBB+JEWV6Y8YWhTrGQJMVhrSZE:1gENSDaJp9W8h2S
    MD5:EBECE93A3CB80D46A53BD059E2FA8834
    SHA1:254204BD4242D67F132AD29AA785D1CB33C0A35A
    SHA-256:F3F62EF0D30C2CFD8C025C571F58AAE4658913892B4E3F9451CD17A34F302BB4
    SHA-512:740F217B0230DF331E33F5010965EE55BF5D485F74FEBA0BF60C2757A887BC8B560E2B53172A5E023033984BBD8D0ADAC0463D8B575598333587B2624166D525
    Malicious:false
    Preview:LANGUAGE_NAME..Portugu.s..LANGUAGE_FILE..Portugues..LANGUAGE_ISO..pt..LANGUAGE_AUTHOR..Rui Fernandes (CANTIC, ruiefe at mail.malhatlantica.pt) \r\nPedro T. Pinheiro (Universidade Nova de Lisboa-FCT, ptiago at mail.iupi.pt) \r\n..LANGUAGE_CHARSET..ISO-8859-1..LANGUAGE_WINDOWSID..Portuguese (Portugal)..OK..OK..Cancel..Cancelar..Exit..Sair..Close..Fechar..Cancel changes..Cancelar altera..es..Click to confirm..Clique para confirmar..Click to get help!..Clique para obter ajuda..Click to return to previous screen..Clique para retroceder..Click to go to next screen..Clique para avan.ar..Hide password..Ocultar palavra-chave..Save project..Guardar projecto..Close current project?..Fechar o projecto em curso?..Delete this project?..Apagar este projecto?..Delete empty project %s?..Apagar o projecto vazio %s?..Action not yet implemented..Fun..o n.o dispon.vel..Error deleting this project..Erro ao apagar o projecto..Select a rule for the filter..Escolha uma regra para o filtro..Enter keywords for t

    C:\Program Files\WinHTTrack\lang\is-J4MH1.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Non-ISO extended-ASCII text, with very long lines (791), with CRLF line terminators
    Category:dropped
    Size (bytes):34711
    Entropy (8bit):5.242569056702732
    Encrypted:false
    SSDEEP:768:uGJBNmxNmgWuBTP+JGDl1rbSNrzosk0HjRKj8+bCB57Z:uqBNmD5xl+ClBY7K8+bCB57Z
    MD5:3193362CEF5A0C51EB04AE84B95A54FE
    SHA1:F35522E0ABFBEC87F4C8A8B1B7A919AD4AEB78B7
    SHA-256:33944345DF041E26ECF51156CB53B8FA21D4B526FF55806469152F7ED6DE4C2E
    SHA-512:F6EB73B42527993E3747FC7B7C0D22A382A7ACC2BCCC5F2D7EFE7C6AD6061F7D5DF0D855290FD45CB15EED3D42702D4578E577383391F1FD858E3F1A242A0E87
    Malicious:false
    Preview:LANGUAGE_NAME..Slovak..LANGUAGE_FILE..Slovak..LANGUAGE_ISO..sk..LANGUAGE_AUTHOR..Dr. Martin Sereday (sereday at stonline.sk)\r\n..LANGUAGE_CHARSET..ISO-8859-2..LANGUAGE_WINDOWSID..Slovak..OK...no..Cancel..Zru.i...Exit..Ukon.i...Close..Zatvori...Cancel changes..Zru.i. zmeny..Click to confirm..Potvrdi. zmeny..Click to get help!..Pomoc..Click to return to previous screen..Predch.dzaj.ca obrazovka..Click to go to next screen..Nasleduj.ca obrazovka..Hide password..Skry. heslo..Save project..Ulo.i. projekt..Close current project?..Zatvori. projekt?..Delete this project?..Vymaza. projekt?..Delete empty project %s?..Vymaza. pr.zdne projekty?..Action not yet implemented..Akcia zatia. nebola zaraden...Error deleting this project..Chyba pri mazan. projektu..Select a rule for the filter..Vybra. pravidlo filtra..Enter keywords for the filter..Vlo.i. k...ov. slovo pre filter..Cancel..Zru.i...Add this rule..Prida. toto pravidlo..Please enter one or several keyword(s) for the rule..Vlo. jedno alebo ni

    C:\Program Files\WinHTTrack\lang\is-K313S.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (798), with CRLF line terminators
    Category:dropped
    Size (bytes):34394
    Entropy (8bit):5.029788650233175
    Encrypted:false
    SSDEEP:768:rv4MN6xNQduwGjtd9AUrj2mfkKW9wL6mlCmoej23pnNgWlf/1Cgp:rv4MN6DsuwGxd9P2kGwL63mpj25flf/R
    MD5:60F092A80A651B5A46CDE6CBA549925E
    SHA1:6BF29715F6A0BFE0C99B053FAED27302C85AAC02
    SHA-256:13930BCEBB6F94FECEE0D7721C2934F6E20C94843B8413ACB3156AD0A6E5EEAA
    SHA-512:C5B03A80CFB06C478E621A202D358874B70D57449727A5588E07179BD30966F02E4EB8CBDB21F8B86CA16FD54D18BB0831C80F7BE050190539C702E0F1397F93
    Malicious:false
    Preview:LANGUAGE_NAME..Eesti..LANGUAGE_FILE..Eesti..LANGUAGE_ISO..et..LANGUAGE_AUTHOR..T.nu Virma\r\n..LANGUAGE_CHARSET..ISO-8859-4..LANGUAGE_WINDOWSID..Estonian..OK..OK..Cancel..Loobu..Exit..V.lju..Close..Sulge..Cancel changes..Loobu muudatuste tegemisest..Click to confirm..Kliki kinnitamiseks..Click to get help!..Kliki abi saamiseks!..Click to return to previous screen..Tagasi eelmisele ekraanile..Click to go to next screen..Edasi j.rgmisele ekraanile..Hide password..Peida parool..Save project..Salvesta projekt..Close current project?..Kas sulgeda k.esolev projekt?..Delete this project?..Kas kustutada see projekt?..Delete empty project %s?..Kas kustutada t.hi projekt %s?..Action not yet implemented..Tegevus ei ole veel l.petatud..Error deleting this project..Viga selle projekti kustutamisel..Select a rule for the filter..Vali filtreerimisreegel..Enter keywords for the filter..Sisesta m.rks.nad filtri jaoks..Cancel..Loobu..Add this rule..Lisa see reegel..Please enter one or several keyword(s)

    C:\Program Files\WinHTTrack\lang\is-LBAJH.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (806), with CRLF line terminators
    Category:dropped
    Size (bytes):40421
    Entropy (8bit):4.934920714754602
    Encrypted:false
    SSDEEP:768:zbd0Cs4STNExNIaB0WHVRVvl2ODYRBFXzTLJlFP5Wruf0JDvcwQDlCaSA:zbdK4STNEDH0W1RVvl2ODYRBFXzfhPoa
    MD5:C4BCE8E0E8270CE0963D325509ECEF72
    SHA1:9BB9A2C8818533928FC453A14667DB5A577B6EE0
    SHA-256:3CEB18D6AA3FAE0F1E5F2B84669A7DDBB4341A0BB8F9739942431A57E2820EF1
    SHA-512:48E0FE5BF997681941A43631691E03FDD5A66B33BFBD5A2FB0EC7844F34D9470063BDB7459737C89C19A51640C94F24173C282C199B0263EBC555836AF8C28E2
    Malicious:false
    Preview:LANGUAGE_NAME..Fran.ais..LANGUAGE_FILE..Francais..LANGUAGE_ISO..fr..LANGUAGE_AUTHOR..Xavier Roche (roche at httrack.com)\r\nRobert Lagadec (rlagadec at yahoo.fr) \r\n..LANGUAGE_CHARSET..ISO-8859-1..LANGUAGE_WINDOWSID..French (Standard)..OK..Oui..Cancel..Annuler..Exit..Quitter..Close..Fermer..Cancel changes..Annuler les changements..Click to confirm..Cliquez pour confirmer..Click to get help!..Cliquez pour avoir de l'aide!..Click to return to previous screen..Pour revenir . la fen.tre pr.c.dente..Click to go to next screen..Pour passer . la fen.tre suivante..Hide password..Masquer le mot de passe..Save project..Enregistrer le projet..Close current project?..Fermer le projet courant?..Delete this project?..Supprimer ce projet?..Delete empty project %s?..Supprimer le projet vide %s?..Action not yet implemented..Cette fonction n'est pas encore disponible..Error deleting this project..Erreur lors de l'effacement de ce projet..Select a rule for the filter..Choisissez un crit.re pour le filtr

    C:\Program Files\WinHTTrack\lang\is-LCLNP.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (736), with CRLF line terminators
    Category:dropped
    Size (bytes):34783
    Entropy (8bit):5.006395891181154
    Encrypted:false
    SSDEEP:768:+u4FN8RxNaqxfUiz710AZzFHPsJpTCTeM/93vWnqHD701amzzX4:+u4FN8RDa2zBJsvTcsnqjgI
    MD5:22A730556E3B6C192B001706783E1FA1
    SHA1:94498E8663984CCE02FF975E0DEAEE2D37BF8E17
    SHA-256:049D8A87BABDABE29C254386B4016E410FC50A54F5A49C50E7336FC682CF7ED2
    SHA-512:C179CF53C5241C448ECE597213461BB4481FFC2BF84257955007736BC998EB825DFA0CAB0B1628A7805C0B40DFF0C71319E51BECCF3089E7006C4882D1477CA9
    Malicious:false
    Preview:LANGUAGE_NAME..Norsk..LANGUAGE_FILE..Norsk..LANGUAGE_ISO..no..LANGUAGE_AUTHOR..Tobias "Spug" Langhoff (Dark Spug at hazardlabs.com )\r\n[ spug_enigma@hotmail.com ] \r\n..LANGUAGE_CHARSET..ISO-8859-1..LANGUAGE_WINDOWSID..Norwegian (Nynorsk)..OK..OK..Cancel..Avbryt..Exit..Avslutt..Close..Lukk..Cancel changes..Angre endringer..Click to confirm..Klikk for . bekrefte..Click to get help!..Klikk her for . f. hjelp!..Click to return to previous screen..Klikk for . g. tilbake til forrige skjerm..Click to go to next screen..Klikk for . g. til neste skjerm..Hide password..Skjul passord..Save project..Lagre prosjekt..Close current project?..Vil du lukke prosjektet?..Delete this project?..Vil du slette dette prosjektet?..Delete empty project %s?..Vil du slette det tomme prosjektet %s?..Action not yet implemented..Denne funksjonen er ikke utviklet enda..Error deleting this project..Kunne ikke slette prosjektet..Select a rule for the filter..Velg en regel for dette filteret..Enter keywords for the fi

    C:\Program Files\WinHTTrack\lang\is-MB8IV.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Non-ISO extended-ASCII text, with very long lines (841), with CRLF line terminators
    Category:dropped
    Size (bytes):37875
    Entropy (8bit):5.045677541370703
    Encrypted:false
    SSDEEP:768:pkKh7FtNTVxNf1fXHsaWeVrPHLk1s+y3nkYv1KpR8:pnBNRDf1kCU4hGK
    MD5:7EFADB4D1085E0E7FF9B85468D9D55F5
    SHA1:89997CE905DBED759638FB965641B33ED9DD3845
    SHA-256:F46EF0CB2A03A85D7A2B10790DFA9E3707C50A386D5E2AF522051B42C2B13DA0
    SHA-512:FCDAA18C3BA8294A274D49ED591455F2529E9851D405B44B21E0E53FD1424189853735535991D85F7AC956F738525C1BAB5003FD71ECC794CFB90D5ACE4C8610
    Malicious:false
    Preview:LANGUAGE_NAME..Hrvatski..LANGUAGE_FILE..Croatian..LANGUAGE_ISO..hr..LANGUAGE_AUTHOR..Dominko A.daji. (domazd@mail.ru) \r\n..LANGUAGE_CHARSET..ISO-8859-2..LANGUAGE_WINDOWSID..Croatian..OK..U redu..Cancel..Odustati..Exit..Svr.etak..Close..Zatvoriti..Cancel changes..Opozvati izmjene..Click to confirm..Preuzeti izmjene..Click to get help!..Kliknuti za pomo.!..Click to return to previous screen..Kliknuti za povratak na prethodni prikaz..Click to go to next screen..Kliknuti za povratak na slijede.i prikaz..Hide password..Sakriti lozinku..Save project..Pohraniti projekt..Close current project?..Zatvoriti teku.i projekt?..Delete this project?..Izbrisati taj projekt?..Delete empty project %s?..Izbrisati prazni projekt %s?..Action not yet implemented..Funkcija jo. nije raspolo.iva..Error deleting this project..Pogre.ka tijekom brisanja tog projekta..Select a rule for the filter..Izaberite neko pravilo za taj filtar..Enter keywords for the filter..Unesite klju.ne rije.i za taj filtar..Cancel..Odu

    C:\Program Files\WinHTTrack\lang\is-N8GL1.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Non-ISO extended-ASCII text, with very long lines (736), with CRLF line terminators
    Category:dropped
    Size (bytes):34388
    Entropy (8bit):5.040392159560872
    Encrypted:false
    SSDEEP:768:IYpqnD5gN7BjxN7RgKXPKTjWlHxiy09Qpi9Mfmyh3ndFd5y7F:IYknDWN7BjD7qKXPDlRA6Glm/d07F
    MD5:54F59EDBBF80BCF2BE3569664BFF9752
    SHA1:FEA1F69385DCC035D9EE7CC4AA7F8CEDD0751396
    SHA-256:D8FE9C28315C794075392F4474A810408FDE6E191AFA190E3203076F84AAB876
    SHA-512:CAC5F817D8ECB28191C71E2621A0E0ECBD8B2CCA4351BBE2317C6C5EB88BE84EB21A87729203657DE0C6A9D6049F19F0612FE4002F39840981C420198E9E7E0B
    Malicious:false
    Preview:LANGUAGE_NAME..Slovenian..LANGUAGE_FILE..Slovenian..LANGUAGE_ISO..si..LANGUAGE_AUTHOR..Jadran Rudec,iur.\r\njrudec@email.si \r\n..LANGUAGE_CHARSET..ISO-8859-1..LANGUAGE_WINDOWSID..Slovenian..OK..Vredu..Cancel..Opusti..Exit..Izhod..Close..Zapri..Cancel changes..Opusti spremembe..Click to confirm..Klikni za potrditev..Click to get help!..Klikni za pomo.!..Click to return to previous screen..Klikni za vrnitev na prej.nji zaslon..Click to go to next screen..Klikni za prehod na naslednji zaslon..Hide password..Skrij geslo..Save project..Shrani projekt..Close current project?..Zaprem teko.i projekt?..Delete this project?..Zbri.em ta projekt?..Delete empty project %s?..Zbri.em prazen projekt %s?..Action not yet implemented..Dogodek .e ni predviden..Error deleting this project..Napaka med brisanjem tega projekta..Select a rule for the filter..Izberi pravilo za filtriranje..Enter keywords for the filter..Vpi.ite klju.no besedo filtriranja..Cancel..Opusti..Add this rule..Dodaj to pravilo..Please

    C:\Program Files\WinHTTrack\lang\is-PON7P.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (894), with CRLF line terminators
    Category:dropped
    Size (bytes):35827
    Entropy (8bit):5.096590190231921
    Encrypted:false
    SSDEEP:384:dCth6POWhmpxkcUfFtAhtt0t1RX58lwjoPivXuqP7Gn3yLIbBztFQKX57N2Awf1M:MaexKK0XRMa2qP7Gn3ykRtFzB5UfZz4P
    MD5:C7BDD1E8547EDAE639492932B0420933
    SHA1:D8240E8BFFF420B750221C7E076E74917FFE704D
    SHA-256:A136C01403A31D4AF914CC3AE339F8C933F7BAF0E47700F911B7DD4ABC96DE56
    SHA-512:F785FE3011F78E197E86AE2064B6CBDB9F7D43B339CA7538C6A1F8F5EC065686967D4D5E72565909AF5EDF5C47000FF51E36424377F35A00967DBDDD5A235F95
    Malicious:false
    Preview:LANGUAGE_NAME..Turkish..LANGUAGE_FILE..Turkish..LANGUAGE_ISO..tr..LANGUAGE_AUTHOR..Arman (Armish) Aksoy <armish@linux-sevenler.de>\r\n..LANGUAGE_CHARSET..ISO-8859-9..LANGUAGE_WINDOWSID..Turkish..OK..Tamam..Cancel..Vazge...Exit....k....Close..Kapat..Cancel changes..De.i.ikleri Kaydetme..Click to confirm..Onaylamak i.in T.klay.n..Click to get help!..Yard.m almak i.in T.klay.n..Click to return to previous screen...nceki ekrana d.nmek i.in t.klay.n..Click to go to next screen..Sonraki ekrana gitmek i.in t.klay.n..Hide password..Parolay. Gizle..Save project..Projeyi Kaydet..Close current project?..A..k proje kapat.ls.n m.?..Delete this project?..Bu proje silinsin mi?..Delete empty project %s?..%s bo. projesi silinsin mi?..Action not yet implemented..Eylem hen.z uygulanmad...Error deleting this project..Bu proje silinirken hata olu.tu..Select a rule for the filter..Filtre i.in bir kural se.in..Enter keywords for the filter..Filtre i.in anahtar kelimeleri giriniz..Cancel..Vazge...Add this rul

    C:\Program Files\WinHTTrack\lang\is-QVG6I.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (807), with CRLF line terminators
    Category:dropped
    Size (bytes):35287
    Entropy (8bit):5.83471162156965
    Encrypted:false
    SSDEEP:768:vpfINRxNdEky6SlYejos8aw5RftXIXItLb9VWlUO+1t:vRINRDukLSPQa4NeI1xtt
    MD5:2C87BA4C71DB04DF5A2877980E2634A3
    SHA1:8CC30C3DDC6283434B35A9E898F9126AEEB93681
    SHA-256:61E00EE1D513E8B81C9D5CF5F153A57782EFC56EE30751DD5793943FD8775EE8
    SHA-512:DF12AA8604C5E1304F4AC341C5E9F36F637606E1FA54049D1BB31BD4799B7DEDD5A32E3EBA3DECF7A44561F3A12CF2EB5E55AE9D0BB327CB4EDDF6A608A66645
    Malicious:false
    Preview:LANGUAGE_NAME..Ukrainian..LANGUAGE_FILE..Ukrainian..LANGUAGE_ISO..uk..LANGUAGE_AUTHOR..Andrij Shevchuk (http://programy.com.ua, http://vic-info.com.ua) \r\n..LANGUAGE_CHARSET..ISO-8859-5..LANGUAGE_WINDOWSID..Ukrainian..OK......Cancel.............Exit.........Close...........Cancel changes........... ......Click to confirm..............Click to get help!.......... ........Click to return to previous screen............. .......Click to go to next screen......... .. .......... ........Hide password......... ........Save project.......... ........Close current project?......... ........ ......?..Delete this project?.......... ... ......?..Delete empty project %s?.......... ....... ...... %s?..Action not yet implemented...... .. ............Error deleting this project......... ......... .........Select a rule for the filter......... ... .........Enter keywords for the filter........ ........ .... .........Cancel.............Add this rule........ .. .......Please enter one or several k

    C:\Program Files\WinHTTrack\lang\is-SSNBO.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (761), with CRLF line terminators
    Category:dropped
    Size (bytes):36439
    Entropy (8bit):5.028879912422024
    Encrypted:false
    SSDEEP:768:v+N5xNVxTHBzAgWcrZOGGuryYe7x0MCvb/:v+N5DVzsA8VFKb/
    MD5:3F6B6BCDB3C9DA8ABA597BBEAA56B52E
    SHA1:D9CB582F9F02CF9DC9107641A8D45E5EC7A5AD68
    SHA-256:B292E21F92A0ECEA6B0FA8B423693C9A67E20FE938666B50BAB26E6A4C97B562
    SHA-512:07BBF2927128BDD2CDC666828720C849FCB4169EF9CA74B23F4D4E498D4DC530F6C452CC1745425920CDA17201886068F29C1E3A3C6382B9FCF187441DF057CE
    Malicious:false
    Preview:LANGUAGE_NAME..Deutsch..LANGUAGE_FILE..Deutsch..LANGUAGE_ISO..de..LANGUAGE_AUTHOR..Rainer Klueting (rk-htt at centermail.net) \r\nBastian Gorke (bastiang at yahoo.com) \r\nRudi Ferrari (Wyando at netcologne.de) \r\nMarcus Gaza (MarcusGaza at t-online.de) \r\n..LANGUAGE_CHARSET..ISO-8859-1..LANGUAGE_WINDOWSID..German (Standard)..OK..OK..Cancel..Abbrechen..Exit..Beenden..Close..Schlie.en..Cancel changes...nderungen verwerfen..Click to confirm...nderungen .bernehmen..Click to get help!..Hilfe aufrufen..Click to return to previous screen..Zur.ck zum letzten Schritt..Click to go to next screen..Weiter zum n.chsten Schritt..Hide password..Passwort nicht anzeigen..Save project..Projekt speichern..Close current project?..Aktives Projekt schlie.en?..Delete this project?..Dieses Projekt l.schen?..Delete empty project %s?..Leeres Projekt %s l.schen?..Action not yet implemented..Funktion noch nicht verf.gbar..Error deleting this project..Fehler beim L.schen des Projekts..Select a rule for the filt

    C:\Program Files\WinHTTrack\lang\is-T9H9H.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (842), with CRLF line terminators
    Category:dropped
    Size (bytes):35134
    Entropy (8bit):5.020707210850664
    Encrypted:false
    SSDEEP:768:ynGopdeBxlkYf/SGigFiJBJf/32rXIbM2mVAdselBtQwIVz7R:ynGofeBvkYfaG/FOJHgINtQwIVz7R
    MD5:C4E1F53A1E8FB285E6A9F5C550C4EFEC
    SHA1:5F6BC8B8B965CCE2DD432C9C12C9936DC9E774A9
    SHA-256:A97F36836D1731AAD3E43B95A7BFF21FD0867E9B80B55ED12E02A5C75D3FC121
    SHA-512:1EB4D8A76709F79189F1144FEAF117902B43CB71787CA2B4500FF9F60237F5E6F3276D83989159775B5F944CE698D02BB09F6F9F848A9117A7DA71D393A2D1FB
    Malicious:false
    Preview:LANGUAGE_NAME..Finnish..LANGUAGE_FILE..Finnish..LANGUAGE_ISO..fi..LANGUAGE_AUTHOR..Mika K.hk.nen (mika.kahkonen at mbnet.fi)..LANGUAGE_CHARSET..ISO-8859-1..LANGUAGE_WINDOWSID..Finnish..OK..OK..Cancel..Peruuta..Exit..Poistu..Close..Sulje..Cancel changes..Peruuta muutokset..Click to confirm..Hyv.ksy..Click to get help!..Apua!..Click to return to previous screen..Palaa edelliseen ruutuun..Click to go to next screen..Mene seuraavaan ruutuun..Hide password..K.tke salasana..Save project..Tallenna projekti..Close current project?..Sulje nykyinen projekti?..Delete this project?..Poista projekti?..Delete empty project %s?..Poista tyhj. projekti %s?..Action not yet implemented..Toimintoa ei toteutettu viel...Error deleting this project..Virhe poistettaessa projektia..Select a rule for the filter..Valitse suodattimen s..nt...Enter keywords for the filter..Kirjoita suodattimen avainsanat..Cancel..Peruuta..Add this rule..Lis.. s..nt...Please enter one or several keyword(s) for the rule..Valitse yks

    C:\Program Files\WinHTTrack\lang\is-TL8SS.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Non-ISO extended-ASCII text, with very long lines (828), with CRLF line terminators
    Category:dropped
    Size (bytes):34268
    Entropy (8bit):5.244722862876783
    Encrypted:false
    SSDEEP:384:/4SxylChXNxxNWKUGSZbjXhtEgt0tE/9druCx0dlj0zn4xAHkpZnquXTXSK/56Gu:A0NxxNWfRiedmxPXXTjI0gnp7COIOWS
    MD5:0C41D3081FD68F89B4847E27D050C7B1
    SHA1:AC0BA078F0F7CF3399CFC9AD6ADDE75BA8CDA359
    SHA-256:8476A06593C3261F4098DDA7CBF0983F8AFCDAEFDB6B6BEFEAE3B854E62C8269
    SHA-512:B6553A50ECDC69180DB61ACC1964B44FE33E84269568B5AC6D811987A0A727258B8E676462F0BCCF3E67D330398C03CCE137E24CB151148A61280577514AAB92
    Malicious:false
    Preview:LANGUAGE_NAME...esky..LANGUAGE_FILE..Cesky..LANGUAGE_ISO..cs..LANGUAGE_AUTHOR..Anton.n Mat.j..k (matejcik@volny.cz) \r \n..LANGUAGE_CHARSET..WINDOWS-1250..LANGUAGE_WINDOWSID..Czech..OK..Ano..Cancel..Zru.it..Exit..Konec..Close..Zav..t..Cancel changes..Zru.it zm.ny..Click to confirm..Klikni pro potvrzen...Click to get help!..Klikni pro n.pov.du..Click to return to previous screen..Klikni pro n.vrat do p.edchoz.ho okna..Click to go to next screen..Klikni pro pokra.ov.n. na n.sleduj.c.m okn...Hide password..Skr.t heslo..Save project..Ulo.it projekt..Close current project?..Zav..t aktu.ln. projekt?..Delete this project?..Smazat tento projekt?..Delete empty project %s?..Smazat pr.zdn. projekt %s?..Action not yet implemented..Akce nen. je.t. implementov.na..Error deleting this project..Chyba p.i maz.n. tohoto projektu..Select a rule for the filter..V.b.r pravidla pro filtr..Enter keywords for the filter..Zadej kl..ov. slova pro filtr..Cancel..Zru.it..Add this rule..P.idat toto pravidlo..Pleas

    C:\Program Files\WinHTTrack\lang\is-V8ELG.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (736), with CRLF line terminators
    Category:dropped
    Size (bytes):28797
    Entropy (8bit):6.213415445008274
    Encrypted:false
    SSDEEP:768:725gANDxNVSY67iTrTd/EmT2hfUjCXxTcx4MFWTVxUXnR5H:i5gANDD8NudsK2hfUj2Tcx4XqnR5H
    MD5:8AB741CB6657E809BEB6EB10913B263D
    SHA1:33DF5D0F1C3B7DDEF3CF463DD4CFDA4706D7F60D
    SHA-256:56B1EFCF8516DC8099F308C6924B38E49A5685C40BFB9821179C028BA1FC3403
    SHA-512:5128F2A8A12D250152325B7B27F112D421AFE411A97EABF1D892F874402A490EF9ED72F4E303896A878EF222641B6B85AD12723125A876702281BD1108CE275E
    Malicious:false
    Preview:LANGUAGE_NAME..Chinese-Simplified..LANGUAGE_FILE..Chinese-Simplified..LANGUAGE_ISO..zh..LANGUAGE_AUTHOR..Brook Qin (brookqwr at sina.com) \r\n..LANGUAGE_CHARSET..gb2312..LANGUAGE_WINDOWSID..Chinese (PRC)..OK.......Cancel.......Exit.......Close.......Cancel changes...........Click to confirm............Click to get help!.............!..Click to return to previous screen.................Click to go to next screen..................Hide password...........Save project..........Close current project?.............?..Delete this project?..........?..Delete empty project %s?........... %s?..Action not yet implemented..............Error deleting this project.................Select a rule for the filter.................Enter keywords for the filter...................Cancel.......Add this rule...........Please enter one or several keyword(s) for the rule............................Add Scan Rule.............Criterion.......String.........Add.

    C:\Program Files\WinHTTrack\lang\is-VLDM8.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with very long lines (736), with CRLF line terminators
    Category:dropped
    Size (bytes):29327
    Entropy (8bit):6.147590111579792
    Encrypted:false
    SSDEEP:768:20gN4xNGGDU+3DSMcOx7/twlYoguZt8NRy9:27N4Dxw+zOm7menqYRy9
    MD5:CE5200A7B620A5AF0E1526D21442CA2E
    SHA1:E46B50D7EB271F778206699C48B3F87063C88A60
    SHA-256:2D4097840F32DFAC291439D720C53CBDCC084A46061B819636BDEA0A6166543F
    SHA-512:B71CBFC628D2246B925E8AC8D054DC98A7A62CDB14489509AD4C4B90E0DA623053F00009E18187430C58B09FFEFDFA44DF0CE064F4444101791FA696ECFF33C2
    Malicious:false
    Preview:LANGUAGE_NAME..Chinese-BIG5..LANGUAGE_FILE..Chinese-BIG5..LANGUAGE_ISO..zh_TW..LANGUAGE_AUTHOR..David Hing Cheong Hung (DAVEHUNG@mtr.com.hk)\r\n..LANGUAGE_CHARSET..BIG5..LANGUAGE_WINDOWSID..Chinese (Taiwan)..OK...T.w..Cancel........Exit.....}..Close........Cancel changes...........Click to confirm...I...H.T.{..Click to get help!...I...H.......!..Click to return to previous screen...I...H..^.e.@....Click to go to next screen...I...H..F.U.@....Hide password......K.X..Save project...O.s.M....Close current project?...O._......e.M..?..Delete this project?...R.....M..?..Delete empty project %s?...R......M.. %s?..Action not yet implemented....@..........Error deleting this project...R....M...X....Select a rule for the filter.....L.o......W.h..Enter keywords for the filter.....L.o....J.......Cancel........Add this rule...W.[..W.h..Please enter one or several keyword(s) for the rule........W.h..J.@..X.........Add Scan Rule...W.[...y.W.h..Criterion....h..String...r....Add...W

    C:\Program Files\WinHTTrack\libeay32.dll (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
    Category:dropped
    Size (bytes):1651712
    Entropy (8bit):6.5374178803224705
    Encrypted:false
    SSDEEP:49152:M1NPj4YL4gHLjZjRyDA33FaMzjEOZjrp+VtGHPd:JYjjROA3GErp+VtG
    MD5:FC596FDC33C5F8B95560C5A31FA379D9
    SHA1:F731BFF62C51BA00387E762F8BB3F9525DEDA4E6
    SHA-256:AD991E0F64758987BF266094DB94A5DC615FDEDBD6B4472AB3B54DAA31ACFFA9
    SHA-512:E12C7D9DCF738C32E44BAA498FDE2EC741ED1E799BD3E8C7C044ACD3439DFFE7DA284A7DCFD669BEBF4C3583660C3C1B66A17292E6BC2E2295F7C8A70C4F8EAD
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 0%
    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........I.............W......@.........p....F......P......A......G......B.....Rich............PE..d...7.>T.........." ................._...............................................................................................|..Q....o.......@....... ...............P...?..`5...............................................0..(............................text............................... ..`.rdata.......0......................@..@.data...8....0......................@....pdata....... ......................@..@.rsrc........@......................@..@.reloc...L...P...N..................@..B................................................................................................................................................................................................................................................................................

    C:\Program Files\WinHTTrack\libhttrack.dll (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
    Category:dropped
    Size (bytes):763392
    Entropy (8bit):6.468360677194401
    Encrypted:false
    SSDEEP:12288:41CtaoPETgXcRufekHHXCg13wVqOaR5bC0vCd0LCFDYlYpTuN:XtaosgXcRufNSg1pOF02wYpy
    MD5:2929F0ED54071CCD72EDEC565E6DB0C7
    SHA1:4E650F285F47CD6267DB33AE304C7D01E2A77D19
    SHA-256:3AEFE2B0DCEECAA2A865AB9B30095B23BAA9C817B75147561500DC45E13DCAD0
    SHA-512:909A7967CB0CF97D978F1E103FAF68071DEAD14661D439E4A21F1EEC568FA7351D326EF0C37C4AA41851C211A9493DFC6B1DAEFBCBAD8BDCA1FFC8D1E85C5E2B
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 0%
    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........M..b#..b#..b#.n-...b#......b#......b#......b#...X..b#..b"..b#......b#......b#......b#.Rich.b#.................PE..d..... Y.........." ................\...............................................................................................)......D................... :......................................................................`............................text............................... ..`.rdata...j.......l..................@..@.data...0:...@...*...(..............@....pdata.. :.......<...R..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

    C:\Program Files\WinHTTrack\libssl32.dll (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
    Category:dropped
    Size (bytes):357376
    Entropy (8bit):6.107476818924725
    Encrypted:false
    SSDEEP:6144:dEn/jiRtgk9NHoj2Q6yr6lIBLsy0IfMFPL+Ehy7OtdbDC7VMsNORJjd542Ki6hS5:dE/jiRtgk9NHoaQ6yr6uBLsy0IfMFT+E
    MD5:A96DB1B339924E6DF3FA369615DA2DE2
    SHA1:4CBDC505B5B248A8C20BE4B317029C32E28487A9
    SHA-256:7CA267B4E6CCEDFF8DD3730033C14A7237DECB7AAC721ABD3F286E41F38FC983
    SHA-512:752AAA9A8F9A1503534910C8D0C4E1BFDF79F054FF34932752A4A7DA848F1A84FFAC58F1ADA3E637EC1F0F89225D25801A27DE991BD9C7246556AE822EB65938
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 0%
    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........aB9..,j..,j..,j.x.j..,j.x.j..,j.x.j..,j..-j..,j.x.j..,j.x.j..,j.x.j..,j.x.j..,jRich..,j................PE..d...G.>T.........." ................D..............................................._Z..............................................@/..p$......P............`..H'..............D...p...................................................H............................text............................... ..`.rdata..............................@..@.data........`.......>..............@....pdata..H'...`...(...4..............@..@.rsrc................\..............@..@.reloc..<............d..............@..B........................................................................................................................................................................................................................................................................

    C:\Program Files\WinHTTrack\libtest\Makefile.am (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text
    Category:dropped
    Size (bytes):1747
    Entropy (8bit):5.393870423923631
    Encrypted:false
    SSDEEP:48:/5IE1Hl4jHl3HldvrXHlhFt7vHlh3FDcHlhk6wHlxgwYQq:/Jl47l3ldvrXlhFt7flh3FD2lhk6yl2n
    MD5:F407FD57FBB551D13B34AAD20D00FC6D
    SHA1:873425E586BCF5357F2B779E7F79E18DAB783618
    SHA-256:80E3807C5E33A8A43BFCCAE441E01BE1FB99BB455641401D803178E399B8432C
    SHA-512:4826BDC4B853F6BFE9BC7D7E0C317835922DB20EF9EB2525F43ECA727D7D9BFFE72FA8B75BD8898FA8439B15C3D39F7A5B1B3D5E0BC2872BBD53D76C03D8FFDF
    Malicious:false
    Preview:.exemplesdir = $(datadir)/httrack/libtest.exemples_DATA = example.* *.c *.h *.txt.EXTRA_DIST = $(exemples_DATA)..INCLUDES = \..@DEFAULT_CFLAGS@ \..@THREADS_CFLAGS@ \..@V6_FLAG@ \..@LFS_FLAG@ \..-DPREFIX=\""$(prefix)"\" \..-DSYSCONFDIR=\""$(sysconfdir)"\" \..-DDATADIR=\""$(datadir)"\" \..-DLIBDIR=\""$(libdir)"\"..AM_CPPFLAGS = -I../src.AM_LDFLAGS = -L../src..# Examples.libbaselinks_la_SOURCES = callbacks-example-baselinks.c.libbaselinks_la_LIBADD = $(THREADS_LIBS) $(SOCKET_LIBS) -lhttrack.libbaselinks_la_LDFLAGS = -version-info 1:0:0.libcontentfilter_la_SOURCES = callbacks-example-contentfilter.c.libcontentfilter_la_LIBADD = $(THREADS_LIBS) $(SOCKET_LIBS) -lhttrack.libcontentfilter_la_LDFLAGS = -version-info 1:0:0.libdisplayheader_la_SOURCES = callbacks-example-displayheader.c.libdisplayheader_la_LIBADD = $(THREADS_LIBS) $(SOCKET_LIBS) -lhttrack.libdisplayheader_la_LDFLAGS = -version-info 1:0:0.libfilename_la_SOURCES = callbacks-example-filename.c.libfilename_la_LIBADD = $(THREADS_L

    C:\Program Files\WinHTTrack\libtest\Makefile.in (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:makefile script, ASCII text
    Category:dropped
    Size (bytes):19996
    Entropy (8bit):5.6022174254212285
    Encrypted:false
    SSDEEP:384:wN152iTtmSQI0dsmW/PLXmL7ih1PlWDPHcdP71T3skFLdwFp4ZzIIlfo5Z3GzVeT:Cv2iTtmSsW/PLXmL7iDdWD/cdz1T3s44
    MD5:3FE71EEBA0C78ACCA91C2F2E4397A0CB
    SHA1:BB713F1B064939930B2EDB06A5B5647ACFA28C0B
    SHA-256:0CD5DA142B2C98C1647EA4E2E99B8EC49BA6DBD642456A9E9A02609B25FF199C
    SHA-512:BD652ACD1C888727B5B0FE4413B744289D0ADAF6A08630FFDAF8621399E53176EEE4DB33F31F27609BBC9A06804B2BB5435DAEBE8AC31B6B4F0B22004DC7C691
    Malicious:false
    Preview:# Makefile.in generated by automake 1.7.9 from Makefile.am..# @configure_input@..# Copyright 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003.# Free Software Foundation, Inc..# This Makefile.in is free software; the Free Software Foundation.# gives unlimited permission to copy and/or distribute it,.# with or without modifications, as long as this notice is preserved...# This program is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY, to the extent permitted by law; without.# even the implied warranty of MERCHANTABILITY or FITNESS FOR A.# PARTICULAR PURPOSE...@SET_MAKE@..srcdir = @srcdir@.top_srcdir = @top_srcdir@.VPATH = @srcdir@.pkgdatadir = $(datadir)/@PACKAGE@.pkglibdir = $(libdir)/@PACKAGE@.pkgincludedir = $(includedir)/@PACKAGE@.top_builddir = ....am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd.INSTALL = @INSTALL@.install_sh_DATA = $(install_sh) -c -m 644.install_sh_PROGRAM = $(install_sh) -c.install_sh_SCRIPT = $(install_sh) -c.INST

    C:\Program Files\WinHTTrack\libtest\callbacks-example-baselinks.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):3972
    Entropy (8bit):5.214846763109059
    Encrypted:false
    SSDEEP:48:Jju3TT6BG7DMx+xD09b5gM5NwvF053PXyq84qSXe7SqSzTD/NGbeyAdXy+U4dhRq:Jy3n6B4DAzb58M1bwsX1xFy+UkH4B
    MD5:8CC2744EF728B069EE5CA31ABDA463A6
    SHA1:DC838E8B55EEDAF156F11B643EF88B9D1F30F735
    SHA-256:C0855C0F9EFBF39A90BB184C8E7BD1B57760B54FEFA761799487E4FAB4F9911A
    SHA-512:125446742E0939035DE3934ECD2C18442D15464DCA69206CB2D0DB683B31260E7191AE2529C9D29AAC7743CDA19FC9152A894FC817B8A090623FEB8A467C602A
    Malicious:false
    Preview:/*.. HTTrack external callbacks example : enforce a constant base href...Can be useful to make copies of site's archives using site's URL base href as root reference.. .c file.... How to build: (callback.so or callback.dll).. With GNU-GCC:.. gcc -O -g3 -Wall -D_REENTRANT -shared -o mycallback.so callbacks-example.c -lhttrack1.. With MS-Visual C++:.. cl -LD -nologo -W3 -Zi -Zp4 -DWIN32 -Fe"mycallback.dll" callbacks-example.c libhttrack1.lib.... Note: the httrack library linker option is only necessary when using libhttrack's functions inside the callback.... How to use:.. httrack --wrapper mycallback ....*/....#include <stdio.h>..#include <stdlib.h>..#include <string.h>..../* Standard httrack module includes */..#include "httrack-library.h"..#include "htsopt.h"..#include "htsdefines.h"..../* Local function definitions */..static int process_file(t_hts_callbackarg *carg, httrackp* opt, char* html, int len, const char* url_address, const char*

    C:\Program Files\WinHTTrack\libtest\callbacks-example-changecontent.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):1890
    Entropy (8bit):5.066301974734332
    Encrypted:false
    SSDEEP:24:JhvG6BBoIkcqDM1r+xD0Z0uCNRSlhlv6Qh6rwpdtym8VUqT0SQKN/Dv49e:Jw6BG7DMx+xD09b5VhmwwTUs0cvMe
    MD5:6B9BE83229EFA16F9EBD8BDCDD3A71DB
    SHA1:3D7AD4B22BF369BB0D1F48A289C19D10F9AE5F57
    SHA-256:3C54F446D0967F15A6F099FD655D6F84BDA0A5526AAEE0CA4A001013A6EEF5F4
    SHA-512:8DF765FC935762C618CCA04973696A198AAF5C549057A41939955F59FB2F1EEF0D8667AE621A9D7A8AF0E1E7CC8613C46B7F2D9BE8FBAD0E6954FA61422A3610
    Malicious:false
    Preview:/*.. HTTrack external callbacks example : display all incoming request headers.. Example of <wrappername>_init and <wrappername>_exit call (httrack >> 3.31).. .c file.... How to build: (callback.so or callback.dll).. With GNU-GCC:.. gcc -O -g3 -Wall -D_REENTRANT -shared -o mycallback.so callbacks-example.c -lhttrack1.. With MS-Visual C++:.. cl -LD -nologo -W3 -Zi -Zp4 -DWIN32 -Fe"mycallback.dll" callbacks-example.c libhttrack1.lib.... Note: the httrack library linker option is only necessary when using libhttrack's functions inside the callback.... How to use:.. httrack --wrapper mycallback ....*/....#include <stdio.h>..#include <stdlib.h>..#include <string.h>..../* Standard httrack module includes */..#include "httrack-library.h"..#include "htsopt.h"..#include "htsdefines.h"..../* Local function definitions */..static int postprocess(t_hts_callbackarg *carg, httrackp *opt, .. char** html, int* len,..

    C:\Program Files\WinHTTrack\libtest\callbacks-example-contentfilter.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):4979
    Entropy (8bit):5.126326387126232
    Encrypted:false
    SSDEEP:96:JIn6B4DARb5v3wrpXuzsmG8UW4M7cWuXyV4B:G6GavwrYzsmG8UW4M7cWuCV4B
    MD5:5575705B9D1724A3705B9B171E7B6901
    SHA1:A3040EFD781CD19647807AD14CFFA39A4DDCB722
    SHA-256:167648CD28926F078319A1FD3F5DD5940226CEAAEAB9CFC1A84737BEF4C8CC17
    SHA-512:82D9E92C111669BCF3E133E24E5217A27CA3DD3D036DC37D5B43AA745294E793A0F0A462D309026ABE6CE174F967C959FF5F0A0E2B6A07AE01EAF01A3CB69B61
    Malicious:false
    Preview:/*.. HTTrack external callbacks example : crawling html pages depending on content.. Example of <wrappername>_init and <wrappername>_exit call (httrack >> 3.31).. .c file.... How to build: (callback.so or callback.dll).. With GNU-GCC:.. gcc -O -g3 -Wall -D_REENTRANT -shared -o mycallback.so callbacks-example.c -lhttrack1.. With MS-Visual C++:.. cl -LD -nologo -W3 -Zi -Zp4 -DWIN32 -Fe"mycallback.dll" callbacks-example.c libhttrack1.lib.... Note: the httrack library linker option is only necessary when using libhttrack's functions inside the callback.... How to use:.. httrack --wrapper mycallback,stringtofind,stringtofind.. ....*/....#include <stdio.h>..#include <stdlib.h>..#include <string.h>..../* Standard httrack module includes */..#include "httrack-library.h"..#include "htsopt.h"..#include "htsdefines.h"..../* Local function definitions */..static int process(t_hts_callbackarg *carg, httrackp *opt, char* html, int len, const char* add

    C:\Program Files\WinHTTrack\libtest\callbacks-example-displayheader.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2048
    Entropy (8bit):4.9894465712700065
    Encrypted:false
    SSDEEP:24:JhvG6BBoIkcqDM1r+xD0Z0uCNRSlhlv6CSezJwpdttJ8jmSezmldw/8v/j:Jw6BG7DMx+xD09b5/x1wvCmxl03j
    MD5:238D1FF9A80772889A02BEB37D18097F
    SHA1:798D30D9A00A3DFBDB7B0D2C7358EAA248CB6B57
    SHA-256:F6B98F46FF949D90170B3D18C6A8AEF70461059D04BF76971F9D7B67DA51E262
    SHA-512:AC14C44A2CE88A30CD06C25212A289B8FA2965E05D8091D7208D738491136EE3FAFF30AD863E5FE97A4E8A62251BDCC1791DD407A66A147A2FB43981DB35FA49
    Malicious:false
    Preview:/*.. HTTrack external callbacks example : display all incoming request headers.. Example of <wrappername>_init and <wrappername>_exit call (httrack >> 3.31).. .c file.... How to build: (callback.so or callback.dll).. With GNU-GCC:.. gcc -O -g3 -Wall -D_REENTRANT -shared -o mycallback.so callbacks-example.c -lhttrack1.. With MS-Visual C++:.. cl -LD -nologo -W3 -Zi -Zp4 -DWIN32 -Fe"mycallback.dll" callbacks-example.c libhttrack1.lib.... Note: the httrack library linker option is only necessary when using libhttrack's functions inside the callback.... How to use:.. httrack --wrapper mycallback ....*/....#include <stdio.h>..#include <stdlib.h>..#include <string.h>..../* Standard httrack module includes */..#include "httrack-library.h"..#include "htsopt.h"..#include "htsdefines.h"..../* Local function definitions */..static int process(t_hts_callbackarg *carg, httrackp *opt, .. char* buff, const char* adr, const char* fil, .

    C:\Program Files\WinHTTrack\libtest\callbacks-example-filename.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2412
    Entropy (8bit):5.1449149583961695
    Encrypted:false
    SSDEEP:48:JPR6BG7DMx+xD09b5rQRDIZHwvQKQH0FbNxB:JJ6B4DAzb5r/VKTTB
    MD5:E0807B7AAC7FE7CA97534C874BCBB602
    SHA1:95D026BBD8380991AD2FE1EA500C5B3B2C028A72
    SHA-256:64EB70C119C88DC8B2C725B44E3216001105266670A02CC8B664A076803CADB9
    SHA-512:29C042D061AF465B174C79F7998E051C3D91D1953BC37C146F002040CCE2015C304741CBE25CF5A67D1C7FEC66C648832F99D98DF05E2173DB2A28296ECBE205
    Malicious:false
    Preview:/*.. HTTrack external callbacks example : changing the destination filename.. .c file.... How to build: (callback.so or callback.dll).. With GNU-GCC:.. gcc -O -g3 -Wall -D_REENTRANT -shared -o mycallback.so callbacks-example.c -lhttrack1.. With MS-Visual C++:.. cl -LD -nologo -W3 -Zi -Zp4 -DWIN32 -Fe"mycallback.dll" callbacks-example.c libhttrack1.lib.... Note: the httrack library linker option is only necessary when using libhttrack's functions inside the callback.... How to use:.. httrack --wrapper mycallback ....*/....#include <stdio.h>..#include <stdlib.h>..#include <string.h>..../* Standard httrack module includes */..#include "httrack-library.h"..#include "htsopt.h"..#include "htsdefines.h"..../* Local function definitions */..static int mysavename(t_hts_callbackarg *carg, httrackp *opt, const char* adr_complete, const char* fil_complete, const char* referer_adr, const char* referer_fil, char* save);..../* Options settings */..#includ

    C:\Program Files\WinHTTrack\libtest\callbacks-example-filename2.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):4351
    Entropy (8bit):5.186523183602917
    Encrypted:false
    SSDEEP:96:E6B4DAEfboFu+Wqx/DK/6ZnVyV4KKrqmYB:jGFYuPq/Dk6Zn8V4/bYB
    MD5:8F6C7795676CD4970D27E76588871F7D
    SHA1:054FE18D9EF84D056FA228327BAB9F324F139196
    SHA-256:D1F4E97821B2E74EAE202CD7B492438DA7B1CEBD946824ABE33FA42AED0571D0
    SHA-512:3B6E146595FF6D4E2B7DCD7CBA19B25362741E0D13E55C7D26A4A4FA597F1F25FCBB1F3CE7FA9DD29D086B4149C328476BD76C61F4ACB47CF1D56B760F749B08
    Malicious:false
    Preview:/*.. How to build: (callback.so or callback.dll).. With GNU-GCC:.. gcc -O -g3 -Wall -D_REENTRANT -shared -o mycallback.so callbacks-example.c -lhttrack1.. With MS-Visual C++:.. cl -LD -nologo -W3 -Zi -Zp4 -DWIN32 -Fe"mycallback.dll" callbacks-example.c libhttrack1.lib.... Note: the httrack library linker option is only necessary when using libhttrack's functions inside the callback.... How to use:.. httrack --wrapper mycallback,string1,string2 ....*/....#include <stdio.h>..#include <stdlib.h>..#include <string.h>..../* Standard httrack module includes */..#include "httrack-library.h"..#include "htsopt.h"..#include "htsdefines.h"..../* Function definitions */..static int mysavename(t_hts_callbackarg *carg, httrackp *opt, const char* adr_complete, const char* fil_complete, const char* referer_adr, const char* referer_fil, char* save);..static int myend(t_hts_callbackarg *carg, httrackp *opt);..../* TOLOWER */..#define TOLOWER_(a) (a >= 'A' && a <=

    C:\Program Files\WinHTTrack\libtest\callbacks-example-filenameiisbug.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2422
    Entropy (8bit):5.231211818668449
    Encrypted:false
    SSDEEP:24:JqPZZSAG6BBoIkcqDM1r+x60uCNRSlhlfGQ8Eawpdttx8KM2Q8zM4AC50lw/8FHO:JoSj6BG7DMx+xkboQRawvXfQY0FHYucB
    MD5:C15C8F5EEF43A828D229FCEB1030EC7E
    SHA1:E9F699A3A601B7613B5DE8E877AF888A86EE9004
    SHA-256:71A456BA692475AA4BF4E4DBE823E6CF5CFEECEBD8BA625B43049F12525F20D9
    SHA-512:448E1188B7A680941DD989F6CC5C5A4C5E8123BF33767F46340EAE8A11FCEF5999974CD3031929DF7231EDA19DC0E8FD71609BC1A1733C097D137023F292ACCB
    Malicious:false
    Preview:/*.. HTTrack external callbacks example : changing folder names ending with ".com".. with ".c0m" as a workaround of IIS bug (see KB 275601).... How to build: (callback.so or callback.dll).. With GNU-GCC:.. gcc -O -g3 -Wall -D_REENTRANT -shared -o mycallback.so callbacks-example.c -lhttrack1.. With MS-Visual C++:.. cl -LD -nologo -W3 -Zi -Zp4 -DWIN32 -Fe"mycallback.dll" callbacks-example.c libhttrack1.lib.... Note: the httrack library linker option is only necessary when using libhttrack's functions inside the callback..*/....#include <stdio.h>..#include <stdlib.h>..#include <string.h>..../* Standard httrack module includes */..#include "httrack-library.h"..#include "htsopt.h"..#include "htsdefines.h"..../* Function definitions */..static int mysavename(t_hts_callbackarg *carg, httrackp *opt, const char* adr_complete, const char* fil_complete, const char* referer_adr, const char* referer_fil, char* save);..../* ..module entry point ..*/..EXTERNAL_FU

    C:\Program Files\WinHTTrack\libtest\callbacks-example-listlinks.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):4544
    Entropy (8bit):5.233257137550844
    Encrypted:false
    SSDEEP:48:Jy6BG7DMx+xD09b5Evi3IaMZarXaw4KSj8yT60Kyj0l3qi3IZPf50y8f11t+pV4B:Jy6B4DAzbD4t+q8yq1T4NCxyV4B
    MD5:380F70F9952044F81E26474AB3AB60C7
    SHA1:E4F9A20E8F56921B9F1A8A96890809DA5E1EE3B0
    SHA-256:3E45C31C313C50FB4EBE57F4FA3F677969314F9A23CC5DAAEBCB694401D3A1A3
    SHA-512:E160EAA7E7995A61DEF285AAF846FA5FC5E6AEF87180C071187966D824900CF74060A3D1C08813612F109AB45B50046B769AE6CDE6CC18E2B1CB26EDF44419CE
    Malicious:false
    Preview:/*.. HTTrack external callbacks example.. .c file.... How to build: (callback.so or callback.dll).. With GNU-GCC:.. gcc -O -g3 -Wall -D_REENTRANT -shared -o mycallback.so callbacks-example.c -lhttrack1.. With MS-Visual C++:.. cl -LD -nologo -W3 -Zi -Zp4 -DWIN32 -Fe"mycallback.dll" callbacks-example.c libhttrack1.lib.... Note: the httrack library linker option is only necessary when using libhttrack's functions inside the callback.... How to use:.. httrack --wrapper mycallback ....*/....#include <stdio.h>..#include <stdlib.h>..#include <string.h>..../* Standard httrack module includes */..#include "httrack-library.h"..#include "htsopt.h"..#include "htsdefines.h"..../* Function definitions */..static int process_file(t_hts_callbackarg *carg, httrackp *opt, char* html, int len, const char* url_address, const char* url_file);..static int check_detectedlink(t_hts_callbackarg *carg, httrackp *opt, char* link);..static int check_loop(t_hts_callbac

    C:\Program Files\WinHTTrack\libtest\callbacks-example-log.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):3978
    Entropy (8bit):5.132817356891103
    Encrypted:false
    SSDEEP:96:JH66B4DAmbZyBNQryStOIs11kySeOs4fKoRPZPe:hpGteqySPs3k9rs451e
    MD5:EAA70406B6694CF7637D69D213438130
    SHA1:D2A860BD93845227881B5A70C6B8343F12265C85
    SHA-256:5EBF6E87E77249B20E24B6DBD326D30BBD6A1940E526525A0A1B0715F22ABA3D
    SHA-512:01725CE77A20F7770D59C624A0C97911218C2CCD52C17E818705D7B76AFA0FA6930B7FA3066C1C597C67DFB4870F808B5A4A005DFCB2CE2246876AB4AD67259F
    Malicious:false
    Preview:/*.. HTTrack external callbacks example : dumy plugin, aimed to log for debugging purpose.... How to build: (callback.so or callback.dll).. With GNU-GCC:.. gcc -O -g3 -Wall -D_REENTRANT -shared -o mycallback.so callbacks-example.c -lhttrack1.. With MS-Visual C++:.. cl -LD -nologo -W3 -Zi -Zp4 -DWIN32 -Fe"mycallback.dll" callbacks-example.c libhttrack1.lib.... Note: the httrack library linker option is only necessary when using libhttrack's functions inside the callback.... How to use:.. httrack --wrapper mycallback ....*/..../* system includes */..#include <stdio.h>..#include <stdlib.h>..#include <string.h>..../* standard httrack module includes */..#include "httrack-library.h"..#include "htsopt.h"..#include "htsdefines.h"..../* local function called as "check_html" callback */..static int process_file(t_hts_callbackarg *carg, httrackp *opt, .. char* html, int len, const char* url_address, const char* url_file) {.. void

    C:\Program Files\WinHTTrack\libtest\callbacks-example-simple.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):3204
    Entropy (8bit):5.087217400655997
    Encrypted:false
    SSDEEP:48:JI6BG7DMx+xD0kbZyzl4NJLJM/kyflrNJ0nNyNs4nw4+ckKuJnjJnQXwCbAB:JI6B4DAmbZy+N4/kypNXs4fKKuV23AB
    MD5:97D5ADE34855D1E566348B7C68830F78
    SHA1:4CE82A6CB892EDB656F3ACA14F04DE2AA0EF4CC1
    SHA-256:28EA5A05B378C0A7DC61558BF26971892929192B1F6AE73087EADAB31083D0BD
    SHA-512:6B07F4FC535F2F9D9850B1402564D539CC29FB49EB84D5BDF98778663B8C5A1BFF997296524FED80809174EF77E9ED37D94B10EDFE4AD2A600170368CF93036C
    Malicious:false
    Preview:/*.. HTTrack external callbacks example : print all downloaded html documents.... How to build: (callback.so or callback.dll).. With GNU-GCC:.. gcc -O -g3 -Wall -D_REENTRANT -shared -o mycallback.so callbacks-example.c -lhttrack1.. With MS-Visual C++:.. cl -LD -nologo -W3 -Zi -Zp4 -DWIN32 -Fe"mycallback.dll" callbacks-example.c libhttrack1.lib.... Note: the httrack library linker option is only necessary when using libhttrack's functions inside the callback.... How to use:.. httrack --wrapper mycallback ....*/..../* system includes */..#include <stdio.h>..#include <stdlib.h>..#include <string.h>..../* standard httrack module includes */..#include "httrack-library.h"..#include "htsopt.h"..#include "htsdefines.h"..../* local function called as "check_html" callback */..static int process_file(t_hts_callbackarg /*the carg structure, holding various information*/*carg, /*the option settings*/httrackp *opt, .. /*other paramet

    C:\Program Files\WinHTTrack\libtest\example.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):7835
    Entropy (8bit):5.14687097147136
    Encrypted:false
    SSDEEP:192:v0org4DF2Igw9kS4jNqN4/2L7teECQaPIN7TcY+e:corg4Dzl
    MD5:6E5C1DC64C7BDD6A90D568C3CEABAE19
    SHA1:32F25074765EAFE06AAC2F7CEACA004920308323
    SHA-256:87D04A219138027C4717DF1E84297B090D05883DFDE1F951EE5D6112E4DCFFC5
    SHA-512:9E0CBEDEB6B8FDA9C57E8E9164788A26FDF88F375A9892B89DEFEC24A1DCC5D5E46EEB827B3DC73DAB8B0E2D9F114C875F04FDB5DEF2B3CD8C5290F5A8E1DF52
    Malicious:false
    Preview:/*.. HTTrack library example.. .c file.... Prerequisites:.. - install winhttrack.. - set the proper path in the project settings (especially for the httrack lib and dll).... How to build: (callback.so or callback.dll).. With GNU-GCC:.. gcc -I/usr/include/httrack -O -g3 -Wall -D_REENTRANT -o example example.c -lhttrack1.. With MS-Visual C++:.. cl -nologo -W3 -Zi -Zp4 -DWIN32 -Fe"mycallback.exe" callbacks-example.c wsock32.lib libhttrack.lib..*/....#include <stdio.h>..#include <stdlib.h>..#include <string.h>..#ifdef _WIN32..#include <windows.h>..#endif..../* Standard httrack module includes */..#include "httrack-library.h"..#include "htsopt.h"..#include "htsdefines.h"..../* Local definitions */..#include "example.h"..../*.. * Name: main.. * Description: main() function.. * Parameters: None.. * Should return: error status..*/..int main(void) {.. /* .. First, ask for an URL .. Note: For the test, option r2 (mirror max

    C:\Program Files\WinHTTrack\libtest\example.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):3079
    Entropy (8bit):4.638212784598226
    Encrypted:false
    SSDEEP:48:j4VnV0bcmLn/H/EnH7QStH3PStXXi/i2STbskmUgHSubdi1ASdBSdGmGOccvSCGm:qVZbYtqmEMBOj0fVYHYY
    MD5:EA7C4B3A3F0DB6D2F23BF8064C6E99ED
    SHA1:FC27D3E6A4F481CCCBBEAF2C87BBBBA47FC797B8
    SHA-256:422692F93F3469FE1BC6E0895BADBA1B7368E8D40DC07A0EB645416900F4BD21
    SHA-512:1CDAED6CBF1E0FBBEF09AA38991FC67F8FA8A26DE2A7FCE0F27CB0F264E1B8BBCBB639029C03BFC80A1D4FDD27D2572C69AA28B4702288527704F39782640346
    Malicious:false
    Preview:/*.. HTTrack library example.. .h file..*/....#ifdef __WIN32..#define CDECL __cdecl..#else..#define CDECL..#endif....static void CDECL httrack_wrapper_init(t_hts_callbackarg *carg);..static void CDECL httrack_wrapper_uninit(t_hts_callbackarg *carg);..static int CDECL httrack_wrapper_start(t_hts_callbackarg *carg, httrackp* opt);..static int CDECL httrack_wrapper_chopt(t_hts_callbackarg *carg, httrackp* opt);..static int CDECL httrack_wrapper_end(t_hts_callbackarg *carg, httrackp* opt); ..static int CDECL httrack_wrapper_checkhtml(t_hts_callbackarg *carg, httrackp *opt, char* html,int len,const char* url_address,const char* url_file);..static int CDECL httrack_wrapper_loop(t_hts_callbackarg *carg, httrackp *opt, void* _back,int back_max,int back_index,int lien_n,int lien_tot,int stat_time,hts_stat_struct* stats);..static const char* CDECL httrack_wrapper_query(t_hts_callbackarg *carg, httrackp *opt, const char* question);..static const char* CDECL httrack_wrapper_query2(t_hts_c

    C:\Program Files\WinHTTrack\libtest\is-098P1.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):1890
    Entropy (8bit):5.066301974734332
    Encrypted:false
    SSDEEP:24:JhvG6BBoIkcqDM1r+xD0Z0uCNRSlhlv6Qh6rwpdtym8VUqT0SQKN/Dv49e:Jw6BG7DMx+xD09b5VhmwwTUs0cvMe
    MD5:6B9BE83229EFA16F9EBD8BDCDD3A71DB
    SHA1:3D7AD4B22BF369BB0D1F48A289C19D10F9AE5F57
    SHA-256:3C54F446D0967F15A6F099FD655D6F84BDA0A5526AAEE0CA4A001013A6EEF5F4
    SHA-512:8DF765FC935762C618CCA04973696A198AAF5C549057A41939955F59FB2F1EEF0D8667AE621A9D7A8AF0E1E7CC8613C46B7F2D9BE8FBAD0E6954FA61422A3610
    Malicious:false
    Preview:/*.. HTTrack external callbacks example : display all incoming request headers.. Example of <wrappername>_init and <wrappername>_exit call (httrack >> 3.31).. .c file.... How to build: (callback.so or callback.dll).. With GNU-GCC:.. gcc -O -g3 -Wall -D_REENTRANT -shared -o mycallback.so callbacks-example.c -lhttrack1.. With MS-Visual C++:.. cl -LD -nologo -W3 -Zi -Zp4 -DWIN32 -Fe"mycallback.dll" callbacks-example.c libhttrack1.lib.... Note: the httrack library linker option is only necessary when using libhttrack's functions inside the callback.... How to use:.. httrack --wrapper mycallback ....*/....#include <stdio.h>..#include <stdlib.h>..#include <string.h>..../* Standard httrack module includes */..#include "httrack-library.h"..#include "htsopt.h"..#include "htsdefines.h"..../* Local function definitions */..static int postprocess(t_hts_callbackarg *carg, httrackp *opt, .. char** html, int* len,..

    C:\Program Files\WinHTTrack\libtest\is-18H57.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2048
    Entropy (8bit):4.9894465712700065
    Encrypted:false
    SSDEEP:24:JhvG6BBoIkcqDM1r+xD0Z0uCNRSlhlv6CSezJwpdttJ8jmSezmldw/8v/j:Jw6BG7DMx+xD09b5/x1wvCmxl03j
    MD5:238D1FF9A80772889A02BEB37D18097F
    SHA1:798D30D9A00A3DFBDB7B0D2C7358EAA248CB6B57
    SHA-256:F6B98F46FF949D90170B3D18C6A8AEF70461059D04BF76971F9D7B67DA51E262
    SHA-512:AC14C44A2CE88A30CD06C25212A289B8FA2965E05D8091D7208D738491136EE3FAFF30AD863E5FE97A4E8A62251BDCC1791DD407A66A147A2FB43981DB35FA49
    Malicious:false
    Preview:/*.. HTTrack external callbacks example : display all incoming request headers.. Example of <wrappername>_init and <wrappername>_exit call (httrack >> 3.31).. .c file.... How to build: (callback.so or callback.dll).. With GNU-GCC:.. gcc -O -g3 -Wall -D_REENTRANT -shared -o mycallback.so callbacks-example.c -lhttrack1.. With MS-Visual C++:.. cl -LD -nologo -W3 -Zi -Zp4 -DWIN32 -Fe"mycallback.dll" callbacks-example.c libhttrack1.lib.... Note: the httrack library linker option is only necessary when using libhttrack's functions inside the callback.... How to use:.. httrack --wrapper mycallback ....*/....#include <stdio.h>..#include <stdlib.h>..#include <string.h>..../* Standard httrack module includes */..#include "httrack-library.h"..#include "htsopt.h"..#include "htsdefines.h"..../* Local function definitions */..static int process(t_hts_callbackarg *carg, httrackp *opt, .. char* buff, const char* adr, const char* fil, .

    C:\Program Files\WinHTTrack\libtest\is-2EG7O.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):3079
    Entropy (8bit):4.638212784598226
    Encrypted:false
    SSDEEP:48:j4VnV0bcmLn/H/EnH7QStH3PStXXi/i2STbskmUgHSubdi1ASdBSdGmGOccvSCGm:qVZbYtqmEMBOj0fVYHYY
    MD5:EA7C4B3A3F0DB6D2F23BF8064C6E99ED
    SHA1:FC27D3E6A4F481CCCBBEAF2C87BBBBA47FC797B8
    SHA-256:422692F93F3469FE1BC6E0895BADBA1B7368E8D40DC07A0EB645416900F4BD21
    SHA-512:1CDAED6CBF1E0FBBEF09AA38991FC67F8FA8A26DE2A7FCE0F27CB0F264E1B8BBCBB639029C03BFC80A1D4FDD27D2572C69AA28B4702288527704F39782640346
    Malicious:false
    Preview:/*.. HTTrack library example.. .h file..*/....#ifdef __WIN32..#define CDECL __cdecl..#else..#define CDECL..#endif....static void CDECL httrack_wrapper_init(t_hts_callbackarg *carg);..static void CDECL httrack_wrapper_uninit(t_hts_callbackarg *carg);..static int CDECL httrack_wrapper_start(t_hts_callbackarg *carg, httrackp* opt);..static int CDECL httrack_wrapper_chopt(t_hts_callbackarg *carg, httrackp* opt);..static int CDECL httrack_wrapper_end(t_hts_callbackarg *carg, httrackp* opt); ..static int CDECL httrack_wrapper_checkhtml(t_hts_callbackarg *carg, httrackp *opt, char* html,int len,const char* url_address,const char* url_file);..static int CDECL httrack_wrapper_loop(t_hts_callbackarg *carg, httrackp *opt, void* _back,int back_max,int back_index,int lien_n,int lien_tot,int stat_time,hts_stat_struct* stats);..static const char* CDECL httrack_wrapper_query(t_hts_callbackarg *carg, httrackp *opt, const char* question);..static const char* CDECL httrack_wrapper_query2(t_hts_c

    C:\Program Files\WinHTTrack\libtest\is-72EIE.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2226
    Entropy (8bit):4.961892748969933
    Encrypted:false
    SSDEEP:24:dyDHojhQByX5F+EDDWkyEOkH5CTbVpTYcEzmxrcOgSbpGHcVxBnVZkPddG:d4IVtFPDDNygHWTdEyk58VVZkFdG
    MD5:A05313270965352F09D945D92C9DFC62
    SHA1:4531C6337C986624B1A2366A028934C7021F9361
    SHA-256:582AEC2CCF27E0521B94A78EDDB5F814E63BFB163885D7DD144456F005230699
    SHA-512:C0D89156A64D12BF47CD595D125F12230CB85BDC16F318B25C1C426B2BDC706EC127D5167D5B11002EF594111FA7B4CECC3BD297D0BCB60B3BC1FC85BE62EFC3
    Malicious:false
    Preview:HTTrack library example..-----------------------....Here is an example of how to integrate HTTrack Website Copier into a project..to use it as a "core library". ......Important Notice:..----------------....These sources are covered by the GNU General Public License (see below)..(Projects based on these sources must follow the GPL, too)......Copyright notice:..----------------....HTTrack Website Copier, Offline Browser for Windows and Unix..Copyright (C) Xavier Roche and other contributors....This program is free software; you can redistribute it and/or..modify it under the terms of the GNU General Public License..as published by the Free Software Foundation; either version 3..of the License, or any later version.....This program is distributed in the hope that it will be useful,..but WITHOUT ANY WARRANTY; without even the implied warranty of..MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the..GNU General Public License for more details.....You should have received a copy of

    C:\Program Files\WinHTTrack\libtest\is-91MOA.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2412
    Entropy (8bit):5.1449149583961695
    Encrypted:false
    SSDEEP:48:JPR6BG7DMx+xD09b5rQRDIZHwvQKQH0FbNxB:JJ6B4DAzb5r/VKTTB
    MD5:E0807B7AAC7FE7CA97534C874BCBB602
    SHA1:95D026BBD8380991AD2FE1EA500C5B3B2C028A72
    SHA-256:64EB70C119C88DC8B2C725B44E3216001105266670A02CC8B664A076803CADB9
    SHA-512:29C042D061AF465B174C79F7998E051C3D91D1953BC37C146F002040CCE2015C304741CBE25CF5A67D1C7FEC66C648832F99D98DF05E2173DB2A28296ECBE205
    Malicious:false
    Preview:/*.. HTTrack external callbacks example : changing the destination filename.. .c file.... How to build: (callback.so or callback.dll).. With GNU-GCC:.. gcc -O -g3 -Wall -D_REENTRANT -shared -o mycallback.so callbacks-example.c -lhttrack1.. With MS-Visual C++:.. cl -LD -nologo -W3 -Zi -Zp4 -DWIN32 -Fe"mycallback.dll" callbacks-example.c libhttrack1.lib.... Note: the httrack library linker option is only necessary when using libhttrack's functions inside the callback.... How to use:.. httrack --wrapper mycallback ....*/....#include <stdio.h>..#include <stdlib.h>..#include <string.h>..../* Standard httrack module includes */..#include "httrack-library.h"..#include "htsopt.h"..#include "htsdefines.h"..../* Local function definitions */..static int mysavename(t_hts_callbackarg *carg, httrackp *opt, const char* adr_complete, const char* fil_complete, const char* referer_adr, const char* referer_fil, char* save);..../* Options settings */..#includ

    C:\Program Files\WinHTTrack\libtest\is-CFV8O.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):7835
    Entropy (8bit):5.14687097147136
    Encrypted:false
    SSDEEP:192:v0org4DF2Igw9kS4jNqN4/2L7teECQaPIN7TcY+e:corg4Dzl
    MD5:6E5C1DC64C7BDD6A90D568C3CEABAE19
    SHA1:32F25074765EAFE06AAC2F7CEACA004920308323
    SHA-256:87D04A219138027C4717DF1E84297B090D05883DFDE1F951EE5D6112E4DCFFC5
    SHA-512:9E0CBEDEB6B8FDA9C57E8E9164788A26FDF88F375A9892B89DEFEC24A1DCC5D5E46EEB827B3DC73DAB8B0E2D9F114C875F04FDB5DEF2B3CD8C5290F5A8E1DF52
    Malicious:false
    Preview:/*.. HTTrack library example.. .c file.... Prerequisites:.. - install winhttrack.. - set the proper path in the project settings (especially for the httrack lib and dll).... How to build: (callback.so or callback.dll).. With GNU-GCC:.. gcc -I/usr/include/httrack -O -g3 -Wall -D_REENTRANT -o example example.c -lhttrack1.. With MS-Visual C++:.. cl -nologo -W3 -Zi -Zp4 -DWIN32 -Fe"mycallback.exe" callbacks-example.c wsock32.lib libhttrack.lib..*/....#include <stdio.h>..#include <stdlib.h>..#include <string.h>..#ifdef _WIN32..#include <windows.h>..#endif..../* Standard httrack module includes */..#include "httrack-library.h"..#include "htsopt.h"..#include "htsdefines.h"..../* Local definitions */..#include "example.h"..../*.. * Name: main.. * Description: main() function.. * Parameters: None.. * Should return: error status..*/..int main(void) {.. /* .. First, ask for an URL .. Note: For the test, option r2 (mirror max

    C:\Program Files\WinHTTrack\libtest\is-CREK1.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2420
    Entropy (8bit):5.274330172803927
    Encrypted:false
    SSDEEP:48:ckDjCKUCKSzy6E4o4f3wsLdJhphzh8tQF67/bRC4:dfEx4f3NLdJhphzh8tQF67/bI4
    MD5:4D6948F6BE26BE0E3EC5D1240C3F14CC
    SHA1:B83137D3CE806892211E360A32C445E65409186B
    SHA-256:D5ED1B9A952B919EAFB12F99BEAC63C32B0759A0FF5D3371712839BA42104311
    SHA-512:C4B80B31CD8F4D038EEDB51DFBD0B3D8CEE667ED3E583CC4519AE3512B956B4BFEEA8F34E3817DDFDC226DD4FC916CFEE3250BFE118A5BE44BBD5BED1FE0BA5B
    Malicious:false
    Preview:<?xml version="1.0" encoding="Windows-1252"?>..<VisualStudioProject...ProjectType="Visual C++"...Version="7.10"...Name="libtest"...ProjectGUID="{76424734-BC12-4472-ABE2-B5C7A4A0B733}"...Keyword="MakeFileProj">...<Platforms>....<Platform.....Name="Win32"/>...</Platforms>...<Configurations>....<Configuration.....Name="Debug|Win32".....OutputDirectory="Debug".....IntermediateDirectory="Debug".....ConfigurationType="0">.....<Tool......Name="VCNMakeTool"......BuildCommandLine="nmake -f libtest.mak"......CleanCommandLine="del *.obj"/>....</Configuration>....<Configuration.....Name="Release|Win32".....OutputDirectory="Release".....IntermediateDirectory="Release".....ConfigurationType="0">.....<Tool......Name="VCNMakeTool"......BuildCommandLine="nmake -f libtest.mak"......CleanCommandLine="del *.obj"/>....</Configuration>...</Configurations>...<References>...</References>...<Files>....<Filter.....Name="Source Files".....Filter="cpp;c;cxx;def;odl;idl;hpj;bat;asm;asmx".....UniqueIdentifier="{4FC

    C:\Program Files\WinHTTrack\libtest\is-DATIA.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):4544
    Entropy (8bit):5.233257137550844
    Encrypted:false
    SSDEEP:48:Jy6BG7DMx+xD09b5Evi3IaMZarXaw4KSj8yT60Kyj0l3qi3IZPf50y8f11t+pV4B:Jy6B4DAzbD4t+q8yq1T4NCxyV4B
    MD5:380F70F9952044F81E26474AB3AB60C7
    SHA1:E4F9A20E8F56921B9F1A8A96890809DA5E1EE3B0
    SHA-256:3E45C31C313C50FB4EBE57F4FA3F677969314F9A23CC5DAAEBCB694401D3A1A3
    SHA-512:E160EAA7E7995A61DEF285AAF846FA5FC5E6AEF87180C071187966D824900CF74060A3D1C08813612F109AB45B50046B769AE6CDE6CC18E2B1CB26EDF44419CE
    Malicious:false
    Preview:/*.. HTTrack external callbacks example.. .c file.... How to build: (callback.so or callback.dll).. With GNU-GCC:.. gcc -O -g3 -Wall -D_REENTRANT -shared -o mycallback.so callbacks-example.c -lhttrack1.. With MS-Visual C++:.. cl -LD -nologo -W3 -Zi -Zp4 -DWIN32 -Fe"mycallback.dll" callbacks-example.c libhttrack1.lib.... Note: the httrack library linker option is only necessary when using libhttrack's functions inside the callback.... How to use:.. httrack --wrapper mycallback ....*/....#include <stdio.h>..#include <stdlib.h>..#include <string.h>..../* Standard httrack module includes */..#include "httrack-library.h"..#include "htsopt.h"..#include "htsdefines.h"..../* Function definitions */..static int process_file(t_hts_callbackarg *carg, httrackp *opt, char* html, int len, const char* url_address, const char* url_file);..static int check_detectedlink(t_hts_callbackarg *carg, httrackp *opt, char* link);..static int check_loop(t_hts_callbac

    C:\Program Files\WinHTTrack\libtest\is-E3DI8.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:makefile script, ASCII text
    Category:dropped
    Size (bytes):19996
    Entropy (8bit):5.6022174254212285
    Encrypted:false
    SSDEEP:384:wN152iTtmSQI0dsmW/PLXmL7ih1PlWDPHcdP71T3skFLdwFp4ZzIIlfo5Z3GzVeT:Cv2iTtmSsW/PLXmL7iDdWD/cdz1T3s44
    MD5:3FE71EEBA0C78ACCA91C2F2E4397A0CB
    SHA1:BB713F1B064939930B2EDB06A5B5647ACFA28C0B
    SHA-256:0CD5DA142B2C98C1647EA4E2E99B8EC49BA6DBD642456A9E9A02609B25FF199C
    SHA-512:BD652ACD1C888727B5B0FE4413B744289D0ADAF6A08630FFDAF8621399E53176EEE4DB33F31F27609BBC9A06804B2BB5435DAEBE8AC31B6B4F0B22004DC7C691
    Malicious:false
    Preview:# Makefile.in generated by automake 1.7.9 from Makefile.am..# @configure_input@..# Copyright 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003.# Free Software Foundation, Inc..# This Makefile.in is free software; the Free Software Foundation.# gives unlimited permission to copy and/or distribute it,.# with or without modifications, as long as this notice is preserved...# This program is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY, to the extent permitted by law; without.# even the implied warranty of MERCHANTABILITY or FITNESS FOR A.# PARTICULAR PURPOSE...@SET_MAKE@..srcdir = @srcdir@.top_srcdir = @top_srcdir@.VPATH = @srcdir@.pkgdatadir = $(datadir)/@PACKAGE@.pkglibdir = $(libdir)/@PACKAGE@.pkgincludedir = $(includedir)/@PACKAGE@.top_builddir = ....am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd.INSTALL = @INSTALL@.install_sh_DATA = $(install_sh) -c -m 644.install_sh_PROGRAM = $(install_sh) -c.install_sh_SCRIPT = $(install_sh) -c.INST

    C:\Program Files\WinHTTrack\libtest\is-GTOQT.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:makefile script, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1782
    Entropy (8bit):5.3085536420955615
    Encrypted:false
    SSDEEP:48:6jA4o4BMHZTGWCDKyl17yyRPl/yynl4wyy40l8yyIldeyyElh+yyhSlh0yyhOhlD:6PjBMCl17Ltl/Lnl4wL40l8LIldeLElV
    MD5:628BA9E28943866C5CF1048D13DDABA0
    SHA1:FE48B99B1DA46820DADCC65FD097F8C1260E2405
    SHA-256:E3D5D8024603679649FB022B040A98DF449145D292036A583B2973E1AD0181E2
    SHA-512:9D13DCE4510C69160E57874B40E92C67C7330ED35F01D4D3509B57BBF47261B17CB6763FE8D4A11F64E713FE9A4DA1DF8D0112FE1B78D85070CD971B29CBB6EC
    Malicious:false
    Preview:# Makefile....OBJDIR = ./Release/..PATH = $(DEVSTU)\vc\bin;$(DEVSTU)\sharedide\bin;$(PATH)..INCLUDES = /I "." /I ".." /I "../IPv6Kit/inc" /I "$(DEVSTU)\vc\include"..LIB_FLAGS = /link /LIBPATH:"L:\HTTrack\httrack\src_win\libhttrack" /LIBPATH:"L:\HTTrack\httrack\libhttrack"..COMMON_FLAGS = /W3 /O2 /Fo"$(OBJDIR)" /Fd"$(OBJDIR)" /Fa"$(OBJDIR)" $(INCLUDES)..CPP_FLAGS = /LD $(COMMON_FLAGS) libhttrack.lib..BIN_FLAGS = /link /LIBPATH:"C:\temp\Debuglib"....all:.. cl $(CPP_FLAGS) \.. callbacks-example-simple.c -Fe$(OBJDIR)callbacks-example-simple.dll \.. $(LIB_FLAGS).. cl $(CPP_FLAGS) \.. callbacks-example-log.c -Fe$(OBJDIR)callbacks-example-log.dll \.. $(LIB_FLAGS).. cl $(CPP_FLAGS) \.. callbacks-example-baselinks.c -Fe$(OBJDIR)callbacks-example-baselinks.dll \.. $(LIB_FLAGS).. cl $(CPP_FLAGS) \.. callbacks-example-contentfilter.c -Fe$(OBJDIR)callbacks-example-contentfilter.dll \.. $(LIB_FLAGS).. cl $(CPP_FLAGS) \.. callbacks-example-displayheader.c -Fe$(OBJDIR)c

    C:\Program Files\WinHTTrack\libtest\is-I7PFS.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text
    Category:dropped
    Size (bytes):1747
    Entropy (8bit):5.393870423923631
    Encrypted:false
    SSDEEP:48:/5IE1Hl4jHl3HldvrXHlhFt7vHlh3FDcHlhk6wHlxgwYQq:/Jl47l3ldvrXlhFt7flh3FD2lhk6yl2n
    MD5:F407FD57FBB551D13B34AAD20D00FC6D
    SHA1:873425E586BCF5357F2B779E7F79E18DAB783618
    SHA-256:80E3807C5E33A8A43BFCCAE441E01BE1FB99BB455641401D803178E399B8432C
    SHA-512:4826BDC4B853F6BFE9BC7D7E0C317835922DB20EF9EB2525F43ECA727D7D9BFFE72FA8B75BD8898FA8439B15C3D39F7A5B1B3D5E0BC2872BBD53D76C03D8FFDF
    Malicious:false
    Preview:.exemplesdir = $(datadir)/httrack/libtest.exemples_DATA = example.* *.c *.h *.txt.EXTRA_DIST = $(exemples_DATA)..INCLUDES = \..@DEFAULT_CFLAGS@ \..@THREADS_CFLAGS@ \..@V6_FLAG@ \..@LFS_FLAG@ \..-DPREFIX=\""$(prefix)"\" \..-DSYSCONFDIR=\""$(sysconfdir)"\" \..-DDATADIR=\""$(datadir)"\" \..-DLIBDIR=\""$(libdir)"\"..AM_CPPFLAGS = -I../src.AM_LDFLAGS = -L../src..# Examples.libbaselinks_la_SOURCES = callbacks-example-baselinks.c.libbaselinks_la_LIBADD = $(THREADS_LIBS) $(SOCKET_LIBS) -lhttrack.libbaselinks_la_LDFLAGS = -version-info 1:0:0.libcontentfilter_la_SOURCES = callbacks-example-contentfilter.c.libcontentfilter_la_LIBADD = $(THREADS_LIBS) $(SOCKET_LIBS) -lhttrack.libcontentfilter_la_LDFLAGS = -version-info 1:0:0.libdisplayheader_la_SOURCES = callbacks-example-displayheader.c.libdisplayheader_la_LIBADD = $(THREADS_LIBS) $(SOCKET_LIBS) -lhttrack.libdisplayheader_la_LDFLAGS = -version-info 1:0:0.libfilename_la_SOURCES = callbacks-example-filename.c.libfilename_la_LIBADD = $(THREADS_L

    C:\Program Files\WinHTTrack\libtest\is-KBBHN.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):3972
    Entropy (8bit):5.214846763109059
    Encrypted:false
    SSDEEP:48:Jju3TT6BG7DMx+xD09b5gM5NwvF053PXyq84qSXe7SqSzTD/NGbeyAdXy+U4dhRq:Jy3n6B4DAzb58M1bwsX1xFy+UkH4B
    MD5:8CC2744EF728B069EE5CA31ABDA463A6
    SHA1:DC838E8B55EEDAF156F11B643EF88B9D1F30F735
    SHA-256:C0855C0F9EFBF39A90BB184C8E7BD1B57760B54FEFA761799487E4FAB4F9911A
    SHA-512:125446742E0939035DE3934ECD2C18442D15464DCA69206CB2D0DB683B31260E7191AE2529C9D29AAC7743CDA19FC9152A894FC817B8A090623FEB8A467C602A
    Malicious:false
    Preview:/*.. HTTrack external callbacks example : enforce a constant base href...Can be useful to make copies of site's archives using site's URL base href as root reference.. .c file.... How to build: (callback.so or callback.dll).. With GNU-GCC:.. gcc -O -g3 -Wall -D_REENTRANT -shared -o mycallback.so callbacks-example.c -lhttrack1.. With MS-Visual C++:.. cl -LD -nologo -W3 -Zi -Zp4 -DWIN32 -Fe"mycallback.dll" callbacks-example.c libhttrack1.lib.... Note: the httrack library linker option is only necessary when using libhttrack's functions inside the callback.... How to use:.. httrack --wrapper mycallback ....*/....#include <stdio.h>..#include <stdlib.h>..#include <string.h>..../* Standard httrack module includes */..#include "httrack-library.h"..#include "htsopt.h"..#include "htsdefines.h"..../* Local function definitions */..static int process_file(t_hts_callbackarg *carg, httrackp* opt, char* html, int len, const char* url_address, const char*

    C:\Program Files\WinHTTrack\libtest\is-SFASP.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):3978
    Entropy (8bit):5.132817356891103
    Encrypted:false
    SSDEEP:96:JH66B4DAmbZyBNQryStOIs11kySeOs4fKoRPZPe:hpGteqySPs3k9rs451e
    MD5:EAA70406B6694CF7637D69D213438130
    SHA1:D2A860BD93845227881B5A70C6B8343F12265C85
    SHA-256:5EBF6E87E77249B20E24B6DBD326D30BBD6A1940E526525A0A1B0715F22ABA3D
    SHA-512:01725CE77A20F7770D59C624A0C97911218C2CCD52C17E818705D7B76AFA0FA6930B7FA3066C1C597C67DFB4870F808B5A4A005DFCB2CE2246876AB4AD67259F
    Malicious:false
    Preview:/*.. HTTrack external callbacks example : dumy plugin, aimed to log for debugging purpose.... How to build: (callback.so or callback.dll).. With GNU-GCC:.. gcc -O -g3 -Wall -D_REENTRANT -shared -o mycallback.so callbacks-example.c -lhttrack1.. With MS-Visual C++:.. cl -LD -nologo -W3 -Zi -Zp4 -DWIN32 -Fe"mycallback.dll" callbacks-example.c libhttrack1.lib.... Note: the httrack library linker option is only necessary when using libhttrack's functions inside the callback.... How to use:.. httrack --wrapper mycallback ....*/..../* system includes */..#include <stdio.h>..#include <stdlib.h>..#include <string.h>..../* standard httrack module includes */..#include "httrack-library.h"..#include "htsopt.h"..#include "htsdefines.h"..../* local function called as "check_html" callback */..static int process_file(t_hts_callbackarg *carg, httrackp *opt, .. char* html, int len, const char* url_address, const char* url_file) {.. void

    C:\Program Files\WinHTTrack\libtest\is-SHLUD.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):3204
    Entropy (8bit):5.087217400655997
    Encrypted:false
    SSDEEP:48:JI6BG7DMx+xD0kbZyzl4NJLJM/kyflrNJ0nNyNs4nw4+ckKuJnjJnQXwCbAB:JI6B4DAmbZy+N4/kypNXs4fKKuV23AB
    MD5:97D5ADE34855D1E566348B7C68830F78
    SHA1:4CE82A6CB892EDB656F3ACA14F04DE2AA0EF4CC1
    SHA-256:28EA5A05B378C0A7DC61558BF26971892929192B1F6AE73087EADAB31083D0BD
    SHA-512:6B07F4FC535F2F9D9850B1402564D539CC29FB49EB84D5BDF98778663B8C5A1BFF997296524FED80809174EF77E9ED37D94B10EDFE4AD2A600170368CF93036C
    Malicious:false
    Preview:/*.. HTTrack external callbacks example : print all downloaded html documents.... How to build: (callback.so or callback.dll).. With GNU-GCC:.. gcc -O -g3 -Wall -D_REENTRANT -shared -o mycallback.so callbacks-example.c -lhttrack1.. With MS-Visual C++:.. cl -LD -nologo -W3 -Zi -Zp4 -DWIN32 -Fe"mycallback.dll" callbacks-example.c libhttrack1.lib.... Note: the httrack library linker option is only necessary when using libhttrack's functions inside the callback.... How to use:.. httrack --wrapper mycallback ....*/..../* system includes */..#include <stdio.h>..#include <stdlib.h>..#include <string.h>..../* standard httrack module includes */..#include "httrack-library.h"..#include "htsopt.h"..#include "htsdefines.h"..../* local function called as "check_html" callback */..static int process_file(t_hts_callbackarg /*the carg structure, holding various information*/*carg, /*the option settings*/httrackp *opt, .. /*other paramet

    C:\Program Files\WinHTTrack\libtest\is-TPN2M.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2422
    Entropy (8bit):5.231211818668449
    Encrypted:false
    SSDEEP:24:JqPZZSAG6BBoIkcqDM1r+x60uCNRSlhlfGQ8Eawpdttx8KM2Q8zM4AC50lw/8FHO:JoSj6BG7DMx+xkboQRawvXfQY0FHYucB
    MD5:C15C8F5EEF43A828D229FCEB1030EC7E
    SHA1:E9F699A3A601B7613B5DE8E877AF888A86EE9004
    SHA-256:71A456BA692475AA4BF4E4DBE823E6CF5CFEECEBD8BA625B43049F12525F20D9
    SHA-512:448E1188B7A680941DD989F6CC5C5A4C5E8123BF33767F46340EAE8A11FCEF5999974CD3031929DF7231EDA19DC0E8FD71609BC1A1733C097D137023F292ACCB
    Malicious:false
    Preview:/*.. HTTrack external callbacks example : changing folder names ending with ".com".. with ".c0m" as a workaround of IIS bug (see KB 275601).... How to build: (callback.so or callback.dll).. With GNU-GCC:.. gcc -O -g3 -Wall -D_REENTRANT -shared -o mycallback.so callbacks-example.c -lhttrack1.. With MS-Visual C++:.. cl -LD -nologo -W3 -Zi -Zp4 -DWIN32 -Fe"mycallback.dll" callbacks-example.c libhttrack1.lib.... Note: the httrack library linker option is only necessary when using libhttrack's functions inside the callback..*/....#include <stdio.h>..#include <stdlib.h>..#include <string.h>..../* Standard httrack module includes */..#include "httrack-library.h"..#include "htsopt.h"..#include "htsdefines.h"..../* Function definitions */..static int mysavename(t_hts_callbackarg *carg, httrackp *opt, const char* adr_complete, const char* fil_complete, const char* referer_adr, const char* referer_fil, char* save);..../* ..module entry point ..*/..EXTERNAL_FU

    C:\Program Files\WinHTTrack\libtest\is-UHB7R.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):4979
    Entropy (8bit):5.126326387126232
    Encrypted:false
    SSDEEP:96:JIn6B4DARb5v3wrpXuzsmG8UW4M7cWuXyV4B:G6GavwrYzsmG8UW4M7cWuCV4B
    MD5:5575705B9D1724A3705B9B171E7B6901
    SHA1:A3040EFD781CD19647807AD14CFFA39A4DDCB722
    SHA-256:167648CD28926F078319A1FD3F5DD5940226CEAAEAB9CFC1A84737BEF4C8CC17
    SHA-512:82D9E92C111669BCF3E133E24E5217A27CA3DD3D036DC37D5B43AA745294E793A0F0A462D309026ABE6CE174F967C959FF5F0A0E2B6A07AE01EAF01A3CB69B61
    Malicious:false
    Preview:/*.. HTTrack external callbacks example : crawling html pages depending on content.. Example of <wrappername>_init and <wrappername>_exit call (httrack >> 3.31).. .c file.... How to build: (callback.so or callback.dll).. With GNU-GCC:.. gcc -O -g3 -Wall -D_REENTRANT -shared -o mycallback.so callbacks-example.c -lhttrack1.. With MS-Visual C++:.. cl -LD -nologo -W3 -Zi -Zp4 -DWIN32 -Fe"mycallback.dll" callbacks-example.c libhttrack1.lib.... Note: the httrack library linker option is only necessary when using libhttrack's functions inside the callback.... How to use:.. httrack --wrapper mycallback,stringtofind,stringtofind.. ....*/....#include <stdio.h>..#include <stdlib.h>..#include <string.h>..../* Standard httrack module includes */..#include "httrack-library.h"..#include "htsopt.h"..#include "htsdefines.h"..../* Local function definitions */..static int process(t_hts_callbackarg *carg, httrackp *opt, char* html, int len, const char* add

    C:\Program Files\WinHTTrack\libtest\is-V22P0.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):4351
    Entropy (8bit):5.186523183602917
    Encrypted:false
    SSDEEP:96:E6B4DAEfboFu+Wqx/DK/6ZnVyV4KKrqmYB:jGFYuPq/Dk6Zn8V4/bYB
    MD5:8F6C7795676CD4970D27E76588871F7D
    SHA1:054FE18D9EF84D056FA228327BAB9F324F139196
    SHA-256:D1F4E97821B2E74EAE202CD7B492438DA7B1CEBD946824ABE33FA42AED0571D0
    SHA-512:3B6E146595FF6D4E2B7DCD7CBA19B25362741E0D13E55C7D26A4A4FA597F1F25FCBB1F3CE7FA9DD29D086B4149C328476BD76C61F4ACB47CF1D56B760F749B08
    Malicious:false
    Preview:/*.. How to build: (callback.so or callback.dll).. With GNU-GCC:.. gcc -O -g3 -Wall -D_REENTRANT -shared -o mycallback.so callbacks-example.c -lhttrack1.. With MS-Visual C++:.. cl -LD -nologo -W3 -Zi -Zp4 -DWIN32 -Fe"mycallback.dll" callbacks-example.c libhttrack1.lib.... Note: the httrack library linker option is only necessary when using libhttrack's functions inside the callback.... How to use:.. httrack --wrapper mycallback,string1,string2 ....*/....#include <stdio.h>..#include <stdlib.h>..#include <string.h>..../* Standard httrack module includes */..#include "httrack-library.h"..#include "htsopt.h"..#include "htsdefines.h"..../* Function definitions */..static int mysavename(t_hts_callbackarg *carg, httrackp *opt, const char* adr_complete, const char* fil_complete, const char* referer_adr, const char* referer_fil, char* save);..static int myend(t_hts_callbackarg *carg, httrackp *opt);..../* TOLOWER */..#define TOLOWER_(a) (a >= 'A' && a <=

    C:\Program Files\WinHTTrack\libtest\libtest.mak (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:makefile script, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1782
    Entropy (8bit):5.3085536420955615
    Encrypted:false
    SSDEEP:48:6jA4o4BMHZTGWCDKyl17yyRPl/yynl4wyy40l8yyIldeyyElh+yyhSlh0yyhOhlD:6PjBMCl17Ltl/Lnl4wL40l8LIldeLElV
    MD5:628BA9E28943866C5CF1048D13DDABA0
    SHA1:FE48B99B1DA46820DADCC65FD097F8C1260E2405
    SHA-256:E3D5D8024603679649FB022B040A98DF449145D292036A583B2973E1AD0181E2
    SHA-512:9D13DCE4510C69160E57874B40E92C67C7330ED35F01D4D3509B57BBF47261B17CB6763FE8D4A11F64E713FE9A4DA1DF8D0112FE1B78D85070CD971B29CBB6EC
    Malicious:false
    Preview:# Makefile....OBJDIR = ./Release/..PATH = $(DEVSTU)\vc\bin;$(DEVSTU)\sharedide\bin;$(PATH)..INCLUDES = /I "." /I ".." /I "../IPv6Kit/inc" /I "$(DEVSTU)\vc\include"..LIB_FLAGS = /link /LIBPATH:"L:\HTTrack\httrack\src_win\libhttrack" /LIBPATH:"L:\HTTrack\httrack\libhttrack"..COMMON_FLAGS = /W3 /O2 /Fo"$(OBJDIR)" /Fd"$(OBJDIR)" /Fa"$(OBJDIR)" $(INCLUDES)..CPP_FLAGS = /LD $(COMMON_FLAGS) libhttrack.lib..BIN_FLAGS = /link /LIBPATH:"C:\temp\Debuglib"....all:.. cl $(CPP_FLAGS) \.. callbacks-example-simple.c -Fe$(OBJDIR)callbacks-example-simple.dll \.. $(LIB_FLAGS).. cl $(CPP_FLAGS) \.. callbacks-example-log.c -Fe$(OBJDIR)callbacks-example-log.dll \.. $(LIB_FLAGS).. cl $(CPP_FLAGS) \.. callbacks-example-baselinks.c -Fe$(OBJDIR)callbacks-example-baselinks.dll \.. $(LIB_FLAGS).. cl $(CPP_FLAGS) \.. callbacks-example-contentfilter.c -Fe$(OBJDIR)callbacks-example-contentfilter.dll \.. $(LIB_FLAGS).. cl $(CPP_FLAGS) \.. callbacks-example-displayheader.c -Fe$(OBJDIR)c

    C:\Program Files\WinHTTrack\libtest\libtest.vcproj (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2420
    Entropy (8bit):5.274330172803927
    Encrypted:false
    SSDEEP:48:ckDjCKUCKSzy6E4o4f3wsLdJhphzh8tQF67/bRC4:dfEx4f3NLdJhphzh8tQF67/bI4
    MD5:4D6948F6BE26BE0E3EC5D1240C3F14CC
    SHA1:B83137D3CE806892211E360A32C445E65409186B
    SHA-256:D5ED1B9A952B919EAFB12F99BEAC63C32B0759A0FF5D3371712839BA42104311
    SHA-512:C4B80B31CD8F4D038EEDB51DFBD0B3D8CEE667ED3E583CC4519AE3512B956B4BFEEA8F34E3817DDFDC226DD4FC916CFEE3250BFE118A5BE44BBD5BED1FE0BA5B
    Malicious:false
    Preview:<?xml version="1.0" encoding="Windows-1252"?>..<VisualStudioProject...ProjectType="Visual C++"...Version="7.10"...Name="libtest"...ProjectGUID="{76424734-BC12-4472-ABE2-B5C7A4A0B733}"...Keyword="MakeFileProj">...<Platforms>....<Platform.....Name="Win32"/>...</Platforms>...<Configurations>....<Configuration.....Name="Debug|Win32".....OutputDirectory="Debug".....IntermediateDirectory="Debug".....ConfigurationType="0">.....<Tool......Name="VCNMakeTool"......BuildCommandLine="nmake -f libtest.mak"......CleanCommandLine="del *.obj"/>....</Configuration>....<Configuration.....Name="Release|Win32".....OutputDirectory="Release".....IntermediateDirectory="Release".....ConfigurationType="0">.....<Tool......Name="VCNMakeTool"......BuildCommandLine="nmake -f libtest.mak"......CleanCommandLine="del *.obj"/>....</Configuration>...</Configurations>...<References>...</References>...<Files>....<Filter.....Name="Source Files".....Filter="cpp;c;cxx;def;odl;idl;hpj;bat;asm;asmx".....UniqueIdentifier="{4FC

    C:\Program Files\WinHTTrack\libtest\readme.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2226
    Entropy (8bit):4.961892748969933
    Encrypted:false
    SSDEEP:24:dyDHojhQByX5F+EDDWkyEOkH5CTbVpTYcEzmxrcOgSbpGHcVxBnVZkPddG:d4IVtFPDDNygHWTdEyk58VVZkFdG
    MD5:A05313270965352F09D945D92C9DFC62
    SHA1:4531C6337C986624B1A2366A028934C7021F9361
    SHA-256:582AEC2CCF27E0521B94A78EDDB5F814E63BFB163885D7DD144456F005230699
    SHA-512:C0D89156A64D12BF47CD595D125F12230CB85BDC16F318B25C1C426B2BDC706EC127D5167D5B11002EF594111FA7B4CECC3BD297D0BCB60B3BC1FC85BE62EFC3
    Malicious:false
    Preview:HTTrack library example..-----------------------....Here is an example of how to integrate HTTrack Website Copier into a project..to use it as a "core library". ......Important Notice:..----------------....These sources are covered by the GNU General Public License (see below)..(Projects based on these sources must follow the GPL, too)......Copyright notice:..----------------....HTTrack Website Copier, Offline Browser for Windows and Unix..Copyright (C) Xavier Roche and other contributors....This program is free software; you can redistribute it and/or..modify it under the terms of the GNU General Public License..as published by the Free Software Foundation; either version 3..of the License, or any later version.....This program is distributed in the hope that it will be useful,..but WITHOUT ANY WARRANTY; without even the implied warranty of..MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the..GNU General Public License for more details.....You should have received a copy of

    C:\Program Files\WinHTTrack\license.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1722
    Entropy (8bit):4.8064255563665474
    Encrypted:false
    SSDEEP:24:yE5F+EDDWkyEOkH5CTbVpT6omBLqXDKdUrJzwyC5vFvW4/mFTxUE8MF/:yOFPDDNygHWT6omsTlURFvWJUM/
    MD5:3C90E2EF4D1FC4FE138058A817C617DE
    SHA1:13B1AFFD0C53106FC8DC8A11F4553E493F51BFEE
    SHA-256:4CC1F5C6070370832842EBC1512650D52811CE052182CE93FD0FCB5DD22BCFE8
    SHA-512:B50D13137EF647959DE50C0A1F0BEF1B2A1703A746696076E84162079E4056FF84E2574D6501B0106844B33D6559425B2A24C4130E461EEB60AFFBB723B3825A
    Malicious:false
    Preview:HTTrack Website Copier License Agreement:....HTTrack Website Copier, Offline Browser for Windows and Unix..Copyright (C) Xavier Roche and other contributors....This program is free software; you can redistribute it and/or..modify it under the terms of the GNU General Public License..as published by the Free Software Foundation; either version 3..of the License, or any later version.....This program is distributed in the hope that it will be useful,..but WITHOUT ANY WARRANTY; without even the implied warranty of..MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the..GNU General Public License for more details.....You should have received a copy of the GNU General Public License..along with this program; if not, write to the Free Software..Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.....In addition, as a special exception, Xavier Roche gives permission to..link the code of this program with the openSSL library (or with..modified versions of openSSL

    C:\Program Files\WinHTTrack\mfc90.dll (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
    Category:dropped
    Size (bytes):1671160
    Entropy (8bit):6.040721295924078
    Encrypted:false
    SSDEEP:49152:1/DtPxTK+ZnGfnpYuLupNdadHuDg2QhZg5mPwkn9n83dyMCwb7L6QXBiZj2KOYSf:1/DDNnGfnzS
    MD5:60B030677185841817FA38BDA0DA6473
    SHA1:AE45372B4CE19C773D627F9DF829FC16702FE840
    SHA-256:2A527EEF7D5CBC295E5B3CEEF5C5E1C34BF9FBA51335102B44D73B67F5DBBE86
    SHA-512:CE1A560E372E2E35E092A7C6F823CACE40D38A96246A27E5025172D418164471B0CBA0319C8E83A6FF4D693F9D9250CC9D279154ACF0AE9D5F9A81CC2C4F9BF0
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 0%
    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q...5.5.5..&-.4..&..%.+.?.7...:.4.+./.(.+.(.=..&.<.5.U.+.9.1.+.&...+.>.4.+.8.4.+.=.4.Rich5.........PE..d....K1G.........." ..........................mx..........................................@..........................................K...`..H...x.......x....`..P3...\...#...P..lr..0(......................................................p........................text............................... ..`.rdata..............................@..@.data...........`..................@....pdata..P3...`...4..................@..@.rsrc...x............(..............@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

    C:\Program Files\WinHTTrack\msvcr90.dll (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
    Category:dropped
    Size (bytes):627200
    Entropy (8bit):6.599563273610714
    Encrypted:false
    SSDEEP:12288:1y+a/N+bAH6nDjnBRsjZ6iIzKq+dKEN1WeAIYcPmqy7A0g:1yr0UH2DrsjkiC4L1WeAIzPmqy7A/
    MD5:23B134891C08C7F04C1747F6BCEC06EA
    SHA1:26A77CCF0E62FAA436255E47A0C3C8A818733193
    SHA-256:E11CE4B90DB815359B2D76F95F623FC26924C5A254F0540224FA6FEB623817E5
    SHA-512:30C89F058B3B9DDD39ED7A3E3C470C2DF08940DBC3EA0CF72CF271FA76EE19D956EE503A3FA2839458FBD2A61658FF3AA7F8326E6ECCAE9C11AC78B4C2B84C14
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 0%
    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........2K..aK..aK..al;.aH..aK..a...aU.Ca...aU.UaS..aU.Da...aU.RaJ..aU.TaJ..aU.QaJ..aRichK..a........PE..d....>1G.........." .....n...&.......&........bx..........................................@.........................................0q..Cx..._..(............`...E...n...$.............................................................. ............................text....m.......n.................. ..`.rdata..si.......j...r..............@..@.data....d.......<..................@....pdata...E...`...F..................@..@.rsrc................^..............@..@.reloc...............b..............@..B................................................................................................................................................................................................................................................................................

    C:\Program Files\WinHTTrack\proxytrack.exe (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:PE32+ executable (console) x86-64, for MS Windows
    Category:dropped
    Size (bytes):345160
    Entropy (8bit):6.10696498882204
    Encrypted:false
    SSDEEP:6144:ecazHJuRnMknZaZge8kR4m7uHSxL10GVAHIdb8DL4hyTf7Y:ecazJuRnMknZaZgevamCyxRAyb8X0
    MD5:C0D6AB75459485DB4B579B136DCDDA1A
    SHA1:54290B7DC8DBB9782BB5A7F4F6E84472D0B7FD60
    SHA-256:8D5A9FBAE93A834FEE926D90118DE2A13E8C55C45F13A3B3D38924636F380F12
    SHA-512:C2E1CA67357C75479BEE593549CE480CA5B886C827FF8304A54EEA73B3C6818E2B04A163DBDE6A8433431BF2C8C5364FD02C6EE92F3EB5E4BE30974EE2A05FE4
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 0%
    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........QC...C...C.....:.F...J.(.m...J.9.O...J.?.A...d...F...C.......J./.....J.>.B...J.=.B...RichC...................PE..d...~. Y..........#............................@....................................................................................0y..(....l..P....p.......P.......,..H............4...............................................0..h............................text............................... ..`.rdata..XM...0...N..................@..@.data................h..............@....pdata.......P... ..................@..@.rsrc........p.......*..............@..@........................................................................................................................................................................................................................................................................................................

    C:\Program Files\WinHTTrack\proxytrack.exp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Intel 80386 COFF object file, not stripped, 2 sections, symbol offset=0xc1e, 78 symbols, created Sat May 20 08:49:45 2017, 1st section name ".edata"
    Category:dropped
    Size (bytes):5195
    Entropy (8bit):4.237970051993339
    Encrypted:false
    SSDEEP:96:qqxgGKnaDAlbKy8mLb4fyMOdMxuYIeaQz8G4yFjrddjWNGesBuIv6fdQBHMqB4Ax:qqmGKnaCYyMOmBdaDLXI1
    MD5:C2840C47DCF683F82A8ED9AC93A09745
    SHA1:68FEC368076B06B55C3971797EB839BB9A3F7223
    SHA-256:26EDD315898E6906D55E112BCAD23B8CCDE0B20AB94033CB1518C9F4E54D502F
    SHA-512:32CF61CCBE5A62694A8561B63C9C4A34E188D7587AC22C53323B4E7129ECCB632A38627ADD61CE32F193926C3D9D9F392DD1EB6D3AB0E031AEB69479D772B4D8
    Malicious:false
    Preview:L...). Y....N........edata..........(...d...........L...@..@.debug$S............................@..B....). Y............$...$............................................................................................................................................................................................................................................................................................................................................................................... .!.".#.proxytrack.exe.coucal_add.coucal_add_pvoid.coucal_calc_hashes.coucal_created.coucal_dec.coucal_delete.coucal_enum_new.coucal_enum_next.coucal_exists.coucal_fetch_value.coucal_fetch_value_hashes.coucal_get_intptr.coucal_get_name.coucal_get_pvoid.coucal_hash_data.coucal_hash_size.coucal_hash_string.coucal_inc.coucal_memory_size.coucal_new.coucal_nitems.coucal_read.coucal_read_pvoid.coucal_read_value.coucal_readptr.coucal_remove.coucal_set_assert_handler.coucal_set_global_assert_handler.coucal_set_

    C:\Program Files\WinHTTrack\proxytrack.lib (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:current ar archive
    Category:dropped
    Size (bytes):9438
    Entropy (8bit):5.0085497805109584
    Encrypted:false
    SSDEEP:96:n8x3I+ONzEwG3T+vGNiqGv94EI9JGKi3K6K0n7I5M8q3jOWaf06DjBW:n8xzONzEwZvGNinv9XISU5g6WajDjBW
    MD5:E75184B756EC91F3FE2A9894E7689F43
    SHA1:C92CD3EED04652E40E86CBF718958DF8CF054A57
    SHA-256:B40199859E233ED9B5858ADD37D2AC9DA89A55A21348339353288311D549F235
    SHA-512:24A2BA1444CABD960741F2F9D7B31E16EC0931DA452EEAECBDA965267029312B7D2C449AA7C378F9E4F004DB214A71ED7C039A192BE16BDD4CFA83C52203DC9E
    Malicious:false
    Preview:!<arch>./ 1495270185 0 1974 `....K.......,...f...................................j...j...........z...z..#...#...$j..$j...*...*..#...#............................................D...D...........<...<...........N...N...........$...$.........."..."...!(..!(..#...#..."..."... ,.. ,..!...!............^...^...........Z...Z.......... ... .__IMPORT_DESCRIPTOR_proxytrack.__NULL_IMPORT_DESCRIPTOR..proxytrack_NULL_THUNK_DATA.__imp__coucal_get_name._coucal_get_name.__imp__coucal_hash_data._coucal_hash_data.__imp__coucal_hash_string._coucal_hash_string.__imp__coucal_calc_hashes._coucal_calc_hashes.__imp__coucal_read_pvoid._coucal_read_pvoid.__imp__coucal_read_value._coucal_read_value.__imp__coucal_get_pvoid._coucal_get_pvoid.__imp__coucal_write_pvoid._coucal_write_pvoid.__imp__coucal_write_value._coucal_write_value.__imp__coucal_add_pvoid._coucal_add_pvoid.__imp__coucal_write._coucal_write.__imp__coucal_memory_size._coucal_memory_size.__imp__coucal_add._coucal_

    C:\Program Files\WinHTTrack\readme (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1740
    Entropy (8bit):4.895194912247934
    Encrypted:false
    SSDEEP:24:85zSQhMkL+zOXri36Cm6KBq0m6qWxyR/iAA12mfh17fWy82UgWX04alu:2eAiQ0JpKJpq01/fDfWy8VlL
    MD5:43606C066E329E5C72504BFB5214C7D6
    SHA1:81A418AF97C7D28BF1A29053886C3F483A71DFD9
    SHA-256:5EBE86AB8C969915FFDC1DE04E1810CA17F1FDFB1C0B5E78E46463A3C251E7B2
    SHA-512:E84893728E2D056FD6B8C06C6145D336DD0A67B987EA4422DD46233EB1A19DCD3331CB3D16742904A89F1E2CB834229081C81BCA26DD5B4B26E27ABC14E63E3E
    Malicious:false
    Preview:HTTrack Website Copier, Offline Browser for Windows and Unix..Copyright (C) Xavier Roche and other contributors....Welcome to HTTrack Website Copier!......Information:....The folder html/ contains the documentation..You might want to read these files, especially for installing HTTrack:.. - See INSTALL file for installation information (NO WARRANTY).. - See license.txt file for license information......Contacting us:....If you want to ask any question, feel free to contact us!..email: httrack@httrack.com......Donations:....HTTrack Website Copier is free software, but if you can, please donate to the Free Software Foundation (FSF) to support free software!....(Europe)..http://www.fsfeurope.org/help/donate.html....(World)..http://www.fsf.org/help/donate.html......Engine limits:....These are the principals limits of HTTrack for that moment. Note that we did not heard about any other utility..that would have solved them.....- Several scripts generating complex filenames may not find them

    C:\Program Files\WinHTTrack\src\Makefile (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with very long lines (342)
    Category:dropped
    Size (bytes):47196
    Entropy (8bit):5.677182157087262
    Encrypted:false
    SSDEEP:768:KxqCFQAw5E36z+EzFDhQZMM0cp/2OMqR5pTs5w0pBKbiAcWzY19LlOiTh2a6Lmdt:KECC/hQSMqiupBKbiAcWzY19Llp3f7+G
    MD5:45AC4A4B4FDEDC21498F6384A0C78A8B
    SHA1:618B8B8714A0DCD17362EE1C71FFB32B87B3EC36
    SHA-256:0E01E5EA86523C8C07B771BDB3C5C547D379AA7FE1809F49A9DF3603ED038B24
    SHA-512:B9DD05309CB08D15C2816492B3695D2C94F0020B84AFF61E0534D0023182AF4683FFB9EA4B0052919C35465424A8CC369D96C27F2F10C2323F7C92988C984A1D
    Malicious:false
    Preview:# Makefile.in generated by automake 1.11.6 from Makefile.am..# src/Makefile. Generated from Makefile.in by configure...# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,.# 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Free Software.# Foundation, Inc..# This Makefile.in is free software; the Free Software Foundation.# gives unlimited permission to copy and/or distribute it,.# with or without modifications, as long as this notice is preserved...# This program is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY, to the extent permitted by law; without.# even the implied warranty of MERCHANTABILITY or FITNESS FOR A.# PARTICULAR PURPOSE.........am__make_dryrun = \. { \. am__dry=no; \. case $$MAKEFLAGS in \. *\\[\ \.]*) \. echo 'am--echo: ; @echo "AM" OK' | $(MAKE) -f - 2>/dev/null \. | grep '^AM OK$$' >/dev/null || am__dry=yes;; \. *) \. for am__flg in $$MAKEFLAGS; do \. case $$am__flg in

    C:\Program Files\WinHTTrack\src\Makefile.am (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text
    Category:dropped
    Size (bytes):3361
    Entropy (8bit):5.3708176863092065
    Encrypted:false
    SSDEEP:96:kf/Ahz+S+t/lWV1kHnnxoo/9exE9Ru8Ftxr2NPzf+D:kQdV0QEnnL/9ea9Ru8FUPiD
    MD5:63A86DD3097D98DA9E0FBFEDAA146596
    SHA1:137C6239FEB786F37174AF90C43D0E8DC2500238
    SHA-256:AC34D9541021DFABE6437A5BDD46E52E113AEDEEF42933DC75024C12CAB80026
    SHA-512:04B935FACB87EE166C8A3FCA0222246A1173BEA0E8A1F82788364BE4987A3222BAA96F64797FA3EDF2DBCB5347824DCC8143E9A433043424EB7606B5C72E37FA
    Malicious:false
    Preview:DevIncludesdir = $(includedir)/httrack.DevIncludes_DATA = \..httrack-library.h \..htsglobal.h \..htsopt.h \..htswrap.h \..htsconfig.h \..../config.h \..htsmodules.h \..htsbasenet.h \..htsnet.h \..htsbauth.h \..htsdefines.h \..htsstrings.h \..htsarrays.h \..htssafe.h..AM_CPPFLAGS = \..@DEFAULT_CFLAGS@ \..@THREADS_CFLAGS@ \..@V6_FLAG@ \..@LFS_FLAG@ \..-DPREFIX=\""$(prefix)"\" \..-DSYSCONFDIR=\""$(sysconfdir)"\" \..-DDATADIR=\""$(datadir)"\" \..-DLIBDIR=\""$(libdir)"\" \..-I"$(abs_srcdir)" \..-I"$(abs_srcdir)/coucal"..bin_PROGRAMS = proxytrack httrack htsserver..httrack_LDADD = $(THREADS_LIBS) libhttrack.la.htsserver_LDADD = $(THREADS_LIBS) $(SOCKET_LIBS) libhttrack.la.proxytrack_LDADD = $(THREADS_LIBS) $(SOCKET_LIBS).proxytrack_CFLAGS = $(AM_CFLAGS) -DNO_MALLOCT -DZLIB_CONST -DHTS_INTHASH_USES_MD5.htsserver_CFLAGS = $(AM_CFLAGS) -DZLIB_CONST -DHTS_INTHASH_USES_MD5..lib_LTLIBRARIES = libhttrack.la libhtsjava.la..htsserver_SOURCES = htsserver.c htsserver.h htsweb.c htsweb.h.proxytrack_SOUR

    C:\Program Files\WinHTTrack\src\Makefile.in (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:makefile script, ASCII text, with very long lines (418)
    Category:dropped
    Size (bytes):97861
    Entropy (8bit):5.6481747718238635
    Encrypted:false
    SSDEEP:1536:maSKW8Jz/ihWHLVPaHpzKmTiAcWJJHhaIzH/vvsvE2TRDvlJ6zprS2PVNnV39eRe:maz/kWrVPaHpzXTiAc+svE2TRDvlJ6zt
    MD5:CD0BF0B2853BB18EE224DCF39CD5B0FB
    SHA1:AB96DCAC5510449DC2A4FE69FCBC3BB995106686
    SHA-256:23AA58CD60BB2AB0ABC8E580667FBEA7A9DA58C1447B59B3C978D5D92A2700FD
    SHA-512:9231DF0550CB19914B68688D9B79BBA301EE7BE7FCFCFC6CAE1DD2EC1ADBBBBD2C6A9A8F1BEC3E8BBF3CEB5B0BD115C86FAE2A590CA09F3A43FFC2801CA8AF28
    Malicious:false
    Preview:# Makefile.in generated by automake 1.14.1 from Makefile.am..# @configure_input@..# Copyright (C) 1994-2013 Free Software Foundation, Inc...# This Makefile.in is free software; the Free Software Foundation.# gives unlimited permission to copy and/or distribute it,.# with or without modifications, as long as this notice is preserved...# This program is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY, to the extent permitted by law; without.# even the implied warranty of MERCHANTABILITY or FITNESS FOR A.# PARTICULAR PURPOSE...@SET_MAKE@.....VPATH = @srcdir@.am__is_gnu_make = test -n '$(MAKEFILE_LIST)' && test -n '$(MAKELEVEL)'.am__make_running_with_option = \. case $${target_option-} in \. ?) ;; \. *) echo "am__make_running_with_option: internal error: invalid" \. "target option '$${target_option-}' specified" >&2; \. exit 1;; \. esac; \. has_opt=no; \. sane_makeflags=$$MAKEFLAGS; \. if $(am__is_gnu_make); then \. sane_mak

    C:\Program Files\WinHTTrack\src\coucal.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):53114
    Entropy (8bit):4.9137983898638184
    Encrypted:false
    SSDEEP:768:xZ+FTprTip3fYTeNeNm7BeAdfa5Lrczk4DbXPDkho6BJsE7KhEmp71fvG2:xcTKwTkeT8PQhNehn
    MD5:FE64D4532EA9BA7B062A8A8FDDF2BA74
    SHA1:403E7DB57289939C077243CF04A813BCAF89C634
    SHA-256:91C6D79A651D1052A393AD545B43901B3A9CDC770A14A0EE2B4E400E6952AB1A
    SHA-512:9E2740E6A1CBFDD2D9BA27702FDBE90163798D8492CB53BBC7278D83207C96D92615C0D1DF88553543CDF16FF9121D101340160FD130729C15F6ADC3E7A96275
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.Coucal, Cuckoo hashing-based hashtable with stash area..Copyright (C) 2013-2014 Xavier Roche (http://www.httrack.com/).All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:..1. Redistributions of source code must retain the above copyright notice, this.list of conditions and the following disclaimer...2. Redistributions in binary form must reproduce the above copyright notice,.this list of conditions and the following disclaimer in the documentation.and/or other materials provided with the distribution...3. Neither the name of the copyright holder nor the names of its contributors.may be used to endorse or promote products derived from this software without.specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, IN

    C:\Program Files\WinHTTrack\src\coucal.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):18635
    Entropy (8bit):4.879963467233371
    Encrypted:false
    SSDEEP:384:xritKB+FZYasgbmMBiwfZ8H2sym7bKW/jOFOVYH95wRi+s/16JVgV+:xZ+FzkMaH0m7H0Ets/w
    MD5:62C36E3BCC49AC1175C15C5536712AE6
    SHA1:5946C2D608F6FA6E65E9FD44005338766C8BE07C
    SHA-256:400C5D803D5E9442F3510347BE4D156DBAE2FF77114249A8E3B9987631AC9DF3
    SHA-512:6C1E51CBA8F3DE44746DB267E7002505B573156EE3C6B33782C3867C5A7770A641EB73F9728CC315C7D62B81BB523C0EFD958884E8BF1913A02CE3AC46CE3459
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.Coucal, Cuckoo hashing-based hashtable with stash area..Copyright (C) 2013-2014 Xavier Roche (http://www.httrack.com/).All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:..1. Redistributions of source code must retain the above copyright notice, this.list of conditions and the following disclaimer...2. Redistributions in binary form must reproduce the above copyright notice,.this list of conditions and the following disclaimer in the documentation.and/or other materials provided with the distribution...3. Neither the name of the copyright holder nor the names of its contributors.may be used to endorse or promote products derived from this software without.specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, IN

    C:\Program Files\WinHTTrack\src\coucal\LICENSE (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text
    Category:dropped
    Size (bytes):1509
    Entropy (8bit):5.16509358556634
    Encrypted:false
    SSDEEP:24:6ZUnooLbOOrpoFT5JjFTzZ6pxBTPn96432s4EOkUs8gROF32s3yTtTf413tf9fsL:pOOrpoJrJzKzP96432svI32s3Stc13tI
    MD5:54C521AD490E615F9BF6599A0DD30EA9
    SHA1:9FC75FE6BC9871B1554A59D430A246D5C30BE206
    SHA-256:842AF80CD11F1B5A978E9E05554F71E5D3DC6D9A68FFFB22EC4450864842945B
    SHA-512:EE458A369F953B58449335B2E80778754190C886F4463A2EC75BC8D7797CF5D6872A96173ABA44DBCADE25DA605D9D49D106FA5FBE7593D3B1E6ED8EC5A2E4BF
    Malicious:false
    Preview:Copyright (c) 2013, Xavier Roche (http://www.httrack.com/).All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:..1. Redistributions of source code must retain the above copyright notice, this.list of conditions and the following disclaimer...2. Redistributions in binary form must reproduce the above copyright notice,.this list of conditions and the following disclaimer in the documentation.and/or other materials provided with the distribution...3. Neither the name of the copyright holder nor the names of its contributors.may be used to endorse or promote products derived from this software without.specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE.DISCLAIMED. IN NO

    C:\Program Files\WinHTTrack\src\coucal\Makefile (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:makefile script, ASCII text
    Category:dropped
    Size (bytes):1132
    Entropy (8bit):5.025104226684108
    Encrypted:false
    SSDEEP:24:TCkwJr8foLQsWu4KyD+qDi4634Kmj4Kchh:TMrOsKRD+qO4Rz0Ph
    MD5:A8D793586EB35380D82838C1DEA79372
    SHA1:73FBEABD6836D977A45C3AFFCA5FE560CF52DDA6
    SHA-256:05388746D2139C250CA712C8537AD771BE7F00B639EE9CB23028C9392A04A117
    SHA-512:09BEA18F3891BF26D3D91D89BB1DD3CF991AAA93A5069B5D742D9449B05272808D132A70AFF473BA213C2AF61DCED5EDDCA045B8C44D42AC2F0F531932F0E2E2
    Malicious:false
    Preview:###############################################################################.#.# "Cuckoo Hashtables".#.###############################################################################..CFILES = coucal.c..all: gcc tests sample runtests..clean:..rm -f *.o *.obj *.so* *.dll *.exe *.pdb *.exp *.lib sample tests..tar:..rm -f coucal.tgz..tar cvfz coucal.tgz coucal.txt coucal.c coucal.h Makefile LICENSE README.md..gcc:..gcc -c -fPIC -O3 -g3 -pthread \...-W -Wall -Wextra -Werror -Wno-unused-function \...-D_REENTRANT -D_GNU_SOURCE \...-DHTS_INTHASH_USES_MURMUR \...$(CFILES)..gcc -shared -fPIC -O3 -Wl,-O1 -Wl,--no-undefined \...-rdynamic -shared -Wl,-soname=libcoucal.so \...coucal.o -o libcoucal.so \...-ldl -lpthread..tests:..gcc -c -fPIC -O3 -g3 \...-W -Wall -Wextra -Werror -Wno-unused-function \...-D_REENTRANT \...tests.c -o tests.o..gcc -fPIC -O3 -Wl,-O1 \...-lcoucal -L. \...tests.o -o tests ..sample:..gcc -c -fPIC -O3 -g3 \...-W -Wall -Wextra -Werror -Wno-unused-function \...-D_REENTRANT \

    C:\Program Files\WinHTTrack\src\coucal\README.md (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Unicode text, UTF-8 text, with very long lines (390)
    Category:dropped
    Size (bytes):2014
    Entropy (8bit):5.1974283193629
    Encrypted:false
    SSDEEP:48:Szhn6S4e505V/sk1Wn9ULD+SD58jyUv/BawmDUkS:Szh94eq5Gkc214yUvLt
    MD5:0F6D3AC5C06D4DAE8F172C19F7BD16B6
    SHA1:C09AC1BCECFB6C3E33E608744335BA10089E58DD
    SHA-256:182391BE76F352E9277297DD6719B0C16F4C1DE87DDA6AEBD52BBFD8613592D5
    SHA-512:DAEE3C6CF10A2E3A586E5B26690D8B944E9B090693C2031736DA35218BAB65A646198EADBBCBF5756820F7494418E95769BE3E9159E19ED9B7B4F238C5AB6F40
    Malicious:false
    Preview:coucal.======..**Coucal**, a Cuckoo-hashing-based hashtable with stash area C library...![Greater Coucal Centropus sinensis](http://upload.wikimedia.org/wikipedia/commons/thumb/8/8d/Greater_Coucal_%28Centropus_sinensis%29_in_Hyderabad_W_IMG_8962.jpg/250px-Greater_Coucal_%28Centropus_sinensis%29_in_Hyderabad_W_IMG_8962.jpg "Centropus sinensis")..> [Wikipedia] A coucal is one of about 30 species of birds in the cuckoo family. All of them belong in the subfamily Centropodinae and the genus Centropus. Unlike many Old World cuckoos, coucals are not brood parasites...This is an implementation of the cuckoo hashing algorithm (Rasmus Pagh and Flemming Friche Rodler, http://www.it-c.dk/people/pagh/papers/cuckoo-jour.pdf) with a stash area (Adam Kirsch, Michael Mitzenmacher and Udi Wieder, http://research.microsoft.com/pubs/73856/stash-full.9-30.pdf), using by default the MurmurHash hash function (Austin Appleby, http://en.wikipedia.org/wiki/MurmurHash)...This allows an efficient generic hashtab

    C:\Program Files\WinHTTrack\src\coucal\coucal.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):53149
    Entropy (8bit):4.913810685510763
    Encrypted:false
    SSDEEP:768:xZ+FTprTip3fYTeNeNm7BeAdfa5Lrkzk4DbXPDkho6BJsE7KhEmp71fvG2:xcTKwTkeTUPQhNehn
    MD5:8591F2782311FA921AE96697912D2B14
    SHA1:5B4846C884732DAC9078EE09162AC5696E52B401
    SHA-256:5BD599AC2F4F342ACDA1A5B048C625FB38FD36687B1D44E376469C724C105424
    SHA-512:A2EB07581CFFC6EF6A2CB51E2F647B0BA1278FF40C3324DBE2115DC62E85301A020B1461F6A32285977B9785FBEEFCEE0A7AF38FE7513E590E1CCE183B12847F
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.Coucal, Cuckoo hashing-based hashtable with stash area..Copyright (C) 2013-2014 Xavier Roche (http://www.httrack.com/).All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:..1. Redistributions of source code must retain the above copyright notice, this.list of conditions and the following disclaimer...2. Redistributions in binary form must reproduce the above copyright notice,.this list of conditions and the following disclaimer in the documentation.and/or other materials provided with the distribution...3. Neither the name of the copyright holder nor the names of its contributors.may be used to endorse or promote products derived from this software without.specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, IN

    C:\Program Files\WinHTTrack\src\coucal\coucal.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):18635
    Entropy (8bit):4.879963467233371
    Encrypted:false
    SSDEEP:384:xritKB+FZYasgbmMBiwfZ8H2sym7bKW/jOFOVYH95wRi+s/16JVgV+:xZ+FzkMaH0m7H0Ets/w
    MD5:62C36E3BCC49AC1175C15C5536712AE6
    SHA1:5946C2D608F6FA6E65E9FD44005338766C8BE07C
    SHA-256:400C5D803D5E9442F3510347BE4D156DBAE2FF77114249A8E3B9987631AC9DF3
    SHA-512:6C1E51CBA8F3DE44746DB267E7002505B573156EE3C6B33782C3867C5A7770A641EB73F9728CC315C7D62B81BB523C0EFD958884E8BF1913A02CE3AC46CE3459
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.Coucal, Cuckoo hashing-based hashtable with stash area..Copyright (C) 2013-2014 Xavier Roche (http://www.httrack.com/).All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:..1. Redistributions of source code must retain the above copyright notice, this.list of conditions and the following disclaimer...2. Redistributions in binary form must reproduce the above copyright notice,.this list of conditions and the following disclaimer in the documentation.and/or other materials provided with the distribution...3. Neither the name of the copyright holder nor the names of its contributors.may be used to endorse or promote products derived from this software without.specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, IN

    C:\Program Files\WinHTTrack\src\coucal\is-4E6DS.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:unified diff output, ASCII text
    Category:dropped
    Size (bytes):769
    Entropy (8bit):5.274534653103435
    Encrypted:false
    SSDEEP:12:+uRu3cxEuFJoUEuU+MzGlAqznALdLrLW6Lb0GSCdIb++O7G+E7G+TF7G+y/AuC02:VtQElix/S6qiwfy//C0bqt
    MD5:7F3D99F3244CCD9A6C818ED532D5285A
    SHA1:F544E04D6A493A386AE827E73F63A4595F9A93AC
    SHA-256:63C17E82CE1C6B69E10B20495B40B55D57D10FF1B6F8E6DAF127E103F953D5DF
    SHA-512:80127A64F234A0C9C39044C92845F8CFF0AB144E32FE4313D9F074D128CDC4D627FEF9EE9A7FACAB4850AA164A5D871FD15FFD5B313A4E70E626965C3B43096C
    Malicious:false
    Preview:--- murmurhash3.h.orig.2014-06-14 14:29:11.562576736 +0200.+++ murmurhash3.h.2014-06-14 14:39:43.989624584 +0200.@@ -7,7 +7,19 @@. // compile and run any of them on any platform, but your performance with the. // non-native version will be less than optimal.. .+#ifdef _WIN32.+#include <stddef.h>.+typedef __int8 int8_t;.+typedef unsigned __int8 uint8_t;.+typedef unsigned __int16 uint16_t;.+typedef unsigned __int32 uint32_t;.+typedef unsigned __int64 uint64_t;.+#elif (defined(SOLARIS) || defined(sun) || defined(HAVE_INTTYPES_H) \.+ || defined(BSD) || defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__NetBSD__) || defined(__FreeBSD_kernel__)).+#include <inttypes.h>.+#else. #include <stdint.h>.+#endif. . static uint32_t rotl32 ( uint32_t x, int8_t r ). {.

    C:\Program Files\WinHTTrack\src\coucal\is-7HLTV.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):53149
    Entropy (8bit):4.913810685510763
    Encrypted:false
    SSDEEP:768:xZ+FTprTip3fYTeNeNm7BeAdfa5Lrkzk4DbXPDkho6BJsE7KhEmp71fvG2:xcTKwTkeTUPQhNehn
    MD5:8591F2782311FA921AE96697912D2B14
    SHA1:5B4846C884732DAC9078EE09162AC5696E52B401
    SHA-256:5BD599AC2F4F342ACDA1A5B048C625FB38FD36687B1D44E376469C724C105424
    SHA-512:A2EB07581CFFC6EF6A2CB51E2F647B0BA1278FF40C3324DBE2115DC62E85301A020B1461F6A32285977B9785FBEEFCEE0A7AF38FE7513E590E1CCE183B12847F
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.Coucal, Cuckoo hashing-based hashtable with stash area..Copyright (C) 2013-2014 Xavier Roche (http://www.httrack.com/).All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:..1. Redistributions of source code must retain the above copyright notice, this.list of conditions and the following disclaimer...2. Redistributions in binary form must reproduce the above copyright notice,.this list of conditions and the following disclaimer in the documentation.and/or other materials provided with the distribution...3. Neither the name of the copyright holder nor the names of its contributors.may be used to endorse or promote products derived from this software without.specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, IN

    C:\Program Files\WinHTTrack\src\coucal\is-8VVDG.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):3366
    Entropy (8bit):4.9295219014365355
    Encrypted:false
    SSDEEP:48:wtUqk2lwIk5WuWz1vWpPyLD6/3yBhrATtkm91s8t6niAQ4ozuh9AT7uh9UGOy:waqkJIcWuW1epGubBcnWr1GOy
    MD5:42485F20A511C37EC72635AB06473A0A
    SHA1:3CA4A16F228C4FE2F574E7C75EE053C1811B95A9
    SHA-256:7B30931693F238A59D1F1ADDEB08CF491E8878AFF60F0FD5487BD43EDE34C241
    SHA-512:DA81017D9658962D8CB7BBFF3F3332050ABDC65094B92112B4A7A790E5EFE94361A15BC7305534214E38385C8A856996A6AAF569D66C03179A7BDDECE68E7E07
    Malicious:false
    Preview://-----------------------------------------------------------------------------.// MurmurHash3 was written by Austin Appleby, and is placed in the public.// domain. The author hereby disclaims copyright to this source code...// Note - The x86 and x64 versions do _not_ produce the same results, as the.// algorithms are optimized for their respective platforms. You can still.// compile and run any of them on any platform, but your performance with the.// non-native version will be less than optimal...#include <stdint.h>..static uint32_t rotl32 ( uint32_t x, int8_t r ).{. return (x << r) | (x >> (32 - r));.}.#define ROTL32(x,y) rotl32(x,y).static uint32_t getblock32 ( const uint32_t * p, int i ).{. return p[i];.}.static uint32_t fmix32 ( uint32_t h ).{. h ^= h >> 16;. h *= 0x85ebca6b;. h ^= h >> 13;. h *= 0xc2b2ae35;. h ^= h >> 16;.. return h;.}.#define BIG_CONSTANT(x) (x##LLU).static void MurmurHash3_x86_128 ( const void * key, const int len,.

    C:\Program Files\WinHTTrack\src\coucal\is-C8VF2.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):7554
    Entropy (8bit):4.941691597927581
    Encrypted:false
    SSDEEP:192:7wOrp8tWZR3s3FKyLfRuyxoy6nqaKog8FyanxjtoytOuy/Ryhai6GrCW:7nritKB+FjRuyxoy6nqaTTFV
    MD5:D708FC90C283E83D2E088BE2220572F9
    SHA1:E6564582D66619BD3515EDDB7608F29D6CF68D83
    SHA-256:F43F631A0F7010BC5545C8FF0328371AAEB011AAA543CEE70EBE2A03C15B8265
    SHA-512:A1D8F2646177D408C58B416AF0F7D0EA5CB94C67D711B82C3F241CEF42BD3DB6F2388B6BE4C8C630FB86774E94376123F842AF1CE5BCDF0CB2C02560A7E8DEC8
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.Coucal, Cuckoo hashing-based hashtable with stash area..Copyright (C) 2013-2014 Xavier Roche and other contributors.All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:..1. Redistributions of source code must retain the above copyright notice, this.list of conditions and the following disclaimer...2. Redistributions in binary form must reproduce the above copyright notice,.this list of conditions and the following disclaimer in the documentation.and/or other materials provided with the distribution...3. Neither the name of the copyright holder nor the names of its contributors.may be used to endorse or promote products derived from this software without.specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLU

    C:\Program Files\WinHTTrack\src\coucal\is-KAHEU.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text
    Category:dropped
    Size (bytes):1509
    Entropy (8bit):5.16509358556634
    Encrypted:false
    SSDEEP:24:6ZUnooLbOOrpoFT5JjFTzZ6pxBTPn96432s4EOkUs8gROF32s3yTtTf413tf9fsL:pOOrpoJrJzKzP96432svI32s3Stc13tI
    MD5:54C521AD490E615F9BF6599A0DD30EA9
    SHA1:9FC75FE6BC9871B1554A59D430A246D5C30BE206
    SHA-256:842AF80CD11F1B5A978E9E05554F71E5D3DC6D9A68FFFB22EC4450864842945B
    SHA-512:EE458A369F953B58449335B2E80778754190C886F4463A2EC75BC8D7797CF5D6872A96173ABA44DBCADE25DA605D9D49D106FA5FBE7593D3B1E6ED8EC5A2E4BF
    Malicious:false
    Preview:Copyright (c) 2013, Xavier Roche (http://www.httrack.com/).All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:..1. Redistributions of source code must retain the above copyright notice, this.list of conditions and the following disclaimer...2. Redistributions in binary form must reproduce the above copyright notice,.this list of conditions and the following disclaimer in the documentation.and/or other materials provided with the distribution...3. Neither the name of the copyright holder nor the names of its contributors.may be used to endorse or promote products derived from this software without.specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE.DISCLAIMED. IN NO

    C:\Program Files\WinHTTrack\src\coucal\is-ND5KS.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Unicode text, UTF-8 text, with very long lines (390)
    Category:dropped
    Size (bytes):2014
    Entropy (8bit):5.1974283193629
    Encrypted:false
    SSDEEP:48:Szhn6S4e505V/sk1Wn9ULD+SD58jyUv/BawmDUkS:Szh94eq5Gkc214yUvLt
    MD5:0F6D3AC5C06D4DAE8F172C19F7BD16B6
    SHA1:C09AC1BCECFB6C3E33E608744335BA10089E58DD
    SHA-256:182391BE76F352E9277297DD6719B0C16F4C1DE87DDA6AEBD52BBFD8613592D5
    SHA-512:DAEE3C6CF10A2E3A586E5B26690D8B944E9B090693C2031736DA35218BAB65A646198EADBBCBF5756820F7494418E95769BE3E9159E19ED9B7B4F238C5AB6F40
    Malicious:false
    Preview:coucal.======..**Coucal**, a Cuckoo-hashing-based hashtable with stash area C library...![Greater Coucal Centropus sinensis](http://upload.wikimedia.org/wikipedia/commons/thumb/8/8d/Greater_Coucal_%28Centropus_sinensis%29_in_Hyderabad_W_IMG_8962.jpg/250px-Greater_Coucal_%28Centropus_sinensis%29_in_Hyderabad_W_IMG_8962.jpg "Centropus sinensis")..> [Wikipedia] A coucal is one of about 30 species of birds in the cuckoo family. All of them belong in the subfamily Centropodinae and the genus Centropus. Unlike many Old World cuckoos, coucals are not brood parasites...This is an implementation of the cuckoo hashing algorithm (Rasmus Pagh and Flemming Friche Rodler, http://www.it-c.dk/people/pagh/papers/cuckoo-jour.pdf) with a stash area (Adam Kirsch, Michael Mitzenmacher and Udi Wieder, http://research.microsoft.com/pubs/73856/stash-full.9-30.pdf), using by default the MurmurHash hash function (Austin Appleby, http://en.wikipedia.org/wiki/MurmurHash)...This allows an efficient generic hashtab

    C:\Program Files\WinHTTrack\src\coucal\is-OEKM0.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):3787
    Entropy (8bit):5.05807076915668
    Encrypted:false
    SSDEEP:48:wtUq3iwfy+Ct2lwIk5WuWz1vWpPyLD6/3yBhrATtkm91s8t6niAQ4ozuh9AT7uht:waq3iwfyRJIcWuW1epGubBcnWr1GOy
    MD5:3F00A3411539996F33ED0B87F040037B
    SHA1:8DCC865536A01BB1BF3CD7A953FDD0BCB06FE5BF
    SHA-256:8EB39294F0D83A41FA4154A863B5B808BBB8301C08A2B901ED1A3F0DF27C03DE
    SHA-512:04432820BEE1DC14AB5FED233FF6FEAA2500B412A19CCF08D6E2D77809F0EB08C30AA4FBE662F28927A5857B53FAF9559E8777ACEE353A095D6B53E11EAF565A
    Malicious:false
    Preview://-----------------------------------------------------------------------------.// MurmurHash3 was written by Austin Appleby, and is placed in the public.// domain. The author hereby disclaims copyright to this source code...// Note - The x86 and x64 versions do _not_ produce the same results, as the.// algorithms are optimized for their respective platforms. You can still.// compile and run any of them on any platform, but your performance with the.// non-native version will be less than optimal...#ifdef _WIN32.#include <stddef.h>.typedef __int8 int8_t;.typedef unsigned __int8 uint8_t;.typedef unsigned __int16 uint16_t;.typedef unsigned __int32 uint32_t;.typedef unsigned __int64 uint64_t;.#elif (defined(SOLARIS) || defined(sun) || defined(HAVE_INTTYPES_H) \. || defined(BSD) || defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__NetBSD__) || defined(__FreeBSD_kernel__)).#include <inttypes.h>.#else.#include <stdint.h>.#endif..static uint32_t rotl32 ( uint32_t x, int8_t r ).{. re

    C:\Program Files\WinHTTrack\src\coucal\is-S5R81.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):2902
    Entropy (8bit):5.385874659485356
    Encrypted:false
    SSDEEP:48:SPa9OOrpoJrJzKzP96432svI32s3Stc13tfyTHqAfYOmNp9lQ4K6oyrKTOHQUEj4:wawOrpoJrJzKZR3s3zxFyTtf0Np9lQVG
    MD5:E0CD32C45DA199343583D8A6EFF107B2
    SHA1:AFBD11F32DBB602C2EE65AAF3F8F8802DC9A4509
    SHA-256:9207B02747AE20F69FE72294BEB84459A2392EAF5738B29BB5ABCCE79ADAD9B9
    SHA-512:C661573B127E42F5FA411DB3A259BC55667F09A607BDF376218E690BD67F50A17B1F16D325B9AF1448CBDC028BD115A6F8B707566CCE296B0485218EC166DEF7
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.Coucal, Cuckoo hashing-based hashtable with stash area..Copyright (C) 2013-2014 Xavier Roche and other contributors.All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:..1. Redistributions of source code must retain the above copyright notice, this.list of conditions and the following disclaimer...2. Redistributions in binary form must reproduce the above copyright notice,.this list of conditions and the following disclaimer in the documentation.and/or other materials provided with the distribution...3. Neither the name of the copyright holder nor the names of its contributors.may be used to endorse or promote products derived from this software without.specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLU

    C:\Program Files\WinHTTrack\src\coucal\is-SP4UO.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):18635
    Entropy (8bit):4.879963467233371
    Encrypted:false
    SSDEEP:384:xritKB+FZYasgbmMBiwfZ8H2sym7bKW/jOFOVYH95wRi+s/16JVgV+:xZ+FzkMaH0m7H0Ets/w
    MD5:62C36E3BCC49AC1175C15C5536712AE6
    SHA1:5946C2D608F6FA6E65E9FD44005338766C8BE07C
    SHA-256:400C5D803D5E9442F3510347BE4D156DBAE2FF77114249A8E3B9987631AC9DF3
    SHA-512:6C1E51CBA8F3DE44746DB267E7002505B573156EE3C6B33782C3867C5A7770A641EB73F9728CC315C7D62B81BB523C0EFD958884E8BF1913A02CE3AC46CE3459
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.Coucal, Cuckoo hashing-based hashtable with stash area..Copyright (C) 2013-2014 Xavier Roche (http://www.httrack.com/).All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:..1. Redistributions of source code must retain the above copyright notice, this.list of conditions and the following disclaimer...2. Redistributions in binary form must reproduce the above copyright notice,.this list of conditions and the following disclaimer in the documentation.and/or other materials provided with the distribution...3. Neither the name of the copyright holder nor the names of its contributors.may be used to endorse or promote products derived from this software without.specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, IN

    C:\Program Files\WinHTTrack\src\coucal\is-UHUT2.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:makefile script, ASCII text
    Category:dropped
    Size (bytes):1132
    Entropy (8bit):5.025104226684108
    Encrypted:false
    SSDEEP:24:TCkwJr8foLQsWu4KyD+qDi4634Kmj4Kchh:TMrOsKRD+qO4Rz0Ph
    MD5:A8D793586EB35380D82838C1DEA79372
    SHA1:73FBEABD6836D977A45C3AFFCA5FE560CF52DDA6
    SHA-256:05388746D2139C250CA712C8537AD771BE7F00B639EE9CB23028C9392A04A117
    SHA-512:09BEA18F3891BF26D3D91D89BB1DD3CF991AAA93A5069B5D742D9449B05272808D132A70AFF473BA213C2AF61DCED5EDDCA045B8C44D42AC2F0F531932F0E2E2
    Malicious:false
    Preview:###############################################################################.#.# "Cuckoo Hashtables".#.###############################################################################..CFILES = coucal.c..all: gcc tests sample runtests..clean:..rm -f *.o *.obj *.so* *.dll *.exe *.pdb *.exp *.lib sample tests..tar:..rm -f coucal.tgz..tar cvfz coucal.tgz coucal.txt coucal.c coucal.h Makefile LICENSE README.md..gcc:..gcc -c -fPIC -O3 -g3 -pthread \...-W -Wall -Wextra -Werror -Wno-unused-function \...-D_REENTRANT -D_GNU_SOURCE \...-DHTS_INTHASH_USES_MURMUR \...$(CFILES)..gcc -shared -fPIC -O3 -Wl,-O1 -Wl,--no-undefined \...-rdynamic -shared -Wl,-soname=libcoucal.so \...coucal.o -o libcoucal.so \...-ldl -lpthread..tests:..gcc -c -fPIC -O3 -g3 \...-W -Wall -Wextra -Werror -Wno-unused-function \...-D_REENTRANT \...tests.c -o tests.o..gcc -fPIC -O3 -Wl,-O1 \...-lcoucal -L. \...tests.o -o tests ..sample:..gcc -c -fPIC -O3 -g3 \...-W -Wall -Wextra -Werror -Wno-unused-function \...-D_REENTRANT \

    C:\Program Files\WinHTTrack\src\coucal\murmurhash3.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):3787
    Entropy (8bit):5.05807076915668
    Encrypted:false
    SSDEEP:48:wtUq3iwfy+Ct2lwIk5WuWz1vWpPyLD6/3yBhrATtkm91s8t6niAQ4ozuh9AT7uht:waq3iwfyRJIcWuW1epGubBcnWr1GOy
    MD5:3F00A3411539996F33ED0B87F040037B
    SHA1:8DCC865536A01BB1BF3CD7A953FDD0BCB06FE5BF
    SHA-256:8EB39294F0D83A41FA4154A863B5B808BBB8301C08A2B901ED1A3F0DF27C03DE
    SHA-512:04432820BEE1DC14AB5FED233FF6FEAA2500B412A19CCF08D6E2D77809F0EB08C30AA4FBE662F28927A5857B53FAF9559E8777ACEE353A095D6B53E11EAF565A
    Malicious:false
    Preview://-----------------------------------------------------------------------------.// MurmurHash3 was written by Austin Appleby, and is placed in the public.// domain. The author hereby disclaims copyright to this source code...// Note - The x86 and x64 versions do _not_ produce the same results, as the.// algorithms are optimized for their respective platforms. You can still.// compile and run any of them on any platform, but your performance with the.// non-native version will be less than optimal...#ifdef _WIN32.#include <stddef.h>.typedef __int8 int8_t;.typedef unsigned __int8 uint8_t;.typedef unsigned __int16 uint16_t;.typedef unsigned __int32 uint32_t;.typedef unsigned __int64 uint64_t;.#elif (defined(SOLARIS) || defined(sun) || defined(HAVE_INTTYPES_H) \. || defined(BSD) || defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__NetBSD__) || defined(__FreeBSD_kernel__)).#include <inttypes.h>.#else.#include <stdint.h>.#endif..static uint32_t rotl32 ( uint32_t x, int8_t r ).{. re

    C:\Program Files\WinHTTrack\src\coucal\murmurhash3.h.diff (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:unified diff output, ASCII text
    Category:dropped
    Size (bytes):769
    Entropy (8bit):5.274534653103435
    Encrypted:false
    SSDEEP:12:+uRu3cxEuFJoUEuU+MzGlAqznALdLrLW6Lb0GSCdIb++O7G+E7G+TF7G+y/AuC02:VtQElix/S6qiwfy//C0bqt
    MD5:7F3D99F3244CCD9A6C818ED532D5285A
    SHA1:F544E04D6A493A386AE827E73F63A4595F9A93AC
    SHA-256:63C17E82CE1C6B69E10B20495B40B55D57D10FF1B6F8E6DAF127E103F953D5DF
    SHA-512:80127A64F234A0C9C39044C92845F8CFF0AB144E32FE4313D9F074D128CDC4D627FEF9EE9A7FACAB4850AA164A5D871FD15FFD5B313A4E70E626965C3B43096C
    Malicious:false
    Preview:--- murmurhash3.h.orig.2014-06-14 14:29:11.562576736 +0200.+++ murmurhash3.h.2014-06-14 14:39:43.989624584 +0200.@@ -7,7 +7,19 @@. // compile and run any of them on any platform, but your performance with the. // non-native version will be less than optimal.. .+#ifdef _WIN32.+#include <stddef.h>.+typedef __int8 int8_t;.+typedef unsigned __int8 uint8_t;.+typedef unsigned __int16 uint16_t;.+typedef unsigned __int32 uint32_t;.+typedef unsigned __int64 uint64_t;.+#elif (defined(SOLARIS) || defined(sun) || defined(HAVE_INTTYPES_H) \.+ || defined(BSD) || defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__NetBSD__) || defined(__FreeBSD_kernel__)).+#include <inttypes.h>.+#else. #include <stdint.h>.+#endif. . static uint32_t rotl32 ( uint32_t x, int8_t r ). {.

    C:\Program Files\WinHTTrack\src\coucal\murmurhash3.h.orig (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):3366
    Entropy (8bit):4.9295219014365355
    Encrypted:false
    SSDEEP:48:wtUqk2lwIk5WuWz1vWpPyLD6/3yBhrATtkm91s8t6niAQ4ozuh9AT7uh9UGOy:waqkJIcWuW1epGubBcnWr1GOy
    MD5:42485F20A511C37EC72635AB06473A0A
    SHA1:3CA4A16F228C4FE2F574E7C75EE053C1811B95A9
    SHA-256:7B30931693F238A59D1F1ADDEB08CF491E8878AFF60F0FD5487BD43EDE34C241
    SHA-512:DA81017D9658962D8CB7BBFF3F3332050ABDC65094B92112B4A7A790E5EFE94361A15BC7305534214E38385C8A856996A6AAF569D66C03179A7BDDECE68E7E07
    Malicious:false
    Preview://-----------------------------------------------------------------------------.// MurmurHash3 was written by Austin Appleby, and is placed in the public.// domain. The author hereby disclaims copyright to this source code...// Note - The x86 and x64 versions do _not_ produce the same results, as the.// algorithms are optimized for their respective platforms. You can still.// compile and run any of them on any platform, but your performance with the.// non-native version will be less than optimal...#include <stdint.h>..static uint32_t rotl32 ( uint32_t x, int8_t r ).{. return (x << r) | (x >> (32 - r));.}.#define ROTL32(x,y) rotl32(x,y).static uint32_t getblock32 ( const uint32_t * p, int i ).{. return p[i];.}.static uint32_t fmix32 ( uint32_t h ).{. h ^= h >> 16;. h *= 0x85ebca6b;. h ^= h >> 13;. h *= 0xc2b2ae35;. h ^= h >> 16;.. return h;.}.#define BIG_CONSTANT(x) (x##LLU).static void MurmurHash3_x86_128 ( const void * key, const int len,.

    C:\Program Files\WinHTTrack\src\coucal\sample.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):2902
    Entropy (8bit):5.385874659485356
    Encrypted:false
    SSDEEP:48:SPa9OOrpoJrJzKzP96432svI32s3Stc13tfyTHqAfYOmNp9lQ4K6oyrKTOHQUEj4:wawOrpoJrJzKZR3s3zxFyTtf0Np9lQVG
    MD5:E0CD32C45DA199343583D8A6EFF107B2
    SHA1:AFBD11F32DBB602C2EE65AAF3F8F8802DC9A4509
    SHA-256:9207B02747AE20F69FE72294BEB84459A2392EAF5738B29BB5ABCCE79ADAD9B9
    SHA-512:C661573B127E42F5FA411DB3A259BC55667F09A607BDF376218E690BD67F50A17B1F16D325B9AF1448CBDC028BD115A6F8B707566CCE296B0485218EC166DEF7
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.Coucal, Cuckoo hashing-based hashtable with stash area..Copyright (C) 2013-2014 Xavier Roche and other contributors.All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:..1. Redistributions of source code must retain the above copyright notice, this.list of conditions and the following disclaimer...2. Redistributions in binary form must reproduce the above copyright notice,.this list of conditions and the following disclaimer in the documentation.and/or other materials provided with the distribution...3. Neither the name of the copyright holder nor the names of its contributors.may be used to endorse or promote products derived from this software without.specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLU

    C:\Program Files\WinHTTrack\src\coucal\tests.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):7554
    Entropy (8bit):4.941691597927581
    Encrypted:false
    SSDEEP:192:7wOrp8tWZR3s3FKyLfRuyxoy6nqaKog8FyanxjtoytOuy/Ryhai6GrCW:7nritKB+FjRuyxoy6nqaTTFV
    MD5:D708FC90C283E83D2E088BE2220572F9
    SHA1:E6564582D66619BD3515EDDB7608F29D6CF68D83
    SHA-256:F43F631A0F7010BC5545C8FF0328371AAEB011AAA543CEE70EBE2A03C15B8265
    SHA-512:A1D8F2646177D408C58B416AF0F7D0EA5CB94C67D711B82C3F241CEF42BD3DB6F2388B6BE4C8C630FB86774E94376123F842AF1CE5BCDF0CB2C02560A7E8DEC8
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.Coucal, Cuckoo hashing-based hashtable with stash area..Copyright (C) 2013-2014 Xavier Roche and other contributors.All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:..1. Redistributions of source code must retain the above copyright notice, this.list of conditions and the following disclaimer...2. Redistributions in binary form must reproduce the above copyright notice,.this list of conditions and the following disclaimer in the documentation.and/or other materials provided with the distribution...3. Neither the name of the copyright holder nor the names of its contributors.may be used to endorse or promote products derived from this software without.specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLU

    C:\Program Files\WinHTTrack\src\hts-indextmpl.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (614)
    Category:dropped
    Size (bytes):52432
    Entropy (8bit):5.051425526760889
    Encrypted:false
    SSDEEP:768:7LSFKVFxcFmFJX1DkTm+JAiomXLlsA3iDGhIrzJaCk9ohQ:WTm+J+oLlsY0GyE
    MD5:5EB6DCD8AE01A05399BBC2B483D6C689
    SHA1:8E29D3C04040535B1AF18720CE88E77397DA584D
    SHA-256:2FE09BC1A082B0BCA085AEB41C9A5EDA4C64A77380289E693B61EE25C63D7837
    SHA-512:E87BCE13F9CAE1D8CF57128A2B5F190939E4AC2A44E544A08381BFB69321BB9863FA992F7DF930CBCB6D3EBC5452C86D254235C4C96925DB2330F66240396D07
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsalias.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):20308
    Entropy (8bit):4.7548871805761985
    Encrypted:false
    SSDEEP:384:qoL2Ar+FHDMKssW2NrgN1WOIwkzYYCipDyKMUgCJQ1hDm3QGV0RLWuYaBVhqnboe:7LbyZy2um3faBVwnbolSWunb9/dd
    MD5:9CD463522598C68539EFE2D0E30A20FA
    SHA1:3C5437CEC429C1D3FAE922183556C92737C3B2B9
    SHA-256:99C31826923ACAFAFCD848A1960594DAF1B5558F2CF6918E9214215D0408049F
    SHA-512:B5146E45B4C66C81FBA4A44CC0DC430316D1C40E70AE11FF86EFCF47027BB4E9BD3454A7BC09B0A3DD29E91496A5CDFDCBF3281F2EA8CDFF32B3A065606FE18A
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsalias.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):2174
    Entropy (8bit):4.86930028704163
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUwfsQ9Z41JxuOl7oyr7z5:qRC732pfsQ9ZExuOlzd
    MD5:7325E4B1ABF066331BA37B593FAE4756
    SHA1:A152C4F47F6AD5F99F906D99694EF225805307A6
    SHA-256:5D12B6318569720E24A1D6D406019877C903FDF4CAB6A9F69DF8B065C2F4ABC9
    SHA-512:025F8D3F74ACDB64D2E28C24ECE9B3C363D53F21EB788769A8849B68FC4F97842B1FF8A90BC913F8C45DB40D7A61C2B41CF0F37E64CEDD891101CED542524C9E
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsarrays.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):4722
    Entropy (8bit):4.991024290903593
    Encrypted:false
    SSDEEP:96:qRC732p1QTdI7yrMuF+QuTw/tPEffmHcqEXiq:qRC7321QTdI7yfkbw/tPSfMdc
    MD5:5638D4151A021F070C0142DF7FBB9791
    SHA1:3180D828D6211D37F9CF1A46AD2F8FD8EE326322
    SHA-256:DDDE0909DA47C6A7FDC10ED12588A9B5C77255DBAD68F9070E48FEBFB57AEB0B
    SHA-512:CE67EE1FD2338CA41BAF5EA9D0FCC421E63792601C60466A0615F4C9747D4D1DE774ADA163CEDA3DA0C2AEDB50B5BC159253EC465C92918260D1067C8FF39DDC
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsback.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):163004
    Entropy (8bit):4.457052883888839
    Encrypted:false
    SSDEEP:1536:iwvFez5FpHHfNzbPQFD00PHs4GyWYOo0RP4ASWdLEcd:iwAlHfhDyGBomgAD
    MD5:0220E75A4EADDF9AAF1CFDFA93196F30
    SHA1:DDF2F841905431DF9C16B6DE6001BB3593B3A6F3
    SHA-256:0F20DD5ED2D52A2452FAF97A42CF68F3A13314ADE2E8F6D0C8C186275897A70D
    SHA-512:97D7B60C0DB24897A815F1B75F4593B1BBFDA4F40FF8C46411CF1849C47914BE3119EC4ADBFC9C0AD6C6F3367B8B0B2B67F3573792CE48E96984405A69B9049A
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsback.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):5914
    Entropy (8bit):4.850526157643613
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUw6dQa0LKK04egc0LeRM0rex80GliZ44fPuVsVifvQesM7injp:qRC732p6dQaKMECWZMmGvQdtmgKTG
    MD5:1D4693951897AB449F2EC5C3BE9A1101
    SHA1:771C664C25E208F5A6284EAE008E55B17D49D76B
    SHA-256:1D194560D634E75FA2782C819AA27D69E87BDF7CBD4E844DC7DEF0590684B83B
    SHA-512:3349FBB84BDC454E3C23650A7A7727AEE0AD812F8AEB3D081517626A3118D733944A841A358184613BE22171EB289869C6B0B44EF6A6FB4C636F6270B82366C4
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsbase.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):3039
    Entropy (8bit):5.227925601465192
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUwn4mnSDmbbJ6NYFQBEOthuthKCp30ZP6YOlgBTZ4s:qRC732pn4mnwDRC/p30ZPm+TZp
    MD5:2E87030AB936BDD97D517E3D4CECBB3A
    SHA1:FBA91728820367225DE3DB675E6213F6DA0E4D1A
    SHA-256:DE1B39F690F5D9956E16484D662C88E0E4B6601CAD6C48ECE5D37D1CCC443266
    SHA-512:037ED6CCBF633AFE17A6F25E2B919831937159D447178335254D10C5CADD017757EBE28154303025D3158AE2088CBCD1DA2C084247EAFA46943920E88FD6491D
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsbasenet.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):4751
    Entropy (8bit):5.456302893868474
    Encrypted:false
    SSDEEP:96:qRC732poyQ4Ojhsr85eKZdIhiqStN8wo1TD:qRC732oyQ44DnTTyw8TD
    MD5:8CE281596ECC2E4A82CB46C466FCD9AB
    SHA1:C4FFB97E0BC292F37AD6F2B1650E364FCAAC7559
    SHA-256:DECB23176077CEA25B6B21A50E0DBB33C1D5C50F4AD602F95853D141435738A9
    SHA-512:47EAC070252609286C6D3886BADF9A28CD002A0C961854A69E0CDBEB7FE99B099EC4CE33A48ADFB0802400053518EB64D69D6E7AB9C993D7647BA2A481DE3C8C
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsbasiccharsets.sh (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Bourne-Again shell script, ASCII text executable
    Category:dropped
    Size (bytes):1970
    Entropy (8bit):5.286670656780334
    Encrypted:false
    SSDEEP:48:kf6tf6Kf6Af6vf6of6bAurMhHXUsIiuBzeLuj:kYVNcp4KksIiK/j
    MD5:80B1B1444F5AA2422DFED125358B1C60
    SHA1:3D95A384F20D5F99DE80A532C1671614BF112655
    SHA-256:3961C6C2BAC732426CDFC7B757CD3422B5FDE3AFE5A16E64E71677594854FA65
    SHA-512:BFF820D49B5378AFE8CDDADDEFA19B2FCEA103ECB878417EC71848629D59A1B013F58822B0F8FEBF4A4CB717C397952E7F6597F7E34BA375F38A7B139C3EB51B
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 0%
    Preview:#!/bin/bash.#..# Change this to download files.if false; then.echo "mget ftp://ftp.unicode.org/Public/MAPPINGS/ISO8859/8859-*.TXT" | lftp.echo "mget ftp://ftp.unicode.org/Public/MAPPINGS/VENDORS/MICSFT/PC/CP*.TXT" | lftp.echo "mget ftp://ftp.unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP*.TXT" | lftp.echo "mget ftp://ftp.unicode.org/Public/MAPPINGS/VENDORS/MICSFT/EBCDIC/CP*.TXT" | lftp.echo "mget ftp://ftp.unicode.org/Public/MAPPINGS/VENDORS/MISC/CP*.TXT" | lftp.echo "mget ftp://ftp.unicode.org/Public/MAPPINGS/VENDORS/MISC/KOI8*.TXT" | lftp.rm -f CP932.TXT CP936.TXT CP949.TXT CP950.TXT.fi..# Produce code.printf "/** GENERATED FILE ($0), DO NOT EDIT **/\n\n".for i in *.TXT ; do. echo "processing $i" >&2. grep -vE "^(#|$)" $i | grep -E "^0x" | sed -e 's/[[:space:]]/ /g' | cut -f1,2 -d' ' | \. (. unset arr. while read LINE ; do. from=$[$(echo $LINE | cut -f1 -d' ')]. if ! test -n "$from"; then. echo "error with $i" >&2. exit 1. elif test $from

    C:\Program Files\WinHTTrack\src\htsbauth.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):13982
    Entropy (8bit):4.741592090428614
    Encrypted:false
    SSDEEP:192:QRC7326BQSQMNulZu5lojnueCiepC6UK/oWG+FPABZ+yaiSbn3GT7iKS6NBo+t5F:QoL2TovoiLY6y+FVNINEIl
    MD5:14A39EF176E3309B065FB3E3F214A0BB
    SHA1:BC84102E6E1910C68933C9A5F56FC6169E8AE589
    SHA-256:F4FDC1CF41A78145ED6E42AE8EE760DEF6B0746640E3B67A554CA1A29BA40CD7
    SHA-512:D52C8C4043BA9AC7A4B39724F9C4E7BFC67866F61A73FF6B0515E9480DE5278A580316D36CFCB4979D371F6F91A0F69B6DE4937448E811B9AED90685326EEE0B
    Malicious:false
    Preview:/*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our work, and spoil the many hours we spent on it...Please visit our Webs

    C:\Program Files\WinHTTrack\src\htsbauth.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):3051
    Entropy (8bit):4.939871674236105
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUw6OWQCJ002VMqfkr09YicxWyLZ4NvDixh3Die8Di5ZUDitHJA:qRC732p6OWQrqqcrqcxWyLZgvexh3eec
    MD5:2F12026E9036B40BD313778B6694F580
    SHA1:81D0C65E1ED1D707A56FA5349418F359167E9C4A
    SHA-256:BCAD9073BDE9862799DEF90546825D34AB8F46302F6A23B91394711400400B4A
    SHA-512:7061541339CD14F0F35DC4C6D6B8A33C1B1CDDF60CA842A3D479527861960B2B4F9F9366BEAF0D7F2CBCB29A4E2619194B4C14A903F12F61783F0F792DD2A654
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htscache.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):81673
    Entropy (8bit):4.593646328436326
    Encrypted:false
    SSDEEP:768:7LYzDYbOScR+itF0CaAfcYKqpxSUzl0L/BG++AsaAabIZTc9UcnAvqbmHEJ1vaIk:usOe6sG+PvIZTc9U9qbmHEJ1iC2vbl
    MD5:21B70740091DA0BCB08FB05186A9FD35
    SHA1:E90CE3EAAFEDE6DAD20F0AD788A61CEFD576617A
    SHA-256:183E00B0A9482587F33A8036E14E8BFD1861973FA0976FC0BA71BD270442C276
    SHA-512:489AEC58FD2727B750878B835178A9AE4874D43167718D6C2F48F3C200F83B5C3FE1EE35A687EA6C6D69DA67A0B3F62E2501A13342D3F4880F0899947BE4386D
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htscache.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):3786
    Entropy (8bit):4.818586957420824
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUw6OPQdZ43Q0LKK0LeRM0GlrgTrlMDgZm99MbdeHp61:qRC732p6mQdZgQKEngTh7/eHpK
    MD5:C4269092151547B67723A9CAF34CAB23
    SHA1:76AB6454FF57FF601626577348CC972C56E940D1
    SHA-256:F7954D005499F87BD57045E9D58175B61CD6C9AAAE8A1679C690711A1A96BA46
    SHA-512:D4AF19B9A944160355CB5388A51FE5D39DE2569194E4017C247D83A7F1C6B32D988D14E2FEB1C780EEB70E4028E8FB74A265C19371BB11643289E9823FD84DDD
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htscatchurl.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):7467
    Entropy (8bit):4.81529825000216
    Encrypted:false
    SSDEEP:192:qRC732DQSJ6joGJagrkXGie9PYygPIqC/yNNr2HYus:qoL2qjBS2HYR
    MD5:9454A5714BFAE96FB4A006D7F9AE9CCD
    SHA1:383A225392A277FD7813F818228CA8AE715820D0
    SHA-256:7F6DD736CF18C77F01D7040003979FE9547E3A4537A2FC878D20F2D994861AD0
    SHA-512:2D5C263460889146B14AA35E4ABE561CC37EA03F7E49F42FDE4814A236DE6FE1CC695D8F321AFE0DAB55FD606AAEC2DC8B034B5F2605D3FC673052298E6BB906
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htscatchurl.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):2296
    Entropy (8bit):5.1309686958920935
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUwDQH3RZ42hqJdjqhgyA:qRC732pDQH3RZxqDqhA
    MD5:021A01CB319FD716C92FF188F9CD16B1
    SHA1:3ABC23FFAE44119D9AF13ED04AEC26B3DFAFF443
    SHA-256:4EA5A2013BCF9898592FA1FC707015A8C2868E0EC35952E4E8F8934CE71F266B
    SHA-512:35E354EB8E04692F375EFD455C3F658B5C32E8600C71AE88123BDEA5C0FB785AF43E7724F3851B8E68E21E669D262AD677F3907813FFF95DD0B4F31F160B1459
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htscharset.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):36193
    Entropy (8bit):4.870968843571292
    Encrypted:false
    SSDEEP:768:7LoAIlX98c1oj9Id96QH9gcJ5/gV8j6nfNO8PNMRh:Elt8ud96FVZS
    MD5:82C8622700218FA989ACEA4EA4E5D09F
    SHA1:46FF4BE9DBF3FFFE2BE0E49572118619C6CAA099
    SHA-256:5AC1C7F372037AD6F1DD3DCCE56E981BD8074F3CD23D794D0E9425A36CC3AD75
    SHA-512:BE5D0BD0E7889D20EC9159B9A19DAEEDA4A6389C1F7DE763A489DE1187193E13FDC49D3683C2263E4C58E4F2FC47DEAE402D64AB659CEEE5B19B55A297049629
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htscharset.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):5448
    Entropy (8bit):4.941010143101136
    Encrypted:false
    SSDEEP:96:qRC732pMQPil6/yZREK4YukIZIYxg6yB3zWx2g:qRC732MQPil6/SREK4YVCIqyDc
    MD5:A7E731260B0FCF4F37401737DB6EC25F
    SHA1:438B30E7E465516A66459A1B0CC908E2342AA142
    SHA-256:5BC4F253653FC14D84F6577AF5EA5C9ABBE432708A8D5704BC51E54F7B718139
    SHA-512:0481C7CCF1F29E17C311F2B0776473782816BA01E9267400E757334B668B21D52436D2DE4EC84DD4E6E59E2268187CF22AE9C3A5283C2AB6039D32962569D13F
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htscodepages.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text
    Category:dropped
    Size (bytes):110386
    Entropy (8bit):3.491050127994881
    Encrypted:false
    SSDEEP:3072:kpiFVniBO713ViMMfGbkCWA9YiYJ6rXq22fJIYHiikrUE5LySAItGb2IJXgxGajP:kpiFVniBO713ViMMfGbkCWA9YiYJAXqW
    MD5:38189E353A89DD63F65F7E7467315274
    SHA1:E1D3A4301620CD2E26146759D775677347941121
    SHA-256:D0197B0940801655012F7828625F2D49E3F472BECFA742031F177C5F06A95AFF
    SHA-512:9E9D621FB5B5DC2C33E95C82EEE43E6F8251AB977F74E0530C4F4E33BD3AEC564853359E82356BF51E3BFE252AB67F3BE4FF6C2EF83C7040EB414382EE1B187F
    Malicious:false
    Preview:/** GENERATED FILE (/temp/httrack-3.47.21/src/htsbasiccharsets.sh), DO NOT EDIT **/../* Table for 8859-10.TXT */.static const hts_UCS4 table_iso_8859_10[256] = {. 0x0000, 0x0001, 0x0002, 0x0003, 0x0004, 0x0005, 0x0006, 0x0007, . 0x0008, 0x0009, 0x000a, 0x000b, 0x000c, 0x000d, 0x000e, 0x000f, . 0x0010, 0x0011, 0x0012, 0x0013, 0x0014, 0x0015, 0x0016, 0x0017, . 0x0018, 0x0019, 0x001a, 0x001b, 0x001c, 0x001d, 0x001e, 0x001f, . 0x0020, 0x0021, 0x0022, 0x0023, 0x0024, 0x0025, 0x0026, 0x0027, . 0x0028, 0x0029, 0x002a, 0x002b, 0x002c, 0x002d, 0x002e, 0x002f, . 0x0030, 0x0031, 0x0032, 0x0033, 0x0034, 0x0035, 0x0036, 0x0037, . 0x0038, 0x0039, 0x003a, 0x003b, 0x003c, 0x003d, 0x003e, 0x003f, . 0x0040, 0x0041, 0x0042, 0x0043, 0x0044, 0x0045, 0x0046, 0x0047, . 0x0048, 0x0049, 0x004a, 0x004b, 0x004c, 0x004d, 0x004e, 0x004f, . 0x0050, 0x0051, 0x0052, 0x0053, 0x0054, 0x0055, 0x0056, 0x0057, . 0x0058, 0x0059, 0x005a, 0x005b, 0x005c, 0x005d, 0x005e, 0x005f, . 0x0060, 0x0061, 0x0062, 0x0063,

    C:\Program Files\WinHTTrack\src\htsconcat.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text
    Category:dropped
    Size (bytes):3433
    Entropy (8bit):5.096564502071116
    Encrypted:false
    SSDEEP:48:GRC7iyZHc1FvPHUw1qQV4ujr9Q+bzFbCSOIDqi2qUxLG2qy6OapTj/3:GRC732pkQVBNX1XBeqQG77z
    MD5:18E7CAE0DFF5EDF257DF6209E8C4C8A5
    SHA1:3799BAD7D81C3A18CE7E97FD88A0ADB8A3938D50
    SHA-256:E5C3E27DC0806E0D5B68C6B65AACA1A2D16C71DBD751621D6393FB073C2B9EDB
    SHA-512:1DA2945B7DEFCB6F9A25D90FF6D9F4F263663E1BEA3AC5112D181A4535B6B0C7B1EFDC1330E71C9506D2AEDAD9ED72781781BC5F18DA44262ACE107997D94CCA
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2013 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsconfig.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):4094
    Entropy (8bit):5.20162305230985
    Encrypted:false
    SSDEEP:96:qRC732pZQ/Jq/JutIGioP05OmyWCxYs7+W0h13Hufz:qRC732ZQ0oyGik04Qq+W0Ofz
    MD5:EBA8BA23A0FDFBC6468CE526444A2E69
    SHA1:1AD24329F9625A4BBB617650FC7BCF68CE6E30C6
    SHA-256:74B8C6013899076A257F865B4B7C88C81E99682FA7ABC170FD679AD435656496
    SHA-512:39473472BBDD166CC73BBA6552D7DF4D6B8773D3B983CFCE1722D59AE3B1D43F887D7F4A91C95BE2A03D388493D7FDA3ADAD8262948146C907BB73BD351A884F
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htscore.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):129929
    Entropy (8bit):4.72445751561178
    Encrypted:false
    SSDEEP:768:7LzDSz6PYXioe8wx+hxW6CVA6Abp7iQi3DcBIxS+XK7Rv9SwmK/pDS9JnEjOSA+S:7DSZXW8cv0bqVS+67j1jOS5b6
    MD5:42BF11D0DD65591542C627E13949C421
    SHA1:4EACF11C72DE4BF6230547AFD5FCBC3A2AD8EA7F
    SHA-256:1C7CB42B2775AE4E8D3CEB492275583536962DE877C0AE60BD62A9194F598E85
    SHA-512:FBD1DD73C9223160FDA8CD25BAD05632DFB32E5C0A921F692E029368BAFB43202BB6733A7A122D47FF9F2F46EE7D836355C56ACEC5E39862057D699485D16508
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htscore.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):10001
    Entropy (8bit):5.08203409595179
    Encrypted:false
    SSDEEP:192:qRC732UQqICMEKgLpwWY4+/AvSI6Z+sXqZAejZN6p/yQ9:qoL2SpwjXqu/yY
    MD5:B5BFE01107AFDC4B5EE7FB4CD558D219
    SHA1:6BBDD685A14E0A118C5619B44F2A0B1FA3460BBA
    SHA-256:DCE1BDFB85ED6A171CA47C4ACCB4478CB5FAA49176C2BE9D810203F117C7F765
    SHA-512:6B5AAF80192AB0366627300E58DBB63BB9ADFF3B5C84007F33AC2537E8BA40457471FD4F76552804FE85CA343EC6DD4E0311F4ED3AA531F49063F8B99BAA7E4F
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htscoremain.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text, with very long lines (417)
    Category:dropped
    Size (bytes):123794
    Entropy (8bit):4.251709049047534
    Encrypted:false
    SSDEEP:1536:JDZRTtekrmgcVfqL29X7pSvFkYUkD2J+aAB9i:L+gcVfqsX9SvFe3J+aAB9i
    MD5:2881C63425F6A734E65E9AF7D8563DDF
    SHA1:47AF2E9FF84532B601476F8E2C55FC71E544771C
    SHA-256:320F4477135F3C9BC11EFC1D40BCB8C1F0E65453E7A9A666CA056712DCD08B10
    SHA-512:658EE953F16A2FCC2E280207027A846E937F6E123C04CC8521444406C8CFC68222F98A1EF45DC4DBDCC9DF0C664439FA9045B8612179BAA81D622EF817A41E51
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htscoremain.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):1788
    Entropy (8bit):4.900918983151231
    Encrypted:false
    SSDEEP:24:nqRJiz7WtyPOkHMlCTbVO2ylFvP4/mFhxUwhkxKQYz8pWrsx8QBqtF2TIgbkCV11:qRC7iyZHc1FvPHUw6sQb3x8QQZ4JD1
    MD5:48C65952CE4A76ABDCD3266410F2314F
    SHA1:4F7E87AA0F94BC84D0F9906CF93838B1E2BBFBCD
    SHA-256:5872860C1788D4C2696FE23C80A8F27247C4234E25654FABD4483B2BCBAA5C26
    SHA-512:7B3A9E54401A64DAC6747EE20CBA08071B2EC36C98E99B9F28ED76E1249ED9D72FA27519166F2B262E6DAF11C68B219AD89B60DA094F4C997ABBB44D36FB2160
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsdefines.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):10324
    Entropy (8bit):4.640940908941287
    Encrypted:false
    SSDEEP:96:qRC732p+Q/VKCUGaGPbNfkFmZX4cIWNuAD/rsdu0esIk:qRC732+Q/VKCUGaGDNumV6WNjrsdjesx
    MD5:841AE89C117010437EBF656064D1E265
    SHA1:032A94374630B32BCA72958AF29ACC79BB94308B
    SHA-256:08CA78F6E3A9D1A872A9ADFD03C6B79FE221DB31E398AB7E7E91634C125D86FE
    SHA-512:FA0D6BE62E6D4D564BEFE5FBE7CC6EE273D86398619B23877D20BC2D1855C98CD62A80A07FA952CD51EE18C2B47CB2795DA36F89A392D591435E924B2E7107E0
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsencoding.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):9390
    Entropy (8bit):4.554782810010881
    Encrypted:false
    SSDEEP:192:qRC732dQJYWEIigu0xdxHJq9Mu4wyjt9CqByacypyaREHt7VcaiFniLnylEybiEV:qoL2HZGVqiTGLpSd
    MD5:E028848F2E41F53CF0EC186956F3D989
    SHA1:628F58BACEC4CAEBF30624FB28E8C939D7D03D9E
    SHA-256:0F7CAF6AAE8654110C0D5EDE945A836A332D80B31CEEA35FBC507DB4C62930EE
    SHA-512:FECE08A2A0389A7004F78233CFDA3213F68618346F582491E042003F100463B9EFD4361BD9789E6A18F14BB4F3AA5F4BD333B85DAF6BBCD86585D472BD5DDF3E
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsencoding.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):3438
    Entropy (8bit):4.8062165574540305
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUwdQIv2eFNxGaJG1nlksuaJG1nlhYqHrBnlsTCBnl3qdOs:qRC732pdQG7Bs1lkIs1lqqHVlsTGl3qZ
    MD5:9867733089E0892C9CF69FA9290494F3
    SHA1:48BC080A510BCBB76B69021D1CE7566F40BF68D2
    SHA-256:12EA8E827D092927C5AF1C3A97A4CF2F44D9CC389C8150A95ABE79E25D6F9266
    SHA-512:CC45350635EFE21B76AD03585FED7C303A7C4A50E7A65B76008A73BD406EE53498A175600C3E1623D686C85D90D1FC94672C91734F6A90493F02A5FFCE6F88D7
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsentities.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text
    Category:dropped
    Size (bytes):41971
    Entropy (8bit):4.717823199034051
    Encrypted:false
    SSDEEP:768:7oTkucg7qo0ZhUB+XL2gq+PfeSRsS9F2BWg0GPFm//AvsE6qwlc9l:7oTtcg9ShUEXjq+PjDJ3cv
    MD5:864F4C1CC53427EB7AC8765D5CA8539B
    SHA1:24F73BE69B79930AE125FE34ED27CEF1C99352F8
    SHA-256:7913BF5CA5D2E1055ECABC5E45A3AC5F25A6643273E52D4EF5EDB88BA077FC08
    SHA-512:BD6FE82C410E8FEE847892CCBB5F5D40B29D041453EC1AFD7E2F4D7E54A1AFA79FF5AE912791C304D8E7AAEABE6CE03E5E60EC80F103B6E572E34AA80D69A0FF
    Malicious:false
    Preview:/*. -- htsentities.h --. FILE GENERATED BY ./htsentities.sh, DO NOT MODIFY.. We compute the LCG hash. (see <http://en.wikipedia.org/wiki/Linear_congruential_generator>). for each entity. We should in theory check using strncmp() that we. actually have the correct entity, but this is actually statistically. not needed... We may want to do better, but we expect the hash function to be uniform, and. let the compiler be smart enough to optimize the switch (for example by. checking in log2() intervals). . This code has been generated using the evil ./htsentities.sh script..*/..static int decode_entity(const unsigned int hash, const size_t len) {. switch(hash) {. /* nbsp 160 no-break space = non-breaking space, */. case 3948425267u:. if (len == 4 /* && strncmp(ent, "nbsp") == 0 */) {. return 160;. }. break;. /* iexcl 161 inverted exclamation mark, U+00A1 ISOnum */. case 1499591408u:. if (len == 5 /* && strncmp(ent, "iexcl") == 0 */) {. return 161;.

    C:\Program Files\WinHTTrack\src\htsentities.sh (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Bourne-Again shell script, ASCII text executable
    Category:dropped
    Size (bytes):1985
    Entropy (8bit):4.681575562885557
    Encrypted:false
    SSDEEP:48:4MaOg2ddN6UQF7W22P//BpU3oMkFgnB5kT:28dYUy7W2yHBpUYMkSB5kT
    MD5:F1AABF1970D890FA6494B029E7C32567
    SHA1:2EA5DDF145A5F076565AF47AEE1B98961A23BF37
    SHA-256:E9B806871FBF170010595DED1E10B28FEE66CBC563336BEEBE19D8B9598BE523
    SHA-512:BC51E995900475FFB0233795B39731862300F9513D5C442B38D9C79712BD6A735D41FC3FF091791099EBFFB88D6D936AB6F362C9EB072A6B925EFA34FCA9FC69
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 0%
    Preview:#!/bin/bash.#..src=html40.txt.url=http://www.w3.org/TR/1998/REC-html40-19980424/html40.txt.dest=htsentities.h..(. cat <<EOF./*. -- ${dest} --. FILE GENERATED BY $0, DO NOT MODIFY.. We compute the LCG hash. (see <http://en.wikipedia.org/wiki/Linear_congruential_generator>). for each entity. We should in theory check using strncmp() that we. actually have the correct entity, but this is actually statistically. not needed... We may want to do better, but we expect the hash function to be uniform, and. let the compiler be smart enough to optimize the switch (for example by. checking in log2() intervals). . This code has been generated using the evil $0 script..*/..static int decode_entity(const unsigned int hash, const size_t len) {. switch(hash) {.EOF. (. if test -f ${src}; then. cat ${src}. else. GET "${url}". fi. ) \. | grep -E '^<!ENTITY [a-zA-Z0-9_]' \. | sed \. -e 's/<!ENTITY //' -e "s/[[:space:]][[

    C:\Program Files\WinHTTrack\src\htsfilters.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):11302
    Entropy (8bit):4.472656035472144
    Encrypted:false
    SSDEEP:192:qRC7326QQSx2CVpqSUtr5DPNYp/zq6e2mtH1qIHudcwyUOrLdBSMhsMB7yaHaxZT:qoL2fHHUPNYp7VPcR/7/fAv
    MD5:EF7E454CB58615AB6F79C4E765B5AE1C
    SHA1:07EB20947CEA60DD17AE5606B8060FE65816287E
    SHA-256:22DD359B893901FA486C3EA0D798E02557A22AE398831D4F691167295F0F03AE
    SHA-512:629B3583D43E68A56C202CFF83BC43B1A12B1DDFB9C878D1C3BA6BD2B657619F6DCECF783F28670AC39C1EE4A22C868FB03CA380A406CAF78F803E15583A0E4A
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsfilters.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):1902
    Entropy (8bit):4.805286027104152
    Encrypted:false
    SSDEEP:24:nqRJiz7WtyPOkHMlCTbVO2ylFvP4/mFhxUwhkQQNvzFF2TIgbkPSXf3AStUsr7ia:qRC7iyZHc1FvPHUw6QQRZ4NvAStUQmna
    MD5:9B5C4AFF0BCE381A998CE200A1BD6247
    SHA1:AC3715F7F5B21AE4412E4D5E2E5035E22F260506
    SHA-256:42335CA1BAA1A9A665A9D29CA288ED9541FC48860DD8961006CD0DD5C0DA225F
    SHA-512:88608E5456F58EDF7A3ABED180C595F09B0F9C7001164796C3C93C940D7F3B3360725AB646FFB3887A4378026132A7512F838692DFB23F0AA19DAEF6A3F85170
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsftp.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):34167
    Entropy (8bit):4.685456900433118
    Encrypted:false
    SSDEEP:384:qoL2mnLQ3BEydi06UWwFsba8OtrpKIezpMaAC9O+WTLiTXQi8rkuQN7oAAC+vG4i:7L0deFQ4avvUXF8R27oAACkTLDC
    MD5:BEC4AD3640021934450E6D9C90132DD6
    SHA1:A80A6AEAB2A228EE0F91D832D6F2205F054D9874
    SHA-256:E1281FE546EE591C01EB5A6E84D95A6650F91DCE77954AFA83685350F4BA7382
    SHA-512:62FF84E68D7A03E9ED76924C945896A608535B27AB23D997C18204C8BE135F6881897D6C3161E3A9251C6AFA0A901BD7766A5D2222D6DAF0D434AC31F2886B22
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsftp.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):2671
    Entropy (8bit):5.1227307904466075
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUwv0Qj0rex80LKF0/eD27TUMZ48atZEE1HWKeqrRCL:qRC732p8QjCFgQMZG9s
    MD5:F76E6755924063D2AE0E3E5DCF04CE7C
    SHA1:E7FBBFB9F990302D2A560108F973B6AE962C343B
    SHA-256:53138BBA682A26732490CA957393EFCD7B4146F01429C401E5D8C604769D3302
    SHA-512:D16A82559D366BDABC258AB77F6A9FD254AC76448420EB878459ED8BE5087141ED745B4132FBC277C66B778F8436D1559C551F1D00EAABA4FC66840307FF571D
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsglobal.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):9691
    Entropy (8bit):5.444962884876827
    Encrypted:false
    SSDEEP:192:qRC732aQeRAeuavB08bK6BArMZ0Kqd970uWV59Q:qoL2lH8bK6BAADTQ
    MD5:A57320455161A8E4321B4643293C4D5F
    SHA1:6DDCB8B87E86F22ADDD2A4896AAFE1167EEA20FE
    SHA-256:DAF44CE0CACCBAB1BBF746C351376928794BE25757110E5DDACB87CDACFC5B78
    SHA-512:4C15E9102E2F561AFC1518C6A93E47EB723A17F252CC89097AE021AFEB2BDD33545746D43AA359DF07177FA855B60CA140DF360A494897BA65F2D20281B80C5E
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htshash.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):11720
    Entropy (8bit):4.695959749449687
    Encrypted:false
    SSDEEP:192:qRC7326jQSsk5l5WkTjzmq6JuHh5StGuWgRzf/7EM8WH3ZvDvXoISO7db2MLt2:qoL225l5WkTjz+2kGuWgRz37EM8SJvDc
    MD5:4C5EA36B42543016F8FB81CB134608EA
    SHA1:43C923173D3D3D9B11F14652957167CA1FA62D96
    SHA-256:402DD148D72BABD0365836DF012831F2FBA93509A3CF69A4B0EBE7E67958188D
    SHA-512:D3C8302BC9A8A3893523372045A447895BD1822C1225AF38B69AA9F0874DF62F122282F49EEC5188BB671BBF161FFE8CE706C48D49D7A2344ACAD985C907447D
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htshash.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):2291
    Entropy (8bit):4.972776530374022
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUw6IQQvZ4U0Mf5DuZWkC94JJH00FFowFlgIFZDT1:qRC732p6IQQvZbKdJZ9Llg4p1
    MD5:6A01B2B95A0BE5A83AB8227DA75FD727
    SHA1:C37F21E7BA2E815955A7804DFD49854937072230
    SHA-256:34A1EA2EF9415466A73DF6C8A1D2691B7F16A119396F24EF57B7615DCE1E1E2D
    SHA-512:F78A6083EF83D4F551CA143DDA57F7E00F731EFE79FD1657EA6D9F7547891A9BA222B5A0A8A9791C5854D36897D48D9D8B754745B08DDB2A93963613879966D0
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htshelp.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):29282
    Entropy (8bit):4.990593262873054
    Encrypted:false
    SSDEEP:384:qoL2aN0lydU1lQb/LZ4fRgTrIVsJ/mOXfWXF6RtISx2E01H:7Lh6fRg4+JeRXF63Ic2E2
    MD5:425C8CEC320DE26992A74E08928342D5
    SHA1:C9C2101580907AF5694BEE84BD49D8F99B5263A7
    SHA-256:806A137A95A85CE010C997ED3391C497D48D0CB18F9E3B9D87FF7500E4A24BE9
    SHA-512:81FF8016610F4372298294FDC66D60C96F4155507FB0E906243635A38BEBFA95101F29B8A3A437C3475CE73ABF37A1B9EE96E2278FDD9C7208DE390DEF8661F4
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htshelp.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):1925
    Entropy (8bit):4.913425826359884
    Encrypted:false
    SSDEEP:24:nqRJiz7WtyPOkHMlCTbVO2ylFvP4/mFhxUwhkjQLzXF2TIgbkKM0DP0xwYCYC1:qRC7iyZHc1FvPHUw6jQdZ4U0LKJ21
    MD5:ECF1B8A0DCBA00A314098045E3CE4563
    SHA1:7553D960735ED8C704A34B3C1E7B5207D01532EB
    SHA-256:5DC527DDC78DDF763E9D840F12BE2532EA502AB6A6B65A58438E39A53E018E81
    SHA-512:CC121691206ABC904487D9256FAC4D7619AA73D66E7BFCB8623B98C95F05976A11C32746735D1EEAC90FAF5A79BE72E818CC9B072357D65736AA6E1C12BD806C
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsindex.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):15582
    Entropy (8bit):4.561517143851487
    Encrypted:false
    SSDEEP:192:qRC732riQS6e3nyZG3mwbTHlxaaBaV0aF2nO2PV+eAMAJbck1SqVyvlyaG8zpkpr:qoL2SCs3mwbTFxFE1Mvd9XTaIwp
    MD5:D11F5FCA3A2DE377A639645E77245FA7
    SHA1:0E4068E2FD2DD09CAD5FA93D9FCD4A9C502F8C9B
    SHA-256:1FE86354DFEC0586A417EEF13123AE87B4755EA86500894CE36C6180FB2057E5
    SHA-512:FC9E9C5E0DFEBB46EA0EA407703ADC22539533483DC28D39E0027D55E953B82152B3BFC1261E6F3D4751FD1C3AB2919AC334B9193CD5EE6027984E686B779F08
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsindex.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):1814
    Entropy (8bit):4.841081362545949
    Encrypted:false
    SSDEEP:24:nqRJiz7WtyPOkHMlCTbVO2ylFvP4/mFhxUwgIaiQHzTF2TIgbkPMTD:qRC7iyZHc1FvPHUwNaiQlZ4pv
    MD5:9B7938DEB221F3507A8A4FE41651CDB5
    SHA1:6A198A64EEFAC82CB1884B9E940987189605BB0F
    SHA-256:8E302BDDF48615FDFD932D3C2B73DE548D2C54945C2C757F0DAF619336A7ED59
    SHA-512:B148CCD48A3F8380E83B23BF5BE8F7F412368E50A7D013A0A7C0E6F2A73750B84EF799E82E086E51EB4B9CC544603183AFE9D68AC1FA68CF7092E0C84BCF7C7C
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsjava.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):13426
    Entropy (8bit):4.937262144408219
    Encrypted:false
    SSDEEP:192:qRC732g5tEZwS6kg7byWjuLtDxyV4aVK7yaFmyvWRAJK3VkTT3ld1dHddnd5BrfJ:qoL228YkgloyPcJT3JO9ZM
    MD5:7510463B147EE29FC6AE0D048D0C89C0
    SHA1:ED782072B0003ACD9F53B4DB997B82D777A06C07
    SHA-256:DB62E720DB1CBB730EC26F05F976A3BF83DD90BD7265A0E2B4B52DFD99B9D887
    SHA-512:169267D3391C97BF73EE6E70A384D38364E06B2BD0A53B7AB710B9ECB84585FEE2AD357206D8A6E32FB80608D3638286661A2FD9CE832F12AAD3538D5F8B7065
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsjava.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):2056
    Entropy (8bit):5.087273848610651
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUwCpvP0czcahUf7Ec+kmkia0o7BplM5U1qZ4Rv91:qRC732pCpvPdIaGf7Ec+kmkiaPSmUZu
    MD5:65AAA657FCDB5CCA5F55DAB25164B0F2
    SHA1:9C5E1A75CC4768E5F91055909E0A7956E7B3ACB2
    SHA-256:D72983B2D1ABEA30F042C154756ED61D9F13DDF277AEB48DEBC7C678C1CE762F
    SHA-512:1AB741694EEDEE06C8062B5D67F7E03D87BDF252936C2BE11D363285CE4F7573944E62FCD7BDF0581F2968CB3721000AEEE4A2DB8132F16CFB71E6E4C7CEC58A
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsjava.vcproj (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:XML 1.0 document, ASCII text
    Category:dropped
    Size (bytes):8590
    Entropy (8bit):5.231087667371481
    Encrypted:false
    SSDEEP:96:1qf2uiYWRsCm0u+qf28iYDsYmnu6qf2eCt2snizB0uzqIlqf2kCt2snwNBnuzqIc:wO5GCmTOnhYmiObZuBINOlZWB9wK
    MD5:A6E29ECC6806BDFC2881D9453887CFDB
    SHA1:C76B45491B0DA067EEA6FA61F3BC7B8CF211D2B5
    SHA-256:9A43C7DBBDCB7ED35C7D40D9DFB906564BDB79859788279C67803835056DBC93
    SHA-512:CD79A97C6CFBC77DF439539A01BA1750104F2D04DE1C17DF017432EE9D129505E2E245DD32818FCD1B509FA53622D513D8FC4E94EF2C4B25D13CD4BF2AA5F825
    Malicious:false
    Preview:<?xml version="1.0" encoding="Windows-1252"?>.<VisualStudioProject..ProjectType="Visual C++"..Version="9,00"..Name="htsjava"..ProjectGUID="{2F353408-2C6C-4D31-9AC0-08BDC064DF64}"..RootNamespace="htsjava"..Keyword="Win32Proj"..TargetFrameworkVersion="131072"..>..<Platforms>...<Platform....Name="Win32".../>...<Platform....Name="x64".../>..</Platforms>..<ToolFiles>..</ToolFiles>..<Configurations>...<Configuration....Name="Debug|Win32"....OutputDirectory="C:\temp\htsjava\Debug"....IntermediateDirectory="C:\temp\htsjava\Debug"....ConfigurationType="2"....InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops"....CharacterSet="2"....>....<Tool.....Name="VCPreBuildEventTool"..../>....<Tool.....Name="VCCustomBuildTool"..../>....<Tool.....Name="VCXMLDataGeneratorTool"..../>....<Tool.....Name="VCWebServiceProxyGeneratorTool"..../>....<Tool.....Name="VCMIDLTool"..../>....<Tool.....Name="VCCLCompilerTool".....Optimization="0".....AdditionalIncludeDirectories="C:\Dev\open

    C:\Program Files\WinHTTrack\src\htslib.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):170555
    Entropy (8bit):4.951374756028349
    Encrypted:false
    SSDEEP:1536:lYx/kczkImK1RFPIYEoDbsfPwSjUETK+C8dWoKvwm9o0uXJrB3nDo7MvVq/:lYdbmejejUx+Q+0oVo7Mv+
    MD5:7DCA3A1BE411DDBFB03611F4FF4AE23B
    SHA1:A3B55BEB40DC0DFA99B0812A8FC78B86AE5E018A
    SHA-256:0F3DCA58741BB3242D00104AA5985C0B5F6EE4FA1A1432EBF485796745D40EFF
    SHA-512:7545927D7FFC3AE5883347CEE6F0F3F4AE3F3535FB5820BA3C9A87E0B5C0254C0B0DD4CF9CC58A9F0F7916902014978E3927C81964C9BAEA70CD2C794CDE6704
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htslib.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):20007
    Entropy (8bit):5.283229255764776
    Encrypted:false
    SSDEEP:384:qoL2WXL1rstu1JKS5wlOj5fo2kQZUM4QFIKIixzS90b:7LfTL5V0QSKn
    MD5:E050F035AE06DA21035850696CC137CC
    SHA1:D7C0D72C60856FA6F7B6EB6FE1B33325B24AA01A
    SHA-256:E07454F01D6516C5C89B503E7FC1DA2ABC842440A3C88024E879B39E223E6F23
    SHA-512:5FD8C5D194C5947D3D58A46B387E2A42B4BBD04EA92808D84DBB43148AB28D8502B5E617A1CC22753659CE8B89D1F5B3C61F87C6277BC30B17152AFCEB222C3B
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsmd5.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):3527
    Entropy (8bit):5.114799458887273
    Encrypted:false
    SSDEEP:96:oRC732poFdJ/SB+k70xM8XwmRMVI1yeMiRbyMhxV:oRC732oFdBSB+kSM8OhiRbyMhxV
    MD5:D8770C9DDB7D301E6808D7A68B668DBC
    SHA1:BA127D115E0136E1E8D1B49C2745BED54E1496F3
    SHA-256:7B38D80CB179D7143B30BEB57FB8BAA2BF39B2A7A2276A4A132A2C73A7DC3A03
    SHA-512:271EF21EBF0723F18BEF21BA5F3C4523F1A1AF88ABED4D30EFE70DF43115A0514CE0430F1018AA080D7C29FC76E5F33FC42E51343C3E2C0CE58A7A35DC03355E
    Malicious:false
    Preview:./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our work, and spoil the many hours we spent on it...Please visit our Web

    C:\Program Files\WinHTTrack\src\htsmd5.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):1964
    Entropy (8bit):4.774816012030446
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUwejFdEI/SJ/+klbZ4G:qRC732poFdJ/SB+klbZ/
    MD5:5919B3D31393A640CC761E0E68B21C5B
    SHA1:36B35488B7ACA2ED66FB1FA92C7B1CF29E627A5A
    SHA-256:6DA9CAA0C50BBE8391B8F7433A72D6DD7A796566263C6EC332CE063F0E25B30D
    SHA-512:8D4AA180E5E8F6183C77CFCB179D9D39CF447F8FC7BCA4C981D91173531749DC81570895674FEF8B1E6C4B9802F94F57E000C07C741E651720EFF1D5B34B5ECD
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsmms.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):7645
    Entropy (8bit):4.824453617852227
    Encrypted:false
    SSDEEP:192:GRC732bQdlIsUPQwSCb2VyBQRWiU/60ny4Hz1KjCco0RQUco:GoL2wexSVyBQ86s5Lo
    MD5:FAF6A7759526F33274E479C36050FD4B
    SHA1:4DB8BB6F4E737F7F151AC8A9D82039B2431BA390
    SHA-256:CC6F66F23F88B6AA108FAE7095A47FD109AADCBE6A451E5E094E18EBA67071E6
    SHA-512:E47453A4BEB8AB408CD6D3C93660E9E6ADCBF743944D960EB13507AD74E1035E18123214059A58D8567F4A56D2AFA1BDA1B5BD566EEA44CAF11D95B5B283A9B6
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2013 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsmms.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):2221
    Entropy (8bit):4.920369700677255
    Encrypted:false
    SSDEEP:48:GRC7iyZHc1FvPHUwQ0QdoMIsjAPQw620rex80LKi0iRU1Xc:GRC732pZQdoMIsjAPQw62Cie1M
    MD5:97300932E48084DE51B2514B00196F8D
    SHA1:1EF97C6B9BDF9E03BA749521CFCC0B59B4369988
    SHA-256:47EB0BFD22A5E2AB3F6644F504D13976AD2389C3C7B976CFF1C5B6D064CDC036
    SHA-512:7F14E78EAF15EE0906B8DBB39F22F5A4220148B168EF570B89A30E117B335054329D2765B31E6182CD91F8DBB911BC2EE9FC6E3F16699CD73022B77B3B3093C0
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2013 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsmodules.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):6878
    Entropy (8bit):5.118812740222004
    Encrypted:false
    SSDEEP:96:qRC732pd1zmQ70xhk/2rTqHwk9kW5pOz2x9YjTGTnIkcPJraNacokZEWH8:qRC732d1KQSW/2ffJWjjl/cPMNad
    MD5:A037037A15F257A5CED8D0E130CE717F
    SHA1:CEC0FD0DDE0FD75DD30DE8B5FE8B56297718DE9F
    SHA-256:38DFCF237A657E79EA8FEAB19093511243E73E46E89C62D798976DC843536413
    SHA-512:A476E8014773765763F360D0F6F7192FEADA8137684BBFD52FF365A9E2B280914CCEDED514C0565306D8007E864C651591B5455B9F42D0021926C3C421C2E7E6
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsmodules.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):4996
    Entropy (8bit):4.825365337553202
    Encrypted:false
    SSDEEP:96:qRC732p8zmQ3IKMEMF3k/Z7mrkqOPDv17qynftWgKvhYgKu/c8ZQ:qRC7328KQ3IKMEM5UBqCb1qst+vhwUQ
    MD5:47B4C3D1BFBB1A26684D813B3502BCCF
    SHA1:C7354A35C04E3AF85F6CA45231509E4363B7AA89
    SHA-256:070C63A4160AD06A58E04D093684631A8249ECE92980985E3935796C08984542
    SHA-512:2533ECB1A86743CA9DA52C5CCD49DFC834C25A0AF178A8F4DA26F4F3BD7ACD4EE33EB7BBC348912B91693CA5BF928048EE8C855DD1C8996433327007BABFDB85
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsname.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):60298
    Entropy (8bit):4.555432945238365
    Encrypted:false
    SSDEEP:768:7LOVRmA8u9xtJGyY4vVczxDvI7p2Ug3z+y7znuFhqYxRt:HuNJ5vVcGwjjuFhqCt
    MD5:C6EAF1ED580BEDE52A30B44FC10FBC0A
    SHA1:838E5D41B2EB5349FBF4B26E10570BA0E384CE71
    SHA-256:56237A2AE28E45308E2C338DD48BBFBD2F87AE8E6EBB47C555B6EF6999E068D0
    SHA-512:22876C50F08C307B5942F4B8C04690625E95FED372ECBA9C09B5601CA51FBCA9358383A1EDCEC3271EF20D31C9FF1DDF4CED9DA15EF804EB659FA07DA15DA4C2
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsname.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):3941
    Entropy (8bit):5.055414146221835
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUw6aPOQFudiIylqZ4U0LKK0K7PM04egc0LeRM0Mf5D20rex80B:qRC732p6a2QF+ylqZbKIMEKCUd0RO
    MD5:A7724BA3443482079024BF30CDDA1A63
    SHA1:38D49586BF9FDE3E69FE7B4EA57D32D62D639701
    SHA-256:661CC2C0DB2E929754BC97FDE5ED045EC5EB863740FFB736273E1B32E5E46FAD
    SHA-512:B925E09EDEE3C1F4E3F8B48BA93277560F3A7DDB04CC635843517B1FD828703C27F0CAC19D5D35A1D1C12C68A1BA9B68356427BEBDA0CACF9D3CABE700EB2486
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsnet.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):8096
    Entropy (8bit):5.054028081521917
    Encrypted:false
    SSDEEP:192:qRC732SWQ4CBeLG9qlzmkdlzh1U4xInK8YvsKnkC:qoL2tlF/8Cp
    MD5:F73E4418D9F41FF0F2C27AB9B97D0FE4
    SHA1:AD27A6B62F33CEEAE61E21698CC8104FAC948A77
    SHA-256:25F3E1E4A7BBC5C37D7D11167A1BD3A749CE3BCE695D57895FF262A4000DDEE7
    SHA-512:A9268B08AED21F6AE1FC8E1EFF0C71ACD61E2BBC3E18AC4B665BC79C6ABE25EEA4DC6EFC21A9B650D75A94B512BA1338A252B67395FDA7B330A49BFD7AD3FD8C
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsopt.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):23460
    Entropy (8bit):4.749124689002922
    Encrypted:false
    SSDEEP:192:qRC732fYQl4kKUBn6JwhYdsv4SMKGiQGQq8QPeandrGxGtGgPhAg0hSYU+Yaxq4f:qoL2nEkwZSB14aE4XPoD3EMdlBvvs40a
    MD5:CE4ABFFC02DFA1CCBD919CACAAFAF3D7
    SHA1:E8507A7B885A57B7E2CA8E678C6DF447894B0A3C
    SHA-256:149B3336081873113109815D369809B41C10BCEDAEC42402598E8FA8C7A1D0B5
    SHA-512:3794B8644210B6E1F5B105E9F109D5E8C3B52ED5C37B8A7011B16D6ABE80592A95EF4162EFC414E5F8A690B7ADCF383C07D2A94A5A7EEE117A1C4C1EBAD2C945
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsparse.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):206105
    Entropy (8bit):4.023323875409283
    Encrypted:false
    SSDEEP:1536:8foq+uS42vZ8yQO/awJeamcoaRVskOM0O1lozoM1NoOOLtL0FHtdiY/7Uhe7FHYN:8Qqc/1G1I0UY/dJ8Vfqex
    MD5:BEA5ED1F7965696B2B04B4DB10A000E6
    SHA1:AC3A91530E862FF6098395ED706EE5FCC1C417BA
    SHA-256:B2636B6B6D65A96ACC04EEBF82B8D80B3194FB2C93DF36D2F973ED186D285BD9
    SHA-512:BA98A47B8083661C1CB8E82F575C65428981E73F32BF222BF6A289F0EEC7B826FFA9C63FCD96AC900D71FA64B5EC97E574C572AD00AB3CB3B93C517BE24A8AEC
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsparse.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):6086
    Entropy (8bit):5.057820756256785
    Encrypted:false
    SSDEEP:96:qRC732pqV/GQyUUioAQlLMme8hQZZUqSE2zyHZhWYbKLT5KdHG1GCBCWpGlf:qRC732qV/GQyUUioAQlLMmzS51ZIT4JR
    MD5:8195C0CA583E29C3AAC5D617B555537A
    SHA1:02516DD2E434ABABEDB8EEA26D2CD1178C3F407C
    SHA-256:76A24BFD517CB489B7B3FF28D9AD548E7B8C3BBD250B569E1F15D8458DAFA3C7
    SHA-512:87BEC4DF18ED4A45E761B0A66EDFFAEDF75514F93B5EB4B453CBCACAC13CDB02685F3A4AF5A836998C190D43AB684C6676B48070E91BAED18726C96A26C8193E
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsrobots.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):3614
    Entropy (8bit):4.785599220149034
    Encrypted:false
    SSDEEP:96:qRC732p6jYQ70xwpx5N/8CA74iZDma0KJGN59rzPeh+bxqipR4ZbWSs4L:qRC7326jYQSwpx5N/8CA74iZDma0KJGu
    MD5:58010BF21F54D0610F805633767C6B18
    SHA1:26958C6865C7C3EBE09A17ED509BA92393736F62
    SHA-256:97721CCB1C4F86F5C0B7D5611395FD336ED50433A491298DF9F96A08F8327832
    SHA-512:75106605EBDEB19420D932F9F730ACCD245EB8315FC87EC4B2ED953825AA2CD89CBF7D5A72570213E9E6F67BCE6FEDD731CFCEA66D88B3370E52FF3071F2656F
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsrobots.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):2004
    Entropy (8bit):4.943957924208768
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUw6jZCQ105Mh/YReZ4fk:qRC732p6jYQ1YcZp
    MD5:B830824A32F26FEDF1031E2752797038
    SHA1:1B7290920284421B3E640EF3FDCF5046F25D6C75
    SHA-256:1B84F37EEF64BC6086ED88A025A65CBB6333EF25BE52578BF0E33F807859F792
    SHA-512:7664B8E13ADF2A6DBA1E90BC1EFA7B9781349F4BFBB4E438EA57F8672AF04BADE43723CE6F8C39A3018C6619E200E833419D6AFA25B672749F758AF3815142BF
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htssafe.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):7750
    Entropy (8bit):5.145354706216479
    Encrypted:false
    SSDEEP:192:qRC732IQH2izaMtW8Ut9se/2h66hciUh/ggTh1hauf1QThDif2j4xN:qoL2ciGMtW8UVEah/HhPh1qhDc28xN
    MD5:E4B78E1CE1BBBF57450B568C1B6C17CF
    SHA1:40253A98E892C5B56AA8628194440072D4DAFF04
    SHA-256:4E6FFD4AD85C3E213058AFD04AA8FC80CA5DF408A81657B315F8294AFA5AABCC
    SHA-512:F42B588325F09BEE57060B56583ECC7552CFE2FC319897A10FF597616E476D82CCCEC65CA9F658C66A9EECC52640D2280CFE269B1BCDEDE813CE966D5B921417
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsserver.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):58567
    Entropy (8bit):4.235196971231774
    Encrypted:false
    SSDEEP:384:qoL26oHSMupsVY0I+Y3z6ijZ5ipERL12Ft/jkZxHMVhNcYyXcTLahTRQKaaau7G7:7LVpke9UpERL1BxVTGPT
    MD5:3531DFD5A3E33352BC36DC77B4D1147D
    SHA1:C4CC8A5FB0E0DC230A8315BA545EE66BCC7F92CB
    SHA-256:1181592BCFF1D67FC1169F9E10C675B1C2E77A4CD93A645F8AF6EDD414D1EB85
    SHA-512:4337D6280B25AED9ACA3A671165DFB53AA4A3382814B0BEAF758E66D2185485C6B58A8C3F39F33E1088F3A06F17F65A80C9DD0F198D573F017310F498B181475
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsserver.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):8484
    Entropy (8bit):4.948191176938263
    Encrypted:false
    SSDEEP:192:qRC732qQX4rHsC4co5p2HYuUAiX1kzPgFmO3LdCHYuUFG0CiGG9eauS:qoL2b2HY3CHYLFteLS
    MD5:9A1E77437A04AA59D85451AB639BD425
    SHA1:3FF2C48400DB2AACAAEAF78C4E188CCA1C76BA9D
    SHA-256:F31BEECB40005C483D051174C35AE0A17507E60D6F738D141FAFBD91B8D46534
    SHA-512:FFCDCAB1D388542CB23AC4ED679C83F8560C31C233BB142CFD3FFFAF6454BF546277A5C12B990B612B7301CA1458E8344BAA6B8168EFB901D86A83641F045144
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsstrings.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):8412
    Entropy (8bit):5.267227776628497
    Encrypted:false
    SSDEEP:96:qRC732p1QgX6+uAXi5WaRiAOBh00AhsX1IG4RQVWbfAjavpY1ypmW+:qRC7321Qk6+uLWaZ/sWBMrjaa4c
    MD5:65AFCC897CFE1B21D9BC8179DA356384
    SHA1:6D167BFAF4863740DB7904ADFE78E39DBD01B13A
    SHA-256:892B848F63FC32156B89085D54ABF71398C2426897AFED09D04AF13BA4A96499
    SHA-512:594825EEC74B60BA449AD363228C02751BC479FE332E3E7ECAA5C7CD3770924696E94B1C3A208A32F3434D590C390F3E8E2BB87F6DFC5C92E749C036460C208C
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsthread.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):5365
    Entropy (8bit):5.133560996693489
    Encrypted:false
    SSDEEP:96:qRC732p+fQ70xfYO0Okt3k76TLT9rjrd6x8b+MksjPqLtasGkVVzt:qRC732+fQSkt3k+1jr0x8b+eG4sGKj
    MD5:F7C93DFCEC8A8DE1F0140388F29C6CE7
    SHA1:359313E88DBA1ABFBD001BE4981301683926EDE1
    SHA-256:597102D9145A8F9E982572B990E95EBA8D91A8341668E88A769F9B1EAAB59D6F
    SHA-512:367AE484D25833FC2E5ADF1BC797DEBF14780A9E160095FCD8DD4EFEE8CDBF0FD4B86CEEAEC35FF3013299415E6C9946CAE8761B2DDA118F0712A28F9936FF32
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsthread.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):2444
    Entropy (8bit):5.130010303907452
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUw+fQ4nXg0knjLsPyG4f+5DNOb66vSvJbv6qh4JS2N:qRC732p+fQ4nXgvw6lfAObPKVBhwh
    MD5:69376B74765BA0C15C32D33EA0950FDD
    SHA1:A3875425D43CB75916CC2EE8FC6CB31656C56698
    SHA-256:F2A04E91C1DBE2C58A2212A07AAE0BB636D2EAB2C2D83564EB34CD8469528BF5
    SHA-512:023DFE7A85E6939731EC49A4FC710739DB8454FBC53C93B4E96D9FD63BD304B8B01E88146C3BFA58B9256FBFCB1A11527548BB932A9B6503F8DF53300DA790A9
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htstools.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):35631
    Entropy (8bit):4.806116140498948
    Encrypted:false
    SSDEEP:384:qoL2JezZPjJMKeMJXrS4WgZD9sJyWf3Fuw3hoWpsWo6kRR883q:7L20PtMKec7KYqrfVu3WpsWo6kRR8uq
    MD5:F02E893B246E4AF491B225075D563D7F
    SHA1:2475F3E3A32AE27EDBCE0D515DA140DB1C4474BE
    SHA-256:50C1BCAF0B95860CCEF3247ACB0F393410A98BC0AB3FF68EBDB674312519D382
    SHA-512:28E86A274A7A552B7E7581BC3E4861037CC2B9FFC40D65B175292F89940CC13F8EEFACF4E5A931FF6CABD6C5E514684AF115C081B3F8C415188312DBD07DE6B4
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htstools.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):4459
    Entropy (8bit):5.043321291659529
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUw6fiQpDz0LKK0cvjnKM20p7oE0MfuZ4CUOu0tAnyeoyWzwzx2:qRC732p6qQNKcU4Zhru0FetyDL
    MD5:50312E36153E5B474C8EDB648F860D29
    SHA1:AAFDC6BC627082913422BB15D8E1BBAD83667B7D
    SHA-256:1D072B751044BE148E1B2914BB7E88BBAC396B1C519CE52AD15465FD5E864044
    SHA-512:006D4DD9136D5A51C8B2F6D87601C0D84E8451F6C4D88EDE4B859E0901C7D12439E8CF643E07CD5AE5355E0092A2D3F225892993E0DE049BA3922181D4CDD680
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsweb.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):27411
    Entropy (8bit):4.852458307193222
    Encrypted:false
    SSDEEP:384:qoL2HvQeNM4RYwjSwcnWmvrbtRJQKs8PAVgFfTOXm:7LabLSwq2JgF7B
    MD5:0481E03E72E9230A58A569E75CBD8D1B
    SHA1:904DDDC69E0DA5870DA0F962DEFE9DDA4155D944
    SHA-256:CDCE54231D15345A9DDAA2FC8E6ED3C02DC43B079BEC674B5021EE0D4E00EBA5
    SHA-512:973B9B12629A7E9DDBD4DFE6FDAD95DB4D7DCBD8DBEC1A248AB9AD79ACF15696BF066891A4A4351AC428E846BA865F6EEEC6D9F6C1B26F6F18936DB583BA6A54
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htsweb.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):6120
    Entropy (8bit):4.439501071807133
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUwNiQp8Bqnt4U4Eb/pZvTY01195qipqZszQ6vbLsR+xfNkzV+w:qRC732pUQ6C6UZvzZLl/Gl3Uc02
    MD5:0F6F05117B91CFECA3A91B4A873C79A5
    SHA1:B0B3BEF3F34BCAC5A58F1D8158F82005A8569530
    SHA-256:28581A3D96200B2CE5E4F04643C18ED3A8E109F22FC789CECEC145AF578F1C99
    SHA-512:6A44D5C570338C62DE1DEC5B194046E67B177CD1BEC42ABE828F84EEABEBE7225AA554D283FCAFA95A20DEDD59AC5767B688A5DE53CF9DF95112A33EBAA49394
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htswizard.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):35633
    Entropy (8bit):4.549673906999867
    Encrypted:false
    SSDEEP:384:qoL2sMNw+oVvRWkTNAcoHPKbCMYekvOQcIfC3yF1d5GHpDvlVtH:7LhFdVvRWAAco2Y+3y5wpDvtH
    MD5:F10A7E593EC0C3C5631F4466A26BAF13
    SHA1:933FD02FB24683FF34FE5C0B5EFB5B4041E20A90
    SHA-256:CF49D3EBF8AACBB67ED509D4011A91E05BDA2E85A47928C283ED861547BF74F9
    SHA-512:298B77060C0BBF3BE02ABEC378388CF293CF5FBC6AA6C2A63E2E2C8A77921013C55B3486B0880EB2E35515FAFA86F552EB1EBCDD6E70BEBA8A9A0B3CD6081E22
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htswizard.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):2247
    Entropy (8bit):4.880113365480491
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUw6byQxZ4f0LKK0K7PwWyKYY:qRC732p6GQxZ8KctY
    MD5:0DBE9DA345C82E3083CC2EC5EF1994A3
    SHA1:51329692115598C5538559AAB6D0111007A83568
    SHA-256:D00B9B925FC30FB0DDBF08B24433AEF699F89782E9C4C691EC5C81F4D5A2BEE3
    SHA-512:8D691493FAD295E1FA28A62CEAAA082CCFB3104EB098B828502344689FC517098E6D50F943361D0C065C318C652790B2FD16E02204BF88C0D872837D201AEEF2
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htswrap.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):2107
    Entropy (8bit):4.863767479251328
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUw6VmQ70x4zETpTzNvBcbK:qRC732p6sQ70x0ETpTx5yK
    MD5:E55919FE120E9E37156CFBB4468D15CF
    SHA1:F0C0DDEE0CD3CBD5C333D395BFE13941404E178E
    SHA-256:6F526E954BFCE03198648B02061177DEDF2DE63AEFE9EF0C2FEF536484793BFD
    SHA-512:416D30130DE597EB3E33E11682DC65282D2903516FFEDDC71BFE4D82C32F5297DD380EDE350FA8376EF2AB71A9700044BF99676553D61BC9849AA9E0557351F3
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htswrap.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):2056
    Entropy (8bit):4.981022105299505
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUw6VmQTZ4/0LK6SfS5O8ZP1:qRC732p6sQTZQpqx
    MD5:8C41288AF37B907423083B61F9AC15E6
    SHA1:4772022E6D19742FE0744B40C6DC914593DDA36B
    SHA-256:EB4439FAF0230CA6864CA9545773300F041B4454E3666FD2B004DDD61E292539
    SHA-512:58678FC3105982B9A39F164514DC32913CA6511ABFA236BD0F21012B255D7D51816D36542C66C90A0239BA65868B83E2C88267B0B7C520425A075DF7CA728239
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htszlib.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):5338
    Entropy (8bit):4.8763942154600235
    Encrypted:false
    SSDEEP:96:qRC732pIN7Q70xkJUPlwwvNhJs3w9Jc+bmCqZiSEYkEAW/AIBPjAOPt8aFRi+W:qRC732IN7QSbPlwwvNM3emCqZiSEYZA1
    MD5:A45B9ECF9BD5A30D4ACB4967FB29AFC2
    SHA1:6C864EF200B9EDBCC2C2CCEC7518E1B0846C433A
    SHA-256:D4E5F0C04A56CBECECA2A1DFA13E747DD161C24F18174140A4186CF938D198A7
    SHA-512:9923FF24246043E1FE13D5DCBD98B8D0D6BC4695DEE3D94863EE1F2E359DB9F4C1BB8D6446483B0E7A31A0FFBCCBA11E5AC2CE0881C1677D042FFE48CE3CEA0D
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\htszlib.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):1849
    Entropy (8bit):4.937437007875708
    Encrypted:false
    SSDEEP:24:nqRJiz7WtyPOkHMlCTbVO2ylFvP4/mFhxUwPz8Ni6Q4iJzQ9I0IyF2TIgbk1v:qRC7iyZHc1FvPHUwIN7Q4tx3Z4m
    MD5:52921885FEE6EFA48E2762F87A30CA80
    SHA1:15D3ADD3B6F56A1B6FEB37F374148ACB4D2E968B
    SHA-256:EDB1CB2507B4087E6AB5F94FCD18BECB1DEFFBB7C81BC9179A25D62AFF0DB1EB
    SHA-512:526D0B5E9CCB7D4439E317BEB3EA65A2C8CB990BB2F75E5166D3EDD4C53CF1E44C39950516899C1C40A61D1CD22E2301941C60A6B81DBBB088883A0B24634A8D
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\httrack-library.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):14631
    Entropy (8bit):5.2187655316122035
    Encrypted:false
    SSDEEP:192:qRC7322QwK4N91gXJVZYq5rIWNyl3uVnB0VYKU5c3BmWATg5d3s6JbYI8Ia6b3H/:qoL2aeHYlcc3QWSg5dHHP1XP
    MD5:3F6719128661763C40FDCE9CC7BAAF58
    SHA1:C7708C882BF965CF041E8D4F6D7A8BA491AEE21B
    SHA-256:1A2BD6B80956696BEF520A971F6E4DB6DBDFA5904E1B3011769B90481F20CED7
    SHA-512:30750D00445E0FD7A720205605D6D5FADF298C2EBED82A186AD7B89BA882F272D1D55CC3DA9C36931770F0C083E0D27A332AE112F5488C06B3AC2D013CFEC788
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\httrack.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):34112
    Entropy (8bit):4.737720823633202
    Encrypted:false
    SSDEEP:384:qoL2akes/YU+knOlWgnRapkrTXyR2HY+oXb8ysU:7LMYHkOlWgnROkVY+oL8ysU
    MD5:C213C8AA2DD44B65C69ABC54E3B1E43E
    SHA1:22BD24A7BDD816739758C1C6AA526F8639E62D04
    SHA-256:B730DC38BA953885DDEE02DB9BAD3FD6BFD522A6C1110282EFBCDD503EE035A6
    SHA-512:9FC5893188934A88F91DC251638109D2B62B83EFAD62C2377CCFB5B570F97C73557D51A55BD3EA84EDB39A27C6E77DBBA29BEBA6144073F64B66AC8AD1922674
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\httrack.dsp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):5551
    Entropy (8bit):5.511565442317637
    Encrypted:false
    SSDEEP:96:yZad29ah5qrq31f+2QNhNQjgxE+qxv2GNCNvam/3Sv+jpb23sNZB0Ni/H3FI+qxb:N20hguRxU9auna2NKk5aJEbEREckc
    MD5:705A579CE4E9EFBA834CE1EA7F80D34A
    SHA1:B83A805354B9F8E71CB44683FB1B8AE219E579B5
    SHA-256:D71C482C264AAC9C766DB008BF3149167B2D240C80FA23EF508EE61C1C15DBA2
    SHA-512:905830CD689103B736B7718FB0E5ECDF7FC0EDDAAEB5B668D213E96363A2DF4B9438792BBF85F1E9EFAF7E7232C52CA87262EAB5065EF918633CC53264F3441E
    Malicious:false
    Preview:# Microsoft Developer Studio Project File - Name="httrack" - Package Owner=<4>..# Microsoft Developer Studio Generated Build File, Format Version 6.00..# ** DO NOT EDIT **....# TARGTYPE "Win32 (x86) Console Application" 0x0103....CFG=httrack - Win32 Debug..!MESSAGE This is not a valid makefile. To build this project using NMAKE,..!MESSAGE use the Export Makefile command and run..!MESSAGE ..!MESSAGE NMAKE /f "httrack.mak"...!MESSAGE ..!MESSAGE You can specify a configuration when running NMAKE..!MESSAGE by defining the macro CFG on the command line. For example:..!MESSAGE ..!MESSAGE NMAKE /f "httrack.mak" CFG="httrack - Win32 Debug"..!MESSAGE ..!MESSAGE Possible choices for configuration are:..!MESSAGE ..!MESSAGE "httrack - Win32 Release" (based on "Win32 (x86) Console Application")..!MESSAGE "httrack - Win32 Debug" (based on "Win32 (x86) Console Application")..!MESSAGE "httrack - Win32 Release avec debug" (based on "Win32 (x86) Console Application")..!MESSAGE ....# Begin Project..# PRO

    C:\Program Files\WinHTTrack\src\httrack.dsw (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):834
    Entropy (8bit):4.168917194377535
    Encrypted:false
    SSDEEP:6:zd22IPtDQHVCeJqN2NdumGsr81ox9cqVZrWpYrkFA4GaI4UItuh741o1MHU7vcqo:zTYcgcg2NDrT1zz34FmM07jzzYpzb
    MD5:80722509448F61A9B3D8C6F61501E281
    SHA1:E87411FA67A006118135C1D281873D172E4CCA45
    SHA-256:CC47132E05EDE76873DD496B0ECA41090528CE4EFA7B560C14FFE3129019F984
    SHA-512:E5EAE18577D98457A0D1664E7A74E99AA3D0C24936B472A6B6769241D8EAB9115F3C42D565054C3DB41BEE1C5E32A315195422A64879DECDF6322ED563A20EDD
    Malicious:false
    Preview:Microsoft Developer Studio Workspace File, Format Version 6.00..# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!....###############################################################################....Project: "httrack"=.\httrack.dsp - Package Owner=<4>....Package=<5>..{{{..}}}....Package=<4>..{{{.. Begin Project Dependency.. Project_Dep_Name libhttrack.. End Project Dependency..}}}....###############################################################################....Project: "libhttrack"=.\libhttrack\libhttrack.dsp - Package Owner=<4>....Package=<5>..{{{..}}}....Package=<4>..{{{..}}}....###############################################################################....Global:....Package=<5>..{{{..}}}....Package=<3>..{{{..}}}....###############################################################################....

    C:\Program Files\WinHTTrack\src\httrack.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):2521
    Entropy (8bit):5.043828910227986
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUw+LQpDo06PhnoXWWXrOUh0MpMkEOmlUb/pZv8A5dTU:qRC732poQejpoXW8rO2BwgZv/U
    MD5:B67570268CF9E9B355ACD41BF1EE371F
    SHA1:C9EB1CE37B9D7B5583100ADE2BBD8C2D2F69F7A7
    SHA-256:196BA9E7CD02C82B2971E3207410484D9ED071B40AD9FDFCD05B6BCE7896CF9C
    SHA-512:C97426F62131196981C4AB650F3E1424F1248AA5EC50B0963D968EF89D860376D20C2DFFC01EED0CF3A7059EE5A0A9A8758C635D6B9D20A43422920E1AEE6914
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\httrack.vcproj (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):17443
    Entropy (8bit):5.195923014802806
    Encrypted:false
    SSDEEP:384:boeBnZxseBnZJ6BOByPrBDBP1L4BpEQCB5KQDE1iO:ke9ZWe9Z8BOATBDp14bNCD8
    MD5:EA6AA176F126B7F790A6466BE37EB8BC
    SHA1:07CAD580789DBC0FC52FA24BDEB2EF8A54C0C6A2
    SHA-256:2D1C3297326F02AF90FB1A0B6D30F962EAE591638CDD36D90E335CB6B318FE87
    SHA-512:3957A582EE782BB8634BFA2166DF462FD2A552C779702D961072530CA6B3E1F956C8CE3F7EA2106126C95C6396EC04F46E2A0EDFED4769D55A7759E57873D888
    Malicious:false
    Preview:<?xml version="1.0" encoding="Windows-1252"?>..<VisualStudioProject...ProjectType="Visual C++"...Version="9,00"...Name="httrack"...ProjectGUID="{D0E894E7-F64C-4722-9807-9ABB1054D43A}"...RootNamespace="httrack"...TargetFrameworkVersion="131072"...>...<Platforms>....<Platform.....Name="Win32"..../>....<Platform.....Name="x64"..../>...</Platforms>...<ToolFiles>...</ToolFiles>...<Configurations>....<Configuration.....Name="Release avec debug|Win32".....OutputDirectory=".\Release_avec_debug".....IntermediateDirectory="c:\temp\vcpp".....ConfigurationType="1".....InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops".....UseOfMFC="0".....ATLMinimizesCRunTimeLibraryUsage="false".....CharacterSet="2".....>.....<Tool......Name="VCPreBuildEventTool"...../>.....<Tool......Name="VCCustomBuildTool"...../>.....<Tool......Name="VCXMLDataGeneratorTool"...../>.....<Tool......Name="VCWebServiceProxyGeneratorTool"...../>.....<Tool......Name="VCMIDLTool"......TypeLibraryName=".\

    C:\Program Files\WinHTTrack\src\is-0H1UN.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):10001
    Entropy (8bit):5.08203409595179
    Encrypted:false
    SSDEEP:192:qRC732UQqICMEKgLpwWY4+/AvSI6Z+sXqZAejZN6p/yQ9:qoL2SpwjXqu/yY
    MD5:B5BFE01107AFDC4B5EE7FB4CD558D219
    SHA1:6BBDD685A14E0A118C5619B44F2A0B1FA3460BBA
    SHA-256:DCE1BDFB85ED6A171CA47C4ACCB4478CB5FAA49176C2BE9D810203F117C7F765
    SHA-512:6B5AAF80192AB0366627300E58DBB63BB9ADFF3B5C84007F33AC2537E8BA40457471FD4F76552804FE85CA343EC6DD4E0311F4ED3AA531F49063F8B99BAA7E4F
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-107TJ.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text
    Category:dropped
    Size (bytes):3361
    Entropy (8bit):5.3708176863092065
    Encrypted:false
    SSDEEP:96:kf/Ahz+S+t/lWV1kHnnxoo/9exE9Ru8Ftxr2NPzf+D:kQdV0QEnnL/9ea9Ru8FUPiD
    MD5:63A86DD3097D98DA9E0FBFEDAA146596
    SHA1:137C6239FEB786F37174AF90C43D0E8DC2500238
    SHA-256:AC34D9541021DFABE6437A5BDD46E52E113AEDEEF42933DC75024C12CAB80026
    SHA-512:04B935FACB87EE166C8A3FCA0222246A1173BEA0E8A1F82788364BE4987A3222BAA96F64797FA3EDF2DBCB5347824DCC8143E9A433043424EB7606B5C72E37FA
    Malicious:false
    Preview:DevIncludesdir = $(includedir)/httrack.DevIncludes_DATA = \..httrack-library.h \..htsglobal.h \..htsopt.h \..htswrap.h \..htsconfig.h \..../config.h \..htsmodules.h \..htsbasenet.h \..htsnet.h \..htsbauth.h \..htsdefines.h \..htsstrings.h \..htsarrays.h \..htssafe.h..AM_CPPFLAGS = \..@DEFAULT_CFLAGS@ \..@THREADS_CFLAGS@ \..@V6_FLAG@ \..@LFS_FLAG@ \..-DPREFIX=\""$(prefix)"\" \..-DSYSCONFDIR=\""$(sysconfdir)"\" \..-DDATADIR=\""$(datadir)"\" \..-DLIBDIR=\""$(libdir)"\" \..-I"$(abs_srcdir)" \..-I"$(abs_srcdir)/coucal"..bin_PROGRAMS = proxytrack httrack htsserver..httrack_LDADD = $(THREADS_LIBS) libhttrack.la.htsserver_LDADD = $(THREADS_LIBS) $(SOCKET_LIBS) libhttrack.la.proxytrack_LDADD = $(THREADS_LIBS) $(SOCKET_LIBS).proxytrack_CFLAGS = $(AM_CFLAGS) -DNO_MALLOCT -DZLIB_CONST -DHTS_INTHASH_USES_MD5.htsserver_CFLAGS = $(AM_CFLAGS) -DZLIB_CONST -DHTS_INTHASH_USES_MD5..lib_LTLIBRARIES = libhttrack.la libhtsjava.la..htsserver_SOURCES = htsserver.c htsserver.h htsweb.c htsweb.h.proxytrack_SOUR

    C:\Program Files\WinHTTrack\src\is-1A6MG.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):35633
    Entropy (8bit):4.549673906999867
    Encrypted:false
    SSDEEP:384:qoL2sMNw+oVvRWkTNAcoHPKbCMYekvOQcIfC3yF1d5GHpDvlVtH:7LhFdVvRWAAco2Y+3y5wpDvtH
    MD5:F10A7E593EC0C3C5631F4466A26BAF13
    SHA1:933FD02FB24683FF34FE5C0B5EFB5B4041E20A90
    SHA-256:CF49D3EBF8AACBB67ED509D4011A91E05BDA2E85A47928C283ED861547BF74F9
    SHA-512:298B77060C0BBF3BE02ABEC378388CF293CF5FBC6AA6C2A63E2E2C8A77921013C55B3486B0880EB2E35515FAFA86F552EB1EBCDD6E70BEBA8A9A0B3CD6081E22
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-1BG43.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with very long lines (342)
    Category:dropped
    Size (bytes):47196
    Entropy (8bit):5.677182157087262
    Encrypted:false
    SSDEEP:768:KxqCFQAw5E36z+EzFDhQZMM0cp/2OMqR5pTs5w0pBKbiAcWzY19LlOiTh2a6Lmdt:KECC/hQSMqiupBKbiAcWzY19Llp3f7+G
    MD5:45AC4A4B4FDEDC21498F6384A0C78A8B
    SHA1:618B8B8714A0DCD17362EE1C71FFB32B87B3EC36
    SHA-256:0E01E5EA86523C8C07B771BDB3C5C547D379AA7FE1809F49A9DF3603ED038B24
    SHA-512:B9DD05309CB08D15C2816492B3695D2C94F0020B84AFF61E0534D0023182AF4683FFB9EA4B0052919C35465424A8CC369D96C27F2F10C2323F7C92988C984A1D
    Malicious:false
    Preview:# Makefile.in generated by automake 1.11.6 from Makefile.am..# src/Makefile. Generated from Makefile.in by configure...# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,.# 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Free Software.# Foundation, Inc..# This Makefile.in is free software; the Free Software Foundation.# gives unlimited permission to copy and/or distribute it,.# with or without modifications, as long as this notice is preserved...# This program is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY, to the extent permitted by law; without.# even the implied warranty of MERCHANTABILITY or FITNESS FOR A.# PARTICULAR PURPOSE.........am__make_dryrun = \. { \. am__dry=no; \. case $$MAKEFLAGS in \. *\\[\ \.]*) \. echo 'am--echo: ; @echo "AM" OK' | $(MAKE) -f - 2>/dev/null \. | grep '^AM OK$$' >/dev/null || am__dry=yes;; \. *) \. for am__flg in $$MAKEFLAGS; do \. case $$am__flg in

    C:\Program Files\WinHTTrack\src\is-1D9S1.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text
    Category:dropped
    Size (bytes):3433
    Entropy (8bit):5.096564502071116
    Encrypted:false
    SSDEEP:48:GRC7iyZHc1FvPHUw1qQV4ujr9Q+bzFbCSOIDqi2qUxLG2qy6OapTj/3:GRC732pkQVBNX1XBeqQG77z
    MD5:18E7CAE0DFF5EDF257DF6209E8C4C8A5
    SHA1:3799BAD7D81C3A18CE7E97FD88A0ADB8A3938D50
    SHA-256:E5C3E27DC0806E0D5B68C6B65AACA1A2D16C71DBD751621D6393FB073C2B9EDB
    SHA-512:1DA2945B7DEFCB6F9A25D90FF6D9F4F263663E1BEA3AC5112D181A4535B6B0C7B1EFDC1330E71C9506D2AEDAD9ED72781781BC5F18DA44262ACE107997D94CCA
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2013 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-1H0GV.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):9390
    Entropy (8bit):4.554782810010881
    Encrypted:false
    SSDEEP:192:qRC732dQJYWEIigu0xdxHJq9Mu4wyjt9CqByacypyaREHt7VcaiFniLnylEybiEV:qoL2HZGVqiTGLpSd
    MD5:E028848F2E41F53CF0EC186956F3D989
    SHA1:628F58BACEC4CAEBF30624FB28E8C939D7D03D9E
    SHA-256:0F7CAF6AAE8654110C0D5EDE945A836A332D80B31CEEA35FBC507DB4C62930EE
    SHA-512:FECE08A2A0389A7004F78233CFDA3213F68618346F582491E042003F100463B9EFD4361BD9789E6A18F14BB4F3AA5F4BD333B85DAF6BBCD86585D472BD5DDF3E
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-1H6RN.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Bourne-Again shell script, ASCII text executable
    Category:dropped
    Size (bytes):1970
    Entropy (8bit):5.286670656780334
    Encrypted:false
    SSDEEP:48:kf6tf6Kf6Af6vf6of6bAurMhHXUsIiuBzeLuj:kYVNcp4KksIiK/j
    MD5:80B1B1444F5AA2422DFED125358B1C60
    SHA1:3D95A384F20D5F99DE80A532C1671614BF112655
    SHA-256:3961C6C2BAC732426CDFC7B757CD3422B5FDE3AFE5A16E64E71677594854FA65
    SHA-512:BFF820D49B5378AFE8CDDADDEFA19B2FCEA103ECB878417EC71848629D59A1B013F58822B0F8FEBF4A4CB717C397952E7F6597F7E34BA375F38A7B139C3EB51B
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 0%
    Preview:#!/bin/bash.#..# Change this to download files.if false; then.echo "mget ftp://ftp.unicode.org/Public/MAPPINGS/ISO8859/8859-*.TXT" | lftp.echo "mget ftp://ftp.unicode.org/Public/MAPPINGS/VENDORS/MICSFT/PC/CP*.TXT" | lftp.echo "mget ftp://ftp.unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP*.TXT" | lftp.echo "mget ftp://ftp.unicode.org/Public/MAPPINGS/VENDORS/MICSFT/EBCDIC/CP*.TXT" | lftp.echo "mget ftp://ftp.unicode.org/Public/MAPPINGS/VENDORS/MISC/CP*.TXT" | lftp.echo "mget ftp://ftp.unicode.org/Public/MAPPINGS/VENDORS/MISC/KOI8*.TXT" | lftp.rm -f CP932.TXT CP936.TXT CP949.TXT CP950.TXT.fi..# Produce code.printf "/** GENERATED FILE ($0), DO NOT EDIT **/\n\n".for i in *.TXT ; do. echo "processing $i" >&2. grep -vE "^(#|$)" $i | grep -E "^0x" | sed -e 's/[[:space:]]/ /g' | cut -f1,2 -d' ' | \. (. unset arr. while read LINE ; do. from=$[$(echo $LINE | cut -f1 -d' ')]. if ! test -n "$from"; then. echo "error with $i" >&2. exit 1. elif test $from

    C:\Program Files\WinHTTrack\src\is-1P6DT.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):129929
    Entropy (8bit):4.72445751561178
    Encrypted:false
    SSDEEP:768:7LzDSz6PYXioe8wx+hxW6CVA6Abp7iQi3DcBIxS+XK7Rv9SwmK/pDS9JnEjOSA+S:7DSZXW8cv0bqVS+67j1jOS5b6
    MD5:42BF11D0DD65591542C627E13949C421
    SHA1:4EACF11C72DE4BF6230547AFD5FCBC3A2AD8EA7F
    SHA-256:1C7CB42B2775AE4E8D3CEB492275583536962DE877C0AE60BD62A9194F598E85
    SHA-512:FBD1DD73C9223160FDA8CD25BAD05632DFB32E5C0A921F692E029368BAFB43202BB6733A7A122D47FF9F2F46EE7D836355C56ACEC5E39862057D699485D16508
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-1VB0O.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):4751
    Entropy (8bit):5.456302893868474
    Encrypted:false
    SSDEEP:96:qRC732poyQ4Ojhsr85eKZdIhiqStN8wo1TD:qRC732oyQ44DnTTyw8TD
    MD5:8CE281596ECC2E4A82CB46C466FCD9AB
    SHA1:C4FFB97E0BC292F37AD6F2B1650E364FCAAC7559
    SHA-256:DECB23176077CEA25B6B21A50E0DBB33C1D5C50F4AD602F95853D141435738A9
    SHA-512:47EAC070252609286C6D3886BADF9A28CD002A0C961854A69E0CDBEB7FE99B099EC4CE33A48ADFB0802400053518EB64D69D6E7AB9C993D7647BA2A481DE3C8C
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-28TUG.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):3941
    Entropy (8bit):5.055414146221835
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUw6aPOQFudiIylqZ4U0LKK0K7PM04egc0LeRM0Mf5D20rex80B:qRC732p6a2QF+ylqZbKIMEKCUd0RO
    MD5:A7724BA3443482079024BF30CDDA1A63
    SHA1:38D49586BF9FDE3E69FE7B4EA57D32D62D639701
    SHA-256:661CC2C0DB2E929754BC97FDE5ED045EC5EB863740FFB736273E1B32E5E46FAD
    SHA-512:B925E09EDEE3C1F4E3F8B48BA93277560F3A7DDB04CC635843517B1FD828703C27F0CAC19D5D35A1D1C12C68A1BA9B68356427BEBDA0CACF9D3CABE700EB2486
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-2CD8V.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):3366
    Entropy (8bit):4.9295219014365355
    Encrypted:false
    SSDEEP:48:wtUqk2lwIk5WuWz1vWpPyLD6/3yBhrATtkm91s8t6niAQ4ozuh9AT7uh9UGOy:waqkJIcWuW1epGubBcnWr1GOy
    MD5:42485F20A511C37EC72635AB06473A0A
    SHA1:3CA4A16F228C4FE2F574E7C75EE053C1811B95A9
    SHA-256:7B30931693F238A59D1F1ADDEB08CF491E8878AFF60F0FD5487BD43EDE34C241
    SHA-512:DA81017D9658962D8CB7BBFF3F3332050ABDC65094B92112B4A7A790E5EFE94361A15BC7305534214E38385C8A856996A6AAF569D66C03179A7BDDECE68E7E07
    Malicious:false
    Preview://-----------------------------------------------------------------------------.// MurmurHash3 was written by Austin Appleby, and is placed in the public.// domain. The author hereby disclaims copyright to this source code...// Note - The x86 and x64 versions do _not_ produce the same results, as the.// algorithms are optimized for their respective platforms. You can still.// compile and run any of them on any platform, but your performance with the.// non-native version will be less than optimal...#include <stdint.h>..static uint32_t rotl32 ( uint32_t x, int8_t r ).{. return (x << r) | (x >> (32 - r));.}.#define ROTL32(x,y) rotl32(x,y).static uint32_t getblock32 ( const uint32_t * p, int i ).{. return p[i];.}.static uint32_t fmix32 ( uint32_t h ).{. h ^= h >> 16;. h *= 0x85ebca6b;. h ^= h >> 13;. h *= 0xc2b2ae35;. h ^= h >> 16;.. return h;.}.#define BIG_CONSTANT(x) (x##LLU).static void MurmurHash3_x86_128 ( const void * key, const int len,.

    C:\Program Files\WinHTTrack\src\is-2CPQ7.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Bourne-Again shell script, ASCII text executable
    Category:dropped
    Size (bytes):4691
    Entropy (8bit):5.4876095511876715
    Encrypted:false
    SSDEEP:96:qqv4fxXN/Wt3tzeeU0VE009ew5hC9ORhFVqaXd9m9F8S42srbiZt15:qqQfPOrzNUgW5hC9OXqaXdHS9r
    MD5:4019A09ED6833BC00427901733EE7AA4
    SHA1:99473FF67B44DE8A85C5960D21362C3A6A7DFD56
    SHA-256:A9F5EAF97C27230D37903283062862AF90773DBBCD949C611399D0B7B62BED48
    SHA-512:8353FED64DAFBE00C307B1F25C9174A22A063FA9E65F9DFCA8E72F19524F7214635ADEEE73BB83159FD58CD5B3D7A7227C0ACA965457B5DE64897266EA5512D6
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 0%
    Preview:#!/bin/bash.#.# WebHTTrack launcher script.# Initializes the htsserver GUI frontend and launch the default browser..BROWSEREXE=.SRCHBROWSEREXE="x-www-browser www-browser iceape mozilla firefox icecat iceweasel abrowser firebird galeon konqueror midori opera google-chrome chrome chromium chromium-browser netscape".if test -n "${BROWSER}"; then.# sensible-browser will f up if BROWSER is not set.SRCHBROWSEREXE="xdg-open sensible-browser ${SRCHBROWSEREXE}".fi.# Patch for Darwin/Mac by Ross Williams.if test "`uname -s`" == "Darwin"; then.# Darwin/Mac OS X uses a system 'open' command to find.# the default browser. The -W flag causes it to wait for.# the browser to exit.BROWSEREXE="/usr/bin/open -W".fi.BINWD=`dirname "$0"`.SRCHPATH="$BINWD /usr/local/bin /usr/share/bin /usr/bin /usr/lib/httrack /usr/local/lib/httrack /usr/local/share/httrack /opt/local/bin /sw/bin ${HOME}/usr/bin ${HOME}/bin".SRCHPATH="$SRCHPATH "`echo $PATH | tr ":" " "`.SRCHDISTPATH="$BINWD/../share $BINWD/.. /usr/share /u

    C:\Program Files\WinHTTrack\src\is-2PVAK.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):11302
    Entropy (8bit):4.472656035472144
    Encrypted:false
    SSDEEP:192:qRC7326QQSx2CVpqSUtr5DPNYp/zq6e2mtH1qIHudcwyUOrLdBSMhsMB7yaHaxZT:qoL2fHHUPNYp7VPcR/7/fAv
    MD5:EF7E454CB58615AB6F79C4E765B5AE1C
    SHA1:07EB20947CEA60DD17AE5606B8060FE65816287E
    SHA-256:22DD359B893901FA486C3EA0D798E02557A22AE398831D4F691167295F0F03AE
    SHA-512:629B3583D43E68A56C202CFF83BC43B1A12B1DDFB9C878D1C3BA6BD2B657619F6DCECF783F28670AC39C1EE4A22C868FB03CA380A406CAF78F803E15583A0E4A
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-32RGM.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):35631
    Entropy (8bit):4.806116140498948
    Encrypted:false
    SSDEEP:384:qoL2JezZPjJMKeMJXrS4WgZD9sJyWf3Fuw3hoWpsWo6kRR883q:7L20PtMKec7KYqrfVu3WpsWo6kRR8uq
    MD5:F02E893B246E4AF491B225075D563D7F
    SHA1:2475F3E3A32AE27EDBCE0D515DA140DB1C4474BE
    SHA-256:50C1BCAF0B95860CCEF3247ACB0F393410A98BC0AB3FF68EBDB674312519D382
    SHA-512:28E86A274A7A552B7E7581BC3E4861037CC2B9FFC40D65B175292F89940CC13F8EEFACF4E5A931FF6CABD6C5E514684AF115C081B3F8C415188312DBD07DE6B4
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-359S1.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):4996
    Entropy (8bit):4.825365337553202
    Encrypted:false
    SSDEEP:96:qRC732p8zmQ3IKMEMF3k/Z7mrkqOPDv17qynftWgKvhYgKu/c8ZQ:qRC7328KQ3IKMEM5UBqCb1qst+vhwUQ
    MD5:47B4C3D1BFBB1A26684D813B3502BCCF
    SHA1:C7354A35C04E3AF85F6CA45231509E4363B7AA89
    SHA-256:070C63A4160AD06A58E04D093684631A8249ECE92980985E3935796C08984542
    SHA-512:2533ECB1A86743CA9DA52C5CCD49DFC834C25A0AF178A8F4DA26F4F3BD7ACD4EE33EB7BBC348912B91693CA5BF928048EE8C855DD1C8996433327007BABFDB85
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-41J9P.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):4094
    Entropy (8bit):5.20162305230985
    Encrypted:false
    SSDEEP:96:qRC732pZQ/Jq/JutIGioP05OmyWCxYs7+W0h13Hufz:qRC732ZQ0oyGik04Qq+W0Ofz
    MD5:EBA8BA23A0FDFBC6468CE526444A2E69
    SHA1:1AD24329F9625A4BBB617650FC7BCF68CE6E30C6
    SHA-256:74B8C6013899076A257F865B4B7C88C81E99682FA7ABC170FD679AD435656496
    SHA-512:39473472BBDD166CC73BBA6552D7DF4D6B8773D3B983CFCE1722D59AE3B1D43F887D7F4A91C95BE2A03D388493D7FDA3ADAD8262948146C907BB73BD351A884F
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-51QTG.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):163004
    Entropy (8bit):4.457052883888839
    Encrypted:false
    SSDEEP:1536:iwvFez5FpHHfNzbPQFD00PHs4GyWYOo0RP4ASWdLEcd:iwAlHfhDyGBomgAD
    MD5:0220E75A4EADDF9AAF1CFDFA93196F30
    SHA1:DDF2F841905431DF9C16B6DE6001BB3593B3A6F3
    SHA-256:0F20DD5ED2D52A2452FAF97A42CF68F3A13314ADE2E8F6D0C8C186275897A70D
    SHA-512:97D7B60C0DB24897A815F1B75F4593B1BBFDA4F40FF8C46411CF1849C47914BE3119EC4ADBFC9C0AD6C6F3367B8B0B2B67F3573792CE48E96984405A69B9049A
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-5NH4G.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):2444
    Entropy (8bit):5.130010303907452
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUw+fQ4nXg0knjLsPyG4f+5DNOb66vSvJbv6qh4JS2N:qRC732p+fQ4nXgvw6lfAObPKVBhwh
    MD5:69376B74765BA0C15C32D33EA0950FDD
    SHA1:A3875425D43CB75916CC2EE8FC6CB31656C56698
    SHA-256:F2A04E91C1DBE2C58A2212A07AAE0BB636D2EAB2C2D83564EB34CD8469528BF5
    SHA-512:023DFE7A85E6939731EC49A4FC710739DB8454FBC53C93B4E96D9FD63BD304B8B01E88146C3BFA58B9256FBFCB1A11527548BB932A9B6503F8DF53300DA790A9
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-5U20D.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):11720
    Entropy (8bit):4.695959749449687
    Encrypted:false
    SSDEEP:192:qRC7326jQSsk5l5WkTjzmq6JuHh5StGuWgRzf/7EM8WH3ZvDvXoISO7db2MLt2:qoL225l5WkTjz+2kGuWgRz37EM8SJvDc
    MD5:4C5EA36B42543016F8FB81CB134608EA
    SHA1:43C923173D3D3D9B11F14652957167CA1FA62D96
    SHA-256:402DD148D72BABD0365836DF012831F2FBA93509A3CF69A4B0EBE7E67958188D
    SHA-512:D3C8302BC9A8A3893523372045A447895BD1822C1225AF38B69AA9F0874DF62F122282F49EEC5188BB671BBF161FFE8CE706C48D49D7A2344ACAD985C907447D
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-6GMEN.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):23460
    Entropy (8bit):4.749124689002922
    Encrypted:false
    SSDEEP:192:qRC732fYQl4kKUBn6JwhYdsv4SMKGiQGQq8QPeandrGxGtGgPhAg0hSYU+Yaxq4f:qoL2nEkwZSB14aE4XPoD3EMdlBvvs40a
    MD5:CE4ABFFC02DFA1CCBD919CACAAFAF3D7
    SHA1:E8507A7B885A57B7E2CA8E678C6DF447894B0A3C
    SHA-256:149B3336081873113109815D369809B41C10BCEDAEC42402598E8FA8C7A1D0B5
    SHA-512:3794B8644210B6E1F5B105E9F109D5E8C3B52ED5C37B8A7011B16D6ABE80592A95EF4162EFC414E5F8A690B7ADCF383C07D2A94A5A7EEE117A1C4C1EBAD2C945
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-6KLAQ.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):13982
    Entropy (8bit):4.741592090428614
    Encrypted:false
    SSDEEP:192:QRC7326BQSQMNulZu5lojnueCiepC6UK/oWG+FPABZ+yaiSbn3GT7iKS6NBo+t5F:QoL2TovoiLY6y+FVNINEIl
    MD5:14A39EF176E3309B065FB3E3F214A0BB
    SHA1:BC84102E6E1910C68933C9A5F56FC6169E8AE589
    SHA-256:F4FDC1CF41A78145ED6E42AE8EE760DEF6B0746640E3B67A554CA1A29BA40CD7
    SHA-512:D52C8C4043BA9AC7A4B39724F9C4E7BFC67866F61A73FF6B0515E9480DE5278A580316D36CFCB4979D371F6F91A0F69B6DE4937448E811B9AED90685326EEE0B
    Malicious:false
    Preview:/*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our work, and spoil the many hours we spent on it...Please visit our Webs

    C:\Program Files\WinHTTrack\src\is-6MIIJ.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (614)
    Category:dropped
    Size (bytes):52432
    Entropy (8bit):5.051425526760889
    Encrypted:false
    SSDEEP:768:7LSFKVFxcFmFJX1DkTm+JAiomXLlsA3iDGhIrzJaCk9ohQ:WTm+J+oLlsY0GyE
    MD5:5EB6DCD8AE01A05399BBC2B483D6C689
    SHA1:8E29D3C04040535B1AF18720CE88E77397DA584D
    SHA-256:2FE09BC1A082B0BCA085AEB41C9A5EDA4C64A77380289E693B61EE25C63D7837
    SHA-512:E87BCE13F9CAE1D8CF57128A2B5F190939E4AC2A44E544A08381BFB69321BB9863FA992F7DF930CBCB6D3EBC5452C86D254235C4C96925DB2330F66240396D07
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-6RT8U.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):5338
    Entropy (8bit):4.8763942154600235
    Encrypted:false
    SSDEEP:96:qRC732pIN7Q70xkJUPlwwvNhJs3w9Jc+bmCqZiSEYkEAW/AIBPjAOPt8aFRi+W:qRC732IN7QSbPlwwvNM3emCqZiSEYZA1
    MD5:A45B9ECF9BD5A30D4ACB4967FB29AFC2
    SHA1:6C864EF200B9EDBCC2C2CCEC7518E1B0846C433A
    SHA-256:D4E5F0C04A56CBECECA2A1DFA13E747DD161C24F18174140A4186CF938D198A7
    SHA-512:9923FF24246043E1FE13D5DCBD98B8D0D6BC4695DEE3D94863EE1F2E359DB9F4C1BB8D6446483B0E7A31A0FFBCCBA11E5AC2CE0881C1677D042FFE48CE3CEA0D
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-7GFNO.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):5551
    Entropy (8bit):5.511565442317637
    Encrypted:false
    SSDEEP:96:yZad29ah5qrq31f+2QNhNQjgxE+qxv2GNCNvam/3Sv+jpb23sNZB0Ni/H3FI+qxb:N20hguRxU9auna2NKk5aJEbEREckc
    MD5:705A579CE4E9EFBA834CE1EA7F80D34A
    SHA1:B83A805354B9F8E71CB44683FB1B8AE219E579B5
    SHA-256:D71C482C264AAC9C766DB008BF3149167B2D240C80FA23EF508EE61C1C15DBA2
    SHA-512:905830CD689103B736B7718FB0E5ECDF7FC0EDDAAEB5B668D213E96363A2DF4B9438792BBF85F1E9EFAF7E7232C52CA87262EAB5065EF918633CC53264F3441E
    Malicious:false
    Preview:# Microsoft Developer Studio Project File - Name="httrack" - Package Owner=<4>..# Microsoft Developer Studio Generated Build File, Format Version 6.00..# ** DO NOT EDIT **....# TARGTYPE "Win32 (x86) Console Application" 0x0103....CFG=httrack - Win32 Debug..!MESSAGE This is not a valid makefile. To build this project using NMAKE,..!MESSAGE use the Export Makefile command and run..!MESSAGE ..!MESSAGE NMAKE /f "httrack.mak"...!MESSAGE ..!MESSAGE You can specify a configuration when running NMAKE..!MESSAGE by defining the macro CFG on the command line. For example:..!MESSAGE ..!MESSAGE NMAKE /f "httrack.mak" CFG="httrack - Win32 Debug"..!MESSAGE ..!MESSAGE Possible choices for configuration are:..!MESSAGE ..!MESSAGE "httrack - Win32 Release" (based on "Win32 (x86) Console Application")..!MESSAGE "httrack - Win32 Debug" (based on "Win32 (x86) Console Application")..!MESSAGE "httrack - Win32 Release avec debug" (based on "Win32 (x86) Console Application")..!MESSAGE ....# Begin Project..# PRO

    C:\Program Files\WinHTTrack\src\is-7GV7D.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):8412
    Entropy (8bit):5.267227776628497
    Encrypted:false
    SSDEEP:96:qRC732p1QgX6+uAXi5WaRiAOBh00AhsX1IG4RQVWbfAjavpY1ypmW+:qRC7321Qk6+uLWaZ/sWBMrjaa4c
    MD5:65AFCC897CFE1B21D9BC8179DA356384
    SHA1:6D167BFAF4863740DB7904ADFE78E39DBD01B13A
    SHA-256:892B848F63FC32156B89085D54ABF71398C2426897AFED09D04AF13BA4A96499
    SHA-512:594825EEC74B60BA449AD363228C02751BC479FE332E3E7ECAA5C7CD3770924696E94B1C3A208A32F3434D590C390F3E8E2BB87F6DFC5C92E749C036460C208C
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-852L9.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):170555
    Entropy (8bit):4.951374756028349
    Encrypted:false
    SSDEEP:1536:lYx/kczkImK1RFPIYEoDbsfPwSjUETK+C8dWoKvwm9o0uXJrB3nDo7MvVq/:lYdbmejejUx+Q+0oVo7Mv+
    MD5:7DCA3A1BE411DDBFB03611F4FF4AE23B
    SHA1:A3B55BEB40DC0DFA99B0812A8FC78B86AE5E018A
    SHA-256:0F3DCA58741BB3242D00104AA5985C0B5F6EE4FA1A1432EBF485796745D40EFF
    SHA-512:7545927D7FFC3AE5883347CEE6F0F3F4AE3F3535FB5820BA3C9A87E0B5C0254C0B0DD4CF9CC58A9F0F7916902014978E3927C81964C9BAEA70CD2C794CDE6704
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-8LV02.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text, with very long lines (417)
    Category:dropped
    Size (bytes):123794
    Entropy (8bit):4.251709049047534
    Encrypted:false
    SSDEEP:1536:JDZRTtekrmgcVfqL29X7pSvFkYUkD2J+aAB9i:L+gcVfqsX9SvFe3J+aAB9i
    MD5:2881C63425F6A734E65E9AF7D8563DDF
    SHA1:47AF2E9FF84532B601476F8E2C55FC71E544771C
    SHA-256:320F4477135F3C9BC11EFC1D40BCB8C1F0E65453E7A9A666CA056712DCD08B10
    SHA-512:658EE953F16A2FCC2E280207027A846E937F6E123C04CC8521444406C8CFC68222F98A1EF45DC4DBDCC9DF0C664439FA9045B8612179BAA81D622EF817A41E51
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-99I0V.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):10324
    Entropy (8bit):4.640940908941287
    Encrypted:false
    SSDEEP:96:qRC732p+Q/VKCUGaGPbNfkFmZX4cIWNuAD/rsdu0esIk:qRC732+Q/VKCUGaGDNumV6WNjrsdjesx
    MD5:841AE89C117010437EBF656064D1E265
    SHA1:032A94374630B32BCA72958AF29ACC79BB94308B
    SHA-256:08CA78F6E3A9D1A872A9ADFD03C6B79FE221DB31E398AB7E7E91634C125D86FE
    SHA-512:FA0D6BE62E6D4D564BEFE5FBE7CC6EE273D86398619B23877D20BC2D1855C98CD62A80A07FA952CD51EE18C2B47CB2795DA36F89A392D591435E924B2E7107E0
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-9H465.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):14631
    Entropy (8bit):5.2187655316122035
    Encrypted:false
    SSDEEP:192:qRC7322QwK4N91gXJVZYq5rIWNyl3uVnB0VYKU5c3BmWATg5d3s6JbYI8Ia6b3H/:qoL2aeHYlcc3QWSg5dHHP1XP
    MD5:3F6719128661763C40FDCE9CC7BAAF58
    SHA1:C7708C882BF965CF041E8D4F6D7A8BA491AEE21B
    SHA-256:1A2BD6B80956696BEF520A971F6E4DB6DBDFA5904E1B3011769B90481F20CED7
    SHA-512:30750D00445E0FD7A720205605D6D5FADF298C2EBED82A186AD7B89BA882F272D1D55CC3DA9C36931770F0C083E0D27A332AE112F5488C06B3AC2D013CFEC788
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-A3OFJ.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):7750
    Entropy (8bit):5.145354706216479
    Encrypted:false
    SSDEEP:192:qRC732IQH2izaMtW8Ut9se/2h66hciUh/ggTh1hauf1QThDif2j4xN:qoL2ciGMtW8UVEah/HhPh1qhDc28xN
    MD5:E4B78E1CE1BBBF57450B568C1B6C17CF
    SHA1:40253A98E892C5B56AA8628194440072D4DAFF04
    SHA-256:4E6FFD4AD85C3E213058AFD04AA8FC80CA5DF408A81657B315F8294AFA5AABCC
    SHA-512:F42B588325F09BEE57060B56583ECC7552CFE2FC319897A10FF597616E476D82CCCEC65CA9F658C66A9EECC52640D2280CFE269B1BCDEDE813CE966D5B921417
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-AHTB1.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:XML 1.0 document, ASCII text
    Category:dropped
    Size (bytes):49343
    Entropy (8bit):5.121137181125374
    Encrypted:false
    SSDEEP:384:GqOdcT8qdQ0IAdZzyRdRhB0y0XUEsB0y0XUE1B0y0XUEDB0y0XUEZB0y0XUEkB0P:FOZqaAmR1
    MD5:AD0555A464DDC2363815399251C05F34
    SHA1:F01099B47BEABD5FCB94EAD782972A3B30B87902
    SHA-256:F690459FB53F9C20B92E149B94D4A199026A0448A78B8D1206F9300FCEDF9068
    SHA-512:34BCDF321AE4A0DC97B1960374DB58200BA3A404DE606F6389AEC8505E280E5BFA1E3DC8473CFB11A8262D9C4C7B935AB592FBD5AE19229D37786173A83E165D
    Malicious:false
    Preview:<?xml version="1.0" encoding="Windows-1252"?>.<VisualStudioProject..ProjectType="Visual C++"..Version="9,00"..Name="libhttrack"..ProjectGUID="{E76AD871-54C1-45E8-A657-6117ADEFFB46}"..RootNamespace="libhttrack"..TargetFrameworkVersion="131072"..>..<Platforms>...<Platform....Name="Win32".../>...<Platform....Name="x64".../>..</Platforms>..<ToolFiles>..</ToolFiles>..<Configurations>...<Configuration....Name="Release|Win32"....OutputDirectory="C:\temp\Releaselib"....IntermediateDirectory="C:\temp\Releaselib"....ConfigurationType="2"....InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops"....UseOfMFC="0"....ATLMinimizesCRunTimeLibraryUsage="false"....CharacterSet="2"....>....<Tool.....Name="VCPreBuildEventTool"..../>....<Tool.....Name="VCCustomBuildTool"..../>....<Tool.....Name="VCXMLDataGeneratorTool"..../>....<Tool.....Name="VCWebServiceProxyGeneratorTool"..../>....<Tool.....Name="VCMIDLTool".....PreprocessorDefinitions="NDEBUG".....MkTypLibCompatible="true"..

    C:\Program Files\WinHTTrack\src\is-AOLO5.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):2056
    Entropy (8bit):4.981022105299505
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUw6VmQTZ4/0LK6SfS5O8ZP1:qRC732p6sQTZQpqx
    MD5:8C41288AF37B907423083B61F9AC15E6
    SHA1:4772022E6D19742FE0744B40C6DC914593DDA36B
    SHA-256:EB4439FAF0230CA6864CA9545773300F041B4454E3666FD2B004DDD61E292539
    SHA-512:58678FC3105982B9A39F164514DC32913CA6511ABFA236BD0F21012B255D7D51816D36542C66C90A0239BA65868B83E2C88267B0B7C520425A075DF7CA728239
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-AU6V7.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):834
    Entropy (8bit):4.168917194377535
    Encrypted:false
    SSDEEP:6:zd22IPtDQHVCeJqN2NdumGsr81ox9cqVZrWpYrkFA4GaI4UItuh741o1MHU7vcqo:zTYcgcg2NDrT1zz34FmM07jzzYpzb
    MD5:80722509448F61A9B3D8C6F61501E281
    SHA1:E87411FA67A006118135C1D281873D172E4CCA45
    SHA-256:CC47132E05EDE76873DD496B0ECA41090528CE4EFA7B560C14FFE3129019F984
    SHA-512:E5EAE18577D98457A0D1664E7A74E99AA3D0C24936B472A6B6769241D8EAB9115F3C42D565054C3DB41BEE1C5E32A315195422A64879DECDF6322ED563A20EDD
    Malicious:false
    Preview:Microsoft Developer Studio Workspace File, Format Version 6.00..# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!....###############################################################################....Project: "httrack"=.\httrack.dsp - Package Owner=<4>....Package=<5>..{{{..}}}....Package=<4>..{{{.. Begin Project Dependency.. Project_Dep_Name libhttrack.. End Project Dependency..}}}....###############################################################################....Project: "libhttrack"=.\libhttrack\libhttrack.dsp - Package Owner=<4>....Package=<5>..{{{..}}}....Package=<4>..{{{..}}}....###############################################################################....Global:....Package=<5>..{{{..}}}....Package=<3>..{{{..}}}....###############################################################################....

    C:\Program Files\WinHTTrack\src\is-B194V.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with very long lines (361), with CRLF line terminators
    Category:dropped
    Size (bytes):4675
    Entropy (8bit):5.486954205867068
    Encrypted:false
    SSDEEP:96:yRawfIT5irfjQNhNQEPTRE+LjUGNCNvrdTWv+SHNAbA0vBPxW2ad1c:eATUjjQF9vUHK2StAbAUhrad1c
    MD5:35135743C08319C957256CFFE0F4351F
    SHA1:309A185090DF7367EAC9E0F1E394E5540CFE708B
    SHA-256:47D89C19732CBEF46373812043F5A8508B5FBFFDB072B515093324D97B7C8E88
    SHA-512:4EDC7B3F0EB36905E4120C807C55C57642072B760533D718275123E429F624743FA3F8BFA9586B17A0DE0369A159F46AA8CB82DC9D6BC6D7C4190F80A602DFB7
    Malicious:false
    Preview:# Microsoft Developer Studio Project File - Name="webhttrack" - Package Owner=<4>..# Microsoft Developer Studio Generated Build File, Format Version 6.00..# ** DO NOT EDIT **....# TARGTYPE "Win32 (x86) Console Application" 0x0103....CFG=webhttrack - Win32 Debug..!MESSAGE This is not a valid makefile. To build this project using NMAKE,..!MESSAGE use the Export Makefile command and run..!MESSAGE ..!MESSAGE NMAKE /f "webhttrack.mak"...!MESSAGE ..!MESSAGE You can specify a configuration when running NMAKE..!MESSAGE by defining the macro CFG on the command line. For example:..!MESSAGE ..!MESSAGE NMAKE /f "webhttrack.mak" CFG="webhttrack - Win32 Debug"..!MESSAGE ..!MESSAGE Possible choices for configuration are:..!MESSAGE ..!MESSAGE "webhttrack - Win32 Release" (based on "Win32 (x86) Console Application")..!MESSAGE "webhttrack - Win32 Debug" (based on "Win32 (x86) Console Application")..!MESSAGE ....# Begin Project..# PROP AllowPerConfigDependencies 0..# PROP Scc_ProjName ""..# PROP Scc_Loca

    C:\Program Files\WinHTTrack\src\is-BDUTR.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:unified diff output, ASCII text
    Category:dropped
    Size (bytes):769
    Entropy (8bit):5.274534653103435
    Encrypted:false
    SSDEEP:12:+uRu3cxEuFJoUEuU+MzGlAqznALdLrLW6Lb0GSCdIb++O7G+E7G+TF7G+y/AuC02:VtQElix/S6qiwfy//C0bqt
    MD5:7F3D99F3244CCD9A6C818ED532D5285A
    SHA1:F544E04D6A493A386AE827E73F63A4595F9A93AC
    SHA-256:63C17E82CE1C6B69E10B20495B40B55D57D10FF1B6F8E6DAF127E103F953D5DF
    SHA-512:80127A64F234A0C9C39044C92845F8CFF0AB144E32FE4313D9F074D128CDC4D627FEF9EE9A7FACAB4850AA164A5D871FD15FFD5B313A4E70E626965C3B43096C
    Malicious:false
    Preview:--- murmurhash3.h.orig.2014-06-14 14:29:11.562576736 +0200.+++ murmurhash3.h.2014-06-14 14:39:43.989624584 +0200.@@ -7,7 +7,19 @@. // compile and run any of them on any platform, but your performance with the. // non-native version will be less than optimal.. .+#ifdef _WIN32.+#include <stddef.h>.+typedef __int8 int8_t;.+typedef unsigned __int8 uint8_t;.+typedef unsigned __int16 uint16_t;.+typedef unsigned __int32 uint32_t;.+typedef unsigned __int64 uint64_t;.+#elif (defined(SOLARIS) || defined(sun) || defined(HAVE_INTTYPES_H) \.+ || defined(BSD) || defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__NetBSD__) || defined(__FreeBSD_kernel__)).+#include <inttypes.h>.+#else. #include <stdint.h>.+#endif. . static uint32_t rotl32 ( uint32_t x, int8_t r ). {.

    C:\Program Files\WinHTTrack\src\is-BTPV3.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Bourne-Again shell script, ASCII text executable
    Category:dropped
    Size (bytes):1985
    Entropy (8bit):4.681575562885557
    Encrypted:false
    SSDEEP:48:4MaOg2ddN6UQF7W22P//BpU3oMkFgnB5kT:28dYUy7W2yHBpUYMkSB5kT
    MD5:F1AABF1970D890FA6494B029E7C32567
    SHA1:2EA5DDF145A5F076565AF47AEE1B98961A23BF37
    SHA-256:E9B806871FBF170010595DED1E10B28FEE66CBC563336BEEBE19D8B9598BE523
    SHA-512:BC51E995900475FFB0233795B39731862300F9513D5C442B38D9C79712BD6A735D41FC3FF091791099EBFFB88D6D936AB6F362C9EB072A6B925EFA34FCA9FC69
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 0%
    Preview:#!/bin/bash.#..src=html40.txt.url=http://www.w3.org/TR/1998/REC-html40-19980424/html40.txt.dest=htsentities.h..(. cat <<EOF./*. -- ${dest} --. FILE GENERATED BY $0, DO NOT MODIFY.. We compute the LCG hash. (see <http://en.wikipedia.org/wiki/Linear_congruential_generator>). for each entity. We should in theory check using strncmp() that we. actually have the correct entity, but this is actually statistically. not needed... We may want to do better, but we expect the hash function to be uniform, and. let the compiler be smart enough to optimize the switch (for example by. checking in log2() intervals). . This code has been generated using the evil $0 script..*/..static int decode_entity(const unsigned int hash, const size_t len) {. switch(hash) {.EOF. (. if test -f ${src}; then. cat ${src}. else. GET "${url}". fi. ) \. | grep -E '^<!ENTITY [a-zA-Z0-9_]' \. | sed \. -e 's/<!ENTITY //' -e "s/[[:space:]][[

    C:\Program Files\WinHTTrack\src\is-BV9HG.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):1814
    Entropy (8bit):4.841081362545949
    Encrypted:false
    SSDEEP:24:nqRJiz7WtyPOkHMlCTbVO2ylFvP4/mFhxUwgIaiQHzTF2TIgbkPMTD:qRC7iyZHc1FvPHUwNaiQlZ4pv
    MD5:9B7938DEB221F3507A8A4FE41651CDB5
    SHA1:6A198A64EEFAC82CB1884B9E940987189605BB0F
    SHA-256:8E302BDDF48615FDFD932D3C2B73DE548D2C54945C2C757F0DAF619336A7ED59
    SHA-512:B148CCD48A3F8380E83B23BF5BE8F7F412368E50A7D013A0A7C0E6F2A73750B84EF799E82E086E51EB4B9CC544603183AFE9D68AC1FA68CF7092E0C84BCF7C7C
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-C6AJR.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):36193
    Entropy (8bit):4.870968843571292
    Encrypted:false
    SSDEEP:768:7LoAIlX98c1oj9Id96QH9gcJ5/gV8j6nfNO8PNMRh:Elt8ud96FVZS
    MD5:82C8622700218FA989ACEA4EA4E5D09F
    SHA1:46FF4BE9DBF3FFFE2BE0E49572118619C6CAA099
    SHA-256:5AC1C7F372037AD6F1DD3DCCE56E981BD8074F3CD23D794D0E9425A36CC3AD75
    SHA-512:BE5D0BD0E7889D20EC9159B9A19DAEEDA4A6389C1F7DE763A489DE1187193E13FDC49D3683C2263E4C58E4F2FC47DEAE402D64AB659CEEE5B19B55A297049629
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-D0IG3.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):17443
    Entropy (8bit):5.195923014802806
    Encrypted:false
    SSDEEP:384:boeBnZxseBnZJ6BOByPrBDBP1L4BpEQCB5KQDE1iO:ke9ZWe9Z8BOATBDp14bNCD8
    MD5:EA6AA176F126B7F790A6466BE37EB8BC
    SHA1:07CAD580789DBC0FC52FA24BDEB2EF8A54C0C6A2
    SHA-256:2D1C3297326F02AF90FB1A0B6D30F962EAE591638CDD36D90E335CB6B318FE87
    SHA-512:3957A582EE782BB8634BFA2166DF462FD2A552C779702D961072530CA6B3E1F956C8CE3F7EA2106126C95C6396EC04F46E2A0EDFED4769D55A7759E57873D888
    Malicious:false
    Preview:<?xml version="1.0" encoding="Windows-1252"?>..<VisualStudioProject...ProjectType="Visual C++"...Version="9,00"...Name="httrack"...ProjectGUID="{D0E894E7-F64C-4722-9807-9ABB1054D43A}"...RootNamespace="httrack"...TargetFrameworkVersion="131072"...>...<Platforms>....<Platform.....Name="Win32"..../>....<Platform.....Name="x64"..../>...</Platforms>...<ToolFiles>...</ToolFiles>...<Configurations>....<Configuration.....Name="Release avec debug|Win32".....OutputDirectory=".\Release_avec_debug".....IntermediateDirectory="c:\temp\vcpp".....ConfigurationType="1".....InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops".....UseOfMFC="0".....ATLMinimizesCRunTimeLibraryUsage="false".....CharacterSet="2".....>.....<Tool......Name="VCPreBuildEventTool"...../>.....<Tool......Name="VCCustomBuildTool"...../>.....<Tool......Name="VCXMLDataGeneratorTool"...../>.....<Tool......Name="VCWebServiceProxyGeneratorTool"...../>.....<Tool......Name="VCMIDLTool"......TypeLibraryName=".\

    C:\Program Files\WinHTTrack\src\is-D6C1T.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):60298
    Entropy (8bit):4.555432945238365
    Encrypted:false
    SSDEEP:768:7LOVRmA8u9xtJGyY4vVczxDvI7p2Ug3z+y7znuFhqYxRt:HuNJ5vVcGwjjuFhqCt
    MD5:C6EAF1ED580BEDE52A30B44FC10FBC0A
    SHA1:838E5D41B2EB5349FBF4B26E10570BA0E384CE71
    SHA-256:56237A2AE28E45308E2C338DD48BBFBD2F87AE8E6EBB47C555B6EF6999E068D0
    SHA-512:22876C50F08C307B5942F4B8C04690625E95FED372ECBA9C09B5601CA51FBCA9358383A1EDCEC3271EF20D31C9FF1DDF4CED9DA15EF804EB659FA07DA15DA4C2
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-DC4BN.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):2291
    Entropy (8bit):4.972776530374022
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUw6IQQvZ4U0Mf5DuZWkC94JJH00FFowFlgIFZDT1:qRC732p6IQQvZbKdJZ9Llg4p1
    MD5:6A01B2B95A0BE5A83AB8227DA75FD727
    SHA1:C37F21E7BA2E815955A7804DFD49854937072230
    SHA-256:34A1EA2EF9415466A73DF6C8A1D2691B7F16A119396F24EF57B7615DCE1E1E2D
    SHA-512:F78A6083EF83D4F551CA143DDA57F7E00F731EFE79FD1657EA6D9F7547891A9BA222B5A0A8A9791C5854D36897D48D9D8B754745B08DDB2A93963613879966D0
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-DJO91.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):2671
    Entropy (8bit):5.1227307904466075
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUwv0Qj0rex80LKF0/eD27TUMZ48atZEE1HWKeqrRCL:qRC732p8QjCFgQMZG9s
    MD5:F76E6755924063D2AE0E3E5DCF04CE7C
    SHA1:E7FBBFB9F990302D2A560108F973B6AE962C343B
    SHA-256:53138BBA682A26732490CA957393EFCD7B4146F01429C401E5D8C604769D3302
    SHA-512:D16A82559D366BDABC258AB77F6A9FD254AC76448420EB878459ED8BE5087141ED745B4132FBC277C66B778F8436D1559C551F1D00EAABA4FC66840307FF571D
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-E0683.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):3787
    Entropy (8bit):5.05807076915668
    Encrypted:false
    SSDEEP:48:wtUq3iwfy+Ct2lwIk5WuWz1vWpPyLD6/3yBhrATtkm91s8t6niAQ4ozuh9AT7uht:waq3iwfyRJIcWuW1epGubBcnWr1GOy
    MD5:3F00A3411539996F33ED0B87F040037B
    SHA1:8DCC865536A01BB1BF3CD7A953FDD0BCB06FE5BF
    SHA-256:8EB39294F0D83A41FA4154A863B5B808BBB8301C08A2B901ED1A3F0DF27C03DE
    SHA-512:04432820BEE1DC14AB5FED233FF6FEAA2500B412A19CCF08D6E2D77809F0EB08C30AA4FBE662F28927A5857B53FAF9559E8777ACEE353A095D6B53E11EAF565A
    Malicious:false
    Preview://-----------------------------------------------------------------------------.// MurmurHash3 was written by Austin Appleby, and is placed in the public.// domain. The author hereby disclaims copyright to this source code...// Note - The x86 and x64 versions do _not_ produce the same results, as the.// algorithms are optimized for their respective platforms. You can still.// compile and run any of them on any platform, but your performance with the.// non-native version will be less than optimal...#ifdef _WIN32.#include <stddef.h>.typedef __int8 int8_t;.typedef unsigned __int8 uint8_t;.typedef unsigned __int16 uint16_t;.typedef unsigned __int32 uint32_t;.typedef unsigned __int64 uint64_t;.#elif (defined(SOLARIS) || defined(sun) || defined(HAVE_INTTYPES_H) \. || defined(BSD) || defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__NetBSD__) || defined(__FreeBSD_kernel__)).#include <inttypes.h>.#else.#include <stdint.h>.#endif..static uint32_t rotl32 ( uint32_t x, int8_t r ).{. re

    C:\Program Files\WinHTTrack\src\is-E7P90.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):1788
    Entropy (8bit):4.900918983151231
    Encrypted:false
    SSDEEP:24:nqRJiz7WtyPOkHMlCTbVO2ylFvP4/mFhxUwhkxKQYz8pWrsx8QBqtF2TIgbkCV11:qRC7iyZHc1FvPHUw6sQb3x8QQZ4JD1
    MD5:48C65952CE4A76ABDCD3266410F2314F
    SHA1:4F7E87AA0F94BC84D0F9906CF93838B1E2BBFBCD
    SHA-256:5872860C1788D4C2696FE23C80A8F27247C4234E25654FABD4483B2BCBAA5C26
    SHA-512:7B3A9E54401A64DAC6747EE20CBA08071B2EC36C98E99B9F28ED76E1249ED9D72FA27519166F2B262E6DAF11C68B219AD89B60DA094F4C997ABBB44D36FB2160
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-E9H01.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):3614
    Entropy (8bit):4.785599220149034
    Encrypted:false
    SSDEEP:96:qRC732p6jYQ70xwpx5N/8CA74iZDma0KJGN59rzPeh+bxqipR4ZbWSs4L:qRC7326jYQSwpx5N/8CA74iZDma0KJGu
    MD5:58010BF21F54D0610F805633767C6B18
    SHA1:26958C6865C7C3EBE09A17ED509BA92393736F62
    SHA-256:97721CCB1C4F86F5C0B7D5611395FD336ED50433A491298DF9F96A08F8327832
    SHA-512:75106605EBDEB19420D932F9F730ACCD245EB8315FC87EC4B2ED953825AA2CD89CBF7D5A72570213E9E6F67BCE6FEDD731CFCEA66D88B3370E52FF3071F2656F
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-EE1SB.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):27411
    Entropy (8bit):4.852458307193222
    Encrypted:false
    SSDEEP:384:qoL2HvQeNM4RYwjSwcnWmvrbtRJQKs8PAVgFfTOXm:7LabLSwq2JgF7B
    MD5:0481E03E72E9230A58A569E75CBD8D1B
    SHA1:904DDDC69E0DA5870DA0F962DEFE9DDA4155D944
    SHA-256:CDCE54231D15345A9DDAA2FC8E6ED3C02DC43B079BEC674B5021EE0D4E00EBA5
    SHA-512:973B9B12629A7E9DDBD4DFE6FDAD95DB4D7DCBD8DBEC1A248AB9AD79ACF15696BF066891A4A4351AC428E846BA865F6EEEC6D9F6C1B26F6F18936DB583BA6A54
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-ELF7E.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):13426
    Entropy (8bit):4.937262144408219
    Encrypted:false
    SSDEEP:192:qRC732g5tEZwS6kg7byWjuLtDxyV4aVK7yaFmyvWRAJK3VkTT3ld1dHddnd5BrfJ:qoL228YkgloyPcJT3JO9ZM
    MD5:7510463B147EE29FC6AE0D048D0C89C0
    SHA1:ED782072B0003ACD9F53B4DB997B82D777A06C07
    SHA-256:DB62E720DB1CBB730EC26F05F976A3BF83DD90BD7265A0E2B4B52DFD99B9D887
    SHA-512:169267D3391C97BF73EE6E70A384D38364E06B2BD0A53B7AB710B9ECB84585FEE2AD357206D8A6E32FB80608D3638286661A2FD9CE832F12AAD3538D5F8B7065
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-EMQTJ.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):2004
    Entropy (8bit):4.943957924208768
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUw6jZCQ105Mh/YReZ4fk:qRC732p6jYQ1YcZp
    MD5:B830824A32F26FEDF1031E2752797038
    SHA1:1B7290920284421B3E640EF3FDCF5046F25D6C75
    SHA-256:1B84F37EEF64BC6086ED88A025A65CBB6333EF25BE52578BF0E33F807859F792
    SHA-512:7664B8E13ADF2A6DBA1E90BC1EFA7B9781349F4BFBB4E438EA57F8672AF04BADE43723CE6F8C39A3018C6619E200E833419D6AFA25B672749F758AF3815142BF
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-FB1CG.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):8460
    Entropy (8bit):5.18326472893532
    Encrypted:false
    SSDEEP:192:H8GHQK7aeKrkcnbqFUh4mJ6OQ3KlWDQ8G5Hfxxug23EVLpswyM+aJBGyhoGuksn/:H7HQ8aeGBnXJ6OQCWDk5Hfxxug23EVLg
    MD5:41DC322A64ABB17C0A30F18E2426CBC8
    SHA1:EBCC70FCD5B9A93CF0B914A59F0347B9AD6BD6A5
    SHA-256:CD508BB72674C8C4903EF2BF6754F5800B9639D941AC460DA27DBA83D696F62E
    SHA-512:4480D1DB312BE02AAB23B60C0E7318ECAE94EF56D714F9E8E8B82A6C2D4024F4013F86ED597614AA49EDB97CDAC931A817AE37749410C445798C0D8487FAFA2B
    Malicious:false
    Preview:/*.* This code implements the MD5 message-digest algorithm..* The algorithm is due to Ron Rivest. This code was.* written by Colin Plumb in 1993, no copyright is claimed..* This code is in the public domain; do with it what you wish..*.* Equivalent code is available from RSA Data Security, Inc..* This code has been tested against that, and is equivalent,.* except that you don't need to include two pages of legalese.* with every copy..*.* To compute the message digest of a chunk of bytes, declare an.* MD5Context structure, pass it to MD5Init, call MD5Update as.* needed on buffers full of bytes, and then call MD5Final, which.* will fill a supplied 16-byte array with the digest..*/../* #include "config.h" */..#include <string.h> /* for memcpy() */.#include "md5.h"..static void byteReverse(unsigned char *buf, unsigned longs);../*.* Note: this code is harmless on little-endian machines..*/.#define byteSwap(a, b) do { \. a ^= b; \. b ^= a; \. a ^= b; \.} while(0).static void

    C:\Program Files\WinHTTrack\src\is-FLKUL.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):6120
    Entropy (8bit):4.439501071807133
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUwNiQp8Bqnt4U4Eb/pZvTY01195qipqZszQ6vbLsR+xfNkzV+w:qRC732pUQ6C6UZvzZLl/Gl3Uc02
    MD5:0F6F05117B91CFECA3A91B4A873C79A5
    SHA1:B0B3BEF3F34BCAC5A58F1D8158F82005A8569530
    SHA-256:28581A3D96200B2CE5E4F04643C18ED3A8E109F22FC789CECEC145AF578F1C99
    SHA-512:6A44D5C570338C62DE1DEC5B194046E67B177CD1BEC42ABE828F84EEABEBE7225AA554D283FCAFA95A20DEDD59AC5767B688A5DE53CF9DF95112A33EBAA49394
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-FQ85O.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):15582
    Entropy (8bit):4.561517143851487
    Encrypted:false
    SSDEEP:192:qRC732riQS6e3nyZG3mwbTHlxaaBaV0aF2nO2PV+eAMAJbck1SqVyvlyaG8zpkpr:qoL2SCs3mwbTFxFE1Mvd9XTaIwp
    MD5:D11F5FCA3A2DE377A639645E77245FA7
    SHA1:0E4068E2FD2DD09CAD5FA93D9FCD4A9C502F8C9B
    SHA-256:1FE86354DFEC0586A417EEF13123AE87B4755EA86500894CE36C6180FB2057E5
    SHA-512:FC9E9C5E0DFEBB46EA0EA407703ADC22539533483DC28D39E0027D55E953B82152B3BFC1261E6F3D4751FD1C3AB2919AC334B9193CD5EE6027984E686B779F08
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-G5VIA.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):88
    Entropy (8bit):4.34366834750546
    Encrypted:false
    SSDEEP:3:eKlg13wJMC0YJAVQM2TsBhQqWhaX7ATfvx:eKyh89JA6M2YBGtLZ
    MD5:31252C3D8BA16CF37FE31A5945105AA5
    SHA1:66CFE8FFFFBCB78620220B30C609D57D1D2C7409
    SHA-256:0BF8A6A7C8045CA0C4BDBB3B5EDA67F292CA606162AD3EB66AF95BEF60ECEAAA
    SHA-512:A2585764CC49409B19DCB33FEFD48CE32D7D8B4C54D1D70A9A7B08ED5CD592B950BFEE25C67B52B511C3D49218501C55335BD063B588F9810C201AE51933C968
    Malicious:false
    Preview:Typo :)..--Cette ligne, et les suivantes ci-dessous, seront ignor.es--..M htssafe.h.

    C:\Program Files\WinHTTrack\src\is-GP5P6.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):5448
    Entropy (8bit):4.941010143101136
    Encrypted:false
    SSDEEP:96:qRC732pMQPil6/yZREK4YukIZIYxg6yB3zWx2g:qRC732MQPil6/SREK4YVCIqyDc
    MD5:A7E731260B0FCF4F37401737DB6EC25F
    SHA1:438B30E7E465516A66459A1B0CC908E2342AA142
    SHA-256:5BC4F253653FC14D84F6577AF5EA5C9ABBE432708A8D5704BC51E54F7B718139
    SHA-512:0481C7CCF1F29E17C311F2B0776473782816BA01E9267400E757334B668B21D52436D2DE4EC84DD4E6E59E2268187CF22AE9C3A5283C2AB6039D32962569D13F
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-GPMLD.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):7467
    Entropy (8bit):4.81529825000216
    Encrypted:false
    SSDEEP:192:qRC732DQSJ6joGJagrkXGie9PYygPIqC/yNNr2HYus:qoL2qjBS2HYR
    MD5:9454A5714BFAE96FB4A006D7F9AE9CCD
    SHA1:383A225392A277FD7813F818228CA8AE715820D0
    SHA-256:7F6DD736CF18C77F01D7040003979FE9547E3A4537A2FC878D20F2D994861AD0
    SHA-512:2D5C263460889146B14AA35E4ABE561CC37EA03F7E49F42FDE4814A236DE6FE1CC695D8F321AFE0DAB55FD606AAEC2DC8B034B5F2605D3FC673052298E6BB906
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-H2T1C.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):20007
    Entropy (8bit):5.283229255764776
    Encrypted:false
    SSDEEP:384:qoL2WXL1rstu1JKS5wlOj5fo2kQZUM4QFIKIixzS90b:7LfTL5V0QSKn
    MD5:E050F035AE06DA21035850696CC137CC
    SHA1:D7C0D72C60856FA6F7B6EB6FE1B33325B24AA01A
    SHA-256:E07454F01D6516C5C89B503E7FC1DA2ABC842440A3C88024E879B39E223E6F23
    SHA-512:5FD8C5D194C5947D3D58A46B387E2A42B4BBD04EA92808D84DBB43148AB28D8502B5E617A1CC22753659CE8B89D1F5B3C61F87C6277BC30B17152AFCEB222C3B
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-I4Q2C.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):1170
    Entropy (8bit):5.1546093584029
    Encrypted:false
    SSDEEP:24:T63DWNwtGB1/Vi/Je7D/I9AlC87sQ/lwGxbaE:TYZs3t6IH/IB8bGE
    MD5:99EDCA6F5AD4D28F68CFAF61CBDBE62B
    SHA1:84CC172690FBE49E4EA4314AC614B1B92057AD3A
    SHA-256:9B0172682B3B52A3C7650CAA8307562865C8C42AA7772B6AAC891E85C126E482
    SHA-512:4D2C4392708792A86CB03D959E341F22DAC40E56FBDC3DE687817AC2BBFC02145E5C35995C4DB83BEADFEB1F5DA3C7E7DA1475CD57B6C58D8AD158D00B0027BF
    Malicious:false
    Preview:#ifndef MD5_H.#define MD5_H..#ifdef _WIN32.#ifndef SIZEOF_LONG.#define SIZEOF_LONG 4.#endif.#else.#include "config.h".#endif..#if SIZEOF_LONG==8.typedef unsigned int uint32;.#elif SIZEOF_LONG==4.typedef unsigned long uint32;.#else.#error undefined: SIZEOF_LONG.#endif..struct MD5Context {. union {. unsigned char ui8[64];. uint32 ui32[16];. } in;. uint32 buf[4];. uint32 bits[2];. int doByteReverse;.};..void MD5Init(struct MD5Context *context, int brokenEndian);.void MD5Update(struct MD5Context *context, unsigned char const *buf,. unsigned len);.void MD5Final(unsigned char digest[16], struct MD5Context *context);.void MD5Transform(uint32 buf[4], uint32 const in[16]);..int mdfile(char *fn, unsigned char *digest);.int mdbinfile(char *fn, unsigned char *bindigest);../* These assume a little endian machine and return incorrect results! .They are here for compatibility with old (broken) versions of RPM */.int mdfileBroken(char *fn, unsigned char *digest);.int mdbinfile

    C:\Program Files\WinHTTrack\src\is-IBLJI.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):29282
    Entropy (8bit):4.990593262873054
    Encrypted:false
    SSDEEP:384:qoL2aN0lydU1lQb/LZ4fRgTrIVsJ/mOXfWXF6RtISx2E01H:7Lh6fRg4+JeRXF63Ic2E2
    MD5:425C8CEC320DE26992A74E08928342D5
    SHA1:C9C2101580907AF5694BEE84BD49D8F99B5263A7
    SHA-256:806A137A95A85CE010C997ED3391C497D48D0CB18F9E3B9D87FF7500E4A24BE9
    SHA-512:81FF8016610F4372298294FDC66D60C96F4155507FB0E906243635A38BEBFA95101F29B8A3A437C3475CE73ABF37A1B9EE96E2278FDD9C7208DE390DEF8661F4
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-IBQLD.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):81673
    Entropy (8bit):4.593646328436326
    Encrypted:false
    SSDEEP:768:7LYzDYbOScR+itF0CaAfcYKqpxSUzl0L/BG++AsaAabIZTc9UcnAvqbmHEJ1vaIk:usOe6sG+PvIZTc9U9qbmHEJ1iC2vbl
    MD5:21B70740091DA0BCB08FB05186A9FD35
    SHA1:E90CE3EAAFEDE6DAD20F0AD788A61CEFD576617A
    SHA-256:183E00B0A9482587F33A8036E14E8BFD1861973FA0976FC0BA71BD270442C276
    SHA-512:489AEC58FD2727B750878B835178A9AE4874D43167718D6C2F48F3C200F83B5C3FE1EE35A687EA6C6D69DA67A0B3F62E2501A13342D3F4880F0899947BE4386D
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-IUF72.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):1925
    Entropy (8bit):4.913425826359884
    Encrypted:false
    SSDEEP:24:nqRJiz7WtyPOkHMlCTbVO2ylFvP4/mFhxUwhkjQLzXF2TIgbkKM0DP0xwYCYC1:qRC7iyZHc1FvPHUw6jQdZ4U0LKJ21
    MD5:ECF1B8A0DCBA00A314098045E3CE4563
    SHA1:7553D960735ED8C704A34B3C1E7B5207D01532EB
    SHA-256:5DC527DDC78DDF763E9D840F12BE2532EA502AB6A6B65A58438E39A53E018E81
    SHA-512:CC121691206ABC904487D9256FAC4D7619AA73D66E7BFCB8623B98C95F05976A11C32746735D1EEAC90FAF5A79BE72E818CC9B072357D65736AA6E1C12BD806C
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-JHS9G.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):1902
    Entropy (8bit):4.805286027104152
    Encrypted:false
    SSDEEP:24:nqRJiz7WtyPOkHMlCTbVO2ylFvP4/mFhxUwhkQQNvzFF2TIgbkPSXf3AStUsr7ia:qRC7iyZHc1FvPHUw6QQRZ4NvAStUQmna
    MD5:9B5C4AFF0BCE381A998CE200A1BD6247
    SHA1:AC3715F7F5B21AE4412E4D5E2E5035E22F260506
    SHA-256:42335CA1BAA1A9A665A9D29CA288ED9541FC48860DD8961006CD0DD5C0DA225F
    SHA-512:88608E5456F58EDF7A3ABED180C595F09B0F9C7001164796C3C93C940D7F3B3360725AB646FFB3887A4378026132A7512F838692DFB23F0AA19DAEF6A3F85170
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-JSRA8.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):206105
    Entropy (8bit):4.023323875409283
    Encrypted:false
    SSDEEP:1536:8foq+uS42vZ8yQO/awJeamcoaRVskOM0O1lozoM1NoOOLtL0FHtdiY/7Uhe7FHYN:8Qqc/1G1I0UY/dJ8Vfqex
    MD5:BEA5ED1F7965696B2B04B4DB10A000E6
    SHA1:AC3A91530E862FF6098395ED706EE5FCC1C417BA
    SHA-256:B2636B6B6D65A96ACC04EEBF82B8D80B3194FB2C93DF36D2F973ED186D285BD9
    SHA-512:BA98A47B8083661C1CB8E82F575C65428981E73F32BF222BF6A289F0EEC7B826FFA9C63FCD96AC900D71FA64B5EC97E574C572AD00AB3CB3B93C517BE24A8AEC
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-K8LVH.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):3051
    Entropy (8bit):4.939871674236105
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUw6OWQCJ002VMqfkr09YicxWyLZ4NvDixh3Die8Di5ZUDitHJA:qRC732p6OWQrqqcrqcxWyLZgvexh3eec
    MD5:2F12026E9036B40BD313778B6694F580
    SHA1:81D0C65E1ED1D707A56FA5349418F359167E9C4A
    SHA-256:BCAD9073BDE9862799DEF90546825D34AB8F46302F6A23B91394711400400B4A
    SHA-512:7061541339CD14F0F35DC4C6D6B8A33C1B1CDDF60CA842A3D479527861960B2B4F9F9366BEAF0D7F2CBCB29A4E2619194B4C14A903F12F61783F0F792DD2A654
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-KF29L.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):8096
    Entropy (8bit):5.054028081521917
    Encrypted:false
    SSDEEP:192:qRC732SWQ4CBeLG9qlzmkdlzh1U4xInK8YvsKnkC:qoL2tlF/8Cp
    MD5:F73E4418D9F41FF0F2C27AB9B97D0FE4
    SHA1:AD27A6B62F33CEEAE61E21698CC8104FAC948A77
    SHA-256:25F3E1E4A7BBC5C37D7D11167A1BD3A749CE3BCE695D57895FF262A4000DDEE7
    SHA-512:A9268B08AED21F6AE1FC8E1EFF0C71ACD61E2BBC3E18AC4B665BC79C6ABE25EEA4DC6EFC21A9B650D75A94B512BA1338A252B67395FDA7B330A49BFD7AD3FD8C
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-KIIUU.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):4459
    Entropy (8bit):5.043321291659529
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUw6fiQpDz0LKK0cvjnKM20p7oE0MfuZ4CUOu0tAnyeoyWzwzx2:qRC732p6qQNKcU4Zhru0FetyDL
    MD5:50312E36153E5B474C8EDB648F860D29
    SHA1:AAFDC6BC627082913422BB15D8E1BBAD83667B7D
    SHA-256:1D072B751044BE148E1B2914BB7E88BBAC396B1C519CE52AD15465FD5E864044
    SHA-512:006D4DD9136D5A51C8B2F6D87601C0D84E8451F6C4D88EDE4B859E0901C7D12439E8CF643E07CD5AE5355E0092A2D3F225892993E0DE049BA3922181D4CDD680
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-L348T.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):6878
    Entropy (8bit):5.118812740222004
    Encrypted:false
    SSDEEP:96:qRC732pd1zmQ70xhk/2rTqHwk9kW5pOz2x9YjTGTnIkcPJraNacokZEWH8:qRC732d1KQSW/2ffJWjjl/cPMNad
    MD5:A037037A15F257A5CED8D0E130CE717F
    SHA1:CEC0FD0DDE0FD75DD30DE8B5FE8B56297718DE9F
    SHA-256:38DFCF237A657E79EA8FEAB19093511243E73E46E89C62D798976DC843536413
    SHA-512:A476E8014773765763F360D0F6F7192FEADA8137684BBFD52FF365A9E2B280914CCEDED514C0565306D8007E864C651591B5455B9F42D0021926C3C421C2E7E6
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-L6R77.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text
    Category:dropped
    Size (bytes):41971
    Entropy (8bit):4.717823199034051
    Encrypted:false
    SSDEEP:768:7oTkucg7qo0ZhUB+XL2gq+PfeSRsS9F2BWg0GPFm//AvsE6qwlc9l:7oTtcg9ShUEXjq+PjDJ3cv
    MD5:864F4C1CC53427EB7AC8765D5CA8539B
    SHA1:24F73BE69B79930AE125FE34ED27CEF1C99352F8
    SHA-256:7913BF5CA5D2E1055ECABC5E45A3AC5F25A6643273E52D4EF5EDB88BA077FC08
    SHA-512:BD6FE82C410E8FEE847892CCBB5F5D40B29D041453EC1AFD7E2F4D7E54A1AFA79FF5AE912791C304D8E7AAEABE6CE03E5E60EC80F103B6E572E34AA80D69A0FF
    Malicious:false
    Preview:/*. -- htsentities.h --. FILE GENERATED BY ./htsentities.sh, DO NOT MODIFY.. We compute the LCG hash. (see <http://en.wikipedia.org/wiki/Linear_congruential_generator>). for each entity. We should in theory check using strncmp() that we. actually have the correct entity, but this is actually statistically. not needed... We may want to do better, but we expect the hash function to be uniform, and. let the compiler be smart enough to optimize the switch (for example by. checking in log2() intervals). . This code has been generated using the evil ./htsentities.sh script..*/..static int decode_entity(const unsigned int hash, const size_t len) {. switch(hash) {. /* nbsp 160 no-break space = non-breaking space, */. case 3948425267u:. if (len == 4 /* && strncmp(ent, "nbsp") == 0 */) {. return 160;. }. break;. /* iexcl 161 inverted exclamation mark, U+00A1 ISOnum */. case 1499591408u:. if (len == 5 /* && strncmp(ent, "iexcl") == 0 */) {. return 161;.

    C:\Program Files\WinHTTrack\src\is-LE3AT.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):2247
    Entropy (8bit):4.880113365480491
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUw6byQxZ4f0LKK0K7PwWyKYY:qRC732p6GQxZ8KctY
    MD5:0DBE9DA345C82E3083CC2EC5EF1994A3
    SHA1:51329692115598C5538559AAB6D0111007A83568
    SHA-256:D00B9B925FC30FB0DDBF08B24433AEF699F89782E9C4C691EC5C81F4D5A2BEE3
    SHA-512:8D691493FAD295E1FA28A62CEAAA082CCFB3104EB098B828502344689FC517098E6D50F943361D0C065C318C652790B2FD16E02204BF88C0D872837D201AEEF2
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-LS30R.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):7645
    Entropy (8bit):4.824453617852227
    Encrypted:false
    SSDEEP:192:GRC732bQdlIsUPQwSCb2VyBQRWiU/60ny4Hz1KjCco0RQUco:GoL2wexSVyBQ86s5Lo
    MD5:FAF6A7759526F33274E479C36050FD4B
    SHA1:4DB8BB6F4E737F7F151AC8A9D82039B2431BA390
    SHA-256:CC6F66F23F88B6AA108FAE7095A47FD109AADCBE6A451E5E094E18EBA67071E6
    SHA-512:E47453A4BEB8AB408CD6D3C93660E9E6ADCBF743944D960EB13507AD74E1035E18123214059A58D8567F4A56D2AFA1BDA1B5BD566EEA44CAF11D95B5B283A9B6
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2013 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-MEEQF.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:XML 1.0 document, ASCII text
    Category:dropped
    Size (bytes):11312
    Entropy (8bit):5.2127650509572705
    Encrypted:false
    SSDEEP:192:7GPI77WE+qGPK77DED2nyUGPrIT6+EsogGPNIT6sEukgdn:7Z76E+qv7PEKlJfEsj3BE8N
    MD5:2E024F2DFF2D2478C235BC04A4CD805B
    SHA1:EB7E4F0FD997FCC736CD36B8D5B16D39D9CA49CD
    SHA-256:C39642CDFB3366C2695433D3DC5CEDCEEDF80BF7512AC0B0A7130393962722AB
    SHA-512:C45E594BB16ABF1402AE0CCDC03EB626187113C7691A0B4F8ED7DA40EC94BCB4E441E9B29A172DAEEF130E33D37B464CB2C7D35C411353541100AA9D119838C1
    Malicious:false
    Preview:<?xml version="1.0" encoding="Windows-1252"?>.<VisualStudioProject..ProjectType="Visual C++"..Version="9,00"..Name="webhttrack"..ProjectGUID="{B2A68D1B-3EB3-4B16-B634-8D36AC4266EC}"..RootNamespace="webhttrack"..TargetFrameworkVersion="131072"..>..<Platforms>...<Platform....Name="Win32".../>...<Platform....Name="x64".../>..</Platforms>..<ToolFiles>..</ToolFiles>..<Configurations>...<Configuration....Name="Debug|Win32"....OutputDirectory="C:\temp\webhttrack\Debug"....IntermediateDirectory="C:\temp\webhttrack\Debug"....ConfigurationType="1"....InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops"....UseOfMFC="0"....ATLMinimizesCRunTimeLibraryUsage="false"....CharacterSet="2"....>....<Tool.....Name="VCPreBuildEventTool"..../>....<Tool.....Name="VCCustomBuildTool"..../>....<Tool.....Name="VCXMLDataGeneratorTool"..../>....<Tool.....Name="VCWebServiceProxyGeneratorTool"..../>....<Tool.....Name="VCMIDLTool".....TypeLibraryName=".\Debug/webhttrack.tlb".....HeaderFil

    C:\Program Files\WinHTTrack\src\is-MENI5.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):2221
    Entropy (8bit):4.920369700677255
    Encrypted:false
    SSDEEP:48:GRC7iyZHc1FvPHUwQ0QdoMIsjAPQw620rex80LKi0iRU1Xc:GRC732pZQdoMIsjAPQw62Cie1M
    MD5:97300932E48084DE51B2514B00196F8D
    SHA1:1EF97C6B9BDF9E03BA749521CFCC0B59B4369988
    SHA-256:47EB0BFD22A5E2AB3F6644F504D13976AD2389C3C7B976CFF1C5B6D064CDC036
    SHA-512:7F14E78EAF15EE0906B8DBB39F22F5A4220148B168EF570B89A30E117B335054329D2765B31E6182CD91F8DBB911BC2EE9FC6E3F16699CD73022B77B3B3093C0
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2013 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-ML423.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):3527
    Entropy (8bit):5.114799458887273
    Encrypted:false
    SSDEEP:96:oRC732poFdJ/SB+k70xM8XwmRMVI1yeMiRbyMhxV:oRC732oFdBSB+kSM8OhiRbyMhxV
    MD5:D8770C9DDB7D301E6808D7A68B668DBC
    SHA1:BA127D115E0136E1E8D1B49C2745BED54E1496F3
    SHA-256:7B38D80CB179D7143B30BEB57FB8BAA2BF39B2A7A2276A4A132A2C73A7DC3A03
    SHA-512:271EF21EBF0723F18BEF21BA5F3C4523F1A1AF88ABED4D30EFE70DF43115A0514CE0430F1018AA080D7C29FC76E5F33FC42E51343C3E2C0CE58A7A35DC03355E
    Malicious:false
    Preview:./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our work, and spoil the many hours we spent on it...Please visit our Web

    C:\Program Files\WinHTTrack\src\is-MQ1C4.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):4722
    Entropy (8bit):4.991024290903593
    Encrypted:false
    SSDEEP:96:qRC732p1QTdI7yrMuF+QuTw/tPEffmHcqEXiq:qRC7321QTdI7yfkbw/tPSfMdc
    MD5:5638D4151A021F070C0142DF7FBB9791
    SHA1:3180D828D6211D37F9CF1A46AD2F8FD8EE326322
    SHA-256:DDDE0909DA47C6A7FDC10ED12588A9B5C77255DBAD68F9070E48FEBFB57AEB0B
    SHA-512:CE67EE1FD2338CA41BAF5EA9D0FCC421E63792601C60466A0615F4C9747D4D1DE774ADA163CEDA3DA0C2AEDB50B5BC159253EC465C92918260D1067C8FF39DDC
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-N0FUS.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):2174
    Entropy (8bit):4.86930028704163
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUwfsQ9Z41JxuOl7oyr7z5:qRC732pfsQ9ZExuOlzd
    MD5:7325E4B1ABF066331BA37B593FAE4756
    SHA1:A152C4F47F6AD5F99F906D99694EF225805307A6
    SHA-256:5D12B6318569720E24A1D6D406019877C903FDF4CAB6A9F69DF8B065C2F4ABC9
    SHA-512:025F8D3F74ACDB64D2E28C24ECE9B3C363D53F21EB788769A8849B68FC4F97842B1FF8A90BC913F8C45DB40D7A61C2B41CF0F37E64CEDD891101CED542524C9E
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-NODTC.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):2056
    Entropy (8bit):5.087273848610651
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUwCpvP0czcahUf7Ec+kmkia0o7BplM5U1qZ4Rv91:qRC732pCpvPdIaGf7Ec+kmkiaPSmUZu
    MD5:65AAA657FCDB5CCA5F55DAB25164B0F2
    SHA1:9C5E1A75CC4768E5F91055909E0A7956E7B3ACB2
    SHA-256:D72983B2D1ABEA30F042C154756ED61D9F13DDF277AEB48DEBC7C678C1CE762F
    SHA-512:1AB741694EEDEE06C8062B5D67F7E03D87BDF252936C2BE11D363285CE4F7573944E62FCD7BDF0581F2968CB3721000AEEE4A2DB8132F16CFB71E6E4C7CEC58A
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-O6E3E.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):2296
    Entropy (8bit):5.1309686958920935
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUwDQH3RZ42hqJdjqhgyA:qRC732pDQH3RZxqDqhA
    MD5:021A01CB319FD716C92FF188F9CD16B1
    SHA1:3ABC23FFAE44119D9AF13ED04AEC26B3DFAFF443
    SHA-256:4EA5A2013BCF9898592FA1FC707015A8C2868E0EC35952E4E8F8934CE71F266B
    SHA-512:35E354EB8E04692F375EFD455C3F658B5C32E8600C71AE88123BDEA5C0FB785AF43E7724F3851B8E68E21E669D262AD677F3907813FFF95DD0B4F31F160B1459
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-O7ODN.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):34112
    Entropy (8bit):4.737720823633202
    Encrypted:false
    SSDEEP:384:qoL2akes/YU+knOlWgnRapkrTXyR2HY+oXb8ysU:7LMYHkOlWgnROkVY+oL8ysU
    MD5:C213C8AA2DD44B65C69ABC54E3B1E43E
    SHA1:22BD24A7BDD816739758C1C6AA526F8639E62D04
    SHA-256:B730DC38BA953885DDEE02DB9BAD3FD6BFD522A6C1110282EFBCDD503EE035A6
    SHA-512:9FC5893188934A88F91DC251638109D2B62B83EFAD62C2377CCFB5B570F97C73557D51A55BD3EA84EDB39A27C6E77DBBA29BEBA6144073F64B66AC8AD1922674
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-OIEP2.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text
    Category:dropped
    Size (bytes):514
    Entropy (8bit):3.8300683651962686
    Encrypted:false
    SSDEEP:12:zTYcBH2NDrKha5M0FcCseKvBCfvRgh6zCseKvBC8vRghv:zTWAsKCse0BCHa6Cse0BC+a5
    MD5:2B335E336719564A8EA819DD972F03E9
    SHA1:F13AD33AC92DA6FCEDBCFB28622B0D6BAD9D6A3C
    SHA-256:E7329DB9A55B309A4A5844A6CC70817DB2634F40BD4EC79F6A0ABF1C1992FEF9
    SHA-512:FCDA904D48A07C26A9BEBF4DA0E085AEE4E28C4C0002F9B4FFA8D008561A05549F5351FF649A310A9665FA5FB07462F575540C30CEC2D7A51EACB5E789E2040F
    Malicious:false
    Preview:Microsoft Developer Studio Workspace File, Format Version 6.00.# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!..###############################################################################..Project: "libhttrack"=.\libhttrack.dsp - Package Owner=<4>..Package=<5>.{{{.}}}..Package=<4>.{{{.}}}..###############################################################################..Global:..Package=<5>.{{{.}}}..Package=<3>.{{{.}}}..###############################################################################..

    C:\Program Files\WinHTTrack\src\is-OML73.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):20308
    Entropy (8bit):4.7548871805761985
    Encrypted:false
    SSDEEP:384:qoL2Ar+FHDMKssW2NrgN1WOIwkzYYCipDyKMUgCJQ1hDm3QGV0RLWuYaBVhqnboe:7LbyZy2um3faBVwnbolSWunb9/dd
    MD5:9CD463522598C68539EFE2D0E30A20FA
    SHA1:3C5437CEC429C1D3FAE922183556C92737C3B2B9
    SHA-256:99C31826923ACAFAFCD848A1960594DAF1B5558F2CF6918E9214215D0408049F
    SHA-512:B5146E45B4C66C81FBA4A44CC0DC430316D1C40E70AE11FF86EFCF47027BB4E9BD3454A7BC09B0A3DD29E91496A5CDFDCBF3281F2EA8CDFF32B3A065606FE18A
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-P6JHN.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):18635
    Entropy (8bit):4.879963467233371
    Encrypted:false
    SSDEEP:384:xritKB+FZYasgbmMBiwfZ8H2sym7bKW/jOFOVYH95wRi+s/16JVgV+:xZ+FzkMaH0m7H0Ets/w
    MD5:62C36E3BCC49AC1175C15C5536712AE6
    SHA1:5946C2D608F6FA6E65E9FD44005338766C8BE07C
    SHA-256:400C5D803D5E9442F3510347BE4D156DBAE2FF77114249A8E3B9987631AC9DF3
    SHA-512:6C1E51CBA8F3DE44746DB267E7002505B573156EE3C6B33782C3867C5A7770A641EB73F9728CC315C7D62B81BB523C0EFD958884E8BF1913A02CE3AC46CE3459
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.Coucal, Cuckoo hashing-based hashtable with stash area..Copyright (C) 2013-2014 Xavier Roche (http://www.httrack.com/).All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:..1. Redistributions of source code must retain the above copyright notice, this.list of conditions and the following disclaimer...2. Redistributions in binary form must reproduce the above copyright notice,.this list of conditions and the following disclaimer in the documentation.and/or other materials provided with the distribution...3. Neither the name of the copyright holder nor the names of its contributors.may be used to endorse or promote products derived from this software without.specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, IN

    C:\Program Files\WinHTTrack\src\is-QDUQR.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):1964
    Entropy (8bit):4.774816012030446
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUwejFdEI/SJ/+klbZ4G:qRC732poFdJ/SB+klbZ/
    MD5:5919B3D31393A640CC761E0E68B21C5B
    SHA1:36B35488B7ACA2ED66FB1FA92C7B1CF29E627A5A
    SHA-256:6DA9CAA0C50BBE8391B8F7433A72D6DD7A796566263C6EC332CE063F0E25B30D
    SHA-512:8D4AA180E5E8F6183C77CFCB179D9D39CF447F8FC7BCA4C981D91173531749DC81570895674FEF8B1E6C4B9802F94F57E000C07C741E651720EFF1D5B34B5ECD
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-QDVU7.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):34167
    Entropy (8bit):4.685456900433118
    Encrypted:false
    SSDEEP:384:qoL2mnLQ3BEydi06UWwFsba8OtrpKIezpMaAC9O+WTLiTXQi8rkuQN7oAAC+vG4i:7L0deFQ4avvUXF8R27oAACkTLDC
    MD5:BEC4AD3640021934450E6D9C90132DD6
    SHA1:A80A6AEAB2A228EE0F91D832D6F2205F054D9874
    SHA-256:E1281FE546EE591C01EB5A6E84D95A6650F91DCE77954AFA83685350F4BA7382
    SHA-512:62FF84E68D7A03E9ED76924C945896A608535B27AB23D997C18204C8BE135F6881897D6C3161E3A9251C6AFA0A901BD7766A5D2222D6DAF0D434AC31F2886B22
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-QOE38.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):2107
    Entropy (8bit):4.863767479251328
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUw6VmQ70x4zETpTzNvBcbK:qRC732p6sQ70x0ETpTx5yK
    MD5:E55919FE120E9E37156CFBB4468D15CF
    SHA1:F0C0DDEE0CD3CBD5C333D395BFE13941404E178E
    SHA-256:6F526E954BFCE03198648B02061177DEDF2DE63AEFE9EF0C2FEF536484793BFD
    SHA-512:416D30130DE597EB3E33E11682DC65282D2903516FFEDDC71BFE4D82C32F5297DD380EDE350FA8376EF2AB71A9700044BF99676553D61BC9849AA9E0557351F3
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-QS1DK.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):3039
    Entropy (8bit):5.227925601465192
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUwn4mnSDmbbJ6NYFQBEOthuthKCp30ZP6YOlgBTZ4s:qRC732pn4mnwDRC/p30ZPm+TZp
    MD5:2E87030AB936BDD97D517E3D4CECBB3A
    SHA1:FBA91728820367225DE3DB675E6213F6DA0E4D1A
    SHA-256:DE1B39F690F5D9956E16484D662C88E0E4B6601CAD6C48ECE5D37D1CCC443266
    SHA-512:037ED6CCBF633AFE17A6F25E2B919831937159D447178335254D10C5CADD017757EBE28154303025D3158AE2088CBCD1DA2C084247EAFA46943920E88FD6491D
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-RAGER.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):2521
    Entropy (8bit):5.043828910227986
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUw+LQpDo06PhnoXWWXrOUh0MpMkEOmlUb/pZv8A5dTU:qRC732poQejpoXW8rO2BwgZv/U
    MD5:B67570268CF9E9B355ACD41BF1EE371F
    SHA1:C9EB1CE37B9D7B5583100ADE2BBD8C2D2F69F7A7
    SHA-256:196BA9E7CD02C82B2971E3207410484D9ED071B40AD9FDFCD05B6BCE7896CF9C
    SHA-512:C97426F62131196981C4AB650F3E1424F1248AA5EC50B0963D968EF89D860376D20C2DFFC01EED0CF3A7059EE5A0A9A8758C635D6B9D20A43422920E1AEE6914
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-S60BP.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):8484
    Entropy (8bit):4.948191176938263
    Encrypted:false
    SSDEEP:192:qRC732qQX4rHsC4co5p2HYuUAiX1kzPgFmO3LdCHYuUFG0CiGG9eauS:qoL2b2HY3CHYLFteLS
    MD5:9A1E77437A04AA59D85451AB639BD425
    SHA1:3FF2C48400DB2AACAAEAF78C4E188CCA1C76BA9D
    SHA-256:F31BEECB40005C483D051174C35AE0A17507E60D6F738D141FAFBD91B8D46534
    SHA-512:FFCDCAB1D388542CB23AC4ED679C83F8560C31C233BB142CFD3FFFAF6454BF546277A5C12B990B612B7301CA1458E8344BAA6B8168EFB901D86A83641F045144
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-SNRV5.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):6086
    Entropy (8bit):5.057820756256785
    Encrypted:false
    SSDEEP:96:qRC732pqV/GQyUUioAQlLMme8hQZZUqSE2zyHZhWYbKLT5KdHG1GCBCWpGlf:qRC732qV/GQyUUioAQlLMmzS51ZIT4JR
    MD5:8195C0CA583E29C3AAC5D617B555537A
    SHA1:02516DD2E434ABABEDB8EEA26D2CD1178C3F407C
    SHA-256:76A24BFD517CB489B7B3FF28D9AD548E7B8C3BBD250B569E1F15D8458DAFA3C7
    SHA-512:87BEC4DF18ED4A45E761B0A66EDFFAEDF75514F93B5EB4B453CBCACAC13CDB02685F3A4AF5A836998C190D43AB684C6676B48070E91BAED18726C96A26C8193E
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-T2AOJ.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):53114
    Entropy (8bit):4.9137983898638184
    Encrypted:false
    SSDEEP:768:xZ+FTprTip3fYTeNeNm7BeAdfa5Lrczk4DbXPDkho6BJsE7KhEmp71fvG2:xcTKwTkeT8PQhNehn
    MD5:FE64D4532EA9BA7B062A8A8FDDF2BA74
    SHA1:403E7DB57289939C077243CF04A813BCAF89C634
    SHA-256:91C6D79A651D1052A393AD545B43901B3A9CDC770A14A0EE2B4E400E6952AB1A
    SHA-512:9E2740E6A1CBFDD2D9BA27702FDBE90163798D8492CB53BBC7278D83207C96D92615C0D1DF88553543CDF16FF9121D101340160FD130729C15F6ADC3E7A96275
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.Coucal, Cuckoo hashing-based hashtable with stash area..Copyright (C) 2013-2014 Xavier Roche (http://www.httrack.com/).All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:..1. Redistributions of source code must retain the above copyright notice, this.list of conditions and the following disclaimer...2. Redistributions in binary form must reproduce the above copyright notice,.this list of conditions and the following disclaimer in the documentation.and/or other materials provided with the distribution...3. Neither the name of the copyright holder nor the names of its contributors.may be used to endorse or promote products derived from this software without.specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, IN

    C:\Program Files\WinHTTrack\src\is-T6H63.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):1849
    Entropy (8bit):4.937437007875708
    Encrypted:false
    SSDEEP:24:nqRJiz7WtyPOkHMlCTbVO2ylFvP4/mFhxUwPz8Ni6Q4iJzQ9I0IyF2TIgbk1v:qRC7iyZHc1FvPHUwIN7Q4tx3Z4m
    MD5:52921885FEE6EFA48E2762F87A30CA80
    SHA1:15D3ADD3B6F56A1B6FEB37F374148ACB4D2E968B
    SHA-256:EDB1CB2507B4087E6AB5F94FCD18BECB1DEFFBB7C81BC9179A25D62AFF0DB1EB
    SHA-512:526D0B5E9CCB7D4439E317BEB3EA65A2C8CB990BB2F75E5166D3EDD4C53CF1E44C39950516899C1C40A61D1CD22E2301941C60A6B81DBBB088883A0B24634A8D
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-TARNO.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):13995
    Entropy (8bit):4.748591545146397
    Encrypted:false
    SSDEEP:192:La1WB33GDwgkEKFFWNtccxPgMh9GlUqfQXBCZaOiJE4k8hn6n3j3zFvAwpFoTL7I:m1WxGv7fHxZ+WtKaOim3j1AwpForWV
    MD5:E91151F6836812D3EDDD8628B63E72D6
    SHA1:1B49E62BB87BE5D3A65DEEB8EB566BA520948A4B
    SHA-256:6A3668BEA4B208E68406CC9E1766759D48B23B9A5B914B8E18AA0DD425E08EFE
    SHA-512:A13818ADC83ECE006447F2014003642AA8CFC33BC5F1A5F1D97802F00FC9436108E03B5BF1E3A12A495C8765E3CD591AEEE7809065937E755A05123243E4F0D8
    Malicious:false
    Preview:/*.punycode.c from RFC 3492.http://www.nicemice.net/idn/.Adam M. Costello.http://www.nicemice.net/amc/..This is ANSI C code (C89) implementing Punycode (RFC 3492)...*/..#include "punycode.h"../******************/./* Implementation */..#include <string.h>../*** Bootstring parameters for Punycode ***/..enum { base = 36, tmin = 1, tmax = 26, skew = 38, damp = 700,. initial_bias = 72, initial_n = 0x80, delimiter = 0x2D.};../* basic(cp) tests whether cp is a basic code point: */.#define basic(cp) ((punycode_uint)(cp) < 0x80)../* delim(cp) tests whether cp is a delimiter: */.#define delim(cp) ((cp) == delimiter)../* decode_digit(cp) returns the numeric value of a basic code */./* point (for use in representing integers) in the range 0 to */./* base-1, or base if cp is does not represent a value. */..static punycode_uint decode_digit(punycode_uint cp) {. return cp - 48 < 10 ? cp - 22 : cp - 65 < 26 ? cp - 65 : cp - 97 <. 26 ? cp - 97 : base;.}../* encode_digit(d,flag) returns the b

    C:\Program Files\WinHTTrack\src\is-TEQB0.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):841
    Entropy (8bit):4.190499563639701
    Encrypted:false
    SSDEEP:12:zTYcgcg2NDrXMejzzjXEvunEczz34FZpzb:zacpJBPzjSmz3s3zb
    MD5:54EDFF199BC67A1AC751EC3709AC48F6
    SHA1:7CA59B576E298751DA8CFBCF58A4A4008175DE38
    SHA-256:A7E4A31A7B26639C0DFFA346B7F2B90D75F19116D9ACD0326580BFF0CCA918D1
    SHA-512:73A0CE3FE12BC29A78D616BA9ADA9452F5091D6DF434E1887D5DDB6C8B406E36E212FC607801FFF515A487789747958B83F98F305AAB5E99E103DF6F288DC234
    Malicious:false
    Preview:Microsoft Developer Studio Workspace File, Format Version 6.00..# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!....###############################################################################....Project: "libhttrack"=..\libhttrack\libhttrack.dsp - Package Owner=<4>....Package=<5>..{{{..}}}....Package=<4>..{{{..}}}....###############################################################################....Project: "webhttrack"=.\webhttrack.dsp - Package Owner=<4>....Package=<5>..{{{..}}}....Package=<4>..{{{.. Begin Project Dependency.. Project_Dep_Name libhttrack.. End Project Dependency..}}}....###############################################################################....Global:....Package=<5>..{{{..}}}....Package=<3>..{{{..}}}....###############################################################################....

    C:\Program Files\WinHTTrack\src\is-TG3BN.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):5365
    Entropy (8bit):5.133560996693489
    Encrypted:false
    SSDEEP:96:qRC732p+fQ70xfYO0Okt3k76TLT9rjrd6x8b+MksjPqLtasGkVVzt:qRC732+fQSkt3k+1jr0x8b+eG4sGKj
    MD5:F7C93DFCEC8A8DE1F0140388F29C6CE7
    SHA1:359313E88DBA1ABFBD001BE4981301683926EDE1
    SHA-256:597102D9145A8F9E982572B990E95EBA8D91A8341668E88A769F9B1EAAB59D6F
    SHA-512:367AE484D25833FC2E5ADF1BC797DEBF14780A9E160095FCD8DD4EFEE8CDBF0FD4B86CEEAEC35FF3013299415E6C9946CAE8761B2DDA118F0712A28F9936FF32
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-TK8AC.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:makefile script, ASCII text, with very long lines (418)
    Category:dropped
    Size (bytes):97861
    Entropy (8bit):5.6481747718238635
    Encrypted:false
    SSDEEP:1536:maSKW8Jz/ihWHLVPaHpzKmTiAcWJJHhaIzH/vvsvE2TRDvlJ6zprS2PVNnV39eRe:maz/kWrVPaHpzXTiAc+svE2TRDvlJ6zt
    MD5:CD0BF0B2853BB18EE224DCF39CD5B0FB
    SHA1:AB96DCAC5510449DC2A4FE69FCBC3BB995106686
    SHA-256:23AA58CD60BB2AB0ABC8E580667FBEA7A9DA58C1447B59B3C978D5D92A2700FD
    SHA-512:9231DF0550CB19914B68688D9B79BBA301EE7BE7FCFCFC6CAE1DD2EC1ADBBBBD2C6A9A8F1BEC3E8BBF3CEB5B0BD115C86FAE2A590CA09F3A43FFC2801CA8AF28
    Malicious:false
    Preview:# Makefile.in generated by automake 1.14.1 from Makefile.am..# @configure_input@..# Copyright (C) 1994-2013 Free Software Foundation, Inc...# This Makefile.in is free software; the Free Software Foundation.# gives unlimited permission to copy and/or distribute it,.# with or without modifications, as long as this notice is preserved...# This program is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY, to the extent permitted by law; without.# even the implied warranty of MERCHANTABILITY or FITNESS FOR A.# PARTICULAR PURPOSE...@SET_MAKE@.....VPATH = @srcdir@.am__is_gnu_make = test -n '$(MAKEFILE_LIST)' && test -n '$(MAKELEVEL)'.am__make_running_with_option = \. case $${target_option-} in \. ?) ;; \. *) echo "am__make_running_with_option: internal error: invalid" \. "target option '$${target_option-}' specified" >&2; \. exit 1;; \. esac; \. has_opt=no; \. sane_makeflags=$$MAKEFLAGS; \. if $(am__is_gnu_make); then \. sane_mak

    C:\Program Files\WinHTTrack\src\is-TRQKA.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:XML 1.0 document, ASCII text
    Category:dropped
    Size (bytes):8590
    Entropy (8bit):5.231087667371481
    Encrypted:false
    SSDEEP:96:1qf2uiYWRsCm0u+qf28iYDsYmnu6qf2eCt2snizB0uzqIlqf2kCt2snwNBnuzqIc:wO5GCmTOnhYmiObZuBINOlZWB9wK
    MD5:A6E29ECC6806BDFC2881D9453887CFDB
    SHA1:C76B45491B0DA067EEA6FA61F3BC7B8CF211D2B5
    SHA-256:9A43C7DBBDCB7ED35C7D40D9DFB906564BDB79859788279C67803835056DBC93
    SHA-512:CD79A97C6CFBC77DF439539A01BA1750104F2D04DE1C17DF017432EE9D129505E2E245DD32818FCD1B509FA53622D513D8FC4E94EF2C4B25D13CD4BF2AA5F825
    Malicious:false
    Preview:<?xml version="1.0" encoding="Windows-1252"?>.<VisualStudioProject..ProjectType="Visual C++"..Version="9,00"..Name="htsjava"..ProjectGUID="{2F353408-2C6C-4D31-9AC0-08BDC064DF64}"..RootNamespace="htsjava"..Keyword="Win32Proj"..TargetFrameworkVersion="131072"..>..<Platforms>...<Platform....Name="Win32".../>...<Platform....Name="x64".../>..</Platforms>..<ToolFiles>..</ToolFiles>..<Configurations>...<Configuration....Name="Debug|Win32"....OutputDirectory="C:\temp\htsjava\Debug"....IntermediateDirectory="C:\temp\htsjava\Debug"....ConfigurationType="2"....InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops"....CharacterSet="2"....>....<Tool.....Name="VCPreBuildEventTool"..../>....<Tool.....Name="VCCustomBuildTool"..../>....<Tool.....Name="VCXMLDataGeneratorTool"..../>....<Tool.....Name="VCWebServiceProxyGeneratorTool"..../>....<Tool.....Name="VCMIDLTool"..../>....<Tool.....Name="VCCLCompilerTool".....Optimization="0".....AdditionalIncludeDirectories="C:\Dev\open

    C:\Program Files\WinHTTrack\src\is-U51MN.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text
    Category:dropped
    Size (bytes):8501
    Entropy (8bit):5.294455771465972
    Encrypted:false
    SSDEEP:192:msYrIGl0TYQL/cO0H/ZRE/LSbre40eYGR:msOIGaZL/cO0fqLYe4h
    MD5:44CB15506F9CDAB4AA59C084895FC46C
    SHA1:234B0E3E7149EAD6812DBFE16DFE1A225ABD7AA6
    SHA-256:B0DB935DE0BCFE24614D97FDA628D8E880E1D1B9EB8F5FB8D8FB8005E76DA077
    SHA-512:1020077758D091ABA3095914C0A2DF376B38C803B0BAF9A259DA5CB5C23BACC4BDB20D38555D7B42BF7C84DCC74D7DF2B0CE11B150EE6E68336AE2406F8D628E
    Malicious:false
    Preview:# Microsoft Developer Studio Project File - Name="libhttrack" - Package Owner=<4>.# Microsoft Developer Studio Generated Build File, Format Version 6.00.# ** DO NOT EDIT **..# TARGTYPE "Win32 (x86) Dynamic-Link Library" 0x0102..CFG=libhttrack - Win32 Debug.!MESSAGE This is not a valid makefile. To build this project using NMAKE,.!MESSAGE use the Export Makefile command and run.!MESSAGE .!MESSAGE NMAKE /f "libhttrack.mak"..!MESSAGE .!MESSAGE You can specify a configuration when running NMAKE.!MESSAGE by defining the macro CFG on the command line. For example:.!MESSAGE .!MESSAGE NMAKE /f "libhttrack.mak" CFG="libhttrack - Win32 Debug".!MESSAGE .!MESSAGE Possible choices for configuration are:.!MESSAGE .!MESSAGE "libhttrack - Win32 Release" (based on "Win32 (x86) Dynamic-Link Library").!MESSAGE "libhttrack - Win32 Debug" (based on "Win32 (x86) Dynamic-Link Library").!MESSAGE ..# Begin Project.# PROP AllowPerConfigDependencies 0.# PROP Scc_ProjName "".# PROP Scc_LocalPath "".CPP=cl.exe.MTL

    C:\Program Files\WinHTTrack\src\is-U8F0K.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):5914
    Entropy (8bit):4.850526157643613
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUw6dQa0LKK04egc0LeRM0rex80GliZ44fPuVsVifvQesM7injp:qRC732p6dQaKMECWZMmGvQdtmgKTG
    MD5:1D4693951897AB449F2EC5C3BE9A1101
    SHA1:771C664C25E208F5A6284EAE008E55B17D49D76B
    SHA-256:1D194560D634E75FA2782C819AA27D69E87BDF7CBD4E844DC7DEF0590684B83B
    SHA-512:3349FBB84BDC454E3C23650A7A7727AEE0AD812F8AEB3D081517626A3118D733944A841A358184613BE22171EB289869C6B0B44EF6A6FB4C636F6270B82366C4
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-UD1A1.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):3786
    Entropy (8bit):4.818586957420824
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUw6OPQdZ43Q0LKK0LeRM0GlrgTrlMDgZm99MbdeHp61:qRC732p6mQdZgQKEngTh7/eHpK
    MD5:C4269092151547B67723A9CAF34CAB23
    SHA1:76AB6454FF57FF601626577348CC972C56E940D1
    SHA-256:F7954D005499F87BD57045E9D58175B61CD6C9AAAE8A1679C690711A1A96BA46
    SHA-512:D4AF19B9A944160355CB5388A51FE5D39DE2569194E4017C247D83A7F1C6B32D988D14E2FEB1C780EEB70E4028E8FB74A265C19371BB11643289E9823FD84DDD
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-UFEQA.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):3438
    Entropy (8bit):4.8062165574540305
    Encrypted:false
    SSDEEP:48:qRC7iyZHc1FvPHUwdQIv2eFNxGaJG1nlksuaJG1nlhYqHrBnlsTCBnl3qdOs:qRC732pdQG7Bs1lkIs1lqqHVlsTGl3qZ
    MD5:9867733089E0892C9CF69FA9290494F3
    SHA1:48BC080A510BCBB76B69021D1CE7566F40BF68D2
    SHA-256:12EA8E827D092927C5AF1C3A97A4CF2F44D9CC389C8150A95ABE79E25D6F9266
    SHA-512:CC45350635EFE21B76AD03585FED7C303A7C4A50E7A65B76008A73BD406EE53498A175600C3E1623D686C85D90D1FC94672C91734F6A90493F02A5FFCE6F88D7
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-UJKK4.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text
    Category:dropped
    Size (bytes):110386
    Entropy (8bit):3.491050127994881
    Encrypted:false
    SSDEEP:3072:kpiFVniBO713ViMMfGbkCWA9YiYJ6rXq22fJIYHiikrUE5LySAItGb2IJXgxGajP:kpiFVniBO713ViMMfGbkCWA9YiYJAXqW
    MD5:38189E353A89DD63F65F7E7467315274
    SHA1:E1D3A4301620CD2E26146759D775677347941121
    SHA-256:D0197B0940801655012F7828625F2D49E3F472BECFA742031F177C5F06A95AFF
    SHA-512:9E9D621FB5B5DC2C33E95C82EEE43E6F8251AB977F74E0530C4F4E33BD3AEC564853359E82356BF51E3BFE252AB67F3BE4FF6C2EF83C7040EB414382EE1B187F
    Malicious:false
    Preview:/** GENERATED FILE (/temp/httrack-3.47.21/src/htsbasiccharsets.sh), DO NOT EDIT **/../* Table for 8859-10.TXT */.static const hts_UCS4 table_iso_8859_10[256] = {. 0x0000, 0x0001, 0x0002, 0x0003, 0x0004, 0x0005, 0x0006, 0x0007, . 0x0008, 0x0009, 0x000a, 0x000b, 0x000c, 0x000d, 0x000e, 0x000f, . 0x0010, 0x0011, 0x0012, 0x0013, 0x0014, 0x0015, 0x0016, 0x0017, . 0x0018, 0x0019, 0x001a, 0x001b, 0x001c, 0x001d, 0x001e, 0x001f, . 0x0020, 0x0021, 0x0022, 0x0023, 0x0024, 0x0025, 0x0026, 0x0027, . 0x0028, 0x0029, 0x002a, 0x002b, 0x002c, 0x002d, 0x002e, 0x002f, . 0x0030, 0x0031, 0x0032, 0x0033, 0x0034, 0x0035, 0x0036, 0x0037, . 0x0038, 0x0039, 0x003a, 0x003b, 0x003c, 0x003d, 0x003e, 0x003f, . 0x0040, 0x0041, 0x0042, 0x0043, 0x0044, 0x0045, 0x0046, 0x0047, . 0x0048, 0x0049, 0x004a, 0x004b, 0x004c, 0x004d, 0x004e, 0x004f, . 0x0050, 0x0051, 0x0052, 0x0053, 0x0054, 0x0055, 0x0056, 0x0057, . 0x0058, 0x0059, 0x005a, 0x005b, 0x005c, 0x005d, 0x005e, 0x005f, . 0x0060, 0x0061, 0x0062, 0x0063,

    C:\Program Files\WinHTTrack\src\is-UPOFD.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):9691
    Entropy (8bit):5.444962884876827
    Encrypted:false
    SSDEEP:192:qRC732aQeRAeuavB08bK6BArMZ0Kqd970uWV59Q:qoL2lH8bK6BAADTQ
    MD5:A57320455161A8E4321B4643293C4D5F
    SHA1:6DDCB8B87E86F22ADDD2A4896AAFE1167EEA20FE
    SHA-256:DAF44CE0CACCBAB1BBF746C351376928794BE25757110E5DDACB87CDACFC5B78
    SHA-512:4C15E9102E2F561AFC1518C6A93E47EB723A17F252CC89097AE021AFEB2BDD33545746D43AA359DF07177FA855B60CA140DF360A494897BA65F2D20281B80C5E
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\is-V1DLV.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):4417
    Entropy (8bit):4.436296577223246
    Encrypted:false
    SSDEEP:96:LZ3iDrsIx61HSbZCkOt76PIxmPyNWBtesCopM6+bJwcrANuEbEIMVgOyQ8:LZSnsb1HSbZCkOtGPIxGyNWBteNiM6+w
    MD5:587870545AF07ED61E8B02A4C5B872C0
    SHA1:94DF3C4952D01D1157A84ECA151818BB79E4D3D5
    SHA-256:826543A4D6013CCA7C18CD70B248DA28ACEA45A5382A0BC39FEFBE1BECA7FCD9
    SHA-512:E9D6F4FE8EFB9CCA2B1FD3F97E5653F5AA6AA7A0E9A1B8D6D36CDC75467AE9A4EB566012F62A8FA4C8F846A02A8076C692AB4379B5B1000135BCF35842EDB57A
    Malicious:false
    Preview:/*.punycode.c from RFC 3492.http://www.nicemice.net/idn/.Adam M. Costello.http://www.nicemice.net/amc/..This is ANSI C code (C89) implementing Punycode (RFC 3492)...*/..#ifndef PUNYCODE_COSTELLO_RFC3492_H.#define PUNYCODE_COSTELLO_RFC3492_H../********************/./* Public interface */..#include <limits.h>..typedef enum punycode_status {. punycode_success,. punycode_bad_input, /* Input is invalid. */. punycode_big_output, /* Output would exceed the space provided. */. punycode_overflow /* Input needs wider integers to process. */.} punycode_status;..#if UINT_MAX >= (1 << 26) - 1.typedef unsigned int punycode_uint;.#else.typedef unsigned long punycode_uint;.#endif../* punycode_encode() converts Unicode to Punycode. The input */./* is represented as an array of Unicode code points (not code */./* units; surrogate pairs are not allowed), and the output */./* will be represented as an array of ASCII code points. The

    C:\Program Files\WinHTTrack\src\is-VUG0T.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):58567
    Entropy (8bit):4.235196971231774
    Encrypted:false
    SSDEEP:384:qoL26oHSMupsVY0I+Y3z6ijZ5ipERL12Ft/jkZxHMVhNcYyXcTLahTRQKaaau7G7:7LVpke9UpERL1BxVTGPT
    MD5:3531DFD5A3E33352BC36DC77B4D1147D
    SHA1:C4CC8A5FB0E0DC230A8315BA545EE66BCC7F92CB
    SHA-256:1181592BCFF1D67FC1169F9E10C675B1C2E77A4CD93A645F8AF6EDD414D1EB85
    SHA-512:4337D6280B25AED9ACA3A671165DFB53AA4A3382814B0BEAF758E66D2185485C6B58A8C3F39F33E1088F3A06F17F65A80C9DD0F198D573F017310F498B181475
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src\libhttrack.dsp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text
    Category:dropped
    Size (bytes):8501
    Entropy (8bit):5.294455771465972
    Encrypted:false
    SSDEEP:192:msYrIGl0TYQL/cO0H/ZRE/LSbre40eYGR:msOIGaZL/cO0fqLYe4h
    MD5:44CB15506F9CDAB4AA59C084895FC46C
    SHA1:234B0E3E7149EAD6812DBFE16DFE1A225ABD7AA6
    SHA-256:B0DB935DE0BCFE24614D97FDA628D8E880E1D1B9EB8F5FB8D8FB8005E76DA077
    SHA-512:1020077758D091ABA3095914C0A2DF376B38C803B0BAF9A259DA5CB5C23BACC4BDB20D38555D7B42BF7C84DCC74D7DF2B0CE11B150EE6E68336AE2406F8D628E
    Malicious:false
    Preview:# Microsoft Developer Studio Project File - Name="libhttrack" - Package Owner=<4>.# Microsoft Developer Studio Generated Build File, Format Version 6.00.# ** DO NOT EDIT **..# TARGTYPE "Win32 (x86) Dynamic-Link Library" 0x0102..CFG=libhttrack - Win32 Debug.!MESSAGE This is not a valid makefile. To build this project using NMAKE,.!MESSAGE use the Export Makefile command and run.!MESSAGE .!MESSAGE NMAKE /f "libhttrack.mak"..!MESSAGE .!MESSAGE You can specify a configuration when running NMAKE.!MESSAGE by defining the macro CFG on the command line. For example:.!MESSAGE .!MESSAGE NMAKE /f "libhttrack.mak" CFG="libhttrack - Win32 Debug".!MESSAGE .!MESSAGE Possible choices for configuration are:.!MESSAGE .!MESSAGE "libhttrack - Win32 Release" (based on "Win32 (x86) Dynamic-Link Library").!MESSAGE "libhttrack - Win32 Debug" (based on "Win32 (x86) Dynamic-Link Library").!MESSAGE ..# Begin Project.# PROP AllowPerConfigDependencies 0.# PROP Scc_ProjName "".# PROP Scc_LocalPath "".CPP=cl.exe.MTL

    C:\Program Files\WinHTTrack\src\libhttrack.dsw (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text
    Category:dropped
    Size (bytes):514
    Entropy (8bit):3.8300683651962686
    Encrypted:false
    SSDEEP:12:zTYcBH2NDrKha5M0FcCseKvBCfvRgh6zCseKvBC8vRghv:zTWAsKCse0BCHa6Cse0BC+a5
    MD5:2B335E336719564A8EA819DD972F03E9
    SHA1:F13AD33AC92DA6FCEDBCFB28622B0D6BAD9D6A3C
    SHA-256:E7329DB9A55B309A4A5844A6CC70817DB2634F40BD4EC79F6A0ABF1C1992FEF9
    SHA-512:FCDA904D48A07C26A9BEBF4DA0E085AEE4E28C4C0002F9B4FFA8D008561A05549F5351FF649A310A9665FA5FB07462F575540C30CEC2D7A51EACB5E789E2040F
    Malicious:false
    Preview:Microsoft Developer Studio Workspace File, Format Version 6.00.# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!..###############################################################################..Project: "libhttrack"=.\libhttrack.dsp - Package Owner=<4>..Package=<5>.{{{.}}}..Package=<4>.{{{.}}}..###############################################################################..Global:..Package=<5>.{{{.}}}..Package=<3>.{{{.}}}..###############################################################################..

    C:\Program Files\WinHTTrack\src\libhttrack.vcproj (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:XML 1.0 document, ASCII text
    Category:dropped
    Size (bytes):49343
    Entropy (8bit):5.121137181125374
    Encrypted:false
    SSDEEP:384:GqOdcT8qdQ0IAdZzyRdRhB0y0XUEsB0y0XUE1B0y0XUEDB0y0XUEZB0y0XUEkB0P:FOZqaAmR1
    MD5:AD0555A464DDC2363815399251C05F34
    SHA1:F01099B47BEABD5FCB94EAD782972A3B30B87902
    SHA-256:F690459FB53F9C20B92E149B94D4A199026A0448A78B8D1206F9300FCEDF9068
    SHA-512:34BCDF321AE4A0DC97B1960374DB58200BA3A404DE606F6389AEC8505E280E5BFA1E3DC8473CFB11A8262D9C4C7B935AB592FBD5AE19229D37786173A83E165D
    Malicious:false
    Preview:<?xml version="1.0" encoding="Windows-1252"?>.<VisualStudioProject..ProjectType="Visual C++"..Version="9,00"..Name="libhttrack"..ProjectGUID="{E76AD871-54C1-45E8-A657-6117ADEFFB46}"..RootNamespace="libhttrack"..TargetFrameworkVersion="131072"..>..<Platforms>...<Platform....Name="Win32".../>...<Platform....Name="x64".../>..</Platforms>..<ToolFiles>..</ToolFiles>..<Configurations>...<Configuration....Name="Release|Win32"....OutputDirectory="C:\temp\Releaselib"....IntermediateDirectory="C:\temp\Releaselib"....ConfigurationType="2"....InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops"....UseOfMFC="0"....ATLMinimizesCRunTimeLibraryUsage="false"....CharacterSet="2"....>....<Tool.....Name="VCPreBuildEventTool"..../>....<Tool.....Name="VCCustomBuildTool"..../>....<Tool.....Name="VCXMLDataGeneratorTool"..../>....<Tool.....Name="VCWebServiceProxyGeneratorTool"..../>....<Tool.....Name="VCMIDLTool".....PreprocessorDefinitions="NDEBUG".....MkTypLibCompatible="true"..

    C:\Program Files\WinHTTrack\src\md5.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):8460
    Entropy (8bit):5.18326472893532
    Encrypted:false
    SSDEEP:192:H8GHQK7aeKrkcnbqFUh4mJ6OQ3KlWDQ8G5Hfxxug23EVLpswyM+aJBGyhoGuksn/:H7HQ8aeGBnXJ6OQCWDk5Hfxxug23EVLg
    MD5:41DC322A64ABB17C0A30F18E2426CBC8
    SHA1:EBCC70FCD5B9A93CF0B914A59F0347B9AD6BD6A5
    SHA-256:CD508BB72674C8C4903EF2BF6754F5800B9639D941AC460DA27DBA83D696F62E
    SHA-512:4480D1DB312BE02AAB23B60C0E7318ECAE94EF56D714F9E8E8B82A6C2D4024F4013F86ED597614AA49EDB97CDAC931A817AE37749410C445798C0D8487FAFA2B
    Malicious:false
    Preview:/*.* This code implements the MD5 message-digest algorithm..* The algorithm is due to Ron Rivest. This code was.* written by Colin Plumb in 1993, no copyright is claimed..* This code is in the public domain; do with it what you wish..*.* Equivalent code is available from RSA Data Security, Inc..* This code has been tested against that, and is equivalent,.* except that you don't need to include two pages of legalese.* with every copy..*.* To compute the message digest of a chunk of bytes, declare an.* MD5Context structure, pass it to MD5Init, call MD5Update as.* needed on buffers full of bytes, and then call MD5Final, which.* will fill a supplied 16-byte array with the digest..*/../* #include "config.h" */..#include <string.h> /* for memcpy() */.#include "md5.h"..static void byteReverse(unsigned char *buf, unsigned longs);../*.* Note: this code is harmless on little-endian machines..*/.#define byteSwap(a, b) do { \. a ^= b; \. b ^= a; \. a ^= b; \.} while(0).static void

    C:\Program Files\WinHTTrack\src\md5.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):1170
    Entropy (8bit):5.1546093584029
    Encrypted:false
    SSDEEP:24:T63DWNwtGB1/Vi/Je7D/I9AlC87sQ/lwGxbaE:TYZs3t6IH/IB8bGE
    MD5:99EDCA6F5AD4D28F68CFAF61CBDBE62B
    SHA1:84CC172690FBE49E4EA4314AC614B1B92057AD3A
    SHA-256:9B0172682B3B52A3C7650CAA8307562865C8C42AA7772B6AAC891E85C126E482
    SHA-512:4D2C4392708792A86CB03D959E341F22DAC40E56FBDC3DE687817AC2BBFC02145E5C35995C4DB83BEADFEB1F5DA3C7E7DA1475CD57B6C58D8AD158D00B0027BF
    Malicious:false
    Preview:#ifndef MD5_H.#define MD5_H..#ifdef _WIN32.#ifndef SIZEOF_LONG.#define SIZEOF_LONG 4.#endif.#else.#include "config.h".#endif..#if SIZEOF_LONG==8.typedef unsigned int uint32;.#elif SIZEOF_LONG==4.typedef unsigned long uint32;.#else.#error undefined: SIZEOF_LONG.#endif..struct MD5Context {. union {. unsigned char ui8[64];. uint32 ui32[16];. } in;. uint32 buf[4];. uint32 bits[2];. int doByteReverse;.};..void MD5Init(struct MD5Context *context, int brokenEndian);.void MD5Update(struct MD5Context *context, unsigned char const *buf,. unsigned len);.void MD5Final(unsigned char digest[16], struct MD5Context *context);.void MD5Transform(uint32 buf[4], uint32 const in[16]);..int mdfile(char *fn, unsigned char *digest);.int mdbinfile(char *fn, unsigned char *bindigest);../* These assume a little endian machine and return incorrect results! .They are here for compatibility with old (broken) versions of RPM */.int mdfileBroken(char *fn, unsigned char *digest);.int mdbinfile

    C:\Program Files\WinHTTrack\src\minizip\ChangeLogUnzip (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1697
    Entropy (8bit):4.924168565042047
    Encrypted:false
    SSDEEP:48:5TQjheF7i66fjO9aJIGgNSR6Vui1x/Ssn:khec66fjMnSQL15
    MD5:203B6E16F5CF5F67F409E5A1B0D675A2
    SHA1:EFF95707307C50F62244A02C5827B82475B1FBFC
    SHA-256:3C4795EED1DC687379949A50EBB786EE11E4E22D33436E20515F88A9BC1162F1
    SHA-512:6B21038B88688AF092B929A722C6AC5A9D5E80D73F973C3A96AE66056964D9644DBD525675AFA4A5470A2BFD6F18AD1840E705A7A2D933FB136F519F9FB61922
    Malicious:false
    Preview:Change in 1.00: (10 sept 03)..- rename to 1.00..- cosmetic code change....Change in 0.22: (19 May 03)..- crypting support (unless you define NOCRYPT)..- append file in existing zipfile....Change in 0.21: (10 Mar 03)..- bug fixes....Change in 0.17: (27 Jan 02)..- bug fixes....Change in 0.16: (19 Jan 02)..- Support of ioapi for virtualize zip file access....Change in 0.15: (19 Mar 98)..- fix memory leak in minizip.c....Change in 0.14: (10 Mar 98)..- fix bugs in minizip.c sample for zipping big file..- fix problem in month in date handling..- fix bug in unzlocal_GetCurrentFileInfoInternal in unzip.c for.. comment handling....Change in 0.13: (6 Mar 98)..- fix bugs in zip.c..- add real minizip sample....Change in 0.12: (4 Mar 98)..- add zip.c and zip.h for creates .zip file..- fix change_file_date in miniunz.c for Unix (Jean-loup Gailly)..- fix miniunz.c for file without specific record for directory....Change in 0.11: (3 Mar 98)..- fix bug in unzGetCurrentFileInfo for get extra field an

    C:\Program Files\WinHTTrack\src\minizip\MiniZip64_Changes.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text
    Category:dropped
    Size (bytes):109
    Entropy (8bit):4.680347896421445
    Encrypted:false
    SSDEEP:3:5yMKcSE3LJtMTusyh6VFNpcMePo1khdH:AXEF+Tusm6VFfcBo1khd
    MD5:EC302A2B5E19AF31263CE77260DD49D0
    SHA1:CB10D2AF06D59532C6D462AB0DBD2B79C55A5834
    SHA-256:302C62B328647F5472FB7755249A83459BE7F8FFB1FAE07E8BA318FCE8F4126C
    SHA-512:DA87D3C077EAEB350232E4AE9AE786887C29EC10F971FD3E029C7CB1799CEBD216E6651C2FEE2A5F23CAAFF8C52D5F2AE094E791EE3B002082F2BBEDB57E82BB
    Malicious:false
    Preview:.MiniZip 1.1 was derrived from MiniZip at version 1.01f..Change in 1.0 (Okt 2009). - **TODO - Add history**..

    C:\Program Files\WinHTTrack\src\minizip\MiniZip64_info.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text
    Category:dropped
    Size (bytes):3048
    Entropy (8bit):4.738412966409047
    Encrypted:false
    SSDEEP:48:6ZirpN+UDPW3ZdH+nQYDZs1sO/KZh2mXHsVKXSIDts03/jeb/bh6KMTp4/z3j0:duZ0S7yZh2mX/XSEsIK34
    MD5:AB61E7D58C5C7114A6C531CE36CCC3E5
    SHA1:E1F5511BBDF9715BB2F18E4D24924CCA3275FB24
    SHA-256:122719C32EF1763A5F6BA9C8CDEFC1D78A76F7156B09E7B6F69B73F968E0DAC3
    SHA-512:2CF91199C88192AB3DA748F652FA58C99CAE83AB7D84EC49A132AB39FE7BB83443685B55EC6E7852F602A6ED67AFE19998842DE1CBC19AFA652535EE59E9E7D2
    Malicious:false
    Preview:MiniZip - Copyright (c) 1998-2010 - by Gilles Vollant - version 1.1 64 bits from Mathias Svensson..Introduction.---------------------.MiniZip 1.1 is built from MiniZip 1.0 by Gilles Vollant ( http://www.winimage.com/zLibDll/minizip.html )..When adding ZIP64 support into minizip it would result into risk of breaking compatibility with minizip 1.0..All possible work was done for compatibility....Background.---------------------.When adding ZIP64 support Mathias Svensson found that Even Rouault have added ZIP64 .support for unzip.c into minizip for a open source project called gdal ( http://www.gdal.org/ )..That was used as a starting point. And after that ZIP64 support was added to zip.c.some refactoring and code cleanup was also done....Changed from MiniZip 1.0 to MiniZip 1.1.---------------------------------------.* Added ZIP64 support for unzip ( by Even Rouault ).* Added ZIP64 support for zip ( by Mathias Svensson ).* Reverted some changed that Even Rouault did..* Bunch of patches re

    C:\Program Files\WinHTTrack\src\minizip\crypt.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):4735
    Entropy (8bit):4.966689728090298
    Encrypted:false
    SSDEEP:96:RVk2y4ZsP+RBn7VogVLaQg0x5aS5LzbfziQTI6wfZ8fZrj:RW0n7PVLaQg0xHb7iQs6AZkZrj
    MD5:6E72C46776F0DB175EC8F15144A3C250
    SHA1:94F289E1B0403B01289B10C6B32ED7D1471FA0CA
    SHA-256:8E872B60255B8447DA99885C7159C2E1F1BB8143523BDBE71784E60F98BFD67B
    SHA-512:DFF681B1881286126B3F12F4F10CD6E37105232363793D6E0B1CD1FDDC2FAFD1175245A4F715C5768B41DB0F97A94D6A5C370370B7AF475905130D13B3DD453A
    Malicious:false
    Preview:/* crypt.h -- base code for crypt/uncrypt ZIPfile... Version 1.01e, February 12th, 2005.. Copyright (C) 1998-2005 Gilles Vollant.. This code is a modified version of crypting code in Infozip distribution.. The encryption/decryption parts of this source code (as opposed to the. non-echoing password parts) were originally written in Europe. The. whole source package can be freely distributed, including from the USA.. (Prior to January 2000, re-export from the US was a violation of US law.).. This encryption code is a direct transcription of the algorithm from. Roger Schlafly, described by Phil Katz in the file appnote.txt. This. file (appnote.txt) is distributed with the PKZIP program (even in the. version without encryption capabilities)... If you don't need crypting in your application, just define symbols. NOCRYPT and NOUNCRYPT... This code support the "Traditional PKWARE Encryption"... The new AES encryption added on Zip format by Winzip (see the page.

    C:\Program Files\WinHTTrack\src\minizip\ioapi.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):8629
    Entropy (8bit):5.095011077975582
    Encrypted:false
    SSDEEP:192:3J82LRIiaGxFyKUycXyjUhC33EC3f539N3LQWevQEp2sG3K03Ie3aht/9x1RuhtJ:582LfQht/9x1RuhtbRx1RR
    MD5:E7FA8173386F38099C38D21F1C1C7527
    SHA1:ADC7E410FEC8100B7F3004F0AC13EF52CD48DEE7
    SHA-256:E2C5E33EEBD9DDCFFAF20048722A25F61E6CA6B3C6CDAC449E4FBCDE76946D96
    SHA-512:9B8547B12069288AA79673B2BD2DB978E6CE37AA0A5469ACA48B096647FF5D0793153BF34F1B5F36C09E46871797C8F9D4177F88402619B1312922CC7C0BA86E
    Malicious:false
    Preview:/* ioapi.h -- IO base function header for compress/uncompress .zip. part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html ).. Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html ).. Modifications for Zip64 support. Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com ).. For more info read MiniZip_info.txt..*/..#if defined(_WIN32) && (!(defined(_CRT_SECURE_NO_WARNINGS))). #define _CRT_SECURE_NO_WARNINGS.#endif..#if defined(__APPLE__) || defined(__ANDROID__) || defined(IOAPI_NO_64).// In darwin and perhaps other BSD variants off_t is a 64 bit value, hence no need for specific 64 bit functions.#define FOPEN_FUNC(filename, mode) fopen(filename, mode).#define FTELLO_FUNC(stream) ftello(stream).#define FSEEKO_FUNC(stream, offset, origin) fseeko(stream, offset, origin).#else.#define FOPEN_FUNC(filename, mode) fopen64(filename, mode).#define FTELLO_FUNC(stream) ftello64(stream

    C:\Program Files\WinHTTrack\src\minizip\ioapi.c.diff (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:unified diff output, ASCII text
    Category:dropped
    Size (bytes):2926
    Entropy (8bit):5.085786796410659
    Encrypted:false
    SSDEEP:48:zwv6PJLFjPsdbEj9u28Da9QIX+LjeoIdkljotnz7znzhzcbzHzjzpnzdzgbzHzjG:zy6PJLVPqk90L9IrnzNQTvxJETvG
    MD5:EAD6F04B65B8D39E0003D8C5FFBE8B9B
    SHA1:D65185734AFE18DC9158A7E858A4D6BF99189C8C
    SHA-256:AF6D79D8E374E8D7FA64E39975686AA1A7C972487E25D91F3DC7E4388A46B0F9
    SHA-512:7092480B3F85B76F5C8373AFBD8DE5081A47C1D68AC10316176EDE1DCC1859448F6D82F1E56887A3F966FC32743A4C7BA3E021D96122F1A282B9E17B6271A4E7
    Malicious:false
    Preview:--- ioapi.c.orig.2014-06-10 18:55:32.778807408 +0200.+++ ioapi.c.2014-06-22 12:22:06.606696274 +0200.@@ -14,7 +14,7 @@. #define _CRT_SECURE_NO_WARNINGS. #endif. .-#if defined(__APPLE__) || defined(IOAPI_NO_64).+#if defined(__APPLE__) || defined(__ANDROID__) || defined(IOAPI_NO_64). // In darwin and perhaps other BSD variants off_t is a 64 bit value, hence no need for specific 64 bit functions. #define FOPEN_FUNC(filename, mode) fopen(filename, mode). #define FTELLO_FUNC(stream) ftello(stream).@@ -73,6 +73,7 @@. p_filefunc64_32->zfile_func64.zerror_file = p_filefunc32->zerror_file;. p_filefunc64_32->zfile_func64.zread_file = p_filefunc32->zread_file;. p_filefunc64_32->zfile_func64.zwrite_file = p_filefunc32->zwrite_file;.+ p_filefunc64_32->zfile_func64.zflush_file = p_filefunc32->zflush_file;. p_filefunc64_32->zfile_func64.ztell64_file = NULL;. p_filefunc64_32->zfile_func64.zseek64_file = NULL;. p_filefunc64_32->zfile_func64.zclose_file = p_filefunc32-

    C:\Program Files\WinHTTrack\src\minizip\ioapi.c.orig (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):8225
    Entropy (8bit):5.096155745837525
    Encrypted:false
    SSDEEP:192:3J82eIiaGxFyKTycXyjUhC33EC3f539N3LQWevQEp2603Ie39ht/91RuhtbR1RR:582ySht/91RuhtbR1RR
    MD5:E8A6CC43207A37D631D9E90BBEC6E6ED
    SHA1:2846A21BA725DA90AA3A67024D8107DAA793F5F7
    SHA-256:66B39C27042F6AD12CC12EFB0C82CDF100C6640B5FA959B8B866E252966113A9
    SHA-512:92811AEDB5FB0C9A60FCBA4C5BD4B718DE98FAF6A8D65CE16A7F580D97B23D7B9B2A2CC2E79BCAB503645E45A8E2F81882411B426A575C6B58C489616E5E9A58
    Malicious:false
    Preview:/* ioapi.h -- IO base function header for compress/uncompress .zip. part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html ).. Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html ).. Modifications for Zip64 support. Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com ).. For more info read MiniZip_info.txt..*/..#if defined(_WIN32) && (!(defined(_CRT_SECURE_NO_WARNINGS))). #define _CRT_SECURE_NO_WARNINGS.#endif..#if defined(__APPLE__) || defined(IOAPI_NO_64).// In darwin and perhaps other BSD variants off_t is a 64 bit value, hence no need for specific 64 bit functions.#define FOPEN_FUNC(filename, mode) fopen(filename, mode).#define FTELLO_FUNC(stream) ftello(stream).#define FSEEKO_FUNC(stream, offset, origin) fseeko(stream, offset, origin).#else.#define FOPEN_FUNC(filename, mode) fopen64(filename, mode).#define FTELLO_FUNC(stream) ftello64(stream).#define FSEEKO_FUNC(st

    C:\Program Files\WinHTTrack\src\minizip\ioapi.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):7798
    Entropy (8bit):5.138889762643193
    Encrypted:false
    SSDEEP:192:338vbwKxShaKEUZcec1GvXRUUG2weJ7JcmcuHtg:n8q9EUZcecsvXRxG2weJ7qZt
    MD5:A4DAC867A80298BFDBDC2D3A375E5352
    SHA1:CB679F78A6531A9FD7867E24DFDBD95237C8FA80
    SHA-256:B599ACC2BA2B5BDBDD36A59CF6E00A77DE58595320029E846351F94D8C6640BB
    SHA-512:3D96AF5F18AB044BA87616D784DA5A65CC2B1B120512C1535286580E3A2C8D9CDDEC20EEE544EBEE0FE40D05A7FA3640690432F771B1A8E4075CC341E058EB33
    Malicious:false
    Preview:/* ioapi.h -- IO base function header for compress/uncompress .zip. part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html ).. Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html ).. Modifications for Zip64 support. Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com ).. For more info read MiniZip_info.txt.. Changes.. Oct-2009 - Defined ZPOS64_T to fpos_t on windows and u_int64_t on linux. (might need to find a better why for this). Oct-2009 - Change to fseeko64, ftello64 and fopen64 so large files would work on linux.. More if/def section may be needed to support other platforms. Oct-2009 - Defined fxxxx64 calls to normal fopen/ftell/fseek so they would compile on windows.. (but you should use iowin32.c for windows instead)..*/..#ifndef _ZLIBIOAPI64_H.#define _ZLIBIOAPI64_H..#if (!defined(_WIN32)) && (!defined(WIN32)) &&

    C:\Program Files\WinHTTrack\src\minizip\ioapi.h.diff (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:unified diff output, ASCII text
    Category:dropped
    Size (bytes):2658
    Entropy (8bit):5.114899560272486
    Encrypted:false
    SSDEEP:48:n/3jTLmHYjNpC4PSFj7hEoEvRmt8GmfOYeRTlHFD+bG0:nLTaHYjvCYSFj7hE9v2lK
    MD5:DE5B2F59AAB379EFB4AE18852561D827
    SHA1:BE6DA4EFD5BE8031800FAC1847065693B3918EF9
    SHA-256:A5B0B39B29C997D3258C5C883C21B00350BCCD359BADA572116CBC6365186214
    SHA-512:2391D446FC3A4F2CAAB363C43E76436D7466974275EE7A8B6C91E3615DB9AB9ECD37926C41E4D2BC1C9B49C4D3454B8A1131C67A8467B1EB97A20CAF865C7D59
    Malicious:false
    Preview:--- ioapi.h.orig.2012-01-17 03:51:31.000000000 +0100.+++ ioapi.h.2014-06-08 21:54:18.326360527 +0200.@@ -67,6 +67,24 @@. #endif. #endif. .+/* As reported by sammyx, z_crc_t and z_const are not defined in pre-1.2.70 releases of zlib */.+/* See <https://github.com/madler/zlib/commit/6c9bd474aa08312ef2e2e9655a80e18db24a1680#diff-d466aa66f7e453e0c8a7719229cff391R391> */.+#if ZLIB_VERNUM < 0x1270.+.+#ifdef Z_U4.+ typedef Z_U4 z_crc_t;.+#else.+ typedef unsigned long z_crc_t;.+#endif.+.+#if defined(ZLIB_CONST) && !defined(z_const).+# define z_const const.+#else.+# define z_const.+#endif.+.+#endif.+. /*. #ifndef ZPOS64_T. #ifdef _WIN32.@@ -135,6 +153,7 @@. typedef voidpf (ZCALLBACK *open_file_func) OF((voidpf opaque, const char* filename, int mode));. typedef uLong (ZCALLBACK *read_file_func) OF((voidpf opaque, voidpf stream, void* buf, uLong size));. typedef uLong (ZCALLBACK *write_file_func) OF((voidpf opaque, voidpf stream, const void* buf, uLong size));.+typed

    C:\Program Files\WinHTTrack\src\minizip\ioapi.h.orig (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):7051
    Entropy (8bit):5.112346950194113
    Encrypted:false
    SSDEEP:96:3G4T8vYLU5Tvwjmv5SUTcec1GvXRUUGSfj7GJ7J5VhADAcj0Itg:338vbwKxSKcec1GvXRUUG2SJ7JnIHtg
    MD5:7D6C0585719BA47FD356795801BEFC6D
    SHA1:E71518AE9F172EAB44A2D8F52B3F80B0552070D5
    SHA-256:8655408534B78DC0889A45F9359FC6D2D5C8E8D8443B81EDE596F954C720EF48
    SHA-512:8844D699389B22515C9D31C181A8B2BC7AC6A355865D43117AA93DB37FB049EDDB88F63355221A5B702E1DA59848D2DCBC579F81E2C3DBDF4634EF37E2293C48
    Malicious:false
    Preview:/* ioapi.h -- IO base function header for compress/uncompress .zip. part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html ).. Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html ).. Modifications for Zip64 support. Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com ).. For more info read MiniZip_info.txt.. Changes.. Oct-2009 - Defined ZPOS64_T to fpos_t on windows and u_int64_t on linux. (might need to find a better why for this). Oct-2009 - Change to fseeko64, ftello64 and fopen64 so large files would work on linux.. More if/def section may be needed to support other platforms. Oct-2009 - Defined fxxxx64 calls to normal fopen/ftell/fseek so they would compile on windows.. (but you should use iowin32.c for windows instead)..*/..#ifndef _ZLIBIOAPI64_H.#define _ZLIBIOAPI64_H..#if (!defined(_WIN32)) && (!defined(WIN32)) &&

    C:\Program Files\WinHTTrack\src\minizip\iowin32.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):14148
    Entropy (8bit):5.17163474188404
    Encrypted:false
    SSDEEP:384:TPh3br1qC9rrMU0yBurYju2FoiLt/LTHVLtfHTHXtfHTHLtfHTHR:TPh3br1qC9rrMU0y8rYju2FoiLt/LTH1
    MD5:390EE0CCDBB1C4CA430E8DC82404625F
    SHA1:58DFEC8630A3842B6689C077E81407A575DE418C
    SHA-256:0B9C9A609F24CD8DD63E5DB732EFD0B6FF49815166DFC58DDD202B1570B49A8B
    SHA-512:2B166EE632CB2F9D4675639AC28A1FF488EE201A4DC0F804D43E967C7AF71EEA3918A6564947D6C85D77743D5A5DB2D96495C8D52393017DC1E877CFA5BE379B
    Malicious:false
    Preview:/* iowin32.c -- IO base function header for compress/uncompress .zip. Version 1.1, February 14h, 2010. part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html ).. Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html ).. Modifications for Zip64 support. Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com ).. For more info read MiniZip_info.txt..*/..#include <stdlib.h>..#include "zlib.h".#include "ioapi.h".#include "iowin32.h"..#ifndef INVALID_HANDLE_VALUE.#define INVALID_HANDLE_VALUE (0xFFFFFFFF).#endif..#ifndef INVALID_SET_FILE_POINTER.#define INVALID_SET_FILE_POINTER ((DWORD)-1).#endif...#if defined(WINAPI_FAMILY_PARTITION) && (!(defined(IOWIN32_USING_WINRT_API))).#if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_APP).#define IOWIN32_USING_WINRT_API 1.#endif.#endif..voidpf ZCALLBACK win32_open_file_func OF((voidpf opaque, const char* filename, int mode));.uLong ZCALLBACK win32

    C:\Program Files\WinHTTrack\src\minizip\iowin32.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):851
    Entropy (8bit):5.067864462297095
    Encrypted:false
    SSDEEP:12:UsL1ybN7uTTsHhzJ6iDTc1VEPwzZFpYGqIsAhAZia+AfIa+AdDa+AxxakL:yVvPTsmPwJnswAZz+AfR+As+AxMkL
    MD5:818E2950CC00D787EAA9B710007DC53F
    SHA1:4FEDF239AFAFC20E420C5FEC678DBA91C1DD0074
    SHA-256:586F22B9C3C64DA253CE2B518E0FAD61F19A7B47B289FC704CC9708242294C49
    SHA-512:C222972E5BE2C69AC1EECF38F4DA10BD20D33AA76EBD55CB1A1E3D8EE761B99DFC3F9CC82868A63517342DCF99E4B0645B0FBC9F5D9EEBC704F1C7E9DB4B7309
    Malicious:false
    Preview:/* iowin32.h -- IO base function header for compress/uncompress .zip. Version 1.1, February 14h, 2010. part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html ).. Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html ).. Modifications for Zip64 support. Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com ).. For more info read MiniZip_info.txt..*/..#include <windows.h>...#ifdef __cplusplus.extern "C" {.#endif..void fill_win32_filefunc OF((zlib_filefunc_def* pzlib_filefunc_def));.void fill_win32_filefunc64 OF((zlib_filefunc64_def* pzlib_filefunc_def));.void fill_win32_filefunc64A OF((zlib_filefunc64_def* pzlib_filefunc_def));.void fill_win32_filefunc64W OF((zlib_filefunc64_def* pzlib_filefunc_def));..#ifdef __cplusplus.}.#endif.

    C:\Program Files\WinHTTrack\src\minizip\is-03U5C.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):15704
    Entropy (8bit):3.9776475661782884
    Encrypted:false
    SSDEEP:192:usZm4/ZjV9Gf/lsziVyMhoGfc5eMkt77w:5IfrPEeMkt77w
    MD5:E2067124D539336FA48F8E1ADC0A9592
    SHA1:920B468935E5B29F8D753F5F32EA2A3D0E22303F
    SHA-256:5BA30A7FE05A86D343CD3518FDC1DDCF445B8DB9D99CAA2D22D51828020B93F7
    SHA-512:8A021E4BDDD69DDD35E17ED55BEB09F833F341268C2295F0BA7E42F0848F7F6FDB5D52B4E7F01EC6ECD5F204FBD068D91A303E15C7CDD499079DF540DB32C0D1
    Malicious:false
    Preview:/* zip.h -- IO on .zip files using zlib. Version 1.1, February 14h, 2010. part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html ).. Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html ).. Modifications for Zip64 support. Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com ).. For more info read MiniZip_info.txt.. ---------------------------------------------------------------------------.. Condition of use and distribution are the same than zlib :.. This software is provided 'as-is', without any express or implied. warranty. In no event will the authors be held liable for any damages. arising from the use of this software... Permission is granted to anyone to use this software for any purpose,. including commercial applications, and to alter it and redistribute it. freely, subject to the following restrictions:.. 1. The origin of this software must not be

    C:\Program Files\WinHTTrack\src\minizip\is-116R4.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):17763
    Entropy (8bit):4.64331439069436
    Encrypted:false
    SSDEEP:192:mC8+w4FE7bhEVm6bcJehQa0/LT43GQUQLmyU27Rjts2PKzKcynUiaQ2h02mavmek:P8HKm6hTfELhmau+tm0nLPayi
    MD5:254FE0695464D4CBBAA1FDC0C83C6A3C
    SHA1:54E7B5392EE6600C91C9C423561941A571AAF715
    SHA-256:CED49F20C62536A8FFB270B35CFA4994A1DCDCE45F8CF059B941C94CA0022666
    SHA-512:5556907726C13484697E6261A1AB5D4F96313755B87FB10B5A8163533CA39FFB97545C6206BB106DDC3CE122118934EF270806CB36C803C02195F345B712E7BA
    Malicious:false
    Preview:/*. miniunz.c. Version 1.1, February 14h, 2010. sample part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html ).. Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html ).. Modifications of Unzip for Zip64. Copyright (C) 2007-2008 Even Rouault.. Modifications for Zip64 support on both zip and unzip. Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com ).*/..#if (!defined(_WIN32)) && (!defined(WIN32)) && (!defined(__APPLE__)). #ifndef __USE_FILE_OFFSET64. #define __USE_FILE_OFFSET64. #endif. #ifndef __USE_LARGEFILE64. #define __USE_LARGEFILE64. #endif. #ifndef _LARGEFILE64_SOURCE. #define _LARGEFILE64_SOURCE. #endif. #ifndef _FILE_OFFSET_BIT. #define _FILE_OFFSET_BIT 64. #endif.#endif..#ifdef __APPLE__.// In darwin and perhaps other BSD variants off_t is a

    C:\Program Files\WinHTTrack\src\minizip\is-1BOAJ.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):851
    Entropy (8bit):5.067864462297095
    Encrypted:false
    SSDEEP:12:UsL1ybN7uTTsHhzJ6iDTc1VEPwzZFpYGqIsAhAZia+AfIa+AdDa+AxxakL:yVvPTsmPwJnswAZz+AfR+As+AxMkL
    MD5:818E2950CC00D787EAA9B710007DC53F
    SHA1:4FEDF239AFAFC20E420C5FEC678DBA91C1DD0074
    SHA-256:586F22B9C3C64DA253CE2B518E0FAD61F19A7B47B289FC704CC9708242294C49
    SHA-512:C222972E5BE2C69AC1EECF38F4DA10BD20D33AA76EBD55CB1A1E3D8EE761B99DFC3F9CC82868A63517342DCF99E4B0645B0FBC9F5D9EEBC704F1C7E9DB4B7309
    Malicious:false
    Preview:/* iowin32.h -- IO base function header for compress/uncompress .zip. Version 1.1, February 14h, 2010. part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html ).. Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html ).. Modifications for Zip64 support. Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com ).. For more info read MiniZip_info.txt..*/..#include <windows.h>...#ifdef __cplusplus.extern "C" {.#endif..void fill_win32_filefunc OF((zlib_filefunc_def* pzlib_filefunc_def));.void fill_win32_filefunc64 OF((zlib_filefunc64_def* pzlib_filefunc_def));.void fill_win32_filefunc64A OF((zlib_filefunc64_def* pzlib_filefunc_def));.void fill_win32_filefunc64W OF((zlib_filefunc64_def* pzlib_filefunc_def));..#ifdef __cplusplus.}.#endif.

    C:\Program Files\WinHTTrack\src\minizip\is-1M2J2.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):8629
    Entropy (8bit):5.095011077975582
    Encrypted:false
    SSDEEP:192:3J82LRIiaGxFyKUycXyjUhC33EC3f539N3LQWevQEp2sG3K03Ie3aht/9x1RuhtJ:582LfQht/9x1RuhtbRx1RR
    MD5:E7FA8173386F38099C38D21F1C1C7527
    SHA1:ADC7E410FEC8100B7F3004F0AC13EF52CD48DEE7
    SHA-256:E2C5E33EEBD9DDCFFAF20048722A25F61E6CA6B3C6CDAC449E4FBCDE76946D96
    SHA-512:9B8547B12069288AA79673B2BD2DB978E6CE37AA0A5469ACA48B096647FF5D0793153BF34F1B5F36C09E46871797C8F9D4177F88402619B1312922CC7C0BA86E
    Malicious:false
    Preview:/* ioapi.h -- IO base function header for compress/uncompress .zip. part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html ).. Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html ).. Modifications for Zip64 support. Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com ).. For more info read MiniZip_info.txt..*/..#if defined(_WIN32) && (!(defined(_CRT_SECURE_NO_WARNINGS))). #define _CRT_SECURE_NO_WARNINGS.#endif..#if defined(__APPLE__) || defined(__ANDROID__) || defined(IOAPI_NO_64).// In darwin and perhaps other BSD variants off_t is a 64 bit value, hence no need for specific 64 bit functions.#define FOPEN_FUNC(filename, mode) fopen(filename, mode).#define FTELLO_FUNC(stream) ftello(stream).#define FSEEKO_FUNC(stream, offset, origin) fseeko(stream, offset, origin).#else.#define FOPEN_FUNC(filename, mode) fopen64(filename, mode).#define FTELLO_FUNC(stream) ftello64(stream

    C:\Program Files\WinHTTrack\src\minizip\is-2AGUA.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):708
    Entropy (8bit):4.553169076480384
    Encrypted:false
    SSDEEP:12:Uz4ZJ9UR4rlLL8ABAy45HpbtktQNLsZKWxm8hYzSLV612Ty:nZIR4BLIMs3CpY+9Ty
    MD5:7CAAC7503F8F002D61E0F0E5B7F33BC6
    SHA1:907243F7CEA46D38AD12F6A6D6E01ADB4D74F1B3
    SHA-256:6F82C52279E8F79165F4446BE652E5741A49992AC58632470335AA34C564072A
    SHA-512:9C9E3317C5D102383D44391C5B12BC665FA36247D22C58C7ED7913C54F14AB0CF21EDF6D3EB5C3FA15B256AFA7813DDD3021CC49D50264CBEF1E997ACE257FC3
    Malicious:false
    Preview:/*. Additional tools for Minizip. Code: Xavier Roche '2004. License: Same as ZLIB (www.gzip.org).*/..#ifndef _zip_tools_H.#define _zip_tools_H..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _ZLIB_H.#include "zlib.h".#endif..#include "unzip.h"../* Repair a ZIP file (missing central directory). file: file to recover. fileOut: output file after recovery. fileOutTmp: temporary file name used for recovery.*/.extern int ZEXPORT unzRepair(const char* file,. const char* fileOut,. const char* fileOutTmp,. uLong* nRecovered,. uLong* bytesRecovered);...#ifdef __cplusplus.}.#endif...#endif.

    C:\Program Files\WinHTTrack\src\minizip\is-3BEQG.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):7051
    Entropy (8bit):5.112346950194113
    Encrypted:false
    SSDEEP:96:3G4T8vYLU5Tvwjmv5SUTcec1GvXRUUGSfj7GJ7J5VhADAcj0Itg:338vbwKxSKcec1GvXRUUG2SJ7JnIHtg
    MD5:7D6C0585719BA47FD356795801BEFC6D
    SHA1:E71518AE9F172EAB44A2D8F52B3F80B0552070D5
    SHA-256:8655408534B78DC0889A45F9359FC6D2D5C8E8D8443B81EDE596F954C720EF48
    SHA-512:8844D699389B22515C9D31C181A8B2BC7AC6A355865D43117AA93DB37FB049EDDB88F63355221A5B702E1DA59848D2DCBC579F81E2C3DBDF4634EF37E2293C48
    Malicious:false
    Preview:/* ioapi.h -- IO base function header for compress/uncompress .zip. part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html ).. Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html ).. Modifications for Zip64 support. Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com ).. For more info read MiniZip_info.txt.. Changes.. Oct-2009 - Defined ZPOS64_T to fpos_t on windows and u_int64_t on linux. (might need to find a better why for this). Oct-2009 - Change to fseeko64, ftello64 and fopen64 so large files would work on linux.. More if/def section may be needed to support other platforms. Oct-2009 - Defined fxxxx64 calls to normal fopen/ftell/fseek so they would compile on windows.. (but you should use iowin32.c for windows instead)..*/..#ifndef _ZLIBIOAPI64_H.#define _ZLIBIOAPI64_H..#if (!defined(_WIN32)) && (!defined(WIN32)) &&

    C:\Program Files\WinHTTrack\src\minizip\is-45IGK.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):4735
    Entropy (8bit):4.966689728090298
    Encrypted:false
    SSDEEP:96:RVk2y4ZsP+RBn7VogVLaQg0x5aS5LzbfziQTI6wfZ8fZrj:RW0n7PVLaQg0xHb7iQs6AZkZrj
    MD5:6E72C46776F0DB175EC8F15144A3C250
    SHA1:94F289E1B0403B01289B10C6B32ED7D1471FA0CA
    SHA-256:8E872B60255B8447DA99885C7159C2E1F1BB8143523BDBE71784E60F98BFD67B
    SHA-512:DFF681B1881286126B3F12F4F10CD6E37105232363793D6E0B1CD1FDDC2FAFD1175245A4F715C5768B41DB0F97A94D6A5C370370B7AF475905130D13B3DD453A
    Malicious:false
    Preview:/* crypt.h -- base code for crypt/uncrypt ZIPfile... Version 1.01e, February 12th, 2005.. Copyright (C) 1998-2005 Gilles Vollant.. This code is a modified version of crypting code in Infozip distribution.. The encryption/decryption parts of this source code (as opposed to the. non-echoing password parts) were originally written in Europe. The. whole source package can be freely distributed, including from the USA.. (Prior to January 2000, re-export from the US was a violation of US law.).. This encryption code is a direct transcription of the algorithm from. Roger Schlafly, described by Phil Katz in the file appnote.txt. This. file (appnote.txt) is distributed with the PKZIP program (even in the. version without encryption capabilities)... If you don't need crypting in your application, just define symbols. NOCRYPT and NOUNCRYPT... This code support the "Traditional PKWARE Encryption"... The new AES encryption added on Zip format by Winzip (see the page.

    C:\Program Files\WinHTTrack\src\minizip\is-4D4J3.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):8225
    Entropy (8bit):5.096155745837525
    Encrypted:false
    SSDEEP:192:3J82eIiaGxFyKTycXyjUhC33EC3f539N3LQWevQEp2603Ie39ht/91RuhtbR1RR:582ySht/91RuhtbR1RR
    MD5:E8A6CC43207A37D631D9E90BBEC6E6ED
    SHA1:2846A21BA725DA90AA3A67024D8107DAA793F5F7
    SHA-256:66B39C27042F6AD12CC12EFB0C82CDF100C6640B5FA959B8B866E252966113A9
    SHA-512:92811AEDB5FB0C9A60FCBA4C5BD4B718DE98FAF6A8D65CE16A7F580D97B23D7B9B2A2CC2E79BCAB503645E45A8E2F81882411B426A575C6B58C489616E5E9A58
    Malicious:false
    Preview:/* ioapi.h -- IO base function header for compress/uncompress .zip. part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html ).. Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html ).. Modifications for Zip64 support. Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com ).. For more info read MiniZip_info.txt..*/..#if defined(_WIN32) && (!(defined(_CRT_SECURE_NO_WARNINGS))). #define _CRT_SECURE_NO_WARNINGS.#endif..#if defined(__APPLE__) || defined(IOAPI_NO_64).// In darwin and perhaps other BSD variants off_t is a 64 bit value, hence no need for specific 64 bit functions.#define FOPEN_FUNC(filename, mode) fopen(filename, mode).#define FTELLO_FUNC(stream) ftello(stream).#define FSEEKO_FUNC(stream, offset, origin) fseeko(stream, offset, origin).#else.#define FOPEN_FUNC(filename, mode) fopen64(filename, mode).#define FTELLO_FUNC(stream) ftello64(stream).#define FSEEKO_FUNC(st

    C:\Program Files\WinHTTrack\src\minizip\is-4G6S7.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):16352
    Entropy (8bit):4.6099592596197
    Encrypted:false
    SSDEEP:192:WXLnAvqgGf3HpJHUC2ZA2WaR2ls3jWrH5HA6BcX8cUwgppEeqz:YtfXfUpk22lszwH5HA6BcXOwYEeqz
    MD5:11AE6A9D654C95C47DA55FE16772A1E5
    SHA1:4236476513B299F00F9637F7AD3E3631EBDEC2B9
    SHA-256:D8DC58FC0121B6A4B98F3028205BB253F956B1DDF791E9CED3CF44892502A01F
    SHA-512:0EBF5FB31A48577432E9826FB883FD2EB1D804D6B5CDB8F859F5A2AA94D8037AA4806A96EB9EBFAAA94E7A5A1D0D331535536BDC356DD34661E5C2FA15DCA22C
    Malicious:false
    Preview:/* unzip.h -- IO for uncompress .zip files using zlib. Version 1.1, February 14h, 2010. part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html ).. Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html ).. Modifications of Unzip for Zip64. Copyright (C) 2007-2008 Even Rouault.. Modifications for Zip64 support on both zip and unzip. Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com ).. For more info read MiniZip_info.txt.. ---------------------------------------------------------------------------------.. Condition of use and distribution are the same than zlib :.. This software is provided 'as-is', without any express or implied. warranty. In no event will the authors be held liable for any damages. arising from the use of this software... Permission is granted to anyone to use this software for any purpose,. including commercial applicati

    C:\Program Files\WinHTTrack\src\minizip\is-72HU4.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:unified diff output, ASCII text
    Category:dropped
    Size (bytes):923
    Entropy (8bit):4.50363162540157
    Encrypted:false
    SSDEEP:12:xkIq+PsZFeVWp5ahaEOrw57lLcYVWphpasBdl8p37wdOjQKbHfv0e1kTP:+Iq+PW0eNw5pLLlan0spC/zGz
    MD5:7D2EE4E3CC69501C96BED2AA3FAC23FF
    SHA1:4E07BC6FD71F97EA101990BDBCF502133CABFB2F
    SHA-256:E257028E944D4E9C3F332561C0878028B5CBD8935AC7CF205CE1AD6DC77A97DE
    SHA-512:C01FF791B163002BC270C9B4BFFF33023072387338F12C92B438B89C829C7DC9F1C0D3D0FA670DEDAFB69B3F8579CBFE2CF0B052D318A4A38CC939236C1C5F21
    Malicious:false
    Preview:--- zip.h.orig.2010-02-15 12:58:22.000000000 +0100.+++ zip.h.2014-05-24 13:47:52.838188589 +0200.@@ -144,6 +144,11 @@. zipcharpc* globalcomment,. zlib_filefunc64_def* pzlib_filefunc_def));. .+extern zipFile ZEXPORT zipOpen3 OF((const void *pathname,.+ int append,.+ zipcharpc* globalcomment,.+ zlib_filefunc64_32_def* pzlib_filefunc64_32_def));.+. extern int ZEXPORT zipOpenNewFileInZip OF((zipFile file,. const char* filename,. const zip_fileinfo* zipfi,.@@ -311,6 +316,11 @@. Write data in the zipfile. */. .+extern int ZEXPORT zipFlush OF((zipFile file));.+/*.+ Flush the zipfile output.+*/.+. extern int ZEXPORT zipCloseFileInZip OF((zipFile file));. /*. Close the current file in the zipfile.

    C:\Program Files\WinHTTrack\src\minizip\is-7U8TH.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:unified diff output, ASCII text
    Category:dropped
    Size (bytes):2926
    Entropy (8bit):5.085786796410659
    Encrypted:false
    SSDEEP:48:zwv6PJLFjPsdbEj9u28Da9QIX+LjeoIdkljotnz7znzhzcbzHzjzpnzdzgbzHzjG:zy6PJLVPqk90L9IrnzNQTvxJETvG
    MD5:EAD6F04B65B8D39E0003D8C5FFBE8B9B
    SHA1:D65185734AFE18DC9158A7E858A4D6BF99189C8C
    SHA-256:AF6D79D8E374E8D7FA64E39975686AA1A7C972487E25D91F3DC7E4388A46B0F9
    SHA-512:7092480B3F85B76F5C8373AFBD8DE5081A47C1D68AC10316176EDE1DCC1859448F6D82F1E56887A3F966FC32743A4C7BA3E021D96122F1A282B9E17B6271A4E7
    Malicious:false
    Preview:--- ioapi.c.orig.2014-06-10 18:55:32.778807408 +0200.+++ ioapi.c.2014-06-22 12:22:06.606696274 +0200.@@ -14,7 +14,7 @@. #define _CRT_SECURE_NO_WARNINGS. #endif. .-#if defined(__APPLE__) || defined(IOAPI_NO_64).+#if defined(__APPLE__) || defined(__ANDROID__) || defined(IOAPI_NO_64). // In darwin and perhaps other BSD variants off_t is a 64 bit value, hence no need for specific 64 bit functions. #define FOPEN_FUNC(filename, mode) fopen(filename, mode). #define FTELLO_FUNC(stream) ftello(stream).@@ -73,6 +73,7 @@. p_filefunc64_32->zfile_func64.zerror_file = p_filefunc32->zerror_file;. p_filefunc64_32->zfile_func64.zread_file = p_filefunc32->zread_file;. p_filefunc64_32->zfile_func64.zwrite_file = p_filefunc32->zwrite_file;.+ p_filefunc64_32->zfile_func64.zflush_file = p_filefunc32->zflush_file;. p_filefunc64_32->zfile_func64.ztell64_file = NULL;. p_filefunc64_32->zfile_func64.zseek64_file = NULL;. p_filefunc64_32->zfile_func64.zclose_file = p_filefunc32-

    C:\Program Files\WinHTTrack\src\minizip\is-7ULJB.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):15034
    Entropy (8bit):4.404129124340225
    Encrypted:false
    SSDEEP:384:986/SpBR1h1v1wYf5f4F1mLzZTPt1K1q1E:B/yBRT51wc5f4FsVZ4sO
    MD5:E2A4A0C1CAD4CEB1F77FB3B7E813BB35
    SHA1:F47C6866B347BFFF1A54C680B6C393D7C02E1D8D
    SHA-256:FDFCF83979EF2324C1455D369E8ADD8678C804939D412CE53F8B024578CEABAD
    SHA-512:4FD8337A4105638548428B7E3D3D76FBC17780EE8B08AD2B9437DD534E76016440E2E94CD298C39738DC1F32BD0AAF39A6C0DCA9FD57CE7E12B16E4D7CF5DECF
    Malicious:false
    Preview:/*. minizip.c. Version 1.1, February 14h, 2010. sample part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html ).. Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html ).. Modifications of Unzip for Zip64. Copyright (C) 2007-2008 Even Rouault.. Modifications for Zip64 support on both zip and unzip. Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com ).*/...#if (!defined(_WIN32)) && (!defined(WIN32)) && (!defined(__APPLE__)). #ifndef __USE_FILE_OFFSET64. #define __USE_FILE_OFFSET64. #endif. #ifndef __USE_LARGEFILE64. #define __USE_LARGEFILE64. #endif. #ifndef _LARGEFILE64_SOURCE. #define _LARGEFILE64_SOURCE. #endif. #ifndef _FILE_OFFSET_BIT. #define _FILE_OFFSET_BIT 64. #endif.#endif..#ifdef __APPLE__.// In darwin and perhaps other BSD variants off_t is

    C:\Program Files\WinHTTrack\src\minizip\is-9ELME.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1697
    Entropy (8bit):4.924168565042047
    Encrypted:false
    SSDEEP:48:5TQjheF7i66fjO9aJIGgNSR6Vui1x/Ssn:khec66fjMnSQL15
    MD5:203B6E16F5CF5F67F409E5A1B0D675A2
    SHA1:EFF95707307C50F62244A02C5827B82475B1FBFC
    SHA-256:3C4795EED1DC687379949A50EBB786EE11E4E22D33436E20515F88A9BC1162F1
    SHA-512:6B21038B88688AF092B929A722C6AC5A9D5E80D73F973C3A96AE66056964D9644DBD525675AFA4A5470A2BFD6F18AD1840E705A7A2D933FB136F519F9FB61922
    Malicious:false
    Preview:Change in 1.00: (10 sept 03)..- rename to 1.00..- cosmetic code change....Change in 0.22: (19 May 03)..- crypting support (unless you define NOCRYPT)..- append file in existing zipfile....Change in 0.21: (10 Mar 03)..- bug fixes....Change in 0.17: (27 Jan 02)..- bug fixes....Change in 0.16: (19 Jan 02)..- Support of ioapi for virtualize zip file access....Change in 0.15: (19 Mar 98)..- fix memory leak in minizip.c....Change in 0.14: (10 Mar 98)..- fix bugs in minizip.c sample for zipping big file..- fix problem in month in date handling..- fix bug in unzlocal_GetCurrentFileInfoInternal in unzip.c for.. comment handling....Change in 0.13: (6 Mar 98)..- fix bugs in zip.c..- add real minizip sample....Change in 0.12: (4 Mar 98)..- add zip.c and zip.h for creates .zip file..- fix change_file_date in miniunz.c for Unix (Jean-loup Gailly)..- fix miniunz.c for file without specific record for directory....Change in 0.11: (3 Mar 98)..- fix bug in unzGetCurrentFileInfo for get extra field an

    C:\Program Files\WinHTTrack\src\minizip\is-BEBGB.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):50193
    Entropy (8bit):4.889871291063335
    Encrypted:false
    SSDEEP:384:xh4KW7xjQJiLAy8Hg0Ki6o4CNlvxFlSQPxfvTBHtU8O15r:P4KW7CALAbHg0L6jcvxFlDPxfJtUh15r
    MD5:3D624FA2588B8B5182A5A9A4CD15F8E5
    SHA1:1858E43FC1BA3A5EBAAB68DFE98022DE4F9597E0
    SHA-256:C27075FB48731A12C2C92B8CC05F4DCC71776F1F0A8673271B6FEA3447AB5BA7
    SHA-512:218F542DC4EAB76BF3530357356CFFBE659A51C95E1EA34B65ABEC91CBC53BDCABE62DD428F0B0719315206F17DAC5BD9B8AC7A5A51A5ADE571C9FF2B8E6E30B
    Malicious:false
    Preview:/* unzip.c -- IO for uncompress .zip files using zlib.. Version 1.00, September 10th, 2003.... Copyright (C) 1998-2003 Gilles Vollant.... Read unzip.h for more info..*/..../* Decryption code comes from crypt.c by Info-ZIP but has been greatly reduced in terms of..compatibility with older software. The following is from the original crypt.c. Code..woven in by Terry Thorsen 1/2003...*/../*.. Copyright (c) 1990-2000 Info-ZIP. All rights reserved..... See the accompanying file LICENSE, version 2000-Apr-09 or later.. (the contents of which are also included in zip.h) for terms of use... If, for some reason, all these files are missing, the Info-ZIP license.. also may be found at: ftp://ftp.info-zip.org/pub/infozip/license.html..*/../*.. crypt.c (full version) by Info-ZIP. Last revised: [see crypt.h].... The encryption/decryption parts of this source code (as opposed to the.. non-echoing password parts) were originally written in Europe. The.. whole source package can

    C:\Program Files\WinHTTrack\src\minizip\is-C0CAE.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):8146
    Entropy (8bit):4.392005740959655
    Encrypted:false
    SSDEEP:192:Zd6//doXFleGuOe0eGuOeyqi+KF5qXtFNteOeie3eEwP1Age65qF/EeyZgT4:f6/lo1l/Xz/XsrNTHdmTaoEn
    MD5:174C6F2A32DAD5023616FC45855D8C59
    SHA1:0F6DAD6443B0F347AC6B17563014F50C7B4FD17F
    SHA-256:CD887C4AF6D20823BD15F24008B10ACF01969B4165D7848656BDE843A92428D7
    SHA-512:3DCA117F49F7D31017B1DAE7C79853F6EF27084F4BA40CF08248B4BB9D0B0C0A68FA47BD8377C9AD2C55AA07163853E504F8BDF8D908BD186642EE143ACF7186
    Malicious:false
    Preview:/*. Additional tools for Minizip. Code: Xavier Roche '2004. License: Same as ZLIB (www.gzip.org).*/../* Code */.#include <stdio.h>.#include <stdlib.h>.#include <string.h>.#include "zlib.h".#include "unzip.h"..#define READ_8(adr) ((unsigned char)*(adr)).#define READ_16(adr) ( READ_8(adr) | (READ_8(adr+1) << 8) ).#define READ_32(adr) ( READ_16(adr) | (READ_16((adr)+2) << 16) )..#define WRITE_8(buff, n) do { \. *((unsigned char*)(buff)) = (unsigned char) ((n) & 0xff); \.} while(0).#define WRITE_16(buff, n) do { \. WRITE_8((unsigned char*)(buff), n); \. WRITE_8(((unsigned char*)(buff)) + 1, (n) >> 8); \.} while(0).#define WRITE_32(buff, n) do { \. WRITE_16((unsigned char*)(buff), (n) & 0xffff); \. WRITE_16((unsigned char*)(buff) + 2, (n) >> 16); \.} while(0)..extern int ZEXPORT unzRepair(file, fileOut, fileOutTmp, nRecovered, bytesRecovered).const char* file;.const char* fileOut;.const char* fileOutTmp;.uLong* nRecovered;.uLong* bytesRecovered;.{. int err = Z_OK;. FILE* fpZip =

    C:\Program Files\WinHTTrack\src\minizip\is-CPD8I.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):13277
    Entropy (8bit):4.654537841146492
    Encrypted:false
    SSDEEP:192:DFiblX9fOJ1934KjQJ3cAYgZArz3ocMBXs:RafyTjQJMAYgZAr0ceXs
    MD5:675B48C27121FDE57E98806DF4143EE2
    SHA1:76E43D5F94E9F31E9C69DDFAF350AEBCCE0863EC
    SHA-256:7B9A37D95697AFA6FC764EF9DF27D90192A3EF8F993C1578AC490984CE5BCA07
    SHA-512:F885BEBA41653930E39CE5F447CA6AB16D7B7FC39C221D1F618EB6CF816905147BF391E88C0C026C47B38D7F24B50AFBD6D6413A8FE65A58A8CE97B644558F8D
    Malicious:false
    Preview:/* unzip.h -- IO for uncompress .zip files using zlib.. Version 1.00, September 10th, 2003.... Copyright (C) 1998-2003 Gilles Vollant.... This unzip package allow extract file from .ZIP file, compatible with PKZip 2.04g.. WinZip, InfoZip tools and compatible... Encryption and multi volume ZipFile (span) are not supported... Old compressions used by old PKZip 1.x are not supported...... I WAIT FEEDBACK at mail info@winimage.com.. Visit also http://www.winimage.com/zLibDll/unzip.htm for evolution.... Condition of use and distribution are the same than zlib :.... This software is provided 'as-is', without any express or implied.. warranty. In no event will the authors be held liable for any damages.. arising from the use of this software..... Permission is granted to anyone to use this software for any purpose,.. including commercial applications, and to alter it and redistribute it.. freely, subject to the following restrictions:.... 1. The origin of this soft

    C:\Program Files\WinHTTrack\src\minizip\is-EOSGJ.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):71054
    Entropy (8bit):4.808967968167853
    Encrypted:false
    SSDEEP:768:9YhEPv5Rm+OCxOvcMMGZ9ZgRFPHa6WpdTOObVtCEx:9V5RXxucdGv01Ha6iOObVtCEx
    MD5:32C11AE2AA5FF05CD4C871C856450A42
    SHA1:9AE64CB93A02721D33907AA57C3017BCD4E1C19C
    SHA-256:9DC09DA0688E5E5BD359844A7F24B36571213ECE9E634192373F1B0762B18D6A
    SHA-512:D4F2726C1E375676531C2AFB8FDA6359BA1F394481F21DD18CE337629E13C72ED5132597CF8086F174EA6F1C09C59383A0538FF449CF6744DC15B4347ADC639B
    Malicious:false
    Preview:/* unzip.c -- IO for uncompress .zip files using zlib. Version 1.1, February 14h, 2010. part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html ).. Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html ).. Modifications of Unzip for Zip64. Copyright (C) 2007-2008 Even Rouault.. Modifications for Zip64 support on both zip and unzip. Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com ).. For more info read MiniZip_info.txt... ------------------------------------------------------------------------------------. Decryption code comes from crypt.c by Info-ZIP but has been greatly reduced in terms of. compatibility with older software. The following is from the original crypt.c.. Code woven in by Terry Thorsen 1/2003... Copyright (c) 1990-2000 Info-ZIP. All rights reserved... See the accompanying file LICENSE, version 2000-Apr-09 or later. (the contents of wh

    C:\Program Files\WinHTTrack\src\minizip\is-G440K.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:unified diff output, ASCII text
    Category:dropped
    Size (bytes):3262
    Entropy (8bit):5.238863914749323
    Encrypted:false
    SSDEEP:48:O/QbARewudB3LQyKTuSpUgUdNtG4DNtLNtmiZtzYJVx:O/QbAkwu/3xKqRdjWiXcT
    MD5:6D620C6C89CE44E940E5159C9A056C7B
    SHA1:A8BA326CD5E4FEC640AA4D5810507CB21B29FD53
    SHA-256:2E5F4632EF7D907574565F24DB5666AFC4C2FF47A6C7B760AF4BAB2615BF9824
    SHA-512:84FE604667D9950A04B2D37292B09B2DBCEC182DBEB8E72FD323A18B91991DAE206ACD674AD4C1B99B94B7A038DF00F6F21C84C7A61D67D927B54757A750523F
    Malicious:false
    Preview:--- zip.c.orig.2014-06-10 18:55:32.778807408 +0200.+++ zip.c.2014-06-11 20:27:18.355848501 +0200.@@ -186,7 +186,7 @@. #include "crypt.h". #endif. .-local linkedlist_datablock_internal* allocate_new_datablock().+local linkedlist_datablock_internal* allocate_new_datablock(void). {. linkedlist_datablock_internal* ldi;. ldi = (linkedlist_datablock_internal*).@@ -238,7 +238,7 @@. }. . ldi = ll->last_block;.- from_copy = (unsigned char*)buf;.+ from_copy = (const unsigned char*)buf;. . while (len>0). {.@@ -637,7 +637,7 @@. return relativeOffset;. }. .-int LoadCentralDirectoryRecord(zip64_internal* pziinit).+local int LoadCentralDirectoryRecord(zip64_internal* pziinit). {. int err=ZIP_OK;. ZPOS64_T byte_before_the_zipfile;/* byte before the zipfile, (>0 for sfx)*/.@@ -955,7 +955,7 @@. return zipOpen3(pathname,append,NULL,NULL);. }. .-int Write_LocalFileHeader(zip64_internal* zi, const char* filename, uInt size_extrafield_local, const void* extrafield_loc

    C:\Program Files\WinHTTrack\src\minizip\is-HO93J.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text
    Category:dropped
    Size (bytes):109
    Entropy (8bit):4.680347896421445
    Encrypted:false
    SSDEEP:3:5yMKcSE3LJtMTusyh6VFNpcMePo1khdH:AXEF+Tusm6VFfcBo1khd
    MD5:EC302A2B5E19AF31263CE77260DD49D0
    SHA1:CB10D2AF06D59532C6D462AB0DBD2B79C55A5834
    SHA-256:302C62B328647F5472FB7755249A83459BE7F8FFB1FAE07E8BA318FCE8F4126C
    SHA-512:DA87D3C077EAEB350232E4AE9AE786887C29EC10F971FD3E029C7CB1799CEBD216E6651C2FEE2A5F23CAAFF8C52D5F2AE094E791EE3B002082F2BBEDB57E82BB
    Malicious:false
    Preview:.MiniZip 1.1 was derrived from MiniZip at version 1.01f..Change in 1.0 (Okt 2009). - **TODO - Add history**..

    C:\Program Files\WinHTTrack\src\minizip\is-LU355.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):7798
    Entropy (8bit):5.138889762643193
    Encrypted:false
    SSDEEP:192:338vbwKxShaKEUZcec1GvXRUUG2weJ7JcmcuHtg:n8q9EUZcecsvXRxG2weJ7qZt
    MD5:A4DAC867A80298BFDBDC2D3A375E5352
    SHA1:CB679F78A6531A9FD7867E24DFDBD95237C8FA80
    SHA-256:B599ACC2BA2B5BDBDD36A59CF6E00A77DE58595320029E846351F94D8C6640BB
    SHA-512:3D96AF5F18AB044BA87616D784DA5A65CC2B1B120512C1535286580E3A2C8D9CDDEC20EEE544EBEE0FE40D05A7FA3640690432F771B1A8E4075CC341E058EB33
    Malicious:false
    Preview:/* ioapi.h -- IO base function header for compress/uncompress .zip. part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html ).. Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html ).. Modifications for Zip64 support. Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com ).. For more info read MiniZip_info.txt.. Changes.. Oct-2009 - Defined ZPOS64_T to fpos_t on windows and u_int64_t on linux. (might need to find a better why for this). Oct-2009 - Change to fseeko64, ftello64 and fopen64 so large files would work on linux.. More if/def section may be needed to support other platforms. Oct-2009 - Defined fxxxx64 calls to normal fopen/ftell/fseek so they would compile on windows.. (but you should use iowin32.c for windows instead)..*/..#ifndef _ZLIBIOAPI64_H.#define _ZLIBIOAPI64_H..#if (!defined(_WIN32)) && (!defined(WIN32)) &&

    C:\Program Files\WinHTTrack\src\minizip\is-N2DF1.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):15366
    Entropy (8bit):3.970429065081028
    Encrypted:false
    SSDEEP:96:us6sIK32h5vBX38QyZjV9Gfyx+lWt9e3Hib97tOgbvgOJkBbMNkc1cEjcyKcyu/W:usZm4/ZjV9Gf/lsDVyMhoGfcReMkt77w
    MD5:E1495F151B00503A64AAE7B375CC3B80
    SHA1:8CEF828DB4766401B91BEC9B47CA56A3118705FC
    SHA-256:96163FC140E4BF08752E014D20A1EAC3F5ADCDC408366F6D79C1895F2599CF08
    SHA-512:A761F6855F9FFFCB716D3A058AE9152F339FD5AC36E6C152D74D4346FE038D4F6169E23CE54527E94CD9CB1D5B52A01FDCAB9D9C55C6426EB587003EF54D09F2
    Malicious:false
    Preview:/* zip.h -- IO on .zip files using zlib. Version 1.1, February 14h, 2010. part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html ).. Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html ).. Modifications for Zip64 support. Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com ).. For more info read MiniZip_info.txt.. ---------------------------------------------------------------------------.. Condition of use and distribution are the same than zlib :.. This software is provided 'as-is', without any express or implied. warranty. In no event will the authors be held liable for any damages. arising from the use of this software... Permission is granted to anyone to use this software for any purpose,. including commercial applications, and to alter it and redistribute it. freely, subject to the following restrictions:.. 1. The origin of this software must not be

    C:\Program Files\WinHTTrack\src\minizip\is-PJV9M.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:unified diff output, ASCII text
    Category:dropped
    Size (bytes):2218
    Entropy (8bit):4.866716317001363
    Encrypted:false
    SSDEEP:24:zs+Plu5JflRuuYcEMP7ikVAJQC3WZ3l66I3rvl1fxjnxmpQoqBn6I3x6N+4nU8:zxluhYc9dnZA3rvldxjnxmW3oXnU8
    MD5:A8FF6452A5DE4DF174FCFEC2A7D75B42
    SHA1:05FF8FD209272E0713250382497E65EC75F45383
    SHA-256:29834161AAD0724F1AD4112A723F942109A1B249C3DA3957F861D5C7DAE1215A
    SHA-512:581253CB3A034E9221BB752AA46CD46A8D22DB7291CA2DDBF1F6A5BC2D109B1C821DA28C744B055BB5BC663967A16B8868E9369DACC2F2815BA8F1C3BB22112C
    Malicious:false
    Preview:--- mztools.c.orig.2012-01-21 20:58:45.000000000 +0100.+++ mztools.c.2014-05-24 13:27:22.516230485 +0200.@@ -10,6 +10,7 @@. #include <string.h>. #include "zlib.h". #include "unzip.h".+#include "mztools.h". . #define READ_8(adr) ((unsigned char)*(adr)). #define READ_16(adr) ( READ_8(adr) | (READ_8(adr+1) << 8) ).@@ -27,12 +28,9 @@. WRITE_16((unsigned char*)(buff) + 2, (n) >> 16); \. } while(0). .-extern int ZEXPORT unzRepair(file, fileOut, fileOutTmp, nRecovered, bytesRecovered).-const char* file;.-const char* fileOut;.-const char* fileOutTmp;.-uLong* nRecovered;.-uLong* bytesRecovered;.+int ZEXPORT unzRepair(const char* file, const char* fileOut,.+ const char* fileOutTmp, uLong* nRecovered,.+ uLong* bytesRecovered). {. int err = Z_OK;. FILE* fpZip = fopen(file, "rb");.@@ -147,8 +145,8 @@. /* Central directory entry */. {. char header[46];.- char* comment = "";.- int comsize = (int) strlen(comme

    C:\Program Files\WinHTTrack\src\minizip\is-R79A6.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):8157
    Entropy (8bit):4.37386234604434
    Encrypted:false
    SSDEEP:192:Zk6/UdoXFleGuOe0eGuOeyqi+KF5qitFNteOege3eE1P1Ago65qF/EeyZgT4:G6/ao1l/Xz/Xsr8THVmmaoEn
    MD5:34F2B8EEF97864AE77A101D3496706BF
    SHA1:AB9371168CA53BFFA8E84AC9C060BD50DEC695F3
    SHA-256:77F1A4EEE51789FDC753426113628084955C804A6FD80AC500154FFEB7382A94
    SHA-512:99C4D177522C286219F1E72EF1A8B5D8B9A5833716718982F41EBF981E764C76901A1DC61C9AF560B46833D1B5DCBC3C2B87A1E556F4512D88FF48FE04DEFAE5
    Malicious:false
    Preview:/*. Additional tools for Minizip. Code: Xavier Roche '2004. License: Same as ZLIB (www.gzip.org).*/../* Code */.#include <stdio.h>.#include <stdlib.h>.#include <string.h>.#include "zlib.h".#include "unzip.h".#include "mztools.h"..#define READ_8(adr) ((unsigned char)*(adr)).#define READ_16(adr) ( READ_8(adr) | (READ_8(adr+1) << 8) ).#define READ_32(adr) ( READ_16(adr) | (READ_16((adr)+2) << 16) )..#define WRITE_8(buff, n) do { \. *((unsigned char*)(buff)) = (unsigned char) ((n) & 0xff); \.} while(0).#define WRITE_16(buff, n) do { \. WRITE_8((unsigned char*)(buff), n); \. WRITE_8(((unsigned char*)(buff)) + 1, (n) >> 8); \.} while(0).#define WRITE_32(buff, n) do { \. WRITE_16((unsigned char*)(buff), (n) & 0xffff); \. WRITE_16((unsigned char*)(buff) + 2, (n) >> 16); \.} while(0)..int ZEXPORT unzRepair(const char* file, const char* fileOut,. const char* fileOutTmp, uLong* nRecovered,. uLong* bytesRecovered).{. int err = Z_OK;. FILE* fpZip

    C:\Program Files\WinHTTrack\src\minizip\is-RN395.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text
    Category:dropped
    Size (bytes):3048
    Entropy (8bit):4.738412966409047
    Encrypted:false
    SSDEEP:48:6ZirpN+UDPW3ZdH+nQYDZs1sO/KZh2mXHsVKXSIDts03/jeb/bh6KMTp4/z3j0:duZ0S7yZh2mX/XSEsIK34
    MD5:AB61E7D58C5C7114A6C531CE36CCC3E5
    SHA1:E1F5511BBDF9715BB2F18E4D24924CCA3275FB24
    SHA-256:122719C32EF1763A5F6BA9C8CDEFC1D78A76F7156B09E7B6F69B73F968E0DAC3
    SHA-512:2CF91199C88192AB3DA748F652FA58C99CAE83AB7D84EC49A132AB39FE7BB83443685B55EC6E7852F602A6ED67AFE19998842DE1CBC19AFA652535EE59E9E7D2
    Malicious:false
    Preview:MiniZip - Copyright (c) 1998-2010 - by Gilles Vollant - version 1.1 64 bits from Mathias Svensson..Introduction.---------------------.MiniZip 1.1 is built from MiniZip 1.0 by Gilles Vollant ( http://www.winimage.com/zLibDll/minizip.html )..When adding ZIP64 support into minizip it would result into risk of breaking compatibility with minizip 1.0..All possible work was done for compatibility....Background.---------------------.When adding ZIP64 support Mathias Svensson found that Even Rouault have added ZIP64 .support for unzip.c into minizip for a open source project called gdal ( http://www.gdal.org/ )..That was used as a starting point. And after that ZIP64 support was added to zip.c.some refactoring and code cleanup was also done....Changed from MiniZip 1.0 to MiniZip 1.1.---------------------------------------.* Added ZIP64 support for unzip ( by Even Rouault ).* Added ZIP64 support for zip ( by Mathias Svensson ).* Reverted some changed that Even Rouault did..* Bunch of patches re

    C:\Program Files\WinHTTrack\src\minizip\is-S28UL.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:unified diff output, ASCII text
    Category:dropped
    Size (bytes):2658
    Entropy (8bit):5.114899560272486
    Encrypted:false
    SSDEEP:48:n/3jTLmHYjNpC4PSFj7hEoEvRmt8GmfOYeRTlHFD+bG0:nLTaHYjvCYSFj7hE9v2lK
    MD5:DE5B2F59AAB379EFB4AE18852561D827
    SHA1:BE6DA4EFD5BE8031800FAC1847065693B3918EF9
    SHA-256:A5B0B39B29C997D3258C5C883C21B00350BCCD359BADA572116CBC6365186214
    SHA-512:2391D446FC3A4F2CAAB363C43E76436D7466974275EE7A8B6C91E3615DB9AB9ECD37926C41E4D2BC1C9B49C4D3454B8A1131C67A8467B1EB97A20CAF865C7D59
    Malicious:false
    Preview:--- ioapi.h.orig.2012-01-17 03:51:31.000000000 +0100.+++ ioapi.h.2014-06-08 21:54:18.326360527 +0200.@@ -67,6 +67,24 @@. #endif. #endif. .+/* As reported by sammyx, z_crc_t and z_const are not defined in pre-1.2.70 releases of zlib */.+/* See <https://github.com/madler/zlib/commit/6c9bd474aa08312ef2e2e9655a80e18db24a1680#diff-d466aa66f7e453e0c8a7719229cff391R391> */.+#if ZLIB_VERNUM < 0x1270.+.+#ifdef Z_U4.+ typedef Z_U4 z_crc_t;.+#else.+ typedef unsigned long z_crc_t;.+#endif.+.+#if defined(ZLIB_CONST) && !defined(z_const).+# define z_const const.+#else.+# define z_const.+#endif.+.+#endif.+. /*. #ifndef ZPOS64_T. #ifdef _WIN32.@@ -135,6 +153,7 @@. typedef voidpf (ZCALLBACK *open_file_func) OF((voidpf opaque, const char* filename, int mode));. typedef uLong (ZCALLBACK *read_file_func) OF((voidpf opaque, voidpf stream, void* buf, uLong size));. typedef uLong (ZCALLBACK *write_file_func) OF((voidpf opaque, voidpf stream, const void* buf, uLong size));.+typed

    C:\Program Files\WinHTTrack\src\minizip\is-S30J0.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):14148
    Entropy (8bit):5.17163474188404
    Encrypted:false
    SSDEEP:384:TPh3br1qC9rrMU0yBurYju2FoiLt/LTHVLtfHTHXtfHTHLtfHTHR:TPh3br1qC9rrMU0y8rYju2FoiLt/LTH1
    MD5:390EE0CCDBB1C4CA430E8DC82404625F
    SHA1:58DFEC8630A3842B6689C077E81407A575DE418C
    SHA-256:0B9C9A609F24CD8DD63E5DB732EFD0B6FF49815166DFC58DDD202B1570B49A8B
    SHA-512:2B166EE632CB2F9D4675639AC28A1FF488EE201A4DC0F804D43E967C7AF71EEA3918A6564947D6C85D77743D5A5DB2D96495C8D52393017DC1E877CFA5BE379B
    Malicious:false
    Preview:/* iowin32.c -- IO base function header for compress/uncompress .zip. Version 1.1, February 14h, 2010. part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html ).. Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html ).. Modifications for Zip64 support. Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com ).. For more info read MiniZip_info.txt..*/..#include <stdlib.h>..#include "zlib.h".#include "ioapi.h".#include "iowin32.h"..#ifndef INVALID_HANDLE_VALUE.#define INVALID_HANDLE_VALUE (0xFFFFFFFF).#endif..#ifndef INVALID_SET_FILE_POINTER.#define INVALID_SET_FILE_POINTER ((DWORD)-1).#endif...#if defined(WINAPI_FAMILY_PARTITION) && (!(defined(IOWIN32_USING_WINRT_API))).#if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_APP).#define IOWIN32_USING_WINRT_API 1.#endif.#endif..voidpf ZCALLBACK win32_open_file_func OF((voidpf opaque, const char* filename, int mode));.uLong ZCALLBACK win32

    C:\Program Files\WinHTTrack\src\minizip\is-U93QS.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):65850
    Entropy (8bit):5.0221477740743286
    Encrypted:false
    SSDEEP:768:W7B0vnFW3Qors0nBB4hjehwsJYOyfB12XjeJK0nCm+uoHz0r8l6/Sjqi6rU6rCg0:seW3Q1DnCmkTMB77G
    MD5:252AADDAA5F658E71B40FC9DED34471F
    SHA1:084FF1E900A3958B647AB7124F052F33A247B32C
    SHA-256:23E4C2E582E445D96BD7D962FF7B335EEEC3AC45475DE255144A5597FBC9F245
    SHA-512:ABD773C6DE895BDBBC5B8FE5CC70D8BECE5D83552B05738BE0A55C57535506E2B00797338B71958134F682DCD5D4EAB30E39766972651C126DFA9F56117726D3
    Malicious:false
    Preview:/* zip.c -- IO on .zip files using zlib. Version 1.1, February 14h, 2010. part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html ).. Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html ).. Modifications for Zip64 support. Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com ).. For more info read MiniZip_info.txt.. Changes. Oct-2009 - Mathias Svensson - Remove old C style function prototypes. Oct-2009 - Mathias Svensson - Added Zip64 Support when creating new file archives. Oct-2009 - Mathias Svensson - Did some code cleanup and refactoring to get better overview of some functions.. Oct-2009 - Mathias Svensson - Added zipRemoveExtraInfoBlock to strip extra field data from its ZIP64 data. It is used when recreting zip archive with RAW when deleting items from a zip.. ZIP64 data is automaticly added

    C:\Program Files\WinHTTrack\src\minizip\is-VLGB1.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):66094
    Entropy (8bit):5.02214026794667
    Encrypted:false
    SSDEEP:768:W6B0vnFW3rors0nBB4hjehwsJYOyfB12XjeJKZnCm+uoHz0r8G62Sjqi6rU6rCg2:JeW3r1CnCmkTMz778
    MD5:F85A91E83FCAC3C493F48855B5B30A33
    SHA1:0CB813E426BB3AEA8EBC1DE123CEF95425014FCA
    SHA-256:5D2E44267943B06C82C4F8EF9C5A898D69CC7F35D7A06C30E43F61B4311F188D
    SHA-512:7FD4F27237EC57BBB25A919AACCD04F98D4A3607E504A5B75E89A689C179927EDB9F8CD6D65E8ACA868F9D09DB51E79624A1B074BD875021E94FFA67A7C9AF8E
    Malicious:false
    Preview:/* zip.c -- IO on .zip files using zlib. Version 1.1, February 14h, 2010. part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html ).. Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html ).. Modifications for Zip64 support. Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com ).. For more info read MiniZip_info.txt.. Changes. Oct-2009 - Mathias Svensson - Remove old C style function prototypes. Oct-2009 - Mathias Svensson - Added Zip64 Support when creating new file archives. Oct-2009 - Mathias Svensson - Did some code cleanup and refactoring to get better overview of some functions.. Oct-2009 - Mathias Svensson - Added zipRemoveExtraInfoBlock to strip extra field data from its ZIP64 data. It is used when recreting zip archive with RAW when deleting items from a zip.. ZIP64 data is automaticly added

    C:\Program Files\WinHTTrack\src\minizip\miniunz.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):17763
    Entropy (8bit):4.64331439069436
    Encrypted:false
    SSDEEP:192:mC8+w4FE7bhEVm6bcJehQa0/LT43GQUQLmyU27Rjts2PKzKcynUiaQ2h02mavmek:P8HKm6hTfELhmau+tm0nLPayi
    MD5:254FE0695464D4CBBAA1FDC0C83C6A3C
    SHA1:54E7B5392EE6600C91C9C423561941A571AAF715
    SHA-256:CED49F20C62536A8FFB270B35CFA4994A1DCDCE45F8CF059B941C94CA0022666
    SHA-512:5556907726C13484697E6261A1AB5D4F96313755B87FB10B5A8163533CA39FFB97545C6206BB106DDC3CE122118934EF270806CB36C803C02195F345B712E7BA
    Malicious:false
    Preview:/*. miniunz.c. Version 1.1, February 14h, 2010. sample part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html ).. Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html ).. Modifications of Unzip for Zip64. Copyright (C) 2007-2008 Even Rouault.. Modifications for Zip64 support on both zip and unzip. Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com ).*/..#if (!defined(_WIN32)) && (!defined(WIN32)) && (!defined(__APPLE__)). #ifndef __USE_FILE_OFFSET64. #define __USE_FILE_OFFSET64. #endif. #ifndef __USE_LARGEFILE64. #define __USE_LARGEFILE64. #endif. #ifndef _LARGEFILE64_SOURCE. #define _LARGEFILE64_SOURCE. #endif. #ifndef _FILE_OFFSET_BIT. #define _FILE_OFFSET_BIT 64. #endif.#endif..#ifdef __APPLE__.// In darwin and perhaps other BSD variants off_t is a

    C:\Program Files\WinHTTrack\src\minizip\minizip.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):15034
    Entropy (8bit):4.404129124340225
    Encrypted:false
    SSDEEP:384:986/SpBR1h1v1wYf5f4F1mLzZTPt1K1q1E:B/yBRT51wc5f4FsVZ4sO
    MD5:E2A4A0C1CAD4CEB1F77FB3B7E813BB35
    SHA1:F47C6866B347BFFF1A54C680B6C393D7C02E1D8D
    SHA-256:FDFCF83979EF2324C1455D369E8ADD8678C804939D412CE53F8B024578CEABAD
    SHA-512:4FD8337A4105638548428B7E3D3D76FBC17780EE8B08AD2B9437DD534E76016440E2E94CD298C39738DC1F32BD0AAF39A6C0DCA9FD57CE7E12B16E4D7CF5DECF
    Malicious:false
    Preview:/*. minizip.c. Version 1.1, February 14h, 2010. sample part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html ).. Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html ).. Modifications of Unzip for Zip64. Copyright (C) 2007-2008 Even Rouault.. Modifications for Zip64 support on both zip and unzip. Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com ).*/...#if (!defined(_WIN32)) && (!defined(WIN32)) && (!defined(__APPLE__)). #ifndef __USE_FILE_OFFSET64. #define __USE_FILE_OFFSET64. #endif. #ifndef __USE_LARGEFILE64. #define __USE_LARGEFILE64. #endif. #ifndef _LARGEFILE64_SOURCE. #define _LARGEFILE64_SOURCE. #endif. #ifndef _FILE_OFFSET_BIT. #define _FILE_OFFSET_BIT 64. #endif.#endif..#ifdef __APPLE__.// In darwin and perhaps other BSD variants off_t is

    C:\Program Files\WinHTTrack\src\minizip\mztools.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):8157
    Entropy (8bit):4.37386234604434
    Encrypted:false
    SSDEEP:192:Zk6/UdoXFleGuOe0eGuOeyqi+KF5qitFNteOege3eE1P1Ago65qF/EeyZgT4:G6/ao1l/Xz/Xsr8THVmmaoEn
    MD5:34F2B8EEF97864AE77A101D3496706BF
    SHA1:AB9371168CA53BFFA8E84AC9C060BD50DEC695F3
    SHA-256:77F1A4EEE51789FDC753426113628084955C804A6FD80AC500154FFEB7382A94
    SHA-512:99C4D177522C286219F1E72EF1A8B5D8B9A5833716718982F41EBF981E764C76901A1DC61C9AF560B46833D1B5DCBC3C2B87A1E556F4512D88FF48FE04DEFAE5
    Malicious:false
    Preview:/*. Additional tools for Minizip. Code: Xavier Roche '2004. License: Same as ZLIB (www.gzip.org).*/../* Code */.#include <stdio.h>.#include <stdlib.h>.#include <string.h>.#include "zlib.h".#include "unzip.h".#include "mztools.h"..#define READ_8(adr) ((unsigned char)*(adr)).#define READ_16(adr) ( READ_8(adr) | (READ_8(adr+1) << 8) ).#define READ_32(adr) ( READ_16(adr) | (READ_16((adr)+2) << 16) )..#define WRITE_8(buff, n) do { \. *((unsigned char*)(buff)) = (unsigned char) ((n) & 0xff); \.} while(0).#define WRITE_16(buff, n) do { \. WRITE_8((unsigned char*)(buff), n); \. WRITE_8(((unsigned char*)(buff)) + 1, (n) >> 8); \.} while(0).#define WRITE_32(buff, n) do { \. WRITE_16((unsigned char*)(buff), (n) & 0xffff); \. WRITE_16((unsigned char*)(buff) + 2, (n) >> 16); \.} while(0)..int ZEXPORT unzRepair(const char* file, const char* fileOut,. const char* fileOutTmp, uLong* nRecovered,. uLong* bytesRecovered).{. int err = Z_OK;. FILE* fpZip

    C:\Program Files\WinHTTrack\src\minizip\mztools.c.diff (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:unified diff output, ASCII text
    Category:dropped
    Size (bytes):2218
    Entropy (8bit):4.866716317001363
    Encrypted:false
    SSDEEP:24:zs+Plu5JflRuuYcEMP7ikVAJQC3WZ3l66I3rvl1fxjnxmpQoqBn6I3x6N+4nU8:zxluhYc9dnZA3rvldxjnxmW3oXnU8
    MD5:A8FF6452A5DE4DF174FCFEC2A7D75B42
    SHA1:05FF8FD209272E0713250382497E65EC75F45383
    SHA-256:29834161AAD0724F1AD4112A723F942109A1B249C3DA3957F861D5C7DAE1215A
    SHA-512:581253CB3A034E9221BB752AA46CD46A8D22DB7291CA2DDBF1F6A5BC2D109B1C821DA28C744B055BB5BC663967A16B8868E9369DACC2F2815BA8F1C3BB22112C
    Malicious:false
    Preview:--- mztools.c.orig.2012-01-21 20:58:45.000000000 +0100.+++ mztools.c.2014-05-24 13:27:22.516230485 +0200.@@ -10,6 +10,7 @@. #include <string.h>. #include "zlib.h". #include "unzip.h".+#include "mztools.h". . #define READ_8(adr) ((unsigned char)*(adr)). #define READ_16(adr) ( READ_8(adr) | (READ_8(adr+1) << 8) ).@@ -27,12 +28,9 @@. WRITE_16((unsigned char*)(buff) + 2, (n) >> 16); \. } while(0). .-extern int ZEXPORT unzRepair(file, fileOut, fileOutTmp, nRecovered, bytesRecovered).-const char* file;.-const char* fileOut;.-const char* fileOutTmp;.-uLong* nRecovered;.-uLong* bytesRecovered;.+int ZEXPORT unzRepair(const char* file, const char* fileOut,.+ const char* fileOutTmp, uLong* nRecovered,.+ uLong* bytesRecovered). {. int err = Z_OK;. FILE* fpZip = fopen(file, "rb");.@@ -147,8 +145,8 @@. /* Central directory entry */. {. char header[46];.- char* comment = "";.- int comsize = (int) strlen(comme

    C:\Program Files\WinHTTrack\src\minizip\mztools.c.orig (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):8146
    Entropy (8bit):4.392005740959655
    Encrypted:false
    SSDEEP:192:Zd6//doXFleGuOe0eGuOeyqi+KF5qXtFNteOeie3eEwP1Age65qF/EeyZgT4:f6/lo1l/Xz/XsrNTHdmTaoEn
    MD5:174C6F2A32DAD5023616FC45855D8C59
    SHA1:0F6DAD6443B0F347AC6B17563014F50C7B4FD17F
    SHA-256:CD887C4AF6D20823BD15F24008B10ACF01969B4165D7848656BDE843A92428D7
    SHA-512:3DCA117F49F7D31017B1DAE7C79853F6EF27084F4BA40CF08248B4BB9D0B0C0A68FA47BD8377C9AD2C55AA07163853E504F8BDF8D908BD186642EE143ACF7186
    Malicious:false
    Preview:/*. Additional tools for Minizip. Code: Xavier Roche '2004. License: Same as ZLIB (www.gzip.org).*/../* Code */.#include <stdio.h>.#include <stdlib.h>.#include <string.h>.#include "zlib.h".#include "unzip.h"..#define READ_8(adr) ((unsigned char)*(adr)).#define READ_16(adr) ( READ_8(adr) | (READ_8(adr+1) << 8) ).#define READ_32(adr) ( READ_16(adr) | (READ_16((adr)+2) << 16) )..#define WRITE_8(buff, n) do { \. *((unsigned char*)(buff)) = (unsigned char) ((n) & 0xff); \.} while(0).#define WRITE_16(buff, n) do { \. WRITE_8((unsigned char*)(buff), n); \. WRITE_8(((unsigned char*)(buff)) + 1, (n) >> 8); \.} while(0).#define WRITE_32(buff, n) do { \. WRITE_16((unsigned char*)(buff), (n) & 0xffff); \. WRITE_16((unsigned char*)(buff) + 2, (n) >> 16); \.} while(0)..extern int ZEXPORT unzRepair(file, fileOut, fileOutTmp, nRecovered, bytesRecovered).const char* file;.const char* fileOut;.const char* fileOutTmp;.uLong* nRecovered;.uLong* bytesRecovered;.{. int err = Z_OK;. FILE* fpZip =

    C:\Program Files\WinHTTrack\src\minizip\mztools.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):708
    Entropy (8bit):4.553169076480384
    Encrypted:false
    SSDEEP:12:Uz4ZJ9UR4rlLL8ABAy45HpbtktQNLsZKWxm8hYzSLV612Ty:nZIR4BLIMs3CpY+9Ty
    MD5:7CAAC7503F8F002D61E0F0E5B7F33BC6
    SHA1:907243F7CEA46D38AD12F6A6D6E01ADB4D74F1B3
    SHA-256:6F82C52279E8F79165F4446BE652E5741A49992AC58632470335AA34C564072A
    SHA-512:9C9E3317C5D102383D44391C5B12BC665FA36247D22C58C7ED7913C54F14AB0CF21EDF6D3EB5C3FA15B256AFA7813DDD3021CC49D50264CBEF1E997ACE257FC3
    Malicious:false
    Preview:/*. Additional tools for Minizip. Code: Xavier Roche '2004. License: Same as ZLIB (www.gzip.org).*/..#ifndef _zip_tools_H.#define _zip_tools_H..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _ZLIB_H.#include "zlib.h".#endif..#include "unzip.h"../* Repair a ZIP file (missing central directory). file: file to recover. fileOut: output file after recovery. fileOutTmp: temporary file name used for recovery.*/.extern int ZEXPORT unzRepair(const char* file,. const char* fileOut,. const char* fileOutTmp,. uLong* nRecovered,. uLong* bytesRecovered);...#ifdef __cplusplus.}.#endif...#endif.

    C:\Program Files\WinHTTrack\src\minizip\unzip.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):71054
    Entropy (8bit):4.808967968167853
    Encrypted:false
    SSDEEP:768:9YhEPv5Rm+OCxOvcMMGZ9ZgRFPHa6WpdTOObVtCEx:9V5RXxucdGv01Ha6iOObVtCEx
    MD5:32C11AE2AA5FF05CD4C871C856450A42
    SHA1:9AE64CB93A02721D33907AA57C3017BCD4E1C19C
    SHA-256:9DC09DA0688E5E5BD359844A7F24B36571213ECE9E634192373F1B0762B18D6A
    SHA-512:D4F2726C1E375676531C2AFB8FDA6359BA1F394481F21DD18CE337629E13C72ED5132597CF8086F174EA6F1C09C59383A0538FF449CF6744DC15B4347ADC639B
    Malicious:false
    Preview:/* unzip.c -- IO for uncompress .zip files using zlib. Version 1.1, February 14h, 2010. part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html ).. Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html ).. Modifications of Unzip for Zip64. Copyright (C) 2007-2008 Even Rouault.. Modifications for Zip64 support on both zip and unzip. Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com ).. For more info read MiniZip_info.txt... ------------------------------------------------------------------------------------. Decryption code comes from crypt.c by Info-ZIP but has been greatly reduced in terms of. compatibility with older software. The following is from the original crypt.c.. Code woven in by Terry Thorsen 1/2003... Copyright (c) 1990-2000 Info-ZIP. All rights reserved... See the accompanying file LICENSE, version 2000-Apr-09 or later. (the contents of wh

    C:\Program Files\WinHTTrack\src\minizip\unzip.c.orig (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):50193
    Entropy (8bit):4.889871291063335
    Encrypted:false
    SSDEEP:384:xh4KW7xjQJiLAy8Hg0Ki6o4CNlvxFlSQPxfvTBHtU8O15r:P4KW7CALAbHg0L6jcvxFlDPxfJtUh15r
    MD5:3D624FA2588B8B5182A5A9A4CD15F8E5
    SHA1:1858E43FC1BA3A5EBAAB68DFE98022DE4F9597E0
    SHA-256:C27075FB48731A12C2C92B8CC05F4DCC71776F1F0A8673271B6FEA3447AB5BA7
    SHA-512:218F542DC4EAB76BF3530357356CFFBE659A51C95E1EA34B65ABEC91CBC53BDCABE62DD428F0B0719315206F17DAC5BD9B8AC7A5A51A5ADE571C9FF2B8E6E30B
    Malicious:false
    Preview:/* unzip.c -- IO for uncompress .zip files using zlib.. Version 1.00, September 10th, 2003.... Copyright (C) 1998-2003 Gilles Vollant.... Read unzip.h for more info..*/..../* Decryption code comes from crypt.c by Info-ZIP but has been greatly reduced in terms of..compatibility with older software. The following is from the original crypt.c. Code..woven in by Terry Thorsen 1/2003...*/../*.. Copyright (c) 1990-2000 Info-ZIP. All rights reserved..... See the accompanying file LICENSE, version 2000-Apr-09 or later.. (the contents of which are also included in zip.h) for terms of use... If, for some reason, all these files are missing, the Info-ZIP license.. also may be found at: ftp://ftp.info-zip.org/pub/infozip/license.html..*/../*.. crypt.c (full version) by Info-ZIP. Last revised: [see crypt.h].... The encryption/decryption parts of this source code (as opposed to the.. non-echoing password parts) were originally written in Europe. The.. whole source package can

    C:\Program Files\WinHTTrack\src\minizip\unzip.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):16352
    Entropy (8bit):4.6099592596197
    Encrypted:false
    SSDEEP:192:WXLnAvqgGf3HpJHUC2ZA2WaR2ls3jWrH5HA6BcX8cUwgppEeqz:YtfXfUpk22lszwH5HA6BcXOwYEeqz
    MD5:11AE6A9D654C95C47DA55FE16772A1E5
    SHA1:4236476513B299F00F9637F7AD3E3631EBDEC2B9
    SHA-256:D8DC58FC0121B6A4B98F3028205BB253F956B1DDF791E9CED3CF44892502A01F
    SHA-512:0EBF5FB31A48577432E9826FB883FD2EB1D804D6B5CDB8F859F5A2AA94D8037AA4806A96EB9EBFAAA94E7A5A1D0D331535536BDC356DD34661E5C2FA15DCA22C
    Malicious:false
    Preview:/* unzip.h -- IO for uncompress .zip files using zlib. Version 1.1, February 14h, 2010. part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html ).. Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html ).. Modifications of Unzip for Zip64. Copyright (C) 2007-2008 Even Rouault.. Modifications for Zip64 support on both zip and unzip. Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com ).. For more info read MiniZip_info.txt.. ---------------------------------------------------------------------------------.. Condition of use and distribution are the same than zlib :.. This software is provided 'as-is', without any express or implied. warranty. In no event will the authors be held liable for any damages. arising from the use of this software... Permission is granted to anyone to use this software for any purpose,. including commercial applicati

    C:\Program Files\WinHTTrack\src\minizip\unzip.h.orig (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):13277
    Entropy (8bit):4.654537841146492
    Encrypted:false
    SSDEEP:192:DFiblX9fOJ1934KjQJ3cAYgZArz3ocMBXs:RafyTjQJMAYgZAr0ceXs
    MD5:675B48C27121FDE57E98806DF4143EE2
    SHA1:76E43D5F94E9F31E9C69DDFAF350AEBCCE0863EC
    SHA-256:7B9A37D95697AFA6FC764EF9DF27D90192A3EF8F993C1578AC490984CE5BCA07
    SHA-512:F885BEBA41653930E39CE5F447CA6AB16D7B7FC39C221D1F618EB6CF816905147BF391E88C0C026C47B38D7F24B50AFBD6D6413A8FE65A58A8CE97B644558F8D
    Malicious:false
    Preview:/* unzip.h -- IO for uncompress .zip files using zlib.. Version 1.00, September 10th, 2003.... Copyright (C) 1998-2003 Gilles Vollant.... This unzip package allow extract file from .ZIP file, compatible with PKZip 2.04g.. WinZip, InfoZip tools and compatible... Encryption and multi volume ZipFile (span) are not supported... Old compressions used by old PKZip 1.x are not supported...... I WAIT FEEDBACK at mail info@winimage.com.. Visit also http://www.winimage.com/zLibDll/unzip.htm for evolution.... Condition of use and distribution are the same than zlib :.... This software is provided 'as-is', without any express or implied.. warranty. In no event will the authors be held liable for any damages.. arising from the use of this software..... Permission is granted to anyone to use this software for any purpose,.. including commercial applications, and to alter it and redistribute it.. freely, subject to the following restrictions:.... 1. The origin of this soft

    C:\Program Files\WinHTTrack\src\minizip\zip.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):66094
    Entropy (8bit):5.02214026794667
    Encrypted:false
    SSDEEP:768:W6B0vnFW3rors0nBB4hjehwsJYOyfB12XjeJKZnCm+uoHz0r8G62Sjqi6rU6rCg2:JeW3r1CnCmkTMz778
    MD5:F85A91E83FCAC3C493F48855B5B30A33
    SHA1:0CB813E426BB3AEA8EBC1DE123CEF95425014FCA
    SHA-256:5D2E44267943B06C82C4F8EF9C5A898D69CC7F35D7A06C30E43F61B4311F188D
    SHA-512:7FD4F27237EC57BBB25A919AACCD04F98D4A3607E504A5B75E89A689C179927EDB9F8CD6D65E8ACA868F9D09DB51E79624A1B074BD875021E94FFA67A7C9AF8E
    Malicious:false
    Preview:/* zip.c -- IO on .zip files using zlib. Version 1.1, February 14h, 2010. part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html ).. Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html ).. Modifications for Zip64 support. Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com ).. For more info read MiniZip_info.txt.. Changes. Oct-2009 - Mathias Svensson - Remove old C style function prototypes. Oct-2009 - Mathias Svensson - Added Zip64 Support when creating new file archives. Oct-2009 - Mathias Svensson - Did some code cleanup and refactoring to get better overview of some functions.. Oct-2009 - Mathias Svensson - Added zipRemoveExtraInfoBlock to strip extra field data from its ZIP64 data. It is used when recreting zip archive with RAW when deleting items from a zip.. ZIP64 data is automaticly added

    C:\Program Files\WinHTTrack\src\minizip\zip.c.diff (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:unified diff output, ASCII text
    Category:dropped
    Size (bytes):3262
    Entropy (8bit):5.238863914749323
    Encrypted:false
    SSDEEP:48:O/QbARewudB3LQyKTuSpUgUdNtG4DNtLNtmiZtzYJVx:O/QbAkwu/3xKqRdjWiXcT
    MD5:6D620C6C89CE44E940E5159C9A056C7B
    SHA1:A8BA326CD5E4FEC640AA4D5810507CB21B29FD53
    SHA-256:2E5F4632EF7D907574565F24DB5666AFC4C2FF47A6C7B760AF4BAB2615BF9824
    SHA-512:84FE604667D9950A04B2D37292B09B2DBCEC182DBEB8E72FD323A18B91991DAE206ACD674AD4C1B99B94B7A038DF00F6F21C84C7A61D67D927B54757A750523F
    Malicious:false
    Preview:--- zip.c.orig.2014-06-10 18:55:32.778807408 +0200.+++ zip.c.2014-06-11 20:27:18.355848501 +0200.@@ -186,7 +186,7 @@. #include "crypt.h". #endif. .-local linkedlist_datablock_internal* allocate_new_datablock().+local linkedlist_datablock_internal* allocate_new_datablock(void). {. linkedlist_datablock_internal* ldi;. ldi = (linkedlist_datablock_internal*).@@ -238,7 +238,7 @@. }. . ldi = ll->last_block;.- from_copy = (unsigned char*)buf;.+ from_copy = (const unsigned char*)buf;. . while (len>0). {.@@ -637,7 +637,7 @@. return relativeOffset;. }. .-int LoadCentralDirectoryRecord(zip64_internal* pziinit).+local int LoadCentralDirectoryRecord(zip64_internal* pziinit). {. int err=ZIP_OK;. ZPOS64_T byte_before_the_zipfile;/* byte before the zipfile, (>0 for sfx)*/.@@ -955,7 +955,7 @@. return zipOpen3(pathname,append,NULL,NULL);. }. .-int Write_LocalFileHeader(zip64_internal* zi, const char* filename, uInt size_extrafield_local, const void* extrafield_loc

    C:\Program Files\WinHTTrack\src\minizip\zip.c.orig (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):65850
    Entropy (8bit):5.0221477740743286
    Encrypted:false
    SSDEEP:768:W7B0vnFW3Qors0nBB4hjehwsJYOyfB12XjeJK0nCm+uoHz0r8l6/Sjqi6rU6rCg0:seW3Q1DnCmkTMB77G
    MD5:252AADDAA5F658E71B40FC9DED34471F
    SHA1:084FF1E900A3958B647AB7124F052F33A247B32C
    SHA-256:23E4C2E582E445D96BD7D962FF7B335EEEC3AC45475DE255144A5597FBC9F245
    SHA-512:ABD773C6DE895BDBBC5B8FE5CC70D8BECE5D83552B05738BE0A55C57535506E2B00797338B71958134F682DCD5D4EAB30E39766972651C126DFA9F56117726D3
    Malicious:false
    Preview:/* zip.c -- IO on .zip files using zlib. Version 1.1, February 14h, 2010. part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html ).. Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html ).. Modifications for Zip64 support. Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com ).. For more info read MiniZip_info.txt.. Changes. Oct-2009 - Mathias Svensson - Remove old C style function prototypes. Oct-2009 - Mathias Svensson - Added Zip64 Support when creating new file archives. Oct-2009 - Mathias Svensson - Did some code cleanup and refactoring to get better overview of some functions.. Oct-2009 - Mathias Svensson - Added zipRemoveExtraInfoBlock to strip extra field data from its ZIP64 data. It is used when recreting zip archive with RAW when deleting items from a zip.. ZIP64 data is automaticly added

    C:\Program Files\WinHTTrack\src\minizip\zip.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):15704
    Entropy (8bit):3.9776475661782884
    Encrypted:false
    SSDEEP:192:usZm4/ZjV9Gf/lsziVyMhoGfc5eMkt77w:5IfrPEeMkt77w
    MD5:E2067124D539336FA48F8E1ADC0A9592
    SHA1:920B468935E5B29F8D753F5F32EA2A3D0E22303F
    SHA-256:5BA30A7FE05A86D343CD3518FDC1DDCF445B8DB9D99CAA2D22D51828020B93F7
    SHA-512:8A021E4BDDD69DDD35E17ED55BEB09F833F341268C2295F0BA7E42F0848F7F6FDB5D52B4E7F01EC6ECD5F204FBD068D91A303E15C7CDD499079DF540DB32C0D1
    Malicious:false
    Preview:/* zip.h -- IO on .zip files using zlib. Version 1.1, February 14h, 2010. part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html ).. Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html ).. Modifications for Zip64 support. Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com ).. For more info read MiniZip_info.txt.. ---------------------------------------------------------------------------.. Condition of use and distribution are the same than zlib :.. This software is provided 'as-is', without any express or implied. warranty. In no event will the authors be held liable for any damages. arising from the use of this software... Permission is granted to anyone to use this software for any purpose,. including commercial applications, and to alter it and redistribute it. freely, subject to the following restrictions:.. 1. The origin of this software must not be

    C:\Program Files\WinHTTrack\src\minizip\zip.h.diff (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:unified diff output, ASCII text
    Category:dropped
    Size (bytes):923
    Entropy (8bit):4.50363162540157
    Encrypted:false
    SSDEEP:12:xkIq+PsZFeVWp5ahaEOrw57lLcYVWphpasBdl8p37wdOjQKbHfv0e1kTP:+Iq+PW0eNw5pLLlan0spC/zGz
    MD5:7D2EE4E3CC69501C96BED2AA3FAC23FF
    SHA1:4E07BC6FD71F97EA101990BDBCF502133CABFB2F
    SHA-256:E257028E944D4E9C3F332561C0878028B5CBD8935AC7CF205CE1AD6DC77A97DE
    SHA-512:C01FF791B163002BC270C9B4BFFF33023072387338F12C92B438B89C829C7DC9F1C0D3D0FA670DEDAFB69B3F8579CBFE2CF0B052D318A4A38CC939236C1C5F21
    Malicious:false
    Preview:--- zip.h.orig.2010-02-15 12:58:22.000000000 +0100.+++ zip.h.2014-05-24 13:47:52.838188589 +0200.@@ -144,6 +144,11 @@. zipcharpc* globalcomment,. zlib_filefunc64_def* pzlib_filefunc_def));. .+extern zipFile ZEXPORT zipOpen3 OF((const void *pathname,.+ int append,.+ zipcharpc* globalcomment,.+ zlib_filefunc64_32_def* pzlib_filefunc64_32_def));.+. extern int ZEXPORT zipOpenNewFileInZip OF((zipFile file,. const char* filename,. const zip_fileinfo* zipfi,.@@ -311,6 +316,11 @@. Write data in the zipfile. */. .+extern int ZEXPORT zipFlush OF((zipFile file));.+/*.+ Flush the zipfile output.+*/.+. extern int ZEXPORT zipCloseFileInZip OF((zipFile file));. /*. Close the current file in the zipfile.

    C:\Program Files\WinHTTrack\src\minizip\zip.h.orig (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):15366
    Entropy (8bit):3.970429065081028
    Encrypted:false
    SSDEEP:96:us6sIK32h5vBX38QyZjV9Gfyx+lWt9e3Hib97tOgbvgOJkBbMNkc1cEjcyKcyu/W:usZm4/ZjV9Gf/lsDVyMhoGfcReMkt77w
    MD5:E1495F151B00503A64AAE7B375CC3B80
    SHA1:8CEF828DB4766401B91BEC9B47CA56A3118705FC
    SHA-256:96163FC140E4BF08752E014D20A1EAC3F5ADCDC408366F6D79C1895F2599CF08
    SHA-512:A761F6855F9FFFCB716D3A058AE9152F339FD5AC36E6C152D74D4346FE038D4F6169E23CE54527E94CD9CB1D5B52A01FDCAB9D9C55C6426EB587003EF54D09F2
    Malicious:false
    Preview:/* zip.h -- IO on .zip files using zlib. Version 1.1, February 14h, 2010. part of the MiniZip project - ( http://www.winimage.com/zLibDll/minizip.html ).. Copyright (C) 1998-2010 Gilles Vollant (minizip) ( http://www.winimage.com/zLibDll/minizip.html ).. Modifications for Zip64 support. Copyright (C) 2009-2010 Mathias Svensson ( http://result42.com ).. For more info read MiniZip_info.txt.. ---------------------------------------------------------------------------.. Condition of use and distribution are the same than zlib :.. This software is provided 'as-is', without any express or implied. warranty. In no event will the authors be held liable for any damages. arising from the use of this software... Permission is granted to anyone to use this software for any purpose,. including commercial applications, and to alter it and redistribute it. freely, subject to the following restrictions:.. 1. The origin of this software must not be

    C:\Program Files\WinHTTrack\src\murmurhash3.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):3787
    Entropy (8bit):5.05807076915668
    Encrypted:false
    SSDEEP:48:wtUq3iwfy+Ct2lwIk5WuWz1vWpPyLD6/3yBhrATtkm91s8t6niAQ4ozuh9AT7uht:waq3iwfyRJIcWuW1epGubBcnWr1GOy
    MD5:3F00A3411539996F33ED0B87F040037B
    SHA1:8DCC865536A01BB1BF3CD7A953FDD0BCB06FE5BF
    SHA-256:8EB39294F0D83A41FA4154A863B5B808BBB8301C08A2B901ED1A3F0DF27C03DE
    SHA-512:04432820BEE1DC14AB5FED233FF6FEAA2500B412A19CCF08D6E2D77809F0EB08C30AA4FBE662F28927A5857B53FAF9559E8777ACEE353A095D6B53E11EAF565A
    Malicious:false
    Preview://-----------------------------------------------------------------------------.// MurmurHash3 was written by Austin Appleby, and is placed in the public.// domain. The author hereby disclaims copyright to this source code...// Note - The x86 and x64 versions do _not_ produce the same results, as the.// algorithms are optimized for their respective platforms. You can still.// compile and run any of them on any platform, but your performance with the.// non-native version will be less than optimal...#ifdef _WIN32.#include <stddef.h>.typedef __int8 int8_t;.typedef unsigned __int8 uint8_t;.typedef unsigned __int16 uint16_t;.typedef unsigned __int32 uint32_t;.typedef unsigned __int64 uint64_t;.#elif (defined(SOLARIS) || defined(sun) || defined(HAVE_INTTYPES_H) \. || defined(BSD) || defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__NetBSD__) || defined(__FreeBSD_kernel__)).#include <inttypes.h>.#else.#include <stdint.h>.#endif..static uint32_t rotl32 ( uint32_t x, int8_t r ).{. re

    C:\Program Files\WinHTTrack\src\murmurhash3.h.diff (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:unified diff output, ASCII text
    Category:dropped
    Size (bytes):769
    Entropy (8bit):5.274534653103435
    Encrypted:false
    SSDEEP:12:+uRu3cxEuFJoUEuU+MzGlAqznALdLrLW6Lb0GSCdIb++O7G+E7G+TF7G+y/AuC02:VtQElix/S6qiwfy//C0bqt
    MD5:7F3D99F3244CCD9A6C818ED532D5285A
    SHA1:F544E04D6A493A386AE827E73F63A4595F9A93AC
    SHA-256:63C17E82CE1C6B69E10B20495B40B55D57D10FF1B6F8E6DAF127E103F953D5DF
    SHA-512:80127A64F234A0C9C39044C92845F8CFF0AB144E32FE4313D9F074D128CDC4D627FEF9EE9A7FACAB4850AA164A5D871FD15FFD5B313A4E70E626965C3B43096C
    Malicious:false
    Preview:--- murmurhash3.h.orig.2014-06-14 14:29:11.562576736 +0200.+++ murmurhash3.h.2014-06-14 14:39:43.989624584 +0200.@@ -7,7 +7,19 @@. // compile and run any of them on any platform, but your performance with the. // non-native version will be less than optimal.. .+#ifdef _WIN32.+#include <stddef.h>.+typedef __int8 int8_t;.+typedef unsigned __int8 uint8_t;.+typedef unsigned __int16 uint16_t;.+typedef unsigned __int32 uint32_t;.+typedef unsigned __int64 uint64_t;.+#elif (defined(SOLARIS) || defined(sun) || defined(HAVE_INTTYPES_H) \.+ || defined(BSD) || defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__NetBSD__) || defined(__FreeBSD_kernel__)).+#include <inttypes.h>.+#else. #include <stdint.h>.+#endif. . static uint32_t rotl32 ( uint32_t x, int8_t r ). {.

    C:\Program Files\WinHTTrack\src\murmurhash3.h.orig (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):3366
    Entropy (8bit):4.9295219014365355
    Encrypted:false
    SSDEEP:48:wtUqk2lwIk5WuWz1vWpPyLD6/3yBhrATtkm91s8t6niAQ4ozuh9AT7uh9UGOy:waqkJIcWuW1epGubBcnWr1GOy
    MD5:42485F20A511C37EC72635AB06473A0A
    SHA1:3CA4A16F228C4FE2F574E7C75EE053C1811B95A9
    SHA-256:7B30931693F238A59D1F1ADDEB08CF491E8878AFF60F0FD5487BD43EDE34C241
    SHA-512:DA81017D9658962D8CB7BBFF3F3332050ABDC65094B92112B4A7A790E5EFE94361A15BC7305534214E38385C8A856996A6AAF569D66C03179A7BDDECE68E7E07
    Malicious:false
    Preview://-----------------------------------------------------------------------------.// MurmurHash3 was written by Austin Appleby, and is placed in the public.// domain. The author hereby disclaims copyright to this source code...// Note - The x86 and x64 versions do _not_ produce the same results, as the.// algorithms are optimized for their respective platforms. You can still.// compile and run any of them on any platform, but your performance with the.// non-native version will be less than optimal...#include <stdint.h>..static uint32_t rotl32 ( uint32_t x, int8_t r ).{. return (x << r) | (x >> (32 - r));.}.#define ROTL32(x,y) rotl32(x,y).static uint32_t getblock32 ( const uint32_t * p, int i ).{. return p[i];.}.static uint32_t fmix32 ( uint32_t h ).{. h ^= h >> 16;. h *= 0x85ebca6b;. h ^= h >> 13;. h *= 0xc2b2ae35;. h ^= h >> 16;.. return h;.}.#define BIG_CONSTANT(x) (x##LLU).static void MurmurHash3_x86_128 ( const void * key, const int len,.

    C:\Program Files\WinHTTrack\src\proxy\AUTHORS (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):34
    Entropy (8bit):4.1162996057016965
    Encrypted:false
    SSDEEP:3:DZfo3Xzun:Ffonzun
    MD5:D5F790E4912D0B0FFD205118712D9360
    SHA1:B706F6D30C6B9E557A12885329123A587A39027F
    SHA-256:A7FF49A93E97E7387F79CD84DCB87F43F419A025A99EA789C55F64CA544F1150
    SHA-512:D096D3B6744198BAF8F6FAC684601BD140F53C43FD9636BBB5288274F83E937B802056CED172C1CD39210EA4B826CBFDA8C1FE4472A9E186F2F14B05BD5847EC
    Malicious:false
    Preview:Xavier Roche <roche@httrack.com>..

    C:\Program Files\WinHTTrack\src\proxy\COPYING (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text
    Category:dropped
    Size (bytes):35147
    Entropy (8bit):4.573442652974749
    Encrypted:false
    SSDEEP:768:Mo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A7D:Mhcycsrfrnoue
    MD5:D32239BCB673463AB874E80D47FAE504
    SHA1:8624BCDAE55BAEEF00CD11D5DFCFA60F68710A02
    SHA-256:8CEB4B9EE5ADEDDE47B31E975C1D90C73AD27B6B165A1DCD80C7C545EB65B903
    SHA-512:7633623B66B5E686BB94DD96A7CDB5A7E5EE00E87004FAB416A5610D59C62BADAF512A2E26E34E2455B7ED6B76690D2CD47464836D7D85D78B51D50F7E933D5C
    Malicious:false
    Preview: GNU GENERAL PUBLIC LICENSE. Version 3, 29 June 2007.. Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>. Everyone is permitted to copy and distribute verbatim copies. of this license document, but changing it is not allowed... Preamble.. The GNU General Public License is a free, copyleft license for.software and other kinds of works... The licenses for most software and other practical works are designed.to take away your freedom to share and change the works. By contrast,.the GNU General Public License is intended to guarantee your freedom to.share and change all versions of a program--to make sure it remains free.software for all its users. We, the Free Software Foundation, use the.GNU General Public License for most of our software; it applies also to.any other work released this way by its authors. You can apply it to.your programs, too... When we speak of free software, we are referring to

    C:\Program Files\WinHTTrack\src\proxy\changelog.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):924
    Entropy (8bit):5.053481404279071
    Encrypted:false
    SSDEEP:24:Nqwqs4u6jNIL9oXzbu4bRV+HWAF70KplJwQyFLAL:Nq09K1RNAlCvLc
    MD5:714C62C11DDB25F0FC2A9DA8639C3B56
    SHA1:F4B4DA57C8F446E0F8AB94D3D628B2B4A0F13392
    SHA-256:A8B7AFDBA7F5B36149C34D9D3D1ABFF9D92CF4D6DB499E47F1A2CD0FB7A21CCC
    SHA-512:3E36BD098DDCE8BD1E1A8BC08E6EA265A7B11ABC7E4B16777A71C3E8C2E9C411298A79FA07E7F65070489A28A2BBFD74F3B772D41CD12F624483E0A1D3BF93EA
    Malicious:false
    Preview:0.5 - May 8 2006..- added ARC (Internet Archive 1.0) file format..- first index output routines (proxytrack --convert ..)....0.4 - Sept 18 2005..- implemented very limited WebDAV (RFC2518) primitives..- index enumeration fixes..- limited access to the proxy server through HTTP in non-proxy mode....0.3 - Sept 10 2005..- implemented ICPv2 server (tested with Squid Web Proxy Cache) implementing ICP_OP_QUERY and ICP_OP_SECHO..- redirects for URLs with missing ending '/'..- fixed htsnet.h macro errors (bogus port during address copy)..- keep-alive fixes....0.2 - Sept 4 2005..- hack to fix the "external files stored as absolute references" bug..- proper locking for indexes (unlocked zFile)..- added previous httrack .dat/.ndx cache format..- added catalog as index fallback..- started to write ICPv2 server (RFC2186), but not yet ready....0.1 - Aug 27 2005..- initial release: HTTP (RFC2616) proxy and aggregation ready..

    C:\Program Files\WinHTTrack\src\proxy\is-4O2NQ.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):4134
    Entropy (8bit):5.059983796026545
    Encrypted:false
    SSDEEP:48:qRC7iyZHcWgQN02c9lmRytr7Qqt7GMyeW8trMZu2xIqdd4rEGsiwbjxi7+I/jkuE:qRC73dgQNi7Qq9tD2/dd4rEHJbrWjkuE
    MD5:5B751626CF34744B22D957ED8D297E46
    SHA1:00C27E3CD615649D60F898D7922C5B17BFBCE647
    SHA-256:03207E0AE3DC041477137C5FD199EC6199C4ED4A6033D2C022CEDC3B7D22D368
    SHA-512:A3635B93439F936E1E9964712628F52DA7511BB77C39A19B45FA12C4E3E22ADAD0A4A45E57789DFD8189ECE076921506E40775FC8C37EBA3DFE451E879D62B03
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Please visit our Website: http://www.httrack.com.*/../* ------------------------------------------------------------ */./* File: Cache manager for ProxyTrack */./* Author

    C:\Program Files\WinHTTrack\src\proxy\is-B0QDQ.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):34
    Entropy (8bit):4.1162996057016965
    Encrypted:false
    SSDEEP:3:DZfo3Xzun:Ffonzun
    MD5:D5F790E4912D0B0FFD205118712D9360
    SHA1:B706F6D30C6B9E557A12885329123A587A39027F
    SHA-256:A7FF49A93E97E7387F79CD84DCB87F43F419A025A99EA789C55F64CA544F1150
    SHA-512:D096D3B6744198BAF8F6FAC684601BD140F53C43FD9636BBB5288274F83E937B802056CED172C1CD39210EA4B826CBFDA8C1FE4472A9E186F2F14B05BD5847EC
    Malicious:false
    Preview:Xavier Roche <roche@httrack.com>..

    C:\Program Files\WinHTTrack\src\proxy\is-D7J0E.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):11223
    Entropy (8bit):5.035127532858249
    Encrypted:false
    SSDEEP:192:qRC73dVQkU2D5iAyjzPgaCHYueVuyWdv7byVFG0CiNmFNVAjQVQ5Qw7BlcsuJpgJ:qoLdv35gCHYDwnv6VF8FOyQ
    MD5:D7C952BCE7FC8AB428E79E37C0B04DA4
    SHA1:EFE63566C0521898669D3802EB9BDDFFAF548D86
    SHA-256:DB86415C0B6968C9B89BA5AE70178060676C786E1BFBDA1354EB3D4E9CC48E1A
    SHA-512:87BCAC9B5658FA57809A267EDEBE62BD2171AFB18B45717432DA35DE92DF26BE7018C251666DE4539C4251897E0A7AAB65A2B1EA48DEE7B9B02AD3AB9165A16F
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Please visit our Website: http://www.httrack.com.*/../* ------------------------------------------------------------ */./* File: ProxyTrack, httrack cache-based proxy */./* Author

    C:\Program Files\WinHTTrack\src\proxy\is-HI9JV.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):76445
    Entropy (8bit):4.828037356159719
    Encrypted:false
    SSDEEP:1536:gre7GJhgftYMcaBnBbXGWRmcF6S1S61/aO0Gx6056IJ0SevK:ke7GJhgftYMcaBnBbXGWRmcsS1S61/ae
    MD5:7BD68C96C5A6B876049AB92F800B6C73
    SHA1:34EEC10475367F3FB71FD977C4AAA6D53D9315B0
    SHA-256:0613AD1FC08C396D98A2600E8D3B82590D7DDB40C48AD272847F5E98A5CF8C6D
    SHA-512:24CEB1B18A1EB85389F8B4C8BE18CD1245097AF274F3BB6400056C898563D66CD35975FDE9C6C38B7707FC71996D75E41F9DB63C877A87C4FB880ED9F84283E2
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Please visit our Website: http://www.httrack.com.*/../* Parts (inside ARC format routines) by Lars Clausen (lc@statsbiblioteket.dk) */../* ---------------------------------------------------------

    C:\Program Files\WinHTTrack\src\proxy\is-HKPG8.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):2819
    Entropy (8bit):5.021221964306608
    Encrypted:false
    SSDEEP:48:qRC7iyZHcW1QxdfP9yBsRMyvcJCwE7ZvBb/sFXKXtfw:qRC73d1QxHyueyv8ZEz0sC
    MD5:34054863588A45BE916305CFEDA73C0C
    SHA1:E1FA1D6BA1CC4882971CD7C62A784F8731F7F41C
    SHA-256:27D9AC9524D1A704A42B1D3969D2DDF825712ABBB6C45FAAB10AE00E493A383C
    SHA-512:FB5AF1C47509CBC24074A3DC55F1FDB0B8FDAB3C6E35268CF6B8BD72561A91D90D6374ED7863BC8781F445A56C9FB5480045A2844A859E2963066F3DC0AC117A
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Please visit our Website: http://www.httrack.com.*/../* ------------------------------------------------------------ */./* File: Strings */./* Author

    C:\Program Files\WinHTTrack\src\proxy\is-K6JR1.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):924
    Entropy (8bit):5.053481404279071
    Encrypted:false
    SSDEEP:24:Nqwqs4u6jNIL9oXzbu4bRV+HWAF70KplJwQyFLAL:Nq09K1RNAlCvLc
    MD5:714C62C11DDB25F0FC2A9DA8639C3B56
    SHA1:F4B4DA57C8F446E0F8AB94D3D628B2B4A0F13392
    SHA-256:A8B7AFDBA7F5B36149C34D9D3D1ABFF9D92CF4D6DB499E47F1A2CD0FB7A21CCC
    SHA-512:3E36BD098DDCE8BD1E1A8BC08E6EA265A7B11ABC7E4B16777A71C3E8C2E9C411298A79FA07E7F65070489A28A2BBFD74F3B772D41CD12F624483E0A1D3BF93EA
    Malicious:false
    Preview:0.5 - May 8 2006..- added ARC (Internet Archive 1.0) file format..- first index output routines (proxytrack --convert ..)....0.4 - Sept 18 2005..- implemented very limited WebDAV (RFC2518) primitives..- index enumeration fixes..- limited access to the proxy server through HTTP in non-proxy mode....0.3 - Sept 10 2005..- implemented ICPv2 server (tested with Squid Web Proxy Cache) implementing ICP_OP_QUERY and ICP_OP_SECHO..- redirects for URLs with missing ending '/'..- fixed htsnet.h macro errors (bogus port during address copy)..- keep-alive fixes....0.2 - Sept 4 2005..- hack to fix the "external files stored as absolute references" bug..- proper locking for indexes (unlocked zFile)..- added previous httrack .dat/.ndx cache format..- added catalog as index fallback..- started to write ICPv2 server (RFC2186), but not yet ready....0.1 - Aug 27 2005..- initial release: HTTP (RFC2616) proxy and aggregation ready..

    C:\Program Files\WinHTTrack\src\proxy\is-MFB8L.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:XML 1.0 document, ASCII text, with very long lines (798)
    Category:dropped
    Size (bytes):11593
    Entropy (8bit):5.3493933133250735
    Encrypted:false
    SSDEEP:96:J3qf2unRWRWwTUuNqf28nRDWwfHuq4Eqf2eNt2WwnrN3uKqIH3qf2kNt2Wwnt7oc:J6OClwTqOMIwfV4DOydw5iNOAdwh5tRj
    MD5:75FE20CFF4C82D21090BB476641A90F5
    SHA1:7E160DC5F9426BB2877D22A60018706B5C57D165
    SHA-256:8616F30BC5ADCCD11958F35D23AF170876F0594A9AE0BA6F399EF01085B7A7AD
    SHA-512:0C23CB8E3205FE19821ADE2D3938C9AF145079EFD7D6AC383D65557C4A78C627E5E442ECB3D4CD1DA8E9F53D6A14110480C2ED82080772DF7173D54FC377DD9F
    Malicious:false
    Preview:<?xml version="1.0" encoding="Windows-1252"?>.<VisualStudioProject..ProjectType="Visual C++"..Version="9,00"..Name="proxytrack"..ProjectGUID="{4C31F79A-9DAB-44CE-88D6-0FF961599AAB}"..RootNamespace="proxytrack"..Keyword="Win32Proj"..TargetFrameworkVersion="131072"..>..<Platforms>...<Platform....Name="Win32".../>...<Platform....Name="x64".../>..</Platforms>..<ToolFiles>..</ToolFiles>..<Configurations>...<Configuration....Name="Debug|Win32"....OutputDirectory="C:\temp\proxytrack\Debug"....IntermediateDirectory="C:\temp\proxytrack\Debug\int"....ConfigurationType="1"....InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops"....CharacterSet="2"....>....<Tool.....Name="VCPreBuildEventTool"..../>....<Tool.....Name="VCCustomBuildTool"..../>....<Tool.....Name="VCXMLDataGeneratorTool"..../>....<Tool.....Name="VCWebServiceProxyGeneratorTool"..../>....<Tool.....Name="VCMIDLTool"..../>....<Tool.....Name="VCCLCompilerTool".....Optimization="0".....AdditionalIncludeDirector

    C:\Program Files\WinHTTrack\src\proxy\is-NTNA4.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):6022
    Entropy (8bit):4.991818577224529
    Encrypted:false
    SSDEEP:96:qRC73dVQuYkSjrlxHY1D29jGoXLmToTIWORE7q0DxQ5YrC:qRC73dVQ5kSnDY1C9jGJToTIWGE7q0DK
    MD5:3BADA18068F880E89E7C6EAE58C851A4
    SHA1:24D32349869F5FF9D74F91313EC5BFED4E06854E
    SHA-256:CE0C57B4903E9DEF6EA4DA9395D56FA76F245F2601B6E20AC819DD12F20D2010
    SHA-512:04CCDC8B0A10CF443DCF067B46BEBAC1B2454BFD803BC13C3855CBAEA6ABD5A0A4933CD897798CA47A8F20F75F8459B73A21AFCCA22B5BC781F2F5BB0C4A1F58
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Please visit our Website: http://www.httrack.com.*/../* ------------------------------------------------------------ */./* File: ProxyTrack, httrack cache-based proxy */./* Author

    C:\Program Files\WinHTTrack\src\proxy\is-PUKE8.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):52418
    Entropy (8bit):4.8803794172189345
    Encrypted:false
    SSDEEP:768:7LhhKY+lpqC5T7pIX+clFXIIlBZNAPt8/Cn6CaqQLmgZ6XKYv:WPpDhql1LmG1Yv
    MD5:ED8A44BFD458504478EF3A85B6059C82
    SHA1:14BCB09FA1ED03268B131C43334FCDBB4209FFDE
    SHA-256:024ED8A327BB79F4D0D913577B3994CC39873315407B2D03022349B906FE0A30
    SHA-512:06E8D0E0F063BBA135FEF90AD2B97785167BBCFEDBE084D45C8F8F7F3C84C4F8CF2C30435973D8757006E4EECB53B119FEEA8FC4B4233F77120AFD246DB3D310
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Please visit our Website: http://www.httrack.com.*/../* ------------------------------------------------------------ */./* File: ProxyTrack, httrack cache-based proxy */./* Author

    C:\Program Files\WinHTTrack\src\proxy\is-T3LTB.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text
    Category:dropped
    Size (bytes):35147
    Entropy (8bit):4.573442652974749
    Encrypted:false
    SSDEEP:768:Mo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A7D:Mhcycsrfrnoue
    MD5:D32239BCB673463AB874E80D47FAE504
    SHA1:8624BCDAE55BAEEF00CD11D5DFCFA60F68710A02
    SHA-256:8CEB4B9EE5ADEDDE47B31E975C1D90C73AD27B6B165A1DCD80C7C545EB65B903
    SHA-512:7633623B66B5E686BB94DD96A7CDB5A7E5EE00E87004FAB416A5610D59C62BADAF512A2E26E34E2455B7ED6B76690D2CD47464836D7D85D78B51D50F7E933D5C
    Malicious:false
    Preview: GNU GENERAL PUBLIC LICENSE. Version 3, 29 June 2007.. Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>. Everyone is permitted to copy and distribute verbatim copies. of this license document, but changing it is not allowed... Preamble.. The GNU General Public License is a free, copyleft license for.software and other kinds of works... The licenses for most software and other practical works are designed.to take away your freedom to share and change the works. By contrast,.the GNU General Public License is intended to guarantee your freedom to.share and change all versions of a program--to make sure it remains free.software for all its users. We, the Free Software Foundation, use the.GNU General Public License for most of our software; it applies also to.any other work released this way by its authors. You can apply it to.your programs, too... When we speak of free software, we are referring to

    C:\Program Files\WinHTTrack\src\proxy\main.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):6022
    Entropy (8bit):4.991818577224529
    Encrypted:false
    SSDEEP:96:qRC73dVQuYkSjrlxHY1D29jGoXLmToTIWORE7q0DxQ5YrC:qRC73dVQ5kSnDY1C9jGJToTIWGE7q0DK
    MD5:3BADA18068F880E89E7C6EAE58C851A4
    SHA1:24D32349869F5FF9D74F91313EC5BFED4E06854E
    SHA-256:CE0C57B4903E9DEF6EA4DA9395D56FA76F245F2601B6E20AC819DD12F20D2010
    SHA-512:04CCDC8B0A10CF443DCF067B46BEBAC1B2454BFD803BC13C3855CBAEA6ABD5A0A4933CD897798CA47A8F20F75F8459B73A21AFCCA22B5BC781F2F5BB0C4A1F58
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Please visit our Website: http://www.httrack.com.*/../* ------------------------------------------------------------ */./* File: ProxyTrack, httrack cache-based proxy */./* Author

    C:\Program Files\WinHTTrack\src\proxy\proxystrings.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):2819
    Entropy (8bit):5.021221964306608
    Encrypted:false
    SSDEEP:48:qRC7iyZHcW1QxdfP9yBsRMyvcJCwE7ZvBb/sFXKXtfw:qRC73d1QxHyueyv8ZEz0sC
    MD5:34054863588A45BE916305CFEDA73C0C
    SHA1:E1FA1D6BA1CC4882971CD7C62A784F8731F7F41C
    SHA-256:27D9AC9524D1A704A42B1D3969D2DDF825712ABBB6C45FAAB10AE00E493A383C
    SHA-512:FB5AF1C47509CBC24074A3DC55F1FDB0B8FDAB3C6E35268CF6B8BD72561A91D90D6374ED7863BC8781F445A56C9FB5480045A2844A859E2963066F3DC0AC117A
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Please visit our Website: http://www.httrack.com.*/../* ------------------------------------------------------------ */./* File: Strings */./* Author

    C:\Program Files\WinHTTrack\src\proxy\proxytrack.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):52418
    Entropy (8bit):4.8803794172189345
    Encrypted:false
    SSDEEP:768:7LhhKY+lpqC5T7pIX+clFXIIlBZNAPt8/Cn6CaqQLmgZ6XKYv:WPpDhql1LmG1Yv
    MD5:ED8A44BFD458504478EF3A85B6059C82
    SHA1:14BCB09FA1ED03268B131C43334FCDBB4209FFDE
    SHA-256:024ED8A327BB79F4D0D913577B3994CC39873315407B2D03022349B906FE0A30
    SHA-512:06E8D0E0F063BBA135FEF90AD2B97785167BBCFEDBE084D45C8F8F7F3C84C4F8CF2C30435973D8757006E4EECB53B119FEEA8FC4B4233F77120AFD246DB3D310
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Please visit our Website: http://www.httrack.com.*/../* ------------------------------------------------------------ */./* File: ProxyTrack, httrack cache-based proxy */./* Author

    C:\Program Files\WinHTTrack\src\proxy\proxytrack.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):11223
    Entropy (8bit):5.035127532858249
    Encrypted:false
    SSDEEP:192:qRC73dVQkU2D5iAyjzPgaCHYueVuyWdv7byVFG0CiNmFNVAjQVQ5Qw7BlcsuJpgJ:qoLdv35gCHYDwnv6VF8FOyQ
    MD5:D7C952BCE7FC8AB428E79E37C0B04DA4
    SHA1:EFE63566C0521898669D3802EB9BDDFFAF548D86
    SHA-256:DB86415C0B6968C9B89BA5AE70178060676C786E1BFBDA1354EB3D4E9CC48E1A
    SHA-512:87BCAC9B5658FA57809A267EDEBE62BD2171AFB18B45717432DA35DE92DF26BE7018C251666DE4539C4251897E0A7AAB65A2B1EA48DEE7B9B02AD3AB9165A16F
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Please visit our Website: http://www.httrack.com.*/../* ------------------------------------------------------------ */./* File: ProxyTrack, httrack cache-based proxy */./* Author

    C:\Program Files\WinHTTrack\src\proxy\proxytrack.vcproj (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:XML 1.0 document, ASCII text, with very long lines (798)
    Category:dropped
    Size (bytes):11593
    Entropy (8bit):5.3493933133250735
    Encrypted:false
    SSDEEP:96:J3qf2unRWRWwTUuNqf28nRDWwfHuq4Eqf2eNt2WwnrN3uKqIH3qf2kNt2Wwnt7oc:J6OClwTqOMIwfV4DOydw5iNOAdwh5tRj
    MD5:75FE20CFF4C82D21090BB476641A90F5
    SHA1:7E160DC5F9426BB2877D22A60018706B5C57D165
    SHA-256:8616F30BC5ADCCD11958F35D23AF170876F0594A9AE0BA6F399EF01085B7A7AD
    SHA-512:0C23CB8E3205FE19821ADE2D3938C9AF145079EFD7D6AC383D65557C4A78C627E5E442ECB3D4CD1DA8E9F53D6A14110480C2ED82080772DF7173D54FC377DD9F
    Malicious:false
    Preview:<?xml version="1.0" encoding="Windows-1252"?>.<VisualStudioProject..ProjectType="Visual C++"..Version="9,00"..Name="proxytrack"..ProjectGUID="{4C31F79A-9DAB-44CE-88D6-0FF961599AAB}"..RootNamespace="proxytrack"..Keyword="Win32Proj"..TargetFrameworkVersion="131072"..>..<Platforms>...<Platform....Name="Win32".../>...<Platform....Name="x64".../>..</Platforms>..<ToolFiles>..</ToolFiles>..<Configurations>...<Configuration....Name="Debug|Win32"....OutputDirectory="C:\temp\proxytrack\Debug"....IntermediateDirectory="C:\temp\proxytrack\Debug\int"....ConfigurationType="1"....InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops"....CharacterSet="2"....>....<Tool.....Name="VCPreBuildEventTool"..../>....<Tool.....Name="VCCustomBuildTool"..../>....<Tool.....Name="VCXMLDataGeneratorTool"..../>....<Tool.....Name="VCWebServiceProxyGeneratorTool"..../>....<Tool.....Name="VCMIDLTool"..../>....<Tool.....Name="VCCLCompilerTool".....Optimization="0".....AdditionalIncludeDirector

    C:\Program Files\WinHTTrack\src\proxy\store.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):76445
    Entropy (8bit):4.828037356159719
    Encrypted:false
    SSDEEP:1536:gre7GJhgftYMcaBnBbXGWRmcF6S1S61/aO0Gx6056IJ0SevK:ke7GJhgftYMcaBnBbXGWRmcsS1S61/ae
    MD5:7BD68C96C5A6B876049AB92F800B6C73
    SHA1:34EEC10475367F3FB71FD977C4AAA6D53D9315B0
    SHA-256:0613AD1FC08C396D98A2600E8D3B82590D7DDB40C48AD272847F5E98A5CF8C6D
    SHA-512:24CEB1B18A1EB85389F8B4C8BE18CD1245097AF274F3BB6400056C898563D66CD35975FDE9C6C38B7707FC71996D75E41F9DB63C877A87C4FB880ED9F84283E2
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Please visit our Website: http://www.httrack.com.*/../* Parts (inside ARC format routines) by Lars Clausen (lc@statsbiblioteket.dk) */../* ---------------------------------------------------------

    C:\Program Files\WinHTTrack\src\proxy\store.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):4134
    Entropy (8bit):5.059983796026545
    Encrypted:false
    SSDEEP:48:qRC7iyZHcWgQN02c9lmRytr7Qqt7GMyeW8trMZu2xIqdd4rEGsiwbjxi7+I/jkuE:qRC73dgQNi7Qq9tD2/dd4rEHJbrWjkuE
    MD5:5B751626CF34744B22D957ED8D297E46
    SHA1:00C27E3CD615649D60F898D7922C5B17BFBCE647
    SHA-256:03207E0AE3DC041477137C5FD199EC6199C4ED4A6033D2C022CEDC3B7D22D368
    SHA-512:A3635B93439F936E1E9964712628F52DA7511BB77C39A19B45FA12C4E3E22ADAD0A4A45E57789DFD8189ECE076921506E40775FC8C37EBA3DFE451E879D62B03
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2017 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Please visit our Website: http://www.httrack.com.*/../* ------------------------------------------------------------ */./* File: Cache manager for ProxyTrack */./* Author

    C:\Program Files\WinHTTrack\src\punycode.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):13995
    Entropy (8bit):4.748591545146397
    Encrypted:false
    SSDEEP:192:La1WB33GDwgkEKFFWNtccxPgMh9GlUqfQXBCZaOiJE4k8hn6n3j3zFvAwpFoTL7I:m1WxGv7fHxZ+WtKaOim3j1AwpForWV
    MD5:E91151F6836812D3EDDD8628B63E72D6
    SHA1:1B49E62BB87BE5D3A65DEEB8EB566BA520948A4B
    SHA-256:6A3668BEA4B208E68406CC9E1766759D48B23B9A5B914B8E18AA0DD425E08EFE
    SHA-512:A13818ADC83ECE006447F2014003642AA8CFC33BC5F1A5F1D97802F00FC9436108E03B5BF1E3A12A495C8765E3CD591AEEE7809065937E755A05123243E4F0D8
    Malicious:false
    Preview:/*.punycode.c from RFC 3492.http://www.nicemice.net/idn/.Adam M. Costello.http://www.nicemice.net/amc/..This is ANSI C code (C89) implementing Punycode (RFC 3492)...*/..#include "punycode.h"../******************/./* Implementation */..#include <string.h>../*** Bootstring parameters for Punycode ***/..enum { base = 36, tmin = 1, tmax = 26, skew = 38, damp = 700,. initial_bias = 72, initial_n = 0x80, delimiter = 0x2D.};../* basic(cp) tests whether cp is a basic code point: */.#define basic(cp) ((punycode_uint)(cp) < 0x80)../* delim(cp) tests whether cp is a delimiter: */.#define delim(cp) ((cp) == delimiter)../* decode_digit(cp) returns the numeric value of a basic code */./* point (for use in representing integers) in the range 0 to */./* base-1, or base if cp is does not represent a value. */..static punycode_uint decode_digit(punycode_uint cp) {. return cp - 48 < 10 ? cp - 22 : cp - 65 < 26 ? cp - 65 : cp - 97 <. 26 ? cp - 97 : base;.}../* encode_digit(d,flag) returns the b

    C:\Program Files\WinHTTrack\src\punycode.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text
    Category:dropped
    Size (bytes):4417
    Entropy (8bit):4.436296577223246
    Encrypted:false
    SSDEEP:96:LZ3iDrsIx61HSbZCkOt76PIxmPyNWBtesCopM6+bJwcrANuEbEIMVgOyQ8:LZSnsb1HSbZCkOtGPIxGyNWBteNiM6+w
    MD5:587870545AF07ED61E8B02A4C5B872C0
    SHA1:94DF3C4952D01D1157A84ECA151818BB79E4D3D5
    SHA-256:826543A4D6013CCA7C18CD70B248DA28ACEA45A5382A0BC39FEFBE1BECA7FCD9
    SHA-512:E9D6F4FE8EFB9CCA2B1FD3F97E5653F5AA6AA7A0E9A1B8D6D36CDC75467AE9A4EB566012F62A8FA4C8F846A02A8076C692AB4379B5B1000135BCF35842EDB57A
    Malicious:false
    Preview:/*.punycode.c from RFC 3492.http://www.nicemice.net/idn/.Adam M. Costello.http://www.nicemice.net/amc/..This is ANSI C code (C89) implementing Punycode (RFC 3492)...*/..#ifndef PUNYCODE_COSTELLO_RFC3492_H.#define PUNYCODE_COSTELLO_RFC3492_H../********************/./* Public interface */..#include <limits.h>..typedef enum punycode_status {. punycode_success,. punycode_bad_input, /* Input is invalid. */. punycode_big_output, /* Output would exceed the space provided. */. punycode_overflow /* Input needs wider integers to process. */.} punycode_status;..#if UINT_MAX >= (1 << 26) - 1.typedef unsigned int punycode_uint;.#else.typedef unsigned long punycode_uint;.#endif../* punycode_encode() converts Unicode to Punycode. The input */./* is represented as an array of Unicode code points (not code */./* units; surrogate pairs are not allowed), and the output */./* will be represented as an array of ASCII code points. The

    C:\Program Files\WinHTTrack\src\svn-commit.tmp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Unicode text, UTF-8 text
    Category:dropped
    Size (bytes):88
    Entropy (8bit):4.34366834750546
    Encrypted:false
    SSDEEP:3:eKlg13wJMC0YJAVQM2TsBhQqWhaX7ATfvx:eKyh89JA6M2YBGtLZ
    MD5:31252C3D8BA16CF37FE31A5945105AA5
    SHA1:66CFE8FFFFBCB78620220B30C609D57D1D2C7409
    SHA-256:0BF8A6A7C8045CA0C4BDBB3B5EDA67F292CA606162AD3EB66AF95BEF60ECEAAA
    SHA-512:A2585764CC49409B19DCB33FEFD48CE32D7D8B4C54D1D70A9A7B08ED5CD592B950BFEE25C67B52B511C3D49218501C55335BD063B588F9810C201AE51933C968
    Malicious:false
    Preview:Typo :)..--Cette ligne, et les suivantes ci-dessous, seront ignor.es--..M htssafe.h.

    C:\Program Files\WinHTTrack\src\webhttrack (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Bourne-Again shell script, ASCII text executable
    Category:dropped
    Size (bytes):4691
    Entropy (8bit):5.4876095511876715
    Encrypted:false
    SSDEEP:96:qqv4fxXN/Wt3tzeeU0VE009ew5hC9ORhFVqaXd9m9F8S42srbiZt15:qqQfPOrzNUgW5hC9OXqaXdHS9r
    MD5:4019A09ED6833BC00427901733EE7AA4
    SHA1:99473FF67B44DE8A85C5960D21362C3A6A7DFD56
    SHA-256:A9F5EAF97C27230D37903283062862AF90773DBBCD949C611399D0B7B62BED48
    SHA-512:8353FED64DAFBE00C307B1F25C9174A22A063FA9E65F9DFCA8E72F19524F7214635ADEEE73BB83159FD58CD5B3D7A7227C0ACA965457B5DE64897266EA5512D6
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 0%
    Preview:#!/bin/bash.#.# WebHTTrack launcher script.# Initializes the htsserver GUI frontend and launch the default browser..BROWSEREXE=.SRCHBROWSEREXE="x-www-browser www-browser iceape mozilla firefox icecat iceweasel abrowser firebird galeon konqueror midori opera google-chrome chrome chromium chromium-browser netscape".if test -n "${BROWSER}"; then.# sensible-browser will f up if BROWSER is not set.SRCHBROWSEREXE="xdg-open sensible-browser ${SRCHBROWSEREXE}".fi.# Patch for Darwin/Mac by Ross Williams.if test "`uname -s`" == "Darwin"; then.# Darwin/Mac OS X uses a system 'open' command to find.# the default browser. The -W flag causes it to wait for.# the browser to exit.BROWSEREXE="/usr/bin/open -W".fi.BINWD=`dirname "$0"`.SRCHPATH="$BINWD /usr/local/bin /usr/share/bin /usr/bin /usr/lib/httrack /usr/local/lib/httrack /usr/local/share/httrack /opt/local/bin /sw/bin ${HOME}/usr/bin ${HOME}/bin".SRCHPATH="$SRCHPATH "`echo $PATH | tr ":" " "`.SRCHDISTPATH="$BINWD/../share $BINWD/.. /usr/share /u

    C:\Program Files\WinHTTrack\src\webhttrack.dsp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with very long lines (361), with CRLF line terminators
    Category:dropped
    Size (bytes):4675
    Entropy (8bit):5.486954205867068
    Encrypted:false
    SSDEEP:96:yRawfIT5irfjQNhNQEPTRE+LjUGNCNvrdTWv+SHNAbA0vBPxW2ad1c:eATUjjQF9vUHK2StAbAUhrad1c
    MD5:35135743C08319C957256CFFE0F4351F
    SHA1:309A185090DF7367EAC9E0F1E394E5540CFE708B
    SHA-256:47D89C19732CBEF46373812043F5A8508B5FBFFDB072B515093324D97B7C8E88
    SHA-512:4EDC7B3F0EB36905E4120C807C55C57642072B760533D718275123E429F624743FA3F8BFA9586B17A0DE0369A159F46AA8CB82DC9D6BC6D7C4190F80A602DFB7
    Malicious:false
    Preview:# Microsoft Developer Studio Project File - Name="webhttrack" - Package Owner=<4>..# Microsoft Developer Studio Generated Build File, Format Version 6.00..# ** DO NOT EDIT **....# TARGTYPE "Win32 (x86) Console Application" 0x0103....CFG=webhttrack - Win32 Debug..!MESSAGE This is not a valid makefile. To build this project using NMAKE,..!MESSAGE use the Export Makefile command and run..!MESSAGE ..!MESSAGE NMAKE /f "webhttrack.mak"...!MESSAGE ..!MESSAGE You can specify a configuration when running NMAKE..!MESSAGE by defining the macro CFG on the command line. For example:..!MESSAGE ..!MESSAGE NMAKE /f "webhttrack.mak" CFG="webhttrack - Win32 Debug"..!MESSAGE ..!MESSAGE Possible choices for configuration are:..!MESSAGE ..!MESSAGE "webhttrack - Win32 Release" (based on "Win32 (x86) Console Application")..!MESSAGE "webhttrack - Win32 Debug" (based on "Win32 (x86) Console Application")..!MESSAGE ....# Begin Project..# PROP AllowPerConfigDependencies 0..# PROP Scc_ProjName ""..# PROP Scc_Loca

    C:\Program Files\WinHTTrack\src\webhttrack.dsw (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):841
    Entropy (8bit):4.190499563639701
    Encrypted:false
    SSDEEP:12:zTYcgcg2NDrXMejzzjXEvunEczz34FZpzb:zacpJBPzjSmz3s3zb
    MD5:54EDFF199BC67A1AC751EC3709AC48F6
    SHA1:7CA59B576E298751DA8CFBCF58A4A4008175DE38
    SHA-256:A7E4A31A7B26639C0DFFA346B7F2B90D75F19116D9ACD0326580BFF0CCA918D1
    SHA-512:73A0CE3FE12BC29A78D616BA9ADA9452F5091D6DF434E1887D5DDB6C8B406E36E212FC607801FFF515A487789747958B83F98F305AAB5E99E103DF6F288DC234
    Malicious:false
    Preview:Microsoft Developer Studio Workspace File, Format Version 6.00..# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!....###############################################################################....Project: "libhttrack"=..\libhttrack\libhttrack.dsp - Package Owner=<4>....Package=<5>..{{{..}}}....Package=<4>..{{{..}}}....###############################################################################....Project: "webhttrack"=.\webhttrack.dsp - Package Owner=<4>....Package=<5>..{{{..}}}....Package=<4>..{{{.. Begin Project Dependency.. Project_Dep_Name libhttrack.. End Project Dependency..}}}....###############################################################################....Global:....Package=<5>..{{{..}}}....Package=<3>..{{{..}}}....###############################################################################....

    C:\Program Files\WinHTTrack\src\webhttrack.vcproj (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:XML 1.0 document, ASCII text
    Category:dropped
    Size (bytes):11312
    Entropy (8bit):5.2127650509572705
    Encrypted:false
    SSDEEP:192:7GPI77WE+qGPK77DED2nyUGPrIT6+EsogGPNIT6sEukgdn:7Z76E+qv7PEKlJfEsj3BE8N
    MD5:2E024F2DFF2D2478C235BC04A4CD805B
    SHA1:EB7E4F0FD997FCC736CD36B8D5B16D39D9CA49CD
    SHA-256:C39642CDFB3366C2695433D3DC5CEDCEEDF80BF7512AC0B0A7130393962722AB
    SHA-512:C45E594BB16ABF1402AE0CCDC03EB626187113C7691A0B4F8ED7DA40EC94BCB4E441E9B29A172DAEEF130E33D37B464CB2C7D35C411353541100AA9D119838C1
    Malicious:false
    Preview:<?xml version="1.0" encoding="Windows-1252"?>.<VisualStudioProject..ProjectType="Visual C++"..Version="9,00"..Name="webhttrack"..ProjectGUID="{B2A68D1B-3EB3-4B16-B634-8D36AC4266EC}"..RootNamespace="webhttrack"..TargetFrameworkVersion="131072"..>..<Platforms>...<Platform....Name="Win32".../>...<Platform....Name="x64".../>..</Platforms>..<ToolFiles>..</ToolFiles>..<Configurations>...<Configuration....Name="Debug|Win32"....OutputDirectory="C:\temp\webhttrack\Debug"....IntermediateDirectory="C:\temp\webhttrack\Debug"....ConfigurationType="1"....InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops"....UseOfMFC="0"....ATLMinimizesCRunTimeLibraryUsage="false"....CharacterSet="2"....>....<Tool.....Name="VCPreBuildEventTool"..../>....<Tool.....Name="VCCustomBuildTool"..../>....<Tool.....Name="VCXMLDataGeneratorTool"..../>....<Tool.....Name="VCWebServiceProxyGeneratorTool"..../>....<Tool.....Name="VCMIDLTool".....TypeLibraryName=".\Debug/webhttrack.tlb".....HeaderFil

    C:\Program Files\WinHTTrack\src_win\InnoSetup\httrack-x64.iss (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Generic INItialization configuration [Tasks]
    Category:dropped
    Size (bytes):11056
    Entropy (8bit):5.354645746977411
    Encrypted:false
    SSDEEP:192:YTP1bkTVj6fevMxPUM8xv250TiAP7bNFmZCo/u1nfIjpRbpRVpRtpRepR1p4oteT:YBbkTVjdGR8xvBPnNFmZCo/J0e343/Or
    MD5:B03B92807A507D5DDB8ACB4DC39FD76A
    SHA1:AA40A30704F427B7C3CA4E1F49CE5F9768342331
    SHA-256:5D1DC221AF014128F586727694F7B800305B2A0E714EB09B2FB3CB7336B217EE
    SHA-512:09B1D74FEE888161EF270A8CDB5F9B59270D8AC53829E4FAFFAB4CD867C7DA10BF8FE32847D8078AC0C7CC6A00A4304C0B0C660A9DAEBDA56290FBBD077F22AE
    Malicious:false
    Preview:; HTTrack Website Copier - x64 edition....[Setup]..AppVerName=WinHTTrack Website Copier 3.49-2 (x64)..AppVersion=3.49.2..AppName=WinHTTrack Website Copier..ArchitecturesInstallIn64BitMode=x64..ArchitecturesAllowed=x64..; Setup..VersionInfoProductName=WinHTTrack Website Copier (x64)..AppPublisher=HTTrack..AppPublisherURL=http://www.httrack.com..AppSupportURL=http://forum.httrack.com..AppUpdatesURL=http://www.httrack.com/page/2/..DefaultDirName={pf}\WinHTTrack..DefaultGroupName=WinHTTrack..AllowNoIcons=yes..;AlwaysCreateUninstallIcon=yes..LicenseFile=O:\HTTrackFiles\setup_license.txt..; uncomment the following line if you want your installation to run on NT 3.51 too...;MinVersion=4,4..;;AdminPrivilegesRequired=no..AppMutex=WinHTTrack_RUN..OutputBaseFilename=httrack_x64..OutputDir=O:\..SetupIconFile=C:\Dev\httrack-windows\WinHTTrack\res\Shell.ico..UninstallIconFile=C:\Dev\httrack-windows\WinHTTrack\res\Shell.ico..;DiskSpanning=yes..;DiskSize=1048576..SignedUninstaller=yes..; Tools/Configu

    C:\Program Files\WinHTTrack\src_win\InnoSetup\httrack.iss (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Generic INItialization configuration [Tasks]
    Category:dropped
    Size (bytes):10783
    Entropy (8bit):5.341462306059197
    Encrypted:false
    SSDEEP:192:7P1bk4Vj6fRvMxPUMjxv250TiAP7bNFmZCo/u1nfIjpRbpRVpRtpRepR1p4ote3D:Zbk4VjoGRjxvBPnNFmZCo/J0e343/OHL
    MD5:B064CB428E04AFDBD0CBEBA4ACCE290A
    SHA1:65553F257B2DB52B38707B1B85685F18C31AB713
    SHA-256:F1D096B01E295D2CDA0558F2546F1CD127B62D2FD8C7ADF598089A6CD9ADF0A5
    SHA-512:561D0DDA8A0CBF41BBE7E235E2D765F008684D1362ABB81C9CBF431E2E68C9441472805C511BABB823D7779EBBBCBE6D0FFF9A48B094E570D690CF3094CA930D
    Malicious:false
    Preview:; HTTrack Website Copier - x86 edition....[Setup]..AppVerName=WinHTTrack Website Copier 3.49-2..AppVersion=3.49.2..AppName=WinHTTrack Website Copier..AppPublisher=HTTrack..AppPublisherURL=http://www.httrack.com..AppSupportURL=http://forum.httrack.com..AppUpdatesURL=http://www.httrack.com/page/2/..DefaultDirName={pf}\WinHTTrack..DefaultGroupName=WinHTTrack..AllowNoIcons=yes..;AlwaysCreateUninstallIcon=yes..LicenseFile=O:\HTTrackFiles\setup_license.txt..; uncomment the following line if you want your installation to run on NT 3.51 too...;MinVersion=4,4..;;AdminPrivilegesRequired=no..AppMutex=WinHTTrack_RUN..OutputBaseFilename=httrack..OutputDir=O:\..SetupIconFile=C:\Dev\httrack-windows\WinHTTrack\res\Shell.ico..UninstallIconFile=C:\Dev\httrack-windows\WinHTTrack\res\Shell.ico..;DiskSpanning=yes..;DiskSize=1048576..SignedUninstaller=yes..; Tools/Configure Sign Tools.../Add:..; Name of the sign tool: signtool..; Command of the sign tool: "C:\Program Files\Microsoft SDKs\Windows\v6.0A\Bin\s

    C:\Program Files\WinHTTrack\src_win\InnoSetup\is-7378B.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):1195
    Entropy (8bit):4.911086399144892
    Encrypted:false
    SSDEEP:24:yE59+EDDWkyEOkH5CTbVpTjFvW4/mFTxUQ36s:yO9PDDNygHWTjFvWJUyN
    MD5:F93E24FD6A95D2489D5DB275ADD84D2A
    SHA1:624FAC7C36C2F90AA432D75B603E0BAA79A53654
    SHA-256:D62DDB7AE57B89BA7FB237BA9AA7FEFA2C59D764BE3840BE026CD5E12FE410B6
    SHA-512:CC264A926D42B113C66DEAD4EF7831461866B1F72BE2B0DD7C85DE07E051F7577AF1F052DDD6026983D3F171C6989CD9BD69B3AD947D9064F9F346248AC569D9
    Malicious:false
    Preview:HTTrack Website Copier License Agreement:....HTTrack Website Copier, Offline Browser for Windows and Unix..Copyright (C) Xavier Roche and other contributors.....This program is free software; you can redistribute it and/or..modify it under the terms of the GNU General Public License..as published by the Free Software Foundation; either version 3..of the License, or any later version.....This program is distributed in the hope that it will be useful,..but WITHOUT ANY WARRANTY; without even the implied warranty of..MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the..GNU General Public License for more details.....You should have received a copy of the GNU General Public License..along with this program; if not, write to the Free Software..Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.......Important notes:....- We hereby ask people using this source NOT to use it in purpose of grabbing..emails addresses, or collecting any other private informations

    C:\Program Files\WinHTTrack\src_win\InnoSetup\is-Q26TT.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Generic INItialization configuration [Tasks]
    Category:dropped
    Size (bytes):11056
    Entropy (8bit):5.354645746977411
    Encrypted:false
    SSDEEP:192:YTP1bkTVj6fevMxPUM8xv250TiAP7bNFmZCo/u1nfIjpRbpRVpRtpRepR1p4oteT:YBbkTVjdGR8xvBPnNFmZCo/J0e343/Or
    MD5:B03B92807A507D5DDB8ACB4DC39FD76A
    SHA1:AA40A30704F427B7C3CA4E1F49CE5F9768342331
    SHA-256:5D1DC221AF014128F586727694F7B800305B2A0E714EB09B2FB3CB7336B217EE
    SHA-512:09B1D74FEE888161EF270A8CDB5F9B59270D8AC53829E4FAFFAB4CD867C7DA10BF8FE32847D8078AC0C7CC6A00A4304C0B0C660A9DAEBDA56290FBBD077F22AE
    Malicious:false
    Preview:; HTTrack Website Copier - x64 edition....[Setup]..AppVerName=WinHTTrack Website Copier 3.49-2 (x64)..AppVersion=3.49.2..AppName=WinHTTrack Website Copier..ArchitecturesInstallIn64BitMode=x64..ArchitecturesAllowed=x64..; Setup..VersionInfoProductName=WinHTTrack Website Copier (x64)..AppPublisher=HTTrack..AppPublisherURL=http://www.httrack.com..AppSupportURL=http://forum.httrack.com..AppUpdatesURL=http://www.httrack.com/page/2/..DefaultDirName={pf}\WinHTTrack..DefaultGroupName=WinHTTrack..AllowNoIcons=yes..;AlwaysCreateUninstallIcon=yes..LicenseFile=O:\HTTrackFiles\setup_license.txt..; uncomment the following line if you want your installation to run on NT 3.51 too...;MinVersion=4,4..;;AdminPrivilegesRequired=no..AppMutex=WinHTTrack_RUN..OutputBaseFilename=httrack_x64..OutputDir=O:\..SetupIconFile=C:\Dev\httrack-windows\WinHTTrack\res\Shell.ico..UninstallIconFile=C:\Dev\httrack-windows\WinHTTrack\res\Shell.ico..;DiskSpanning=yes..;DiskSize=1048576..SignedUninstaller=yes..; Tools/Configu

    C:\Program Files\WinHTTrack\src_win\InnoSetup\is-QKGQP.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Generic INItialization configuration [Tasks]
    Category:dropped
    Size (bytes):10783
    Entropy (8bit):5.341462306059197
    Encrypted:false
    SSDEEP:192:7P1bk4Vj6fRvMxPUMjxv250TiAP7bNFmZCo/u1nfIjpRbpRVpRtpRepR1p4ote3D:Zbk4VjoGRjxvBPnNFmZCo/J0e343/OHL
    MD5:B064CB428E04AFDBD0CBEBA4ACCE290A
    SHA1:65553F257B2DB52B38707B1B85685F18C31AB713
    SHA-256:F1D096B01E295D2CDA0558F2546F1CD127B62D2FD8C7ADF598089A6CD9ADF0A5
    SHA-512:561D0DDA8A0CBF41BBE7E235E2D765F008684D1362ABB81C9CBF431E2E68C9441472805C511BABB823D7779EBBBCBE6D0FFF9A48B094E570D690CF3094CA930D
    Malicious:false
    Preview:; HTTrack Website Copier - x86 edition....[Setup]..AppVerName=WinHTTrack Website Copier 3.49-2..AppVersion=3.49.2..AppName=WinHTTrack Website Copier..AppPublisher=HTTrack..AppPublisherURL=http://www.httrack.com..AppSupportURL=http://forum.httrack.com..AppUpdatesURL=http://www.httrack.com/page/2/..DefaultDirName={pf}\WinHTTrack..DefaultGroupName=WinHTTrack..AllowNoIcons=yes..;AlwaysCreateUninstallIcon=yes..LicenseFile=O:\HTTrackFiles\setup_license.txt..; uncomment the following line if you want your installation to run on NT 3.51 too...;MinVersion=4,4..;;AdminPrivilegesRequired=no..AppMutex=WinHTTrack_RUN..OutputBaseFilename=httrack..OutputDir=O:\..SetupIconFile=C:\Dev\httrack-windows\WinHTTrack\res\Shell.ico..UninstallIconFile=C:\Dev\httrack-windows\WinHTTrack\res\Shell.ico..;DiskSpanning=yes..;DiskSize=1048576..SignedUninstaller=yes..; Tools/Configure Sign Tools.../Add:..; Name of the sign tool: signtool..; Command of the sign tool: "C:\Program Files\Microsoft SDKs\Windows\v6.0A\Bin\s

    C:\Program Files\WinHTTrack\src_win\InnoSetup\setup_license.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):1195
    Entropy (8bit):4.911086399144892
    Encrypted:false
    SSDEEP:24:yE59+EDDWkyEOkH5CTbVpTjFvW4/mFTxUQ36s:yO9PDDNygHWTjFvWJUyN
    MD5:F93E24FD6A95D2489D5DB275ADD84D2A
    SHA1:624FAC7C36C2F90AA432D75B603E0BAA79A53654
    SHA-256:D62DDB7AE57B89BA7FB237BA9AA7FEFA2C59D764BE3840BE026CD5E12FE410B6
    SHA-512:CC264A926D42B113C66DEAD4EF7831461866B1F72BE2B0DD7C85DE07E051F7577AF1F052DDD6026983D3F171C6989CD9BD69B3AD947D9064F9F346248AC569D9
    Malicious:false
    Preview:HTTrack Website Copier License Agreement:....HTTrack Website Copier, Offline Browser for Windows and Unix..Copyright (C) Xavier Roche and other contributors.....This program is free software; you can redistribute it and/or..modify it under the terms of the GNU General Public License..as published by the Free Software Foundation; either version 3..of the License, or any later version.....This program is distributed in the hope that it will be useful,..but WITHOUT ANY WARRANTY; without even the implied warranty of..MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the..GNU General Public License for more details.....You should have received a copy of the GNU General Public License..along with this program; if not, write to the Free Software..Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.......Important notes:....- We hereby ask people using this source NOT to use it in purpose of grabbing..emails addresses, or collecting any other private informations

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\Shell.ico (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:MS Windows icon resource - 4 icons, 32x32, 48x48
    Category:dropped
    Size (bytes):8166
    Entropy (8bit):3.8949927423136286
    Encrypted:false
    SSDEEP:192:7KDJKDJMd+kp7fCKDE55555ZFFFd5555:7KDJKDyd+kBCKDE55555ZFFFd5555
    MD5:8BBEABB082C72F52611C45DD71B539EB
    SHA1:021E0173BD8FB7D1A1CE14D83F0EB7E22B9B5DDA
    SHA-256:98A539EE42CF14FF22950E62DE4EB82254C5C3B2F87690C323C6D33BD09ED8FC
    SHA-512:0725FEC578E774F33EFBA28C8FA6810D6788B15DE26E2FCBBA438AD89886C2B1A47BDF1563D4783A426DE273825536095D7E9D8CE3FDF7292A76669B8FF08FB0
    Malicious:false
    Preview:...... ..........F...00.............. ......................h...~...(... ...@..............................................................................................""".))).UUU.MMM.BBB.999..|..PP........................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............f.........3...3.3.3.f.3...3...3...33..333.33f.33..33..33..3f..3f3.3ff.3f..3f..3f..3...3.3.3.f.3...3...3...3...3.3.3.f.3..3...3...3.3.3.f.3...3...3...f...f.3.f.f.f...f...f...f3..f33.f3f.f3..f3..f3..ff..ff3.fff.ff..ff..f...f.3.f.f.f...f...f...f...f.3.f..f...f...f...f.3.f...f................3...............33...f..3.......f...f3..3f..f...f...3....3...f...................3.f.f..................3...f...................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f......3..f................3...f..................3...f...............3...f......3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..........

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\StdAfx.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):323
    Entropy (8bit):4.910199240780642
    Encrypted:false
    SSDEEP:6:jGmyXH+5AMRNT15eAHYRFm+ylL+5FdllZ+sMKcaGIA0RQbyueFZAqs7eAqkUA4PT:jGXXHJYx5f4RE+y05JlZ+4cWAoQ5cAqN
    MD5:CCED3A7AD8235E3565D8318372343A8A
    SHA1:6684D68B1EED28B146F5D5B20B48DF76FA7EBFE7
    SHA-256:37F04E611AD7105F8F82F34F90B07600EA34AB6E9F117E918718AACB6D4E9CB6
    SHA-512:2097F29875C0223E04D3A05AE307DC48433204466EE342D8AC06163448B3C854BE768104C5F88248396C9DD0FE5AE7DF56700070A9C5683C7B82413FF060728F
    Malicious:false
    Preview:// stdafx.cpp : source file that includes just the standard includes..// stdafx.pch will be the pre-compiled header..// stdafx.obj will contain the pre-compiled type information....#include "stdafx.h"..../*..#ifdef _ATL_STATIC_REGISTRY..#include <statreg.h>..#include <statreg.cpp>..#endif....#include <atlimpl.cpp>..*/..

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\StdAfx.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1032
    Entropy (8bit):5.430988324350213
    Encrypted:false
    SSDEEP:24:FnNXT/TSF4jCot5fnkBxcFKJWFOqEPUjJ7U8xTZ:nXT/TY4BbslPYl7xTZ
    MD5:128A6B2BA3D0BB6D6B184E4D75260DF4
    SHA1:EEF4E188A01F75208E38C053C8E8E0D5C27442AA
    SHA-256:4279A9C845F756D45A6BE46CC58F42F2752ECFE686FC99CE258E1A326554F041
    SHA-512:D9438B8E17C5F98DBF30E23CEDEE7C9962FF79A3FFEF3A29A5C6121521CC947EA2AD0FE0F253FF12597200E1541D0A4F18FFAB0C1F6C83CBF28D37E4227AC0AC
    Malicious:false
    Preview:// stdafx.h : include file for standard system include files,..// or project specific include files that are used frequently,..// but are changed infrequently....#if !defined(AFX_STDAFX_H__12F4061A_3F8D_4FFA_948D_624E42DAE092__INCLUDED_)..#define AFX_STDAFX_H__12F4061A_3F8D_4FFA_948D_624E42DAE092__INCLUDED_....#if _MSC_VER > 1000..#pragma once..#endif // _MSC_VER > 1000....#define STRICT..#ifndef _WIN32_WINNT..#define _WIN32_WINNT 0x0400..#endif..#define _ATL_APARTMENT_THREADED....#include <atlbase.h>..//You may derive a class from CComModule and use it if you want to override..//something, but do not change the name of _Module..extern CComModule _Module;..#include <atlcom.h>..../* WTL */..#include <atlwin.h>..#include <atlapp.h>..#include <atlctrls.h>..#include <atlmisc.h>..#include <comutil.h>......//{{AFX_INSERT_LOCATION}}..// Microsoft Visual C++ will insert additional declarations immediately before the previous line.....#endif // !defined(AFX_STDAFX_H__12F4061A_3F8D_4FF

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\WinHTTrackIEBar.clw (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):252
    Entropy (8bit):4.96667995664233
    Encrypted:false
    SSDEEP:6:agQO/MKFiEMqiFgIvTmo5yyeA0RQby05LWUAwW14ZA1DX2:pQOjFiEO+4TZ5yyeAoQ/5LRAR3l2
    MD5:FE1E57897406333E1B487C134328EF43
    SHA1:F0513712B2A165C6A43556B81860D2A1B196D1DA
    SHA-256:93DC8792EE8AB125A26E16892551D248D3F60EC7E81A4483775E3E3973822FD7
    SHA-512:E07A7907D969B2BBE6DD4395CDADB5B241964C1D185707F4E17FFECBC7800CECFAE99D0E1411CF05161D4F0504856CB1FEF031A8E5E903D950FDC8A8613D22AB
    Malicious:false
    Preview:; CLW file contains information for the MFC ClassWizard....[General Info]..Version=1..LastClass=..LastTemplate=CDialog..NewFileInclude1=#include "stdafx.h"..NewFileInclude2=#include "winhttrackiebar.h"..LastPage=0....ClassCount=0....ResourceCount=0....

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\WinHTTrackIEBar.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2205
    Entropy (8bit):5.015669163950011
    Encrypted:false
    SSDEEP:48:dXETDS63XETDpuIxETXETvEqEXXEdd06TWzd0iDmdwcU4a6t3Rrj2i1Q68qU6a5L:dUTDJ3UTduICTUTc/XUd1TWzd3Dj4JRo
    MD5:4EEBA05DA1D02A7D22381F4A2A5122F3
    SHA1:CF3277E11BCA77EC09DBDD2F35F826FDD5FCA7AA
    SHA-256:2A8DA5C8124A170AC69AC9BFC6C6CDF16A6420E85628D0A2CA2376B51C38F228
    SHA-512:C84661A7377DE975EED14389DAA4D6F0D2520C184EBDDA6255BF325BCB2842AEED05BB001EDBBD2EDF9B403CEA65F53A6C2A5A001E9E32B6B715D5E61CB3ED9C
    Malicious:false
    Preview:// WinHTTrackIEBar.cpp : Implementation of DLL Exports.......// Note: Proxy/Stub Information..// To build a separate proxy/stub DLL, ..// run nmake -f WinHTTrackIEBarps.mk in the project directory.....#include "stdafx.h"..#include "resource.h"..#include <initguid.h>..#include "WinHTTrackIEBar.h"....#include "WinHTTrackIEBar_i.c"..#include "WinHTTrackLauncher.h"....CComModule _Module;....BEGIN_OBJECT_MAP(ObjectMap)..OBJECT_ENTRY(CLSID_WinHTTrackLauncher, WinHTTrackLauncher)..END_OBJECT_MAP()..../////////////////////////////////////////////////////////////////////////////..// DLL Entry Point....extern "C"..BOOL WINAPI DllMain(HINSTANCE hInstance, DWORD dwReason, LPVOID /*lpReserved*/)..{.. if (dwReason == DLL_PROCESS_ATTACH).. {.. _Module.Init(ObjectMap, hInstance, &LIBID_WINHTTRACKIEBARLib);.. DisableThreadLibraryCalls(hInstance);.. }.. else if (dwReason == DLL_PROCESS_DETACH).. _Module.Term();.. return TRUE; // ok..}..../////////////////

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\WinHTTrackIEBar.def (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):238
    Entropy (8bit):5.164570760797604
    Encrypted:false
    SSDEEP:6:ahXET+L2hbnBQ8UQ2nET+LOvmBwL2FxNqOhhuO5mXykP2n3fmy:IXETNtnBQ8UnnETyBlFxNqOh0O4Xykev
    MD5:3715DCFD15FE29B198D0418B04DF9F50
    SHA1:4D4BED2BDE11A1374133858DB849A7D0D495FFE7
    SHA-256:F46D1B45F214C40E73ABF69886699C3F6839F9616143F207BF8C92E10AD2A7EC
    SHA-512:01F0DFE26FABB4E720F16310D73B2E71C5AF045AB71AF2EF42952C43AAA4B1C549DFE8B89BB4F9E8E59E01AB00E360FA4B82FEFD22F54932D24764A7070DE04A
    Malicious:false
    Preview:; WinHTTrackIEBar.def : Declares the module parameters.....LIBRARY "WinHTTrackIEBar.DLL"....EXPORTS...DllCanUnloadNow @1 PRIVATE...DllGetClassObject @2 PRIVATE...DllRegisterServer @3 PRIVATE...DllUnregisterServer.@4 PRIVATE..

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\WinHTTrackIEBar.dsp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):14015
    Entropy (8bit):5.551134786061665
    Encrypted:false
    SSDEEP:384:5W+Z+H+j+I+P+3+z+P4+Pc+Rv9+FwG5R+khpo9+YZWAF9+P7/C5G5R+PXjmBG55L:ptS9WOiFBOb5oUNv5ov5g1GuqNH
    MD5:14F8783BD4B1B98DE2B4757E04B82B99
    SHA1:49A1E6563F6A2287ECF3ED530F13E2CFAAEA3085
    SHA-256:290C4116D8FE0E5E2424019B99FDCA5A381217230F976A6F97E9B5CE935545AE
    SHA-512:369445977582897363B9B901E7FFB65F713EB364EE22E294FAA3E9FCB18850DC6D47220A90DE7FD275BF6481B2C59FAC5DAAF5A48809A4A3489D3EE61A89C40A
    Malicious:false
    Preview:# Microsoft Developer Studio Project File - Name="WinHTTrackIEBar" - Package Owner=<4>..# Microsoft Developer Studio Generated Build File, Format Version 6.00..# ** DO NOT EDIT **....# TARGTYPE "Win32 (x86) Dynamic-Link Library" 0x0102....CFG=WinHTTrackIEBar - Win32 Debug..!MESSAGE This is not a valid makefile. To build this project using NMAKE,..!MESSAGE use the Export Makefile command and run..!MESSAGE ..!MESSAGE NMAKE /f "WinHTTrackIEBar.mak"...!MESSAGE ..!MESSAGE You can specify a configuration when running NMAKE..!MESSAGE by defining the macro CFG on the command line. For example:..!MESSAGE ..!MESSAGE NMAKE /f "WinHTTrackIEBar.mak" CFG="WinHTTrackIEBar - Win32 Debug"..!MESSAGE ..!MESSAGE Possible choices for configuration are:..!MESSAGE ..!MESSAGE "WinHTTrackIEBar - Win32 Debug" (based on "Win32 (x86) Dynamic-Link Library")..!MESSAGE "WinHTTrackIEBar - Win32 Unicode Debug" (based on "Win32 (x86) Dynamic-Link Library")..!MESSAGE "WinHTTrackIEBar - Win32 Release MinSize" (based on "

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\WinHTTrackIEBar.dsw (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):553
    Entropy (8bit):3.9703214974307715
    Encrypted:false
    SSDEEP:6:zd22IPtDQHVCeJqN2NdumGsr81o3tnET+HYLzXET+Lg7cqVZrWpYrZp4xkmrWpYX:zTYcgcg2NDr5tnEThzXETLzzYpzb
    MD5:F8A3FC5E8DE2AE73028FAD3260D56A52
    SHA1:2B6E00FC8FC295DB3E6056A05E845BA0BFCD75E0
    SHA-256:17B632DD4DE8E1F33C59DAF49C612F024C2B7E1E698C253A5833F7D3EEE3473D
    SHA-512:AE89A715C4C1E2B05EAA6C107D63742E2507903285C8D87A4C7B4DD04B35049B849115CE8E090F76DAE9917A557ADB324E0054C83529B3E5C8341071FE51EFB3
    Malicious:false
    Preview:Microsoft Developer Studio Workspace File, Format Version 6.00..# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!....###############################################################################....Project: "WinHTTrackIEBar"=.\WinHTTrackIEBar.dsp - Package Owner=<4>....Package=<5>..{{{..}}}....Package=<4>..{{{..}}}....###############################################################################....Global:....Package=<5>..{{{..}}}....Package=<3>..{{{..}}}....###############################################################################....

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\WinHTTrackIEBar.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):5902
    Entropy (8bit):5.330011056827852
    Encrypted:false
    SSDEEP:96:XTtHrJWjWhywThT1mxGexW9L1UdUcUdUnn/6xgHNGX4fF25InpM+VohxhBo2h33b:DtHNFd1m2UhU+ytI0Wmr/bhVFG7uxjTZ
    MD5:B5A8C2ED96CA7C94207D2B26C3626A38
    SHA1:413C2CB550E377D667DD5F626A0CD57F38222503
    SHA-256:BBB40735B3EA41619DC4D7E57AE93F6975C3B2F0D853A5B7A5D25A7B77E11717
    SHA-512:D59359720BDFBB995E78B7C420ED38B42B32739788B504E212CF145EF5B27625197EAE3330C1F02A1635510E2A86D6185F11C0E9E6D37CF5B7B6CD46CEF891DB
    Malicious:false
    Preview:..../* this ALWAYS GENERATED file contains the definitions for the interfaces */...... /* File created by MIDL compiler version 7.00.0500 */../* at Thu Feb 18 21:48:38 2010.. */../* Compiler settings for .\WinHTTrackIEBar.idl:.. Oicf, W1, Zp8, env=Win32 (32b run).. protocol : dce , ms_ext, c_ext, robust.. error checks: allocation ref bounds_check enum stub_data .. VC __declspec() decoration level: .. __declspec(uuid()), __declspec(selectany), __declspec(novtable).. DECLSPEC_UUID(), MIDL_INTERFACE()..*/..//@@MIDL_FILE_HEADING( )....#pragma warning( disable: 4049 ) /* more than 64k source lines */....../* verify that the <rpcndr.h> version is high enough to compile this file*/..#ifndef __REQUIRED_RPCNDR_H_VERSION__..#define __REQUIRED_RPCNDR_H_VERSION__ 475..#endif....#include "rpc.h"..#include "rpcndr.h"....#ifndef __RPCNDR_H_VERSION__..#error this stub requires an updated version of <rpcndr.h>..#endif // __RPCNDR_H_VERSION__....#ifndef COM_NO_WINDOWS_H..#i

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\WinHTTrackIEBar.idl (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):837
    Entropy (8bit):5.532317268798473
    Encrypted:false
    SSDEEP:24:dXETaXET4xHETn6b9UE0zEfGsffAtWRETxjUTWG6JTWREFXENkEG:dXETaXETCHET6RUEMEf9BRETlUTW1JSI
    MD5:FC8922282A83D7221D819EF900919700
    SHA1:E9AE484FCC3E781AB9BA4B578E6CAA52669D64E3
    SHA-256:4645DDF75576F3B593228A00941161BD21AA3DA2AB434D751DF62D73121B1257
    SHA-512:9BD288F1B221ECD93CEF935DF3EC8A0B6FFFA1B0D615C0342841C29295FAEF5B59C789F4DB908334A4E6B496AF611CDA35BA8E3AF5A6FDD0D788E26498DAA8DE
    Malicious:false
    Preview:// WinHTTrackIEBar.idl : IDL source for WinHTTrackIEBar.dll..//....// This file will be processed by the MIDL tool to..// produce the type library (WinHTTrackIEBar.tlb) and marshalling code.....import "oaidl.idl";..import "ocidl.idl";......[....object,....uuid(67ADF06B-7E1A-4743-B221-E7AA6E4D1FA8),....dual,....helpstring("IWinHTTrackLauncher Interface"),....pointer_default(unique)...]...interface IWinHTTrackLauncher : IDispatch...{...};....[...uuid(81F786D8-A189-40A1-AB3C-D86A9203F431),...version(1.0),...helpstring("WinHTTrackIEBar 1.0 Type Library")..]..library WINHTTRACKIEBARLib..{...importlib("stdole32.tlb");...importlib("stdole2.tlb");........[....uuid(86529161-034E-4F8A-88D2-3C625E612E04),....helpstring("WinHTTrackLauncher Class")...]...coclass WinHTTrackLauncher...{....[default] interface IWinHTTrackLauncher;...};..};..

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\WinHTTrackIEBar.plg (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (361), with CRLF line terminators
    Category:dropped
    Size (bytes):2345
    Entropy (8bit):5.5345208106400365
    Encrypted:false
    SSDEEP:48:uXETjNQHOXoPGprypETueETeEtROfmr1ETZWETlXETUET+ExETuT/6WETvIa0EVQ:uUT5QHO4u9yqTwTb3OhTZDTWTdT7CTYh
    MD5:A3802DCB2B4CE48B35AA0DD7DB880C9D
    SHA1:8E957016FB632561C9ACA2438234538790728B22
    SHA-256:618B61C5A841F85E9ABE5429AEACC8CB14E00976E572C06A015DBBC8CA1879F2
    SHA-512:2EDC31B10AFCACDCCD5C2492329E44C0EFC660F04C6DF94E9F9670E5D925F720B71CE1A3200FB1D3AA440C4B7B0A4D2921ECEE11483E1DF29F863CFDA2A77BA0
    Malicious:false
    Preview:<html>..<body>..<pre>..<h1>Build Log</h1>..<h3>..--------------------Configuration: WinHTTrackIEBar - Win32 Release MinDependency--------------------..</h3>..<h3>Command Lines</h3>..Creating temporary file "C:\DOCUME~1\ROCHE~1.SER\LOCALS~1\Temp\RSP788.tmp" with contents..[../nologo /MT /W3 /O1 /I "D:\Program Files\Microsoft Visual Studio\VC98\WTL7\include" /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /D "_MBCS" /D "_USRDLL" /D "_ATL_STATIC_REGISTRY" /D "_ATL_MIN_CRT" /FR"ReleaseMinDependency/" /Fp"ReleaseMinDependency/WinHTTrackIEBar.pch" /Yu"stdafx.h" /Fo"ReleaseMinDependency/" /Fd"ReleaseMinDependency/" /FD /c .."C:\Dev\WinHTTrackIEBar\WinHTTrackLauncher.cpp"..]..Creating command line "cl.exe @C:\DOCUME~1\ROCHE~1.SER\LOCALS~1\Temp\RSP788.tmp" ..Creating temporary file "C:\DOCUME~1\ROCHE~1.SER\LOCALS~1\Temp\RSP789.tmp" with contents..[..kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib msvcrt.lib /nolog

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\WinHTTrackIEBar.rc (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):3982
    Entropy (8bit):4.641697757756945
    Encrypted:false
    SSDEEP:96:fPL5qjN5Ttyo1n1XeT9TaTNTODBOxUHtgXBvgT90ZTc:Nqn5JehixaOx9XBvI9ic
    MD5:BF3E6DA953C1C1018FFAAAD5E3780F1E
    SHA1:775ADFFE759352669CA848986A18FF6089027FF5
    SHA-256:5263F0DDF707EA86F74C11D60F293134A2E7D654E0A8786E2C431D5120C48A8E
    SHA-512:5BE6BF7521ABB5138F638F4682FFBF0768852A371633B76262E443CD6A030A4E004E1EA2175325DCFAE0579B927836D29982CAAEC3145F92E975D7B7027B26A2
    Malicious:false
    Preview:// Microsoft Visual C++ generated resource script...//..#include "resource.h"....#define APSTUDIO_READONLY_SYMBOLS../////////////////////////////////////////////////////////////////////////////..//..// Generated from the TEXTINCLUDE 2 resource...//..#include "winres.h"..../////////////////////////////////////////////////////////////////////////////..#undef APSTUDIO_READONLY_SYMBOLS..../////////////////////////////////////////////////////////////////////////////..// French (France) resources....#if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_FRA)..#ifdef _WIN32..LANGUAGE LANG_FRENCH, SUBLANG_FRENCH..#pragma code_page(1252)..#endif //_WIN32....#ifdef APSTUDIO_INVOKED../////////////////////////////////////////////////////////////////////////////..//..// TEXTINCLUDE..//....1 TEXTINCLUDE ..BEGIN.. "resource.h\0"..END....2 TEXTINCLUDE ..BEGIN.. "#include ""winres.h""\r\n".. "\0"..END....3 TEXTINCLUDE ..BEGIN.. "1 TYPELIB ""WinHTTrackIEBar.tlb""\r\n".. "\0"..END....#endif

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\WinHTTrackIEBar.tlb (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:data
    Category:dropped
    Size (bytes):1732
    Entropy (8bit):3.2925806478354707
    Encrypted:false
    SSDEEP:24:5h1AXFcbezj+AhN0VIGgJrTWGKEXEcETxDaEkUE8RCEhD:3bAhN0VIGKTWFEXEcET5aEkUEAn
    MD5:E0DBEE6A010293F52052A69A5E9FFAB5
    SHA1:0DB30E9345350C666E4CFB6F7E022A2DC6AB8371
    SHA-256:E18A4D8D2EFBB4068EFAF59DD6102AB2322ED32AB1C3011840D0C4DEB2111461
    SHA-512:9D1294CAC1808119B3EF50D770A88B0BED3FDBE914F866A2AC24CC90FEF1109C180501B695DA5DA162B7B1E205AAC6CA0B1394D326A170CC9F36BF163FD16409
    Malicious:false
    Preview:MSFT................A...............................7............... ...................d...L...............d...............p...............T...................................................................`...............`...........................................L...T...............$...........................................%"..........................................`....... .......$.......................................4"..............................................@...@.......@...............................................................................................................x...`...................H...........................0.........@.<.j...1........e.w.|Q.......w<.........c.w.|Q.......w<.........d.w.|Q.......w<.........a.R.N..O..<b^a..........0..............F.......................F........k.g.~CG.!.nM..d.......d...........................x...........-.stdole2.tlbWWW............................................................................................

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\WinHTTrackIEBar.vcproj (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:XML 1.0 document, ASCII text, with very long lines (394), with CRLF line terminators
    Category:dropped
    Size (bytes):57068
    Entropy (8bit):5.280788621418483
    Encrypted:false
    SSDEEP:768:rKDtEmvS4MimvSR6albDRmvSTpEmvSG4DmvSp6tmvSEI/RbSZ:b
    MD5:41A1528FDE8C5BDCF49C7AD12084FFF2
    SHA1:CF85A7F4B7874D90EEB84D98694E6C07BEA01A5B
    SHA-256:1BC24EF4201E6FA56757EA44395CA07AB408898D4DEA4614A443D60AB7C0BCD8
    SHA-512:C0C9C83EA8EAAF26DB19CC64A445DC3E43CCDA2064127BA923836F4482750C686353E501FCCE49A25AFA6D2720C9614A671F24771B17AE57F1D8689656CE3E5A
    Malicious:false
    Preview:<?xml version="1.0" encoding="Windows-1252"?>..<VisualStudioProject...ProjectType="Visual C++"...Version="9,00"...Name="WinHTTrackIEBar"...ProjectGUID="{B978BD69-4DF2-4CBB-8843-213EC20538EF}"...RootNamespace="WinHTTrackIEBar"...Keyword="AtlProj"...TargetFrameworkVersion="131072"...>...<Platforms>....<Platform.....Name="Win32"..../>....<Platform.....Name="x64"..../>...</Platforms>...<ToolFiles>...</ToolFiles>...<Configurations>....<Configuration.....Name="Release MinDependency|Win32".....OutputDirectory="C:\temp\httiebar\ReleaseMinDependency".....IntermediateDirectory="C:\temp\httiebar\ReleaseMinDependency".....ConfigurationType="2".....InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops".....UseOfMFC="0".....UseOfATL="1".....ATLMinimizesCRunTimeLibraryUsage="false".....CharacterSet="1".....>.....<Tool......Name="VCPreBuildEventTool"...../>.....<Tool......Name="VCCustomBuildTool"......Description="Performing registration"......CommandLine="regsvr32 /s /c &q

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\WinHTTrackIEBarps.def (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):257
    Entropy (8bit):5.091433979357939
    Encrypted:false
    SSDEEP:6:HuUQ2nET+CJFVCW7RgB4Ov32ZL2FxNxtzW5mX2n3zy:HuUnnETBJFJ7mBZ+MFxNxta4X23zy
    MD5:C58ACEE362FAFC5A0CE7DB63D18791AE
    SHA1:44E1E66916FF1B9F80496F8CBA62E5528DA4B506
    SHA-256:1383EDF4B61D252B6DDB2C26B9071EC5217B287DAF2EAD4570C72FC2946B013E
    SHA-512:861299CB18395F97BE5BA1EBCB99040C93C484645EACAE75E1B62AF8E7F765BC655DF3ED4CB7FC5CC1E31464FAD9D02A8BEA3DF64321D44345CA6481080C5704
    Malicious:false
    Preview:..LIBRARY "WinHTTrackIEBarPS"....DESCRIPTION 'Proxy/Stub DLL'....EXPORTS...DllGetClassObject @1.PRIVATE...DllCanUnloadNow @2.PRIVATE...GetProxyDllInfo @3.PRIVATE...DllRegisterServer..@4.PRIVATE...DllUnregisterServer..@5.PRIVATE..

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\WinHTTrackIEBarps.mk (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):550
    Entropy (8bit):5.164719638449265
    Encrypted:false
    SSDEEP:12:hwETf/rMtXETGdjtXET0560mETfQARETfmVMtXETGdjtXETf6In5G8dLDAQKnuQn:iETfYXET8XETUmETfnETfmOXET8XETSf
    MD5:741A22F1E7077F03A262503DE81D08B3
    SHA1:307CB6C2FA26A2CC43CA3BAC253389F36F129070
    SHA-256:AB5D92231CF00484037E61C5310E18397B6A7546230705B29D1036D7CF5134C9
    SHA-512:60B59B63479C60750C1FDC5BB8FB0A2A7ECDE2BE5ABF60A8D5FB2C3BB3D7B645D366F578A73FB69D0DED98C5BE40C224A0554D55AE6AC311A70396972934E6E2
    Malicious:false
    Preview:..WinHTTrackIEBarps.dll: dlldata.obj WinHTTrackIEBar_p.obj WinHTTrackIEBar_i.obj...link /dll /out:WinHTTrackIEBarps.dll /def:WinHTTrackIEBarps.def /entry:DllMain dlldata.obj WinHTTrackIEBar_p.obj WinHTTrackIEBar_i.obj \....kernel32.lib rpcndr.lib rpcns4.lib rpcrt4.lib oleaut32.lib uuid.lib \.....c.obj:...cl /c /Ox /DWIN32 /D_WIN32_WINNT=0x0400 /DREGISTER_PROXY_DLL \....$<....clean:...@del WinHTTrackIEBarps.dll...@del WinHTTrackIEBarps.lib...@del WinHTTrackIEBarps.exp...@del dlldata.obj...@del WinHTTrackIEBar_p.obj...@del WinHTTrackIEBar_i.obj..

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\WinHTTrackLauncher.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):6177
    Entropy (8bit):5.447668208217976
    Encrypted:false
    SSDEEP:192:dnCtzXuuRJegie0vzvNoLCgFC9Vl8wZdIFX+97RWo4FCqy2hPuNFLt7:dnCtzXuuRJegie0+LCaCKhPOD7
    MD5:444C558885F78ED8C359E335EB81612B
    SHA1:B7DACFF918D48A86DD9856C57C2244468A2E3EFB
    SHA-256:F5571AB08B96C7CA1B1377127F2205AE8B18F9907BF39F7F910465004D359318
    SHA-512:D004ECFA1BCD058B3537944BE9364243E5D85E8054D88521BFB0246CC175B73C3E4912B38792EB8FA1C04695EC94DE6B7DC8010712668584B29F5D88BE384E97
    Malicious:false
    Preview:// WinHTTrackLauncher.cpp : Implementation of CWinHTTrackIEBarApp and DLL registration.....#include "stdafx.h"..#include "WinHTTrackIEBar.h"..#include "WinHTTrackLauncher.h"....extern "C" {..#include <direct.h>..};....#include <commctrl.h>..#include <mshtml.h>....#include "projectInfo.h"..../////////////////////////////////////////////////////////////////////////////..//....static char* BSTRtoPCHAR(BSTR str, UINT codepage = CP_ACP) {.. if (str != NULL) {... int multiByteLength = ::WideCharToMultiByte( codepage, 0, str, (int) wcslen(str), NULL, NULL, NULL, NULL); .. if (multiByteLength > 0) .. { .. char *pcharMutiByteBuffer = (char*) malloc(multiByteLength + 1); .. ::WideCharToMultiByte( codepage, 0, str, (int) wcslen(str), pcharMutiByteBuffer, (int) multiByteLength, NULL, NULL); .. pcharMutiByteBuffer[multiByteLength] = '\0';.. return pcharMutiByteBuffer;.. }.. }.. return NULL;..}....static int fexist(char* s) {.. FILE* fp = fopen(s, "rb");.. if (fp)

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\WinHTTrackLauncher.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2027
    Entropy (8bit):5.61633487801684
    Encrypted:false
    SSDEEP:48:dXECXE+vxvgpsXEDXE2EhhEOaTWI4YEvEiEEibEjLq6sxBEjvxECbrEQ3rven/Ir:dUCU+vxvgpsUDUjhSOaTWIqcnRga02C1
    MD5:6C06DE3A494B477EB540C7FC9F6DF930
    SHA1:449C3C96884A95DBA875E08BFB0E3749C9B37BA1
    SHA-256:ED058CAA4501368345DCE5F9ECE1441BF4D42107FF024A9222E7A76D357D4341
    SHA-512:95F78B753DC0DD29E4AD09048EA5EB6146C9E0432832FEC30605D31F5F90D049468F4EC7D8E524217043277460E3275187C7036FBAFCE543F15F6C487B15FBB6
    Malicious:false
    Preview:// WinHTTrackLauncher.h: Definition of the WinHTTrackLauncher class..//..//////////////////////////////////////////////////////////////////////....#if !defined(AFX_WINHTTRACKLAUNCHER_H__08EA4A9D_DC5C_487F_8196_18B699DB7E08__INCLUDED_)..#define AFX_WINHTTRACKLAUNCHER_H__08EA4A9D_DC5C_487F_8196_18B699DB7E08__INCLUDED_....#if _MSC_VER > 1000..#pragma once..#endif // _MSC_VER > 1000....#include "resource.h" // main symbols..#include "docobj.h"..#include <SHLGUID.h>..../////////////////////////////////////////////////////////////////////////////..// WinHTTrackLauncher....class WinHTTrackLauncher : ...public IDispatchImpl<IWinHTTrackLauncher, &IID_IWinHTTrackLauncher, &LIBID_WINHTTRACKIEBARLib>,...public ISupportErrorInfo,...public CComObjectRoot,...public CComCoClass<WinHTTrackLauncher,&CLSID_WinHTTrackLauncher>,.. public IOleCommandTarget,.. public IObjectWithSite..{..private:.. CComPtr<IWebBrowser2> browser;..public:...WinHTTrackLauncher() {}..BEGIN_COM_MAP(WinHTTrackLauncher)...

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\WinHTTrackLauncher.rgs (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1189
    Entropy (8bit):5.372642037013735
    Encrypted:false
    SSDEEP:24:FywETaREREfETaREoEUBEOYYdETaREKYdETaREy5H4BYvwS7y+N8foWNAR8O2XEB:FywET8EREfET8EoEUBEObET8EpET8EyJ
    MD5:3D801011A8A6905D66B4BFFD82A6F741
    SHA1:AC0C2D89824F3B77065A3D0FD9B00404983A1A44
    SHA-256:C353960BF3FF283F9B8274294AB1335D3875F25607DCA88E9A89CA16BBEB44C4
    SHA-512:A69E4E9E0A78E7C60D2490CB283CDAB45F5433E40102EB13E8CAF10469516E4EE9F5052AF5B18BE73F038D86E7A134BB934C63D967EF6CA902007B15693C3F5D
    Malicious:false
    Preview:HKCR..{...WinHTTrackIEBar.WinHTTrackLauncher.1 = s 'WinHTTrackLauncher Class'...{....CLSID = s '{86529161-034E-4F8A-88D2-3C625E612E04}'...}...WinHTTrackIEBar.WinHTTrackLauncher = s 'WinHTTrackLauncher Class'...{....CLSID = s '{86529161-034E-4F8A-88D2-3C625E612E04}'...}...NoRemove CLSID...{....ForceRemove {86529161-034E-4F8A-88D2-3C625E612E04} = s 'WinHTTrackLauncher Class'....{.....ProgID = s 'WinHTTrackIEBar.WinHTTrackLauncher.1'.....VersionIndependentProgID = s 'WinHTTrackIEBar.WinHTTrackLauncher'.....InprocServer32 = s '%MODULE%'.....{......val ThreadingModel = s 'both'.....}....}...}..}..HKLM..{...Software...{....Microsoft....{.....'Internet Explorer'.....{......Extensions......{.......{36ECAF82-3300-8F84-092E-AFF36D6C7040}.......{........val 'CLSID' = s '{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}'........val 'MenuText' = s 'Launch WinHTTrack'........val 'MenuStatusBar' = s 'Mirror Websites with WinHTTrack'........val 'ClsidExtension' = s '{86529161-034E-4F8A-88D2-3C625E612E04}'.......

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\dlldata.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):851
    Entropy (8bit):4.965593692657532
    Encrypted:false
    SSDEEP:24:aU2rPT7CDBIhW+bXETKWHlgbXETnIhW/0pvUOA3V:I+VIh9XETKWFIXETn702Oa
    MD5:D8CCFC7500E92A7FCBACB0AEE2C3DB79
    SHA1:B847C8DE8D053F4DEB7D705ECC4E5F36C5BAD75F
    SHA-256:786EDCC7A2B7EB42300C1298C2D036E3C83368C6698E585ACD777E5E80D6ED6A
    SHA-512:151121955953EE7C6552F9B1ADE1C4563793708228BB52FEB89366BC9B9D3FC62E754E620AF4D88EAA4D9240A1756953C527E7FD5C7AF95BD99419DAA9F167FB
    Malicious:false
    Preview:/*********************************************************.. DllData file -- generated by MIDL compiler .... DO NOT ALTER THIS FILE.... This file is regenerated by MIDL on every IDL file compile..... To completely reconstruct this file, delete it and rerun MIDL.. on all the IDL files in this DLL, specifying this file for the.. /dlldata command line option....*********************************************************/....#define PROXY_DELEGATION....#include <rpcproxy.h>....#ifdef __cplusplus..extern "C" {..#endif....EXTERN_PROXY_FILE( WinHTTrackIEBar )......PROXYFILE_LIST_START../* Start of list */.. REFERENCE_PROXY_FILE( WinHTTrackIEBar ),../* End of list */..PROXYFILE_LIST_END......DLLDATA_ROUTINES( aProxyFileList, GET_DLL_CLSID )....#ifdef __cplusplus..} /*extern "C" */..#endif..../* end of generated dlldata file */..

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\gpl.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):35821
    Entropy (8bit):4.622128610438848
    Encrypted:false
    SSDEEP:768:A7Y+tNdSz3ZlqXOWoInuzx3Y8N3WiYD0v:AVtNIq1uzZY1C
    MD5:3C34AFDC3ADF82D2448F12715A255122
    SHA1:7713A1753CE88F2C7E6B054ECC8E4C786DF76300
    SHA-256:0B383D5A63DA644F628D99C33976EA6487ED89AAA59F0B3257992DEAC1171E6B
    SHA-512:4937848B94F5B50EA16C51F9E98FDCD3953ACA63D63CA3BB05D8A62C107E382B71C496838D130AE504A52032398630B957ACAEA6C48032081A6366D27CBA5EA9
    Malicious:false
    Preview: GNU GENERAL PUBLIC LICENSE.. Version 3, 29 June 2007.... Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>.. Everyone is permitted to copy and distribute verbatim copies.. of this license document, but changing it is not allowed..... Preamble.... The GNU General Public License is a free, copyleft license for..software and other kinds of works..... The licenses for most software and other practical works are designed..to take away your freedom to share and change the works. By contrast,..the GNU General Public License is intended to guarantee your freedom to..share and change all versions of a program--to make sure it remains free..software for all its users. We, the Free Software Foundation, use the..GNU General Public License for most of our software; it applies also to..any other work released this way by its authors. You can apply it to..your programs, too..... When we speak of free software

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\is-0JRRL.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):323
    Entropy (8bit):4.910199240780642
    Encrypted:false
    SSDEEP:6:jGmyXH+5AMRNT15eAHYRFm+ylL+5FdllZ+sMKcaGIA0RQbyueFZAqs7eAqkUA4PT:jGXXHJYx5f4RE+y05JlZ+4cWAoQ5cAqN
    MD5:CCED3A7AD8235E3565D8318372343A8A
    SHA1:6684D68B1EED28B146F5D5B20B48DF76FA7EBFE7
    SHA-256:37F04E611AD7105F8F82F34F90B07600EA34AB6E9F117E918718AACB6D4E9CB6
    SHA-512:2097F29875C0223E04D3A05AE307DC48433204466EE342D8AC06163448B3C854BE768104C5F88248396C9DD0FE5AE7DF56700070A9C5683C7B82413FF060728F
    Malicious:false
    Preview:// stdafx.cpp : source file that includes just the standard includes..// stdafx.pch will be the pre-compiled header..// stdafx.obj will contain the pre-compiled type information....#include "stdafx.h"..../*..#ifdef _ATL_STATIC_REGISTRY..#include <statreg.h>..#include <statreg.cpp>..#endif....#include <atlimpl.cpp>..*/..

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\is-1F74D.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):257
    Entropy (8bit):5.091433979357939
    Encrypted:false
    SSDEEP:6:HuUQ2nET+CJFVCW7RgB4Ov32ZL2FxNxtzW5mX2n3zy:HuUnnETBJFJ7mBZ+MFxNxta4X23zy
    MD5:C58ACEE362FAFC5A0CE7DB63D18791AE
    SHA1:44E1E66916FF1B9F80496F8CBA62E5528DA4B506
    SHA-256:1383EDF4B61D252B6DDB2C26B9071EC5217B287DAF2EAD4570C72FC2946B013E
    SHA-512:861299CB18395F97BE5BA1EBCB99040C93C484645EACAE75E1B62AF8E7F765BC655DF3ED4CB7FC5CC1E31464FAD9D02A8BEA3DF64321D44345CA6481080C5704
    Malicious:false
    Preview:..LIBRARY "WinHTTrackIEBarPS"....DESCRIPTION 'Proxy/Stub DLL'....EXPORTS...DllGetClassObject @1.PRIVATE...DllCanUnloadNow @2.PRIVATE...GetProxyDllInfo @3.PRIVATE...DllRegisterServer..@4.PRIVATE...DllUnregisterServer..@5.PRIVATE..

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\is-1M9AJ.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:MS Windows icon resource - 4 icons, 32x32, 48x48
    Category:dropped
    Size (bytes):8166
    Entropy (8bit):3.8949927423136286
    Encrypted:false
    SSDEEP:192:7KDJKDJMd+kp7fCKDE55555ZFFFd5555:7KDJKDyd+kBCKDE55555ZFFFd5555
    MD5:8BBEABB082C72F52611C45DD71B539EB
    SHA1:021E0173BD8FB7D1A1CE14D83F0EB7E22B9B5DDA
    SHA-256:98A539EE42CF14FF22950E62DE4EB82254C5C3B2F87690C323C6D33BD09ED8FC
    SHA-512:0725FEC578E774F33EFBA28C8FA6810D6788B15DE26E2FCBBA438AD89886C2B1A47BDF1563D4783A426DE273825536095D7E9D8CE3FDF7292A76669B8FF08FB0
    Malicious:false
    Preview:...... ..........F...00.............. ......................h...~...(... ...@..............................................................................................""".))).UUU.MMM.BBB.999..|..PP........................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............f.........3...3.3.3.f.3...3...3...33..333.33f.33..33..33..3f..3f3.3ff.3f..3f..3f..3...3.3.3.f.3...3...3...3...3.3.3.f.3..3...3...3.3.3.f.3...3...3...f...f.3.f.f.f...f...f...f3..f33.f3f.f3..f3..f3..ff..ff3.fff.ff..ff..f...f.3.f.f.f...f...f...f...f.3.f..f...f...f...f.3.f...f................3...............33...f..3.......f...f3..3f..f...f...3....3...f...................3.f.f..................3...f...................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f......3..f................3...f..................3...f...............3...f......3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..........

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\is-1UJJP.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1189
    Entropy (8bit):5.372642037013735
    Encrypted:false
    SSDEEP:24:FywETaREREfETaREoEUBEOYYdETaREKYdETaREy5H4BYvwS7y+N8foWNAR8O2XEB:FywET8EREfET8EoEUBEObET8EpET8EyJ
    MD5:3D801011A8A6905D66B4BFFD82A6F741
    SHA1:AC0C2D89824F3B77065A3D0FD9B00404983A1A44
    SHA-256:C353960BF3FF283F9B8274294AB1335D3875F25607DCA88E9A89CA16BBEB44C4
    SHA-512:A69E4E9E0A78E7C60D2490CB283CDAB45F5433E40102EB13E8CAF10469516E4EE9F5052AF5B18BE73F038D86E7A134BB934C63D967EF6CA902007B15693C3F5D
    Malicious:false
    Preview:HKCR..{...WinHTTrackIEBar.WinHTTrackLauncher.1 = s 'WinHTTrackLauncher Class'...{....CLSID = s '{86529161-034E-4F8A-88D2-3C625E612E04}'...}...WinHTTrackIEBar.WinHTTrackLauncher = s 'WinHTTrackLauncher Class'...{....CLSID = s '{86529161-034E-4F8A-88D2-3C625E612E04}'...}...NoRemove CLSID...{....ForceRemove {86529161-034E-4F8A-88D2-3C625E612E04} = s 'WinHTTrackLauncher Class'....{.....ProgID = s 'WinHTTrackIEBar.WinHTTrackLauncher.1'.....VersionIndependentProgID = s 'WinHTTrackIEBar.WinHTTrackLauncher'.....InprocServer32 = s '%MODULE%'.....{......val ThreadingModel = s 'both'.....}....}...}..}..HKLM..{...Software...{....Microsoft....{.....'Internet Explorer'.....{......Extensions......{.......{36ECAF82-3300-8F84-092E-AFF36D6C7040}.......{........val 'CLSID' = s '{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}'........val 'MenuText' = s 'Launch WinHTTrack'........val 'MenuStatusBar' = s 'Mirror Websites with WinHTTrack'........val 'ClsidExtension' = s '{86529161-034E-4F8A-88D2-3C625E612E04}'.......

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\is-2KR83.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):5902
    Entropy (8bit):5.330011056827852
    Encrypted:false
    SSDEEP:96:XTtHrJWjWhywThT1mxGexW9L1UdUcUdUnn/6xgHNGX4fF25InpM+VohxhBo2h33b:DtHNFd1m2UhU+ytI0Wmr/bhVFG7uxjTZ
    MD5:B5A8C2ED96CA7C94207D2B26C3626A38
    SHA1:413C2CB550E377D667DD5F626A0CD57F38222503
    SHA-256:BBB40735B3EA41619DC4D7E57AE93F6975C3B2F0D853A5B7A5D25A7B77E11717
    SHA-512:D59359720BDFBB995E78B7C420ED38B42B32739788B504E212CF145EF5B27625197EAE3330C1F02A1635510E2A86D6185F11C0E9E6D37CF5B7B6CD46CEF891DB
    Malicious:false
    Preview:..../* this ALWAYS GENERATED file contains the definitions for the interfaces */...... /* File created by MIDL compiler version 7.00.0500 */../* at Thu Feb 18 21:48:38 2010.. */../* Compiler settings for .\WinHTTrackIEBar.idl:.. Oicf, W1, Zp8, env=Win32 (32b run).. protocol : dce , ms_ext, c_ext, robust.. error checks: allocation ref bounds_check enum stub_data .. VC __declspec() decoration level: .. __declspec(uuid()), __declspec(selectany), __declspec(novtable).. DECLSPEC_UUID(), MIDL_INTERFACE()..*/..//@@MIDL_FILE_HEADING( )....#pragma warning( disable: 4049 ) /* more than 64k source lines */....../* verify that the <rpcndr.h> version is high enough to compile this file*/..#ifndef __REQUIRED_RPCNDR_H_VERSION__..#define __REQUIRED_RPCNDR_H_VERSION__ 475..#endif....#include "rpc.h"..#include "rpcndr.h"....#ifndef __RPCNDR_H_VERSION__..#error this stub requires an updated version of <rpcndr.h>..#endif // __RPCNDR_H_VERSION__....#ifndef COM_NO_WINDOWS_H..#i

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\is-4O959.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):238
    Entropy (8bit):5.164570760797604
    Encrypted:false
    SSDEEP:6:ahXET+L2hbnBQ8UQ2nET+LOvmBwL2FxNqOhhuO5mXykP2n3fmy:IXETNtnBQ8UnnETyBlFxNqOh0O4Xykev
    MD5:3715DCFD15FE29B198D0418B04DF9F50
    SHA1:4D4BED2BDE11A1374133858DB849A7D0D495FFE7
    SHA-256:F46D1B45F214C40E73ABF69886699C3F6839F9616143F207BF8C92E10AD2A7EC
    SHA-512:01F0DFE26FABB4E720F16310D73B2E71C5AF045AB71AF2EF42952C43AAA4B1C549DFE8B89BB4F9E8E59E01AB00E360FA4B82FEFD22F54932D24764A7070DE04A
    Malicious:false
    Preview:; WinHTTrackIEBar.def : Declares the module parameters.....LIBRARY "WinHTTrackIEBar.DLL"....EXPORTS...DllCanUnloadNow @1 PRIVATE...DllGetClassObject @2 PRIVATE...DllRegisterServer @3 PRIVATE...DllUnregisterServer.@4 PRIVATE..

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\is-4TBL6.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):837
    Entropy (8bit):5.532317268798473
    Encrypted:false
    SSDEEP:24:dXETaXET4xHETn6b9UE0zEfGsffAtWRETxjUTWG6JTWREFXENkEG:dXETaXETCHET6RUEMEf9BRETlUTW1JSI
    MD5:FC8922282A83D7221D819EF900919700
    SHA1:E9AE484FCC3E781AB9BA4B578E6CAA52669D64E3
    SHA-256:4645DDF75576F3B593228A00941161BD21AA3DA2AB434D751DF62D73121B1257
    SHA-512:9BD288F1B221ECD93CEF935DF3EC8A0B6FFFA1B0D615C0342841C29295FAEF5B59C789F4DB908334A4E6B496AF611CDA35BA8E3AF5A6FDD0D788E26498DAA8DE
    Malicious:false
    Preview:// WinHTTrackIEBar.idl : IDL source for WinHTTrackIEBar.dll..//....// This file will be processed by the MIDL tool to..// produce the type library (WinHTTrackIEBar.tlb) and marshalling code.....import "oaidl.idl";..import "ocidl.idl";......[....object,....uuid(67ADF06B-7E1A-4743-B221-E7AA6E4D1FA8),....dual,....helpstring("IWinHTTrackLauncher Interface"),....pointer_default(unique)...]...interface IWinHTTrackLauncher : IDispatch...{...};....[...uuid(81F786D8-A189-40A1-AB3C-D86A9203F431),...version(1.0),...helpstring("WinHTTrackIEBar 1.0 Type Library")..]..library WINHTTRACKIEBARLib..{...importlib("stdole32.tlb");...importlib("stdole2.tlb");........[....uuid(86529161-034E-4F8A-88D2-3C625E612E04),....helpstring("WinHTTrackLauncher Class")...]...coclass WinHTTrackLauncher...{....[default] interface IWinHTTrackLauncher;...};..};..

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\is-5F8LU.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):553
    Entropy (8bit):3.9703214974307715
    Encrypted:false
    SSDEEP:6:zd22IPtDQHVCeJqN2NdumGsr81o3tnET+HYLzXET+Lg7cqVZrWpYrZp4xkmrWpYX:zTYcgcg2NDr5tnEThzXETLzzYpzb
    MD5:F8A3FC5E8DE2AE73028FAD3260D56A52
    SHA1:2B6E00FC8FC295DB3E6056A05E845BA0BFCD75E0
    SHA-256:17B632DD4DE8E1F33C59DAF49C612F024C2B7E1E698C253A5833F7D3EEE3473D
    SHA-512:AE89A715C4C1E2B05EAA6C107D63742E2507903285C8D87A4C7B4DD04B35049B849115CE8E090F76DAE9917A557ADB324E0054C83529B3E5C8341071FE51EFB3
    Malicious:false
    Preview:Microsoft Developer Studio Workspace File, Format Version 6.00..# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!....###############################################################################....Project: "WinHTTrackIEBar"=.\WinHTTrackIEBar.dsp - Package Owner=<4>....Package=<5>..{{{..}}}....Package=<4>..{{{..}}}....###############################################################################....Global:....Package=<5>..{{{..}}}....Package=<3>..{{{..}}}....###############################################################################....

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\is-5O8BP.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):123
    Entropy (8bit):4.555395247548123
    Encrypted:false
    SSDEEP:3:RF9c4QGNt7nuREqQKZmSjR4WGIA9WRyDDHyblA9VXUAG4QNIaijR4D:j9c4Q07neE4jjR4qA0RQbyblAUAG4QNP
    MD5:4D32B8D8C4F7DDE4603EEB2148AE64E3
    SHA1:0BE7827D62119C8EB54E112B1DCFE47727888586
    SHA-256:ECB61CBAD9A81729178F4C75314F9FEEE9353B210C4E685A8F4CFF88AC696D1E
    SHA-512:D8259709743CC31490C335AC75793AEE4422A4F0216AF831DAD655931F8308AF901918EBCD92E5EBFC3106C6889D4E2841A42EC8940172D0A3E788D3DC4B2BDC
    Malicious:false
    Preview:// projectInfo.cpp : Implementation of CprojectInfo....#include "stdafx.h"..#include "projectInfo.h"......// CprojectInfo..

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\is-62F96.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):550
    Entropy (8bit):5.164719638449265
    Encrypted:false
    SSDEEP:12:hwETf/rMtXETGdjtXET0560mETfQARETfmVMtXETGdjtXETf6In5G8dLDAQKnuQn:iETfYXET8XETUmETfnETfmOXET8XETSf
    MD5:741A22F1E7077F03A262503DE81D08B3
    SHA1:307CB6C2FA26A2CC43CA3BAC253389F36F129070
    SHA-256:AB5D92231CF00484037E61C5310E18397B6A7546230705B29D1036D7CF5134C9
    SHA-512:60B59B63479C60750C1FDC5BB8FB0A2A7ECDE2BE5ABF60A8D5FB2C3BB3D7B645D366F578A73FB69D0DED98C5BE40C224A0554D55AE6AC311A70396972934E6E2
    Malicious:false
    Preview:..WinHTTrackIEBarps.dll: dlldata.obj WinHTTrackIEBar_p.obj WinHTTrackIEBar_i.obj...link /dll /out:WinHTTrackIEBarps.dll /def:WinHTTrackIEBarps.def /entry:DllMain dlldata.obj WinHTTrackIEBar_p.obj WinHTTrackIEBar_i.obj \....kernel32.lib rpcndr.lib rpcns4.lib rpcrt4.lib oleaut32.lib uuid.lib \.....c.obj:...cl /c /Ox /DWIN32 /D_WIN32_WINNT=0x0400 /DREGISTER_PROXY_DLL \....$<....clean:...@del WinHTTrackIEBarps.dll...@del WinHTTrackIEBarps.lib...@del WinHTTrackIEBarps.exp...@del dlldata.obj...@del WinHTTrackIEBar_p.obj...@del WinHTTrackIEBar_i.obj..

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\is-9UJ74.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2205
    Entropy (8bit):5.015669163950011
    Encrypted:false
    SSDEEP:48:dXETDS63XETDpuIxETXETvEqEXXEdd06TWzd0iDmdwcU4a6t3Rrj2i1Q68qU6a5L:dUTDJ3UTduICTUTc/XUd1TWzd3Dj4JRo
    MD5:4EEBA05DA1D02A7D22381F4A2A5122F3
    SHA1:CF3277E11BCA77EC09DBDD2F35F826FDD5FCA7AA
    SHA-256:2A8DA5C8124A170AC69AC9BFC6C6CDF16A6420E85628D0A2CA2376B51C38F228
    SHA-512:C84661A7377DE975EED14389DAA4D6F0D2520C184EBDDA6255BF325BCB2842AEED05BB001EDBBD2EDF9B403CEA65F53A6C2A5A001E9E32B6B715D5E61CB3ED9C
    Malicious:false
    Preview:// WinHTTrackIEBar.cpp : Implementation of DLL Exports.......// Note: Proxy/Stub Information..// To build a separate proxy/stub DLL, ..// run nmake -f WinHTTrackIEBarps.mk in the project directory.....#include "stdafx.h"..#include "resource.h"..#include <initguid.h>..#include "WinHTTrackIEBar.h"....#include "WinHTTrackIEBar_i.c"..#include "WinHTTrackLauncher.h"....CComModule _Module;....BEGIN_OBJECT_MAP(ObjectMap)..OBJECT_ENTRY(CLSID_WinHTTrackLauncher, WinHTTrackLauncher)..END_OBJECT_MAP()..../////////////////////////////////////////////////////////////////////////////..// DLL Entry Point....extern "C"..BOOL WINAPI DllMain(HINSTANCE hInstance, DWORD dwReason, LPVOID /*lpReserved*/)..{.. if (dwReason == DLL_PROCESS_ATTACH).. {.. _Module.Init(ObjectMap, hInstance, &LIBID_WINHTTRACKIEBARLib);.. DisableThreadLibraryCalls(hInstance);.. }.. else if (dwReason == DLL_PROCESS_DETACH).. _Module.Term();.. return TRUE; // ok..}..../////////////////

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\is-BNIMD.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):6177
    Entropy (8bit):5.447668208217976
    Encrypted:false
    SSDEEP:192:dnCtzXuuRJegie0vzvNoLCgFC9Vl8wZdIFX+97RWo4FCqy2hPuNFLt7:dnCtzXuuRJegie0+LCaCKhPOD7
    MD5:444C558885F78ED8C359E335EB81612B
    SHA1:B7DACFF918D48A86DD9856C57C2244468A2E3EFB
    SHA-256:F5571AB08B96C7CA1B1377127F2205AE8B18F9907BF39F7F910465004D359318
    SHA-512:D004ECFA1BCD058B3537944BE9364243E5D85E8054D88521BFB0246CC175B73C3E4912B38792EB8FA1C04695EC94DE6B7DC8010712668584B29F5D88BE384E97
    Malicious:false
    Preview:// WinHTTrackLauncher.cpp : Implementation of CWinHTTrackIEBarApp and DLL registration.....#include "stdafx.h"..#include "WinHTTrackIEBar.h"..#include "WinHTTrackLauncher.h"....extern "C" {..#include <direct.h>..};....#include <commctrl.h>..#include <mshtml.h>....#include "projectInfo.h"..../////////////////////////////////////////////////////////////////////////////..//....static char* BSTRtoPCHAR(BSTR str, UINT codepage = CP_ACP) {.. if (str != NULL) {... int multiByteLength = ::WideCharToMultiByte( codepage, 0, str, (int) wcslen(str), NULL, NULL, NULL, NULL); .. if (multiByteLength > 0) .. { .. char *pcharMutiByteBuffer = (char*) malloc(multiByteLength + 1); .. ::WideCharToMultiByte( codepage, 0, str, (int) wcslen(str), pcharMutiByteBuffer, (int) multiByteLength, NULL, NULL); .. pcharMutiByteBuffer[multiByteLength] = '\0';.. return pcharMutiByteBuffer;.. }.. }.. return NULL;..}....static int fexist(char* s) {.. FILE* fp = fopen(s, "rb");.. if (fp)

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\is-C17HR.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (361), with CRLF line terminators
    Category:dropped
    Size (bytes):2345
    Entropy (8bit):5.5345208106400365
    Encrypted:false
    SSDEEP:48:uXETjNQHOXoPGprypETueETeEtROfmr1ETZWETlXETUET+ExETuT/6WETvIa0EVQ:uUT5QHO4u9yqTwTb3OhTZDTWTdT7CTYh
    MD5:A3802DCB2B4CE48B35AA0DD7DB880C9D
    SHA1:8E957016FB632561C9ACA2438234538790728B22
    SHA-256:618B61C5A841F85E9ABE5429AEACC8CB14E00976E572C06A015DBBC8CA1879F2
    SHA-512:2EDC31B10AFCACDCCD5C2492329E44C0EFC660F04C6DF94E9F9670E5D925F720B71CE1A3200FB1D3AA440C4B7B0A4D2921ECEE11483E1DF29F863CFDA2A77BA0
    Malicious:false
    Preview:<html>..<body>..<pre>..<h1>Build Log</h1>..<h3>..--------------------Configuration: WinHTTrackIEBar - Win32 Release MinDependency--------------------..</h3>..<h3>Command Lines</h3>..Creating temporary file "C:\DOCUME~1\ROCHE~1.SER\LOCALS~1\Temp\RSP788.tmp" with contents..[../nologo /MT /W3 /O1 /I "D:\Program Files\Microsoft Visual Studio\VC98\WTL7\include" /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /D "_MBCS" /D "_USRDLL" /D "_ATL_STATIC_REGISTRY" /D "_ATL_MIN_CRT" /FR"ReleaseMinDependency/" /Fp"ReleaseMinDependency/WinHTTrackIEBar.pch" /Yu"stdafx.h" /Fo"ReleaseMinDependency/" /Fd"ReleaseMinDependency/" /FD /c .."C:\Dev\WinHTTrackIEBar\WinHTTrackLauncher.cpp"..]..Creating command line "cl.exe @C:\DOCUME~1\ROCHE~1.SER\LOCALS~1\Temp\RSP788.tmp" ..Creating temporary file "C:\DOCUME~1\ROCHE~1.SER\LOCALS~1\Temp\RSP789.tmp" with contents..[..kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib msvcrt.lib /nolog

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\is-DKH4R.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):851
    Entropy (8bit):4.965593692657532
    Encrypted:false
    SSDEEP:24:aU2rPT7CDBIhW+bXETKWHlgbXETnIhW/0pvUOA3V:I+VIh9XETKWFIXETn702Oa
    MD5:D8CCFC7500E92A7FCBACB0AEE2C3DB79
    SHA1:B847C8DE8D053F4DEB7D705ECC4E5F36C5BAD75F
    SHA-256:786EDCC7A2B7EB42300C1298C2D036E3C83368C6698E585ACD777E5E80D6ED6A
    SHA-512:151121955953EE7C6552F9B1ADE1C4563793708228BB52FEB89366BC9B9D3FC62E754E620AF4D88EAA4D9240A1756953C527E7FD5C7AF95BD99419DAA9F167FB
    Malicious:false
    Preview:/*********************************************************.. DllData file -- generated by MIDL compiler .... DO NOT ALTER THIS FILE.... This file is regenerated by MIDL on every IDL file compile..... To completely reconstruct this file, delete it and rerun MIDL.. on all the IDL files in this DLL, specifying this file for the.. /dlldata command line option....*********************************************************/....#define PROXY_DELEGATION....#include <rpcproxy.h>....#ifdef __cplusplus..extern "C" {..#endif....EXTERN_PROXY_FILE( WinHTTrackIEBar )......PROXYFILE_LIST_START../* Start of list */.. REFERENCE_PROXY_FILE( WinHTTrackIEBar ),../* End of list */..PROXYFILE_LIST_END......DLLDATA_ROUTINES( aProxyFileList, GET_DLL_CLSID )....#ifdef __cplusplus..} /*extern "C" */..#endif..../* end of generated dlldata file */..

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\is-G1IP7.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):1195
    Entropy (8bit):4.911086399144892
    Encrypted:false
    SSDEEP:24:yE59+EDDWkyEOkH5CTbVpTjFvW4/mFTxUQ36s:yO9PDDNygHWTjFvWJUyN
    MD5:F93E24FD6A95D2489D5DB275ADD84D2A
    SHA1:624FAC7C36C2F90AA432D75B603E0BAA79A53654
    SHA-256:D62DDB7AE57B89BA7FB237BA9AA7FEFA2C59D764BE3840BE026CD5E12FE410B6
    SHA-512:CC264A926D42B113C66DEAD4EF7831461866B1F72BE2B0DD7C85DE07E051F7577AF1F052DDD6026983D3F171C6989CD9BD69B3AD947D9064F9F346248AC569D9
    Malicious:false
    Preview:HTTrack Website Copier License Agreement:....HTTrack Website Copier, Offline Browser for Windows and Unix..Copyright (C) Xavier Roche and other contributors.....This program is free software; you can redistribute it and/or..modify it under the terms of the GNU General Public License..as published by the Free Software Foundation; either version 3..of the License, or any later version.....This program is distributed in the hope that it will be useful,..but WITHOUT ANY WARRANTY; without even the implied warranty of..MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the..GNU General Public License for more details.....You should have received a copy of the GNU General Public License..along with this program; if not, write to the Free Software..Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.......Important notes:....- We hereby ask people using this source NOT to use it in purpose of grabbing..emails addresses, or collecting any other private informations

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\is-JMC9C.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):3982
    Entropy (8bit):4.641697757756945
    Encrypted:false
    SSDEEP:96:fPL5qjN5Ttyo1n1XeT9TaTNTODBOxUHtgXBvgT90ZTc:Nqn5JehixaOx9XBvI9ic
    MD5:BF3E6DA953C1C1018FFAAAD5E3780F1E
    SHA1:775ADFFE759352669CA848986A18FF6089027FF5
    SHA-256:5263F0DDF707EA86F74C11D60F293134A2E7D654E0A8786E2C431D5120C48A8E
    SHA-512:5BE6BF7521ABB5138F638F4682FFBF0768852A371633B76262E443CD6A030A4E004E1EA2175325DCFAE0579B927836D29982CAAEC3145F92E975D7B7027B26A2
    Malicious:false
    Preview:// Microsoft Visual C++ generated resource script...//..#include "resource.h"....#define APSTUDIO_READONLY_SYMBOLS../////////////////////////////////////////////////////////////////////////////..//..// Generated from the TEXTINCLUDE 2 resource...//..#include "winres.h"..../////////////////////////////////////////////////////////////////////////////..#undef APSTUDIO_READONLY_SYMBOLS..../////////////////////////////////////////////////////////////////////////////..// French (France) resources....#if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_FRA)..#ifdef _WIN32..LANGUAGE LANG_FRENCH, SUBLANG_FRENCH..#pragma code_page(1252)..#endif //_WIN32....#ifdef APSTUDIO_INVOKED../////////////////////////////////////////////////////////////////////////////..//..// TEXTINCLUDE..//....1 TEXTINCLUDE ..BEGIN.. "resource.h\0"..END....2 TEXTINCLUDE ..BEGIN.. "#include ""winres.h""\r\n".. "\0"..END....3 TEXTINCLUDE ..BEGIN.. "1 TYPELIB ""WinHTTrackIEBar.tlb""\r\n".. "\0"..END....#endif

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\is-JPA89.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:data
    Category:dropped
    Size (bytes):1732
    Entropy (8bit):3.2925806478354707
    Encrypted:false
    SSDEEP:24:5h1AXFcbezj+AhN0VIGgJrTWGKEXEcETxDaEkUE8RCEhD:3bAhN0VIGKTWFEXEcET5aEkUEAn
    MD5:E0DBEE6A010293F52052A69A5E9FFAB5
    SHA1:0DB30E9345350C666E4CFB6F7E022A2DC6AB8371
    SHA-256:E18A4D8D2EFBB4068EFAF59DD6102AB2322ED32AB1C3011840D0C4DEB2111461
    SHA-512:9D1294CAC1808119B3EF50D770A88B0BED3FDBE914F866A2AC24CC90FEF1109C180501B695DA5DA162B7B1E205AAC6CA0B1394D326A170CC9F36BF163FD16409
    Malicious:false
    Preview:MSFT................A...............................7............... ...................d...L...............d...............p...............T...................................................................`...............`...........................................L...T...............$...........................................%"..........................................`....... .......$.......................................4"..............................................@...@.......@...............................................................................................................x...`...................H...........................0.........@.<.j...1........e.w.|Q.......w<.........c.w.|Q.......w<.........d.w.|Q.......w<.........a.R.N..O..<b^a..........0..............F.......................F........k.g.~CG.!.nM..d.......d...........................x...........-.stdole2.tlbWWW............................................................................................

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\is-L6H2P.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2027
    Entropy (8bit):5.61633487801684
    Encrypted:false
    SSDEEP:48:dXECXE+vxvgpsXEDXE2EhhEOaTWI4YEvEiEEibEjLq6sxBEjvxECbrEQ3rven/Ir:dUCU+vxvgpsUDUjhSOaTWIqcnRga02C1
    MD5:6C06DE3A494B477EB540C7FC9F6DF930
    SHA1:449C3C96884A95DBA875E08BFB0E3749C9B37BA1
    SHA-256:ED058CAA4501368345DCE5F9ECE1441BF4D42107FF024A9222E7A76D357D4341
    SHA-512:95F78B753DC0DD29E4AD09048EA5EB6146C9E0432832FEC30605D31F5F90D049468F4EC7D8E524217043277460E3275187C7036FBAFCE543F15F6C487B15FBB6
    Malicious:false
    Preview:// WinHTTrackLauncher.h: Definition of the WinHTTrackLauncher class..//..//////////////////////////////////////////////////////////////////////....#if !defined(AFX_WINHTTRACKLAUNCHER_H__08EA4A9D_DC5C_487F_8196_18B699DB7E08__INCLUDED_)..#define AFX_WINHTTRACKLAUNCHER_H__08EA4A9D_DC5C_487F_8196_18B699DB7E08__INCLUDED_....#if _MSC_VER > 1000..#pragma once..#endif // _MSC_VER > 1000....#include "resource.h" // main symbols..#include "docobj.h"..#include <SHLGUID.h>..../////////////////////////////////////////////////////////////////////////////..// WinHTTrackLauncher....class WinHTTrackLauncher : ...public IDispatchImpl<IWinHTTrackLauncher, &IID_IWinHTTrackLauncher, &LIBID_WINHTTRACKIEBARLib>,...public ISupportErrorInfo,...public CComObjectRoot,...public CComCoClass<WinHTTrackLauncher,&CLSID_WinHTTrackLauncher>,.. public IOleCommandTarget,.. public IObjectWithSite..{..private:.. CComPtr<IWebBrowser2> browser;..public:...WinHTTrackLauncher() {}..BEGIN_COM_MAP(WinHTTrackLauncher)...

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\is-OBS3J.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):682
    Entropy (8bit):4.877197580932443
    Encrypted:false
    SSDEEP:12:1PUyfSvPxXETKh8tFEhHkjVc5gCDjxQMncFJnc2vncffkJncbV:1PUyuJXETW8tFEhE2guPcFZc2/cf8Zcx
    MD5:90DC64FF3F682E2D78F4FA160EB5FF1A
    SHA1:17EE647A56A50FC4F0C751C0E0F24CA7FE5ABBC6
    SHA-256:436D8D8868D27F2B5BBF5EE06D7F660414DD1A6ED84E2708DF7332D792D0821C
    SHA-512:0F83348F156DC04E32455CDCEBE3E970BA08C06023143A9DAB3684FB0553B8248151FDE747ABCE6AC3239A1D0150410D8EDA9983F1C7A45C8EE31208E7C53AF6
    Malicious:false
    Preview://{{NO_DEPENDENCIES}}..// Microsoft Visual C++ generated include file...// Used by WinHTTrackIEBar.rc..//..#define IDS_PROJNAME 100..#define IDS_WINHTTRACKLAUNCHER_DESC 101..#define IDR_WinHTTrackLauncher 102..#define IDD_PROJECTINFO 103..#define IDI_ICON1 201..#define IDC_EDIT1 201....// Next default values for new objects..// ..#ifdef APSTUDIO_INVOKED..#ifndef APSTUDIO_READONLY_SYMBOLS..#define _APS_NEXT_RESOURCE_VALUE 202..#define _APS_NEXT_COMMAND_VALUE 32768..#define _APS_NEXT_CONTROL_VALUE 202..#define _APS_NEXT_SYMED_VALUE 104..#endif..#endif..

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\is-OKGSF.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):35821
    Entropy (8bit):4.622128610438848
    Encrypted:false
    SSDEEP:768:A7Y+tNdSz3ZlqXOWoInuzx3Y8N3WiYD0v:AVtNIq1uzZY1C
    MD5:3C34AFDC3ADF82D2448F12715A255122
    SHA1:7713A1753CE88F2C7E6B054ECC8E4C786DF76300
    SHA-256:0B383D5A63DA644F628D99C33976EA6487ED89AAA59F0B3257992DEAC1171E6B
    SHA-512:4937848B94F5B50EA16C51F9E98FDCD3953ACA63D63CA3BB05D8A62C107E382B71C496838D130AE504A52032398630B957ACAEA6C48032081A6366D27CBA5EA9
    Malicious:false
    Preview: GNU GENERAL PUBLIC LICENSE.. Version 3, 29 June 2007.... Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>.. Everyone is permitted to copy and distribute verbatim copies.. of this license document, but changing it is not allowed..... Preamble.... The GNU General Public License is a free, copyleft license for..software and other kinds of works..... The licenses for most software and other practical works are designed..to take away your freedom to share and change the works. By contrast,..the GNU General Public License is intended to guarantee your freedom to..share and change all versions of a program--to make sure it remains free..software for all its users. We, the Free Software Foundation, use the..GNU General Public License for most of our software; it applies also to..any other work released this way by its authors. You can apply it to..your programs, too..... When we speak of free software

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\is-ON7H3.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:XML 1.0 document, ASCII text, with very long lines (394), with CRLF line terminators
    Category:dropped
    Size (bytes):57068
    Entropy (8bit):5.280788621418483
    Encrypted:false
    SSDEEP:768:rKDtEmvS4MimvSR6albDRmvSTpEmvSG4DmvSp6tmvSEI/RbSZ:b
    MD5:41A1528FDE8C5BDCF49C7AD12084FFF2
    SHA1:CF85A7F4B7874D90EEB84D98694E6C07BEA01A5B
    SHA-256:1BC24EF4201E6FA56757EA44395CA07AB408898D4DEA4614A443D60AB7C0BCD8
    SHA-512:C0C9C83EA8EAAF26DB19CC64A445DC3E43CCDA2064127BA923836F4482750C686353E501FCCE49A25AFA6D2720C9614A671F24771B17AE57F1D8689656CE3E5A
    Malicious:false
    Preview:<?xml version="1.0" encoding="Windows-1252"?>..<VisualStudioProject...ProjectType="Visual C++"...Version="9,00"...Name="WinHTTrackIEBar"...ProjectGUID="{B978BD69-4DF2-4CBB-8843-213EC20538EF}"...RootNamespace="WinHTTrackIEBar"...Keyword="AtlProj"...TargetFrameworkVersion="131072"...>...<Platforms>....<Platform.....Name="Win32"..../>....<Platform.....Name="x64"..../>...</Platforms>...<ToolFiles>...</ToolFiles>...<Configurations>....<Configuration.....Name="Release MinDependency|Win32".....OutputDirectory="C:\temp\httiebar\ReleaseMinDependency".....IntermediateDirectory="C:\temp\httiebar\ReleaseMinDependency".....ConfigurationType="2".....InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops".....UseOfMFC="0".....UseOfATL="1".....ATLMinimizesCRunTimeLibraryUsage="false".....CharacterSet="1".....>.....<Tool......Name="VCPreBuildEventTool"...../>.....<Tool......Name="VCCustomBuildTool"......Description="Performing registration"......CommandLine="regsvr32 /s /c &q

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\is-PCBV4.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):252
    Entropy (8bit):4.96667995664233
    Encrypted:false
    SSDEEP:6:agQO/MKFiEMqiFgIvTmo5yyeA0RQby05LWUAwW14ZA1DX2:pQOjFiEO+4TZ5yyeAoQ/5LRAR3l2
    MD5:FE1E57897406333E1B487C134328EF43
    SHA1:F0513712B2A165C6A43556B81860D2A1B196D1DA
    SHA-256:93DC8792EE8AB125A26E16892551D248D3F60EC7E81A4483775E3E3973822FD7
    SHA-512:E07A7907D969B2BBE6DD4395CDADB5B241964C1D185707F4E17FFECBC7800CECFAE99D0E1411CF05161D4F0504856CB1FEF031A8E5E903D950FDC8A8613D22AB
    Malicious:false
    Preview:; CLW file contains information for the MFC ClassWizard....[General Info]..Version=1..LastClass=..LastTemplate=CDialog..NewFileInclude1=#include "stdafx.h"..NewFileInclude2=#include "winhttrackiebar.h"..LastPage=0....ClassCount=0....ResourceCount=0....

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\is-RV1MH.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1481
    Entropy (8bit):5.567754170453056
    Encrypted:false
    SSDEEP:24:E9WE97EAWRPtN3cBx3cCnUhF1VtW0xu5tjgtK+tPRu5twtJxJXWd/7gtmgtC:aW2zb4D1O04tUtK+tPYt6x0tMtntC
    MD5:88278A60ED52EEE77B82C43084E776BD
    SHA1:09A54B50BB587C147DA3F257E8365900C7B09374
    SHA-256:543386BEB139DDA12A6612CC3587227CE5F6002DFCE39B2E05ED649E02E4DFD0
    SHA-512:F22092308B39DF9FDA0D1A5796941348281FFB79339CD787A4573C25BD8F221FE5E565EE0431E1EB7A45C29D5131ADBF9F5C1FF355F0DEDB54219FDA5C8A31BB
    Malicious:false
    Preview:// projectInfo.h : Declaration of the CprojectInfo....#pragma once....#include "stdafx.h"....#include "resource.h" // main symbols..#include <atlhost.h>......// CprojectInfo....class CprojectInfo : ...public CAxDialogImpl<CprojectInfo>..{..private:..._bstr_t* title;..public:...CprojectInfo(_bstr_t* title)...{....this->title = title;...}.....~CprojectInfo()...{...}.....enum { IDD = IDD_PROJECTINFO };....BEGIN_MSG_MAP(CprojectInfo)...MESSAGE_HANDLER(WM_INITDIALOG, OnInitDialog)...COMMAND_HANDLER(IDOK, BN_CLICKED, OnClickedOK)...COMMAND_HANDLER(IDCANCEL, BN_CLICKED, OnClickedCancel)...CHAIN_MSG_MAP(CAxDialogImpl<CprojectInfo>)..END_MSG_MAP()....// Handler prototypes:..// LRESULT MessageHandler(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL& bHandled);..// LRESULT CommandHandler(WORD wNotifyCode, WORD wID, HWND hWndCtl, BOOL& bHandled);..// LRESULT NotifyHandler(int idCtrl, LPNMHDR pnmh, BOOL& bHandled);.....LRESULT OnInitDialog(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL& bHandl

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\is-SO9K6.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1032
    Entropy (8bit):5.430988324350213
    Encrypted:false
    SSDEEP:24:FnNXT/TSF4jCot5fnkBxcFKJWFOqEPUjJ7U8xTZ:nXT/TY4BbslPYl7xTZ
    MD5:128A6B2BA3D0BB6D6B184E4D75260DF4
    SHA1:EEF4E188A01F75208E38C053C8E8E0D5C27442AA
    SHA-256:4279A9C845F756D45A6BE46CC58F42F2752ECFE686FC99CE258E1A326554F041
    SHA-512:D9438B8E17C5F98DBF30E23CEDEE7C9962FF79A3FFEF3A29A5C6121521CC947EA2AD0FE0F253FF12597200E1541D0A4F18FFAB0C1F6C83CBF28D37E4227AC0AC
    Malicious:false
    Preview:// stdafx.h : include file for standard system include files,..// or project specific include files that are used frequently,..// but are changed infrequently....#if !defined(AFX_STDAFX_H__12F4061A_3F8D_4FFA_948D_624E42DAE092__INCLUDED_)..#define AFX_STDAFX_H__12F4061A_3F8D_4FFA_948D_624E42DAE092__INCLUDED_....#if _MSC_VER > 1000..#pragma once..#endif // _MSC_VER > 1000....#define STRICT..#ifndef _WIN32_WINNT..#define _WIN32_WINNT 0x0400..#endif..#define _ATL_APARTMENT_THREADED....#include <atlbase.h>..//You may derive a class from CComModule and use it if you want to override..//something, but do not change the name of _Module..extern CComModule _Module;..#include <atlcom.h>..../* WTL */..#include <atlwin.h>..#include <atlapp.h>..#include <atlctrls.h>..#include <atlmisc.h>..#include <comutil.h>......//{{AFX_INSERT_LOCATION}}..// Microsoft Visual C++ will insert additional declarations immediately before the previous line.....#endif // !defined(AFX_STDAFX_H__12F4061A_3F8D_4FF

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\is-UFNBB.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):14015
    Entropy (8bit):5.551134786061665
    Encrypted:false
    SSDEEP:384:5W+Z+H+j+I+P+3+z+P4+Pc+Rv9+FwG5R+khpo9+YZWAF9+P7/C5G5R+PXjmBG55L:ptS9WOiFBOb5oUNv5ov5g1GuqNH
    MD5:14F8783BD4B1B98DE2B4757E04B82B99
    SHA1:49A1E6563F6A2287ECF3ED530F13E2CFAAEA3085
    SHA-256:290C4116D8FE0E5E2424019B99FDCA5A381217230F976A6F97E9B5CE935545AE
    SHA-512:369445977582897363B9B901E7FFB65F713EB364EE22E294FAA3E9FCB18850DC6D47220A90DE7FD275BF6481B2C59FAC5DAAF5A48809A4A3489D3EE61A89C40A
    Malicious:false
    Preview:# Microsoft Developer Studio Project File - Name="WinHTTrackIEBar" - Package Owner=<4>..# Microsoft Developer Studio Generated Build File, Format Version 6.00..# ** DO NOT EDIT **....# TARGTYPE "Win32 (x86) Dynamic-Link Library" 0x0102....CFG=WinHTTrackIEBar - Win32 Debug..!MESSAGE This is not a valid makefile. To build this project using NMAKE,..!MESSAGE use the Export Makefile command and run..!MESSAGE ..!MESSAGE NMAKE /f "WinHTTrackIEBar.mak"...!MESSAGE ..!MESSAGE You can specify a configuration when running NMAKE..!MESSAGE by defining the macro CFG on the command line. For example:..!MESSAGE ..!MESSAGE NMAKE /f "WinHTTrackIEBar.mak" CFG="WinHTTrackIEBar - Win32 Debug"..!MESSAGE ..!MESSAGE Possible choices for configuration are:..!MESSAGE ..!MESSAGE "WinHTTrackIEBar - Win32 Debug" (based on "Win32 (x86) Dynamic-Link Library")..!MESSAGE "WinHTTrackIEBar - Win32 Unicode Debug" (based on "Win32 (x86) Dynamic-Link Library")..!MESSAGE "WinHTTrackIEBar - Win32 Release MinSize" (based on "

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\projectInfo.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):123
    Entropy (8bit):4.555395247548123
    Encrypted:false
    SSDEEP:3:RF9c4QGNt7nuREqQKZmSjR4WGIA9WRyDDHyblA9VXUAG4QNIaijR4D:j9c4Q07neE4jjR4qA0RQbyblAUAG4QNP
    MD5:4D32B8D8C4F7DDE4603EEB2148AE64E3
    SHA1:0BE7827D62119C8EB54E112B1DCFE47727888586
    SHA-256:ECB61CBAD9A81729178F4C75314F9FEEE9353B210C4E685A8F4CFF88AC696D1E
    SHA-512:D8259709743CC31490C335AC75793AEE4422A4F0216AF831DAD655931F8308AF901918EBCD92E5EBFC3106C6889D4E2841A42EC8940172D0A3E788D3DC4B2BDC
    Malicious:false
    Preview:// projectInfo.cpp : Implementation of CprojectInfo....#include "stdafx.h"..#include "projectInfo.h"......// CprojectInfo..

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\projectInfo.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1481
    Entropy (8bit):5.567754170453056
    Encrypted:false
    SSDEEP:24:E9WE97EAWRPtN3cBx3cCnUhF1VtW0xu5tjgtK+tPRu5twtJxJXWd/7gtmgtC:aW2zb4D1O04tUtK+tPYt6x0tMtntC
    MD5:88278A60ED52EEE77B82C43084E776BD
    SHA1:09A54B50BB587C147DA3F257E8365900C7B09374
    SHA-256:543386BEB139DDA12A6612CC3587227CE5F6002DFCE39B2E05ED649E02E4DFD0
    SHA-512:F22092308B39DF9FDA0D1A5796941348281FFB79339CD787A4573C25BD8F221FE5E565EE0431E1EB7A45C29D5131ADBF9F5C1FF355F0DEDB54219FDA5C8A31BB
    Malicious:false
    Preview:// projectInfo.h : Declaration of the CprojectInfo....#pragma once....#include "stdafx.h"....#include "resource.h" // main symbols..#include <atlhost.h>......// CprojectInfo....class CprojectInfo : ...public CAxDialogImpl<CprojectInfo>..{..private:..._bstr_t* title;..public:...CprojectInfo(_bstr_t* title)...{....this->title = title;...}.....~CprojectInfo()...{...}.....enum { IDD = IDD_PROJECTINFO };....BEGIN_MSG_MAP(CprojectInfo)...MESSAGE_HANDLER(WM_INITDIALOG, OnInitDialog)...COMMAND_HANDLER(IDOK, BN_CLICKED, OnClickedOK)...COMMAND_HANDLER(IDCANCEL, BN_CLICKED, OnClickedCancel)...CHAIN_MSG_MAP(CAxDialogImpl<CprojectInfo>)..END_MSG_MAP()....// Handler prototypes:..// LRESULT MessageHandler(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL& bHandled);..// LRESULT CommandHandler(WORD wNotifyCode, WORD wID, HWND hWndCtl, BOOL& bHandled);..// LRESULT NotifyHandler(int idCtrl, LPNMHDR pnmh, BOOL& bHandled);.....LRESULT OnInitDialog(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL& bHandl

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\resource.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):682
    Entropy (8bit):4.877197580932443
    Encrypted:false
    SSDEEP:12:1PUyfSvPxXETKh8tFEhHkjVc5gCDjxQMncFJnc2vncffkJncbV:1PUyuJXETW8tFEhE2guPcFZc2/cf8Zcx
    MD5:90DC64FF3F682E2D78F4FA160EB5FF1A
    SHA1:17EE647A56A50FC4F0C751C0E0F24CA7FE5ABBC6
    SHA-256:436D8D8868D27F2B5BBF5EE06D7F660414DD1A6ED84E2708DF7332D792D0821C
    SHA-512:0F83348F156DC04E32455CDCEBE3E970BA08C06023143A9DAB3684FB0553B8248151FDE747ABCE6AC3239A1D0150410D8EDA9983F1C7A45C8EE31208E7C53AF6
    Malicious:false
    Preview://{{NO_DEPENDENCIES}}..// Microsoft Visual C++ generated include file...// Used by WinHTTrackIEBar.rc..//..#define IDS_PROJNAME 100..#define IDS_WINHTTRACKLAUNCHER_DESC 101..#define IDR_WinHTTrackLauncher 102..#define IDD_PROJECTINFO 103..#define IDI_ICON1 201..#define IDC_EDIT1 201....// Next default values for new objects..// ..#ifdef APSTUDIO_INVOKED..#ifndef APSTUDIO_READONLY_SYMBOLS..#define _APS_NEXT_RESOURCE_VALUE 202..#define _APS_NEXT_COMMAND_VALUE 32768..#define _APS_NEXT_CONTROL_VALUE 202..#define _APS_NEXT_SYMED_VALUE 104..#endif..#endif..

    C:\Program Files\WinHTTrack\src_win\WinHTTrackIEBar\setup_license.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):1195
    Entropy (8bit):4.911086399144892
    Encrypted:false
    SSDEEP:24:yE59+EDDWkyEOkH5CTbVpTjFvW4/mFTxUQ36s:yO9PDDNygHWTjFvWJUyN
    MD5:F93E24FD6A95D2489D5DB275ADD84D2A
    SHA1:624FAC7C36C2F90AA432D75B603E0BAA79A53654
    SHA-256:D62DDB7AE57B89BA7FB237BA9AA7FEFA2C59D764BE3840BE026CD5E12FE410B6
    SHA-512:CC264A926D42B113C66DEAD4EF7831461866B1F72BE2B0DD7C85DE07E051F7577AF1F052DDD6026983D3F171C6989CD9BD69B3AD947D9064F9F346248AC569D9
    Malicious:false
    Preview:HTTrack Website Copier License Agreement:....HTTrack Website Copier, Offline Browser for Windows and Unix..Copyright (C) Xavier Roche and other contributors.....This program is free software; you can redistribute it and/or..modify it under the terms of the GNU General Public License..as published by the Free Software Foundation; either version 3..of the License, or any later version.....This program is distributed in the hope that it will be useful,..but WITHOUT ANY WARRANTY; without even the implied warranty of..MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the..GNU General Public License for more details.....You should have received a copy of the GNU General Public License..along with this program; if not, write to the Free Software..Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.......Important notes:....- We hereby ask people using this source NOT to use it in purpose of grabbing..emails addresses, or collecting any other private informations

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\AddFilter.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):7230
    Entropy (8bit):5.54103277983292
    Encrypted:false
    SSDEEP:96:IzL3o5ZTMTPKLe8idFB8sB3B/PBUvBesd73m3hR6B8+Cfvz74FraZVW94TYHhoMb:UIdeF3h5WvQsdkn6Ig946RPfp
    MD5:997F45386F5DE42F62CE20D62644540C
    SHA1:C8FBB31CEEFD1CB82C9920531BA70E2DB67DC45A
    SHA-256:92BDA932D5550DC25E4885338EAEFA8FFC733BE54FB43D0732895AA40A83B705
    SHA-512:5706E8DE5F2D78C337736CA759D0D0284DFE288459812CACE1C60D72B7A932A57C08C2ECDA4FADCD42606F46B73932334791B47B2406025769493AB3F3765F65
    Malicious:false
    Preview:// AddFilter.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "AddFilter.h"....extern "C" {.. #include "HTTrackInterface.h".. //#include "htsbase.h"..};....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....extern HICON httrack_icon;..// Helper..extern LaunchHelp* HtsHelper;..../////////////////////////////////////////////////////////////////////////////..// CAddFilter dialog......CAddFilter::CAddFilter(CWnd* pParent /*=NULL*/)...: CDialog(CAddFilter::IDD, pParent)..{...//{{AFX_DATA_INIT(CAddFilter)...m_addtype = _T("");...m_afquery = _T("");...m_aftype = -1;...//}}AFX_DATA_INIT..}......void CAddFilter::DoDataExchange(CDataExchange* pDX)..{...CDialog::DoDataExchange(pDX);...//{{AFX_DATA_MAP(CAddFilter)...DDX_Control(pDX, IDC_affkeyword, m_ctl_affkeyword);...DDX_Control(pDX, IDC_AFext, m_ctl_afext);...DDX_Control(pDX, IDOK, m_ctl_ok);...DDX_Control(pDX, IDC_AFtype, m_ctl_aftype);...DDX_Text(pDX, IDC_

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\AddFilter.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1574
    Entropy (8bit):5.514671519718005
    Encrypted:false
    SSDEEP:24:x222t5HlwEVioAyWEFm1ox05j4cIWzxuwHGUKaLfhiK0HMJhdVJ7U8E2S:SH6EVioUEo9qW7x3LfV0sJPVl7y
    MD5:BEFA507BF6861977DF8508140B8435D5
    SHA1:C5B40F74DD46CE3640C063D4BDA89AA8A318268F
    SHA-256:95BE83020B3EE78EE7095C8FE2E1EA2EEDBBCB5EF2F0D647260A3CE43E84FC7F
    SHA-512:81A375D8E1FAE79ED0ECF8AD1E51AAFD7E11411DEC4DD816CA10F42817BC6696E227644D4147143284B7FF8D92472C86D92453F7E39BDD93DD5D435B4949DF18
    Malicious:false
    Preview:#if !defined(AFX_ADDFILTER_H__B88718A1_6113_11D2_A2B1_0000E84E7CA1__INCLUDED_)..#define AFX_ADDFILTER_H__B88718A1_6113_11D2_A2B1_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// AddFilter.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// CAddFilter dialog....class CAddFilter : public CDialog..{..// Construction..public:.. int type;...CAddFilter(CWnd* pParent = NULL); // standard constructor....// Dialog Data...//{{AFX_DATA(CAddFilter)...enum { IDD = IDD_AddFilter };...CStatic.m_ctl_affkeyword;...CEdit.m_ctl_afext;...CButton.m_ctl_ok;...CComboBox.m_ctl_aftype;...CString.m_addtype;...CString.m_afquery;...int..m_aftype;...//}}AFX_DATA......// Overrides...// ClassWizard generated virtual function overrides...//{{AFX_VIRTUAL(CAddFilter)...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protected:.. char* GetTip(in

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\BatchUpdate.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1127
    Entropy (8bit):5.149631965953755
    Encrypted:false
    SSDEEP:12:jvDuAoQClARtlAZOe8N4UqaKferYQfIYnNwIOlTY1/fRjFzeoMlmpJ2ZaUHymZ5E:vu7plctlReifrIYnqIOY5e5oO37Q
    MD5:07EE882416D4D9B3589BEA4775C063E9
    SHA1:6251FE41CB0D6166928AD559DF0E47AD9E31C172
    SHA-256:A5E926ACBA02C3E4317B6E67C32640D91308975EC39E4C45E8380EBE715A1CF4
    SHA-512:BE96CCABEF1A1D0B7B32106D352DBC3D4DCC9AA5E5AF1AFEA179E7718FA65375C5D1C8B436B08397AD76B0A190B17E971447397BF1E205C70200E3BA25397B79
    Malicious:false
    Preview:// BatchUpdate.cpp : implementation file..//....#include "stdafx.h"..#include "winhttrack.h"..#include "BatchUpdate.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../////////////////////////////////////////////////////////////////////////////..// CBatchUpdate property page....IMPLEMENT_DYNCREATE(CBatchUpdate, CPropertyPage)....CBatchUpdate::CBatchUpdate() : CPropertyPage(CBatchUpdate::IDD)..{...//{{AFX_DATA_INIT(CBatchUpdate)....// NOTE: the ClassWizard will add member initialization here...//}}AFX_DATA_INIT..}....CBatchUpdate::~CBatchUpdate()..{..}....void CBatchUpdate::DoDataExchange(CDataExchange* pDX)..{...CPropertyPage::DoDataExchange(pDX);...//{{AFX_DATA_MAP(CBatchUpdate)....// NOTE: the ClassWizard will add DDX and DDV calls here...//}}AFX_DATA_MAP..}......BEGIN_MESSAGE_MAP(CBatchUpdate, CPropertyPage)...//{{AFX_MSG_MAP(CBatchUpdate)....// NOTE: the ClassWizard will add message map macros here...//}}AFX_MSG_MAP..END_MES

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\BatchUpdate.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1355
    Entropy (8bit):5.479905408806
    Encrypted:false
    SSDEEP:24:lu23u232lkInkFb5Nnz5la3471WztuwHGUKaPisOFskOPUjJ7U8Mu2/:crPJnYXvgYWfx33OFsJPYl71+
    MD5:A831EF9FB3C98F3CEEAA6095D93280A6
    SHA1:18E5573CA473AB77706E969AE56A35301ACEA330
    SHA-256:529598FF251817538160FEE642E9A6E7CA927BE21E1D351C8246EE3F293827C1
    SHA-512:E35369E654F8B3B97ED1107A8C8B0F6CF18577BCA5BA6C5AD127BE68739A6D7BE0F9A51E18025858340A7F560B1B02DACA5460B0E0A472D6862D9B9B4A8FFBF1
    Malicious:false
    Preview:#if !defined(AFX_BATCHUPDATE_H__27459ED9_CCB3_4BA7_B2E3_442733B41467__INCLUDED_)..#define AFX_BATCHUPDATE_H__27459ED9_CCB3_4BA7_B2E3_442733B41467__INCLUDED_....#if _MSC_VER > 1000..#pragma once..#endif // _MSC_VER > 1000..// BatchUpdate.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// CBatchUpdate dialog....class CBatchUpdate : public CPropertyPage..{...DECLARE_DYNCREATE(CBatchUpdate)....// Construction..public:...CBatchUpdate();...~CBatchUpdate();....// Dialog Data...//{{AFX_DATA(CBatchUpdate)...enum { IDD = IDD_BatchUpdate };....// NOTE - ClassWizard will add data members here.....// DO NOT EDIT what you see in these blocks of generated code !...//}}AFX_DATA......// Overrides...// ClassWizard generate virtual function overrides...//{{AFX_VIRTUAL(CBatchUpdate)...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protected:...// Generated message map funct

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\BuildOptions.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):2100
    Entropy (8bit):5.417118430337453
    Encrypted:false
    SSDEEP:48:cWpzp2ktEAT8R+7rQgmtsaxf9dgDidCixBagB7wBUyBHBVfm:9z5CtR+AtPfaid5xBagB7wBUyBHBVO
    MD5:C4702F2353B66C592B571B3EDAE3EEF6
    SHA1:B79D6A0069BFA47B57CABF0B27A57546AC5C4727
    SHA-256:34414C585C7F72100CFBA431050E44E323C27694177A6430E7B713F980E1EDC7
    SHA-512:0E4C160A1BC9DAB0E3D91D446E0B4A84BDAA3366259AC1F5F4B47422AD9E96B2A077CE4556475BC0EA9DC70948308E889D9080563F205F4B714F885A90635F59
    Malicious:false
    Preview:// BuildOptions.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "BuildOptions.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....// Helper..extern LaunchHelp* HtsHelper;....../////////////////////////////////////////////////////////////////////////////..// CBuildOptions dialog......CBuildOptions::CBuildOptions(CWnd* pParent /*=NULL*/)...: CDialog(CBuildOptions::IDD, pParent)..{...//{{AFX_DATA_INIT(CBuildOptions)...m_BuildString = _T("");...//}}AFX_DATA_INIT..}......void CBuildOptions::DoDataExchange(CDataExchange* pDX)..{...CDialog::DoDataExchange(pDX);...//{{AFX_DATA_MAP(CBuildOptions)...DDX_Text(pDX, IDC_BuildString, m_BuildString);...//}}AFX_DATA_MAP..}......BEGIN_MESSAGE_MAP(CBuildOptions, CDialog)...//{{AFX_MSG_MAP(CBuildOptions)...ON_WM_HELPINFO()...//}}AFX_MSG_MAP.. ON_COMMAND(ID_HELP_FINDER,OnHelpInfo2).. ON_COMMAND(ID_HELP,OnHelpInfo2)...ON_COMMAND(ID_DEFAULT_HELP,OnHelpInfo2)..END_M

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\BuildOptions.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1301
    Entropy (8bit):5.47138171214136
    Encrypted:false
    SSDEEP:24:Art2lJhAyW5uK4cIWzajuwHGUKaDiO0HMvkDVJ7U8JS:F/hU1qWelx3x0sv8Vl7Y
    MD5:9D73AF75C33EE555D4A97D2F70B3D4A5
    SHA1:0361CA0293B9CFBFF1327EC651EA43B68098A82F
    SHA-256:6D4FF3DD9B57953FB6267F777628DCE6A80E27C0AAAFA78E0DE0FD44FAD9C1B3
    SHA-512:ED2194EC3D5AB19C340D052FB381CCB886946DD61CB51C1A7E54BA2453D7CDC9881C0FDCF9B13AAEEDE6F80BE0ABEE41EBE7DA45F7561E6B67EE9A83B8FF35C5
    Malicious:false
    Preview:#if !defined(AFX_BUILDOPTIONS_H__9ADE0222_D39E_11D2_A2B1_0000E84E7CA1__INCLUDED_)..#define AFX_BUILDOPTIONS_H__9ADE0222_D39E_11D2_A2B1_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// BuildOptions.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// CBuildOptions dialog....class CBuildOptions : public CDialog..{..// Construction..public:...CBuildOptions(CWnd* pParent = NULL); // standard constructor....// Dialog Data...//{{AFX_DATA(CBuildOptions)...enum { IDD = IDD_BuildOptions };...CString.m_BuildString;...//}}AFX_DATA......// Overrides...// ClassWizard generated virtual function overrides...//{{AFX_VIRTUAL(CBuildOptions)...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protected:.. void OnHelpInfo2();.....// Generated message map functions...//{{AFX_MSG(CBuildOptions)...afx_msg BOOL OnHelpInfo(HELPINFO* dummy)

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\CatchUrl.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):2741
    Entropy (8bit):5.381560892737094
    Encrypted:false
    SSDEEP:48:BpzD5zIAkYtC4o5g1fUZITxYCVxBf/qk9ZGUWq6bNzeiYX2hidCifBDBRgB9C:7ziL4tKZUZVB94T3zPrhid5fBDBRgB9C
    MD5:ADCD43B513B791B48446FCBDB277F292
    SHA1:698E55748DCF50EC25DE2FCC4896BC27C7DEF4DA
    SHA-256:85C122A61C3AD72F522C5E6F97F34F8887CED80FB9E7D0B9E0A7DEC55A041AB5
    SHA-512:49039379FF1FB5CCD655D2A33703C7B6AB9802A06936547D1A37B9803C213DEB6697DB31E6D2669701C39865D6CECD7910347BD315B2475EB1D398471C0A5701
    Malicious:false
    Preview:// CatchUrl.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "CatchUrl.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../////////////////////////////////////////////////////////////////////////////..// CCatchUrl dialog......CCatchUrl::CCatchUrl(CWnd* pParent /*=NULL*/)...: CDialog(CCatchUrl::IDD, pParent)..{...//{{AFX_DATA_INIT(CCatchUrl)...m_info = _T("");...//}}AFX_DATA_INIT..}......void CCatchUrl::DoDataExchange(CDataExchange* pDX)..{...CDialog::DoDataExchange(pDX);...//{{AFX_DATA_MAP(CCatchUrl)...DDX_Text(pDX, IDC_info, m_info);...//}}AFX_DATA_MAP..}....BEGIN_MESSAGE_MAP(CCatchUrl, CDialog)...//{{AFX_MSG_MAP(CCatchUrl)...ON_WM_CLOSE()...//}}AFX_MSG_MAP.. ON_NOTIFY_EX( TTN_NEEDTEXT, 0, OnToolTipNotify )..END_MESSAGE_MAP()..../////////////////////////////////////////////////////////////////////////////..// CCatchUrl message handlers....void CCatchUrl::OnClose() ..{...// TODO: Add your messag

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\CatchUrl.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1305
    Entropy (8bit):5.504847242741956
    Encrypted:false
    SSDEEP:24:Fvkv8ESlz4a5IlEDrvAyafx0X4cIWzAuwHGUKaAishtkDPUjJ7U80v0:FMtSF5y2f0fxWqWsx3aj8PYl708
    MD5:5282D57C287A13733FFB52920B82F3C0
    SHA1:273337BCCB235C176D27E897CDF8DDA0DFB7CC9B
    SHA-256:D81DD468BEE54D8F6A1413CF93A3C08E6F4245AA82B286A60EF9C10A8EDA4556
    SHA-512:B7C47DE9065B91BE6600C03D33451B3D8F8209A7385D492C5E7729FAC82D973A8548EA2002A436B75D60B9E69310230D0EBDE2E801203E9B2AA0E5A6E4A64B38
    Malicious:false
    Preview:#if !defined(AFX_CATCHURL_H__589FEA02_D671_11D3_A2B3_0000E84E7CA1__INCLUDED_)..#define AFX_CATCHURL_H__589FEA02_D671_11D3_A2B3_0000E84E7CA1__INCLUDED_....#if _MSC_VER > 1000..#pragma once..#endif // _MSC_VER > 1000..// CatchUrl.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// CCatchUrl dialog....class CCatchUrl : public CDialog..{..// Construction..public:...CCatchUrl(CWnd* pParent = NULL); // standard constructor.. char* GetTip(int id);....// Dialog Data...//{{AFX_DATA(CCatchUrl)...enum { IDD = IDD_CatchUrl };...CString.m_info;...//}}AFX_DATA......// Overrides...// ClassWizard generated virtual function overrides...//{{AFX_VIRTUAL(CCatchUrl)...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protected:.....// Generated message map functions...//{{AFX_MSG(CCatchUrl)...afx_msg void OnClose();...virtual BOOL OnInitDialog();...//}}AFX_MSG.. afx_msg BOOL On

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\CrashReport.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):12811
    Entropy (8bit):5.386551841420844
    Encrypted:false
    SSDEEP:192:FRC732IEMQuhadbP+9zXngeQYbr+vr/7T7QXrEiSDcxFfNhirKPQAobE:FoL2It3nI2xiOB
    MD5:9E0FCE04E8D460AF1E1C7126AE7C7564
    SHA1:4EFBC70B4EADBBA41307898E23F3EC85DE797686
    SHA-256:DEF32945E85F3339B05FF0EFEBC1A9E18104C438DE9E6CF85A2758BF97AB0B61
    SHA-512:89571C35A02A0AC774518080F095B1D4D079F64D501018B2E2DEB4D2408A4DAB14FD79664B1A639231F95CA506B2633EEA183D6FA0CED97DDEF999748CE3627D
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2014 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\CrashReport.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):1942
    Entropy (8bit):4.728618230001425
    Encrypted:false
    SSDEEP:24:yqRJiz7WtyPOkHMlCTbVO2ylFvP4/mFhxUwIXEXq/QsKp8TfEprkmvzx:FRC7iyZHc1FvPHUwIXEXMQfpEMp4A
    MD5:14BD5687E82C347CF48ED328F03267EE
    SHA1:76C7BF00F01F1E993BEF7F0E22CBC56671EDEB2E
    SHA-256:BED3015D5F74BB43ADA10A864F18D579AC5D5C09CB950143237254EF21C42AD8
    SHA-512:CFCB55F2B14D840FBC0A517876E42BB3BE60715A1991ECCBCF1DF5A534DC14F467D1787B3CBAAA3748EE75CB4ADD42A19F57F66A818060FE02EE3A2F3F75983C
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2014 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\DialogContainer.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):3872
    Entropy (8bit):5.380568069875657
    Encrypted:false
    SSDEEP:96:+8hiTxiB3jmpUoC4luwKyB5Pd7RWR7xNHfXltHpIXfOGNDOm7mSw:xzDol/LxRWRtNHfXltHpCO4u
    MD5:FB56AE23B73B5AC74FC9075C52E7B471
    SHA1:DFFB866EF7A3B885C35601F3DD0FA7CB0A7F7659
    SHA-256:6EB263DBC5244B79DFDC5722FBA45DAC3A568C42127F993AFD6B7A38EC98F850
    SHA-512:AC5BCCFD7D982438462071025EA51A76EC3AF53DFE909FF3F42B291E462BE99019015292CF8217C37ECACBDB0ABBEA81EE1072A8DD67700DB1F6FC29B210B5FC
    Malicious:false
    Preview:// DialogContainer.cpp : implementation file..//....// Les dialogues doivent avoir comme flags:..// CHILD, NONE, VISIBLE..// Et surcharger Oncancel et OnOK......#include "stdafx.h"..#include "winhttrack.h"..#include "DialogContainer.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../////////////////////////////////////////////////////////////////////////////..// CDialogContainer....IMPLEMENT_DYNCREATE(CDialogContainer, CFormView)....CDialogContainer::CDialogContainer()...: CFormView(CDialogContainer::IDD)..{.. scrollsize_declared=FALSE;.. tab=new CWizTab("WinHTTrack Website Copier",0);.. tab2=new CWizTab("WinHTTrack Website Copier",1);...//{{AFX_DATA_INIT(CDialogContainer)....// NOTE: the ClassWizard will add member initialization here...//}}AFX_DATA_INIT..}....CDialogContainer::~CDialogContainer()..{.. /*.. voir WizTab.cpp.. delete tab;.. delete tab2;.. tab=tab2=NULL;.. */..}....void CDialogContainer::DoDataExchange(C

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\DialogContainer.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):2036
    Entropy (8bit):5.452720967820525
    Encrypted:false
    SSDEEP:48:W68y1Ua3OSDRoXqWvXQK5pgx34uireLPYl7c:WxyPOSa6fKMdxQl7c
    MD5:C5FF2CACF4183A74D46A1D47F7CB9FF2
    SHA1:B39F4ADABF907C8A929D208B04754833855789DF
    SHA-256:4D081311B2DA1EF2B5D686428D0631114F01B95B1DA9E1F43DD88DD4074CB168
    SHA-512:8C63692824B9595FA7C0FD51DAE0AF44D74A21F5D2C6A053787B3258DE39F357308424C143A614933DCDC0BED95F994396AC990C3FDE7DBE381A3A97B61E3155
    Malicious:false
    Preview:#if !defined(AFX_DIALOGCONTAINER_H__4F25D0C2_5DF4_4149_BD78_FCB2CD06E2DB__INCLUDED_)..#define AFX_DIALOGCONTAINER_H__4F25D0C2_5DF4_4149_BD78_FCB2CD06E2DB__INCLUDED_....#if _MSC_VER > 1000..#pragma once..#endif // _MSC_VER > 1000..// DialogContainer.h : header file..//....// Includes pour objet encapsul...#include "WizTab.h"..../////////////////////////////////////////////////////////////////////////////..// CDialogContainer form view....#ifndef __AFXEXT_H__..#include <afxext.h>..#endif....class CDialogContainer : public CFormView..{..protected:...CDialogContainer(); // protected constructor used by dynamic creation...DECLARE_DYNCREATE(CDialogContainer).... CWizTab* tab;.. CWizTab* tab2;.. BOOL scrollsize_declared;.. int view_w,view_h;....// Form Data..public:...//{{AFX_DATA(CDialogContainer)...enum { IDD = IDD_DIALOGCONTAINER_FORM };....// NOTE: the ClassWizard will add data members here...//}}AFX_DATA....// Attributes..public:....// Operations..public:....// Overrides...

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\DialogHtmlHelp.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):7083
    Entropy (8bit):5.567690739151063
    Encrypted:false
    SSDEEP:96:Vz+tvCeMikuz82dmIlEVzNbBtJuvHIvo7OZVz94TV2oMxfKIDi:gCIz8F/VzN3Juvovjx94sDi
    MD5:D00C4251A8414CEF7A6976E571852B71
    SHA1:C03E8B97DEC1938FA1DEA9B7EB638B5EDD57485C
    SHA-256:3883EC37E08D8EC151A46EB5C5E8549C539D5316A705BEDCF31CEEAD4EA0ECCF
    SHA-512:0F528E519A2382A986F9FD95201C6328FE157AE44B8A55C7B39A11DA880A6B552A41CFBBE63C848AE7BC7CFD0DC8B4E20CA7842FE7B62534C21AD668624B7262
    Malicious:false
    Preview:// DialogHtmlHelp.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "DialogHtmlHelp.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....extern "C" {.. #include "HTTrackInterface.h".. //#include "htsbase.h"..};....extern HICON httrack_icon;..../////////////////////////////////////////////////////////////////////////////..// CDialogHtmlHelp dialog......CDialogHtmlHelp::CDialogHtmlHelp(CWnd* pParent /*=NULL*/)...: CDialog(CDialogHtmlHelp::IDD, pParent)..{.. page="";...//{{AFX_DATA_INIT(CDialogHtmlHelp)...//}}AFX_DATA_INIT..}......void CDialogHtmlHelp::DoDataExchange(CDataExchange* pDX)..{...CDialog::DoDataExchange(pDX);...//{{AFX_DATA_MAP(CDialogHtmlHelp)...//}}AFX_DATA_MAP..}......BEGIN_MESSAGE_MAP(CDialogHtmlHelp, CDialog)...//{{AFX_MSG_MAP(CDialogHtmlHelp)...ON_WM_SIZE()...ON_WM_CREATE()...ON_BN_CLICKED(IDC_BACK, OnBack)...ON_BN_CLICKED(IDC_FORWARD, OnForward)...ON_BN_CLICKED(IDC_STOP, OnStop).

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\DialogHtmlHelp.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2323
    Entropy (8bit):5.5735624275786355
    Encrypted:false
    SSDEEP:48:yEfCKIereEHy6yf5iYXVUEfqWuXQK5pLW0sQ/grG5f8PYl793:hCvB6mYeKfV70Ql79
    MD5:77715DD91792513BC991640577479E6F
    SHA1:6329486275AC675DAD6F0CF4C4B05E1364A14166
    SHA-256:9FECBD1445B7210E177CCEED7887BA98B85B424F9D42AAD75B221EDDAC1BEAB7
    SHA-512:9807CB645A74C1ACA561056C731E9894E1FE471713A8ED7BEC0AE9364AE3F7E9A9358F059F9C3CD4E566FEF03562C186629FF3EB514F8958F330BBD304C51EAE
    Malicious:false
    Preview:#if !defined(AFX_DIALOGHTMLHELP_H__FED0CE81_AB10_11D3_A2B3_0000E84E7CA1__INCLUDED_)..#define AFX_DIALOGHTMLHELP_H__FED0CE81_AB10_11D3_A2B3_0000E84E7CA1__INCLUDED_....#if _MSC_VER > 1000..#pragma once..#endif // _MSC_VER > 1000..// DialogHtmlHelp.h : header file..//....#include "resource.h"..//#include "LaunchHelpBase.h"..#include "HtmlCtrl.h"....// type callback..typedef void (* Helper_CallBack ) (CWnd*);..typedef void (* OnSize_CallBack ) (CWnd*,UINT nType, int cx, int cy); ..../////////////////////////////////////////////////////////////////////////////..// CDialogHtmlHelp dialog....class CDialogHtmlHelp : public CDialog..{..// Construction..public:.. void Go(CString st);...CDialogHtmlHelp(CWnd* pParent = NULL); // standard constructor.. Helper_CallBack callback;.. OnSize_CallBack callbackOnSize;.. char* GetTip(int id);.. //.. CString page;..protected:...CHtmlCtrl m_page;...CToolBar m_wndToolBar;.. char home[1024];.. char home_dir[1024];..//private:..// LaunchHelpBase

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\DirTreeView.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):20515
    Entropy (8bit):5.247551435437972
    Encrypted:false
    SSDEEP:384:+8kaK3b6+bpOZP14pqu20VIw2W/tJGLEOeNZy2NYpcj5JWlY:ZkaKu9GUpw9jzWlY
    MD5:186D64AE5FB8B47D242344FA18F878BD
    SHA1:4023CDC7A2FED142FFA5CA5D93DF1299BD6518ED
    SHA-256:D5D6E1A026AFBC1CEF870912F5E06A0C2B884F7BA5A30199A04AF6E7A880C459
    SHA-512:8D7C538702326B918AD68B2FB7F92B1CBB27BB0687F3F8E0CAAD9B4F881E1966D9C44BDC7E5AB6ED643B53007B345AAD63EB28A2EC0C6BE5D89ECB32000C2846
    Malicious:false
    Preview:// DirTreeView.cpp : implementation file..//....#include "stdafx.h"..#include "winhttrack.h"..#include "DirTreeView.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....extern "C" {.. #include "HTTrackInterface.h".. //#include "htsbase.h"..};....#include "MainFrm.h"....CDirTreeView* this_DirTreeView=NULL;..../////////////////////////////////////////////////////////////////////////////..// CDirTreeView....IMPLEMENT_DYNCREATE(CDirTreeView, CTreeView)....CDirTreeView::CDirTreeView()..{.. this_DirTreeView=this;.. redraw_in_progress=0;.. timer=0;.. count_whandle=0;.. docType="<nullType>";..}....CDirTreeView::~CDirTreeView()..{.. WaitThreads();.. this_DirTreeView=NULL;.. if (imagelist.m_hImageList) {.. imagelist.Detach();.. imagelist.m_hImageList=NULL;.. }..}......BEGIN_MESSAGE_MAP(CDirTreeView, CTreeView)...//{{AFX_MSG_MAP(CDirTreeView)...ON_WM_TIMER()...ON_WM_SHOWWINDOW()...ON_NOTIFY_REFLECT(TVN_ITEMEXPANDING, OnIteme

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\DirTreeView.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):3514
    Entropy (8bit):5.493243515782507
    Encrypted:false
    SSDEEP:96:FQXbLJ7i0Vr0p0JI2Wt4wiZgKkWtr+P+1qCqQl7J:Og4VmWtruCN
    MD5:F8E6376D22085A85DCBC15099C51B10C
    SHA1:43875154CF793D98D3E677F0A1114044C27AF578
    SHA-256:B4E0C467EB26AB0224FA147EA95D0C73FFE21626728A6913CB4B0EB100D9D3B1
    SHA-512:A587DD820B2DB03BB766F932DF548F8754A1A7D12EA371C76F4068B0DAB74F78C77B85B96CD2C197A5EC46731BE6C5C45CF2EA506A3E3EE6DDC8CC6A6FF04AB1
    Malicious:false
    Preview:#if !defined(AFX_DIRTREEVIEW_H__DFB224E0_828F_426D_A9A3_471D7A2F5108__INCLUDED_)..#define AFX_DIRTREEVIEW_H__DFB224E0_828F_426D_A9A3_471D7A2F5108__INCLUDED_....#if _MSC_VER > 1000..#pragma once..#endif // _MSC_VER > 1000..// DirTreeView.h : header file..//....#include <afxcview.h>..#include "TreeViewToolTip.h"..../////////////////////////////////////////////////////////////////////////////..// CDirTreeView view....class CDirTreeView : public CTreeView..{..protected:...CDirTreeView(); // protected constructor used by dynamic creation...DECLARE_DYNCREATE(CDirTreeView)..protected:.. UINT_PTR timer;.. HANDLE whandle[1024];.. HTREEITEM pos_whandle[1024];.. int count_whandle;.. void StartTimer();.. void StopTimer();.. //.. void BuildTrackHandles();.. void DestroyTrackHandles();.. void DoTrackHandles();....// Attributes..public:...CTreeViewToolTip m_TreeViewToolTip;.. //.. CString refreshPath; /* callback */.. CString docType; /* document type (ex

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\EasyDropTarget.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):7403
    Entropy (8bit):5.305374521449437
    Encrypted:false
    SSDEEP:192:9DEws1E+tlmwuUgUEzyw2vFg2QiluR9DJmIX09sDMdkp1:9jsnvsX2NGR9DJmoX
    MD5:AE6FC8308B470AB0CA5EAD378F0C42DF
    SHA1:15FB349B6B325E05E437D6BC35F406262DACE2BF
    SHA-256:7792B9257BB2086AAD036072689397B15C962B1A91B7711A65D28682BA0E3C0F
    SHA-512:A17A2380557A035CC1592447DA39696801845A70C3BA749967C9FEC739FA485DAAA19F279ADB91D0BCF36803E74D86CE99CDAEEBFFB4DA7CD5AE67805618B345
    Malicious:false
    Preview:/*.. Implementation example:.. .. 1. In the .h file: add....#include "EasyDropTarget.h".......private: .. CEasyDropTarget* drag;....... // Generated message map functions.. afx_msg LRESULT DragDropText(WPARAM wParam,LPARAM lParam);......... 2. In the cpp file: add....#include "EasyDropTarget.h".......#define wm_CEasyDropTargetCallback (WM_USER + 1)..BEGIN_MESSAGE_MAP(Wid1, CDialog)....... ON_MESSAGE( wm_CEasyDropTargetCallback, DragDropText).......END_MESSAGE_MAP()...........int CMyDialogClass::OnCreate(LPCREATESTRUCT lpCreateStruct) ....... // Drag&Drop.. drag=new CEasyDropTarget(this);.. if (drag->IsRegistered()) {.. drag->SetTextCallback(wm_CEasyDropTargetCallback);.. }.......}.... 2b. Add the callback function....// Message from CEasyDropTarget..LRESULT CMyDialogClass::DragDropText(WPARAM wParam,LPARAM lParam) {.. if (lParam) {.. CString st=*((CString*) lParam);.. CLIPFORMAT cfFormat=wParam;.. if (cfFormat==CF_TEXT).. AfxMessageBox("Raw text : "+st);.

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\EasyDropTarget.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1519
    Entropy (8bit):5.406485060360228
    Encrypted:false
    SSDEEP:24:S/X/6+tZp5lC/+ozzXHRefGvPlwGvPl3igvPl/cRw3l379wVyqiEltTd/S:OZp5Y/+I7+uCu9iQj3F9CyR4TI
    MD5:6DD9F5C1334CDB8D455A3AF85FF63723
    SHA1:3831AD6D7763AAC1FE5903BF31138D2E89093C13
    SHA-256:AD7C6BD400562404A6053A1CF193D02FC60E2FC09FA69EA90567E158F29127D5
    SHA-512:4531A333EBD24021FBD7B1562360D92FA8428664CF2E0F4AF0C380849400667EEF6B718B4C29FD8CEC3014E40C315925CFFA3DC8F1310EA008C60BF8976BA373
    Malicious:false
    Preview:#if !defined(AFX_CEasyDropTarget_H__5EBE1984_98CD_11D2_A2B1_0000E84E7CA1__INCLUDED_)..#define AFX_CEasyDropTarget_H__5EBE1984_98CD_11D2_A2B1_0000E84E7CA1__INCLUDED_....#include <afxole.h>....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// CEasyDropTarget.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// CEasyDropTarget document....static int ReadString(CArchive& ar, char* pString, int nMaxLen);....class CEasyDropTarget : public COleDropTarget..{..public: .. CEasyDropTarget();.. CEasyDropTarget(CWnd* wnd);.. BOOL IsRegistered();.. void SetTextCallback(UINT msg);.. //.. static char** StringToArray(CString st);.. static int ReleaseStringToArray(char** st);.... // OLE.. DROPEFFECT OnDragEnter( CWnd* pWnd, COleDataObject* pDataObject, DWORD dwKeyState, CPoint point ); .. DROPEFFECT OnDragOver( CWnd* pWnd, COleDataObject* pDataObject, DWORD dwKeyState, CPoint point ); .. DROPEFFECT OnDragScroll( CWnd* pWnd,

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\FirstInfo.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):3935
    Entropy (8bit):5.500197148247776
    Encrypted:false
    SSDEEP:96:f8fe6roGWMqlKZLZidy/+SbJPs+SbqRYCY:6eZDMoKGy/jb6jbqRDY
    MD5:770BB417E083E07DCBC4D1C12F7823FB
    SHA1:0A0BB935544F87A540BFDFEF8B7377FF2AC40434
    SHA-256:4DE98CFC5B7979A9D56E9CE2779C1E3DD0F83EEB5469A2C82E58C4727D0634B9
    SHA-512:DB8F33EF36EAC4359F08A906659CA77176495FC6FABA4B0DE3C2871F04D7E8EC1E4579CA84DA16238BE4D516859231F3628830E38303A3B275AF7999C1787104
    Malicious:false
    Preview:// FirstInfo.cpp : implementation file..//....#include "stdafx.h"..#include "winhttrack.h"..#include "FirstInfo.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../* Main WizTab frame */..#include "WizTab.h"..extern CWizTab* this_CWizTab;..../* Main splitter frame */..#include "DialogContainer.h"..#include "splitter.h"..extern CSplitterFrame* this_CSplitterFrame;..../* DirTreeView */..#include "DirTreeView.h"..extern CDirTreeView* this_DirTreeView;....../////////////////////////////////////////////////////////////////////////////..// CFirstInfo property page....IMPLEMENT_DYNCREATE(CFirstInfo, CPropertyPage)....CFirstInfo::CFirstInfo() : CPropertyPage(CFirstInfo::IDD)..{...//{{AFX_DATA_INIT(CFirstInfo)....// NOTE: the ClassWizard will add member initialization here...//}}AFX_DATA_INIT..}....CFirstInfo::~CFirstInfo()..{..}....void CFirstInfo::DoDataExchange(CDataExchange* pDX)..{...CPropertyPage::DoDataExchange(pDX);...//{{AFX_DAT

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\FirstInfo.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1360
    Entropy (8bit):5.49755263464226
    Encrypted:false
    SSDEEP:24:ZI/lI/tjxlKQnkYlxuXd471Wz7uwHGUKaPim+hs+m4KSVkOPUjJ7U8mI/1:bxTnJxutYWBx3h+G+cSJPYl7T
    MD5:D978711C9EBB6794156F313E8DE95115
    SHA1:2C3ED61C3D24A80E77B2E56DE255D010F7CBBAA0
    SHA-256:3F48242B543A1044DF492BB16E0BEDD50E9C144347C153CBD7A670A898B5BA8D
    SHA-512:523F104F7E57CD3D0C0C5285A79D7B9FCBA4487350A219CD97E6A043754015F3C3131F479AB2A964BEFAC9EF65FB69FF610F0CEDF43DA658D1C11A8ACD2B317B
    Malicious:false
    Preview:#if !defined(AFX_FirstInfo_H__DC893229_C7D6_448C_860C_54F4E35FFA84__INCLUDED_)..#define AFX_FirstInfo_H__DC893229_C7D6_448C_860C_54F4E35FFA84__INCLUDED_....#if _MSC_VER > 1000..#pragma once..#endif // _MSC_VER > 1000..// FirstInfo.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// CFirstInfo dialog....class CFirstInfo : public CPropertyPage..{...DECLARE_DYNCREATE(CFirstInfo)....// Construction..public:...CFirstInfo();...~CFirstInfo();....// Dialog Data...//{{AFX_DATA(CFirstInfo)...enum { IDD = IDD_FirstInfo };...CStatic.m_splash;...//}}AFX_DATA......// Overrides...// ClassWizard generate virtual function overrides...//{{AFX_VIRTUAL(CFirstInfo)...public:...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protected:...// Generated message map functions...//{{AFX_MSG(CFirstInfo)...afx_msg void OnMouseMove(UINT nFlags, CPoint point);...afx_msg void OnLButtonDown(

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\HTMLHelp.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1322
    Entropy (8bit):5.084423059700499
    Encrypted:false
    SSDEEP:24:2u7plctlYeG+8IYnsbSDe5oPIh9wB/ifBi39rQ:/pOtOIYve5oPIcUM3tQ
    MD5:DBCB9FEFF5D5348EB6B6683C88EE5381
    SHA1:8F29514EAA20F991FD03F92D2AFAB9CF5E821AEE
    SHA-256:9DF1B6FF9C6674A3A7C9902071E550B8843C2FC190162A62DF7222BA7D0D419D
    SHA-512:1E43C82821EC2B406BB45E63A5D355EA5282600EDEBC39D3C0A7E6054CC2452C3FE65DBAD36CD2F9FF042AD7EBBE36F4053A2E61491C7E9B2BC76AB63C451638
    Malicious:false
    Preview:// HTMLHelp.cpp : implementation file..//....#include "stdafx.h"..#include "winhttrack.h"..#include "HTMLHelp.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../////////////////////////////////////////////////////////////////////////////..// CHTMLHelp....IMPLEMENT_DYNCREATE(CHTMLHelp, CHtmlView)....CHTMLHelp::CHTMLHelp()..{...//{{AFX_DATA_INIT(CHTMLHelp)....// NOTE: the ClassWizard will add member initialization here...//}}AFX_DATA_INIT..}....CHTMLHelp::~CHTMLHelp()..{..}....void CHTMLHelp::DoDataExchange(CDataExchange* pDX)..{...CHtmlView::DoDataExchange(pDX);...//{{AFX_DATA_MAP(CHTMLHelp)....// NOTE: the ClassWizard will add DDX and DDV calls here...//}}AFX_DATA_MAP..}......BEGIN_MESSAGE_MAP(CHTMLHelp, CHtmlView)...//{{AFX_MSG_MAP(CHTMLHelp)....// NOTE - the ClassWizard will add and remove mapping macros here....//}}AFX_MSG_MAP..END_MESSAGE_MAP()..../////////////////////////////////////////////////////////////////////////////

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\HTMLHelp.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1593
    Entropy (8bit):5.3715337048974625
    Encrypted:false
    SSDEEP:24:aX6Xhrlqb7ezlem/a3/+6Vk0emjX4cIWzOuwHGUKah+h3wpoiUf2k6PUjJ7U8DXB:KqlYv8zpaZeoXqW2x3Cumf2LPYl7zB
    MD5:A307277482EAABAA60092549B2FB7B77
    SHA1:64451D4A473A0C92DFB47774BDABB2A1FB111B89
    SHA-256:8840ABE7DDC315C9DA9C97B2B57A94041279D1FE164D079AD84F4CD0BA99C2D2
    SHA-512:08CDDA27A9A8B887400D8F2583D1BBFB653CE0FEB5EB644C70F5EADD8326D1C7FB2369DD52BB411B10086F899AC76544B8E83B3B98FBB79672396962A08C3B91
    Malicious:false
    Preview:#if !defined(AFX_HTMLHELP_H__CA6ABCFD_0D37_4DC2_A214_AD0BB7AFBBD5__INCLUDED_)..#define AFX_HTMLHELP_H__CA6ABCFD_0D37_4DC2_A214_AD0BB7AFBBD5__INCLUDED_....#if _MSC_VER > 1000..#pragma once..#endif // _MSC_VER > 1000..// HTMLHelp.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// CHTMLHelp html view....#ifndef __AFXEXT_H__..#include <afxext.h>..#endif..#include <afxhtml.h>....class CHTMLHelp : public CHtmlView..{..public:...CHTMLHelp(); // protected constructor used by dynamic creation...DECLARE_DYNCREATE(CHTMLHelp)....// html Data..public:...//{{AFX_DATA(CHTMLHelp)....// NOTE: the ClassWizard will add data members here...//}}AFX_DATA....// Attributes..public:....// Operations..public:....// Overrides...// ClassWizard generated virtual function overrides...//{{AFX_VIRTUAL(CHTMLHelp)...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..public:...virtual

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\HTTrackInterface.c (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):4942
    Entropy (8bit):5.059134068643704
    Encrypted:false
    SSDEEP:96:JFrDTWFTWUnva3BaHmDg0Gvypoj1u0o8+W3BwDttj/9FbUnESsy4K1L:JFrDTW9WivaxaHCg5vypk1uO1xQF9Fbg
    MD5:4490040B14E60BCA5C06D2023A88B125
    SHA1:B8C3F0C54EC28E2D97162430AE9E96C2B71A9EBF
    SHA-256:CD75E6CFE49AD759F7C946D4408A89EDF268F1265BD46AC2568339AA32E4354F
    SHA-512:F0FA57405D103056E17244FA5154057765624E041CD4A06E0D1F47A06E97FB38F7C3544610DE8012E9C10749FE7C22DC9C9C560FB446F7D26E274F1375479C8C
    Malicious:false
    Preview:/* ------------------------------------------------------------ */../*..HTTrack Website Copier, Offline Browser for Windows and Unix..Copyright (C) Xavier Roche and other contributors....This program is free software; you can redistribute it and/or..modify it under the terms of the GNU General Public License..as published by the Free Software Foundation; either version 3..of the License, or any later version.....This program is distributed in the hope that it will be useful,..but WITHOUT ANY WARRANTY; without even the implied warranty of..MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the..GNU General Public License for more details.....You should have received a copy of the GNU General Public License..along with this program; if not, write to the Free Software..Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.......Important notes:....- We hereby ask people using this source NOT to use it in purpose of grabbing..emails addresses, or collecting any

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\HTTrackInterface.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):965
    Entropy (8bit):5.078763920482896
    Encrypted:false
    SSDEEP:24:O0uCoeIZJNBJjPlhl8l9olrhcRhckhcSahc/cIRvdlaMCFe+TR5qsxp:iJRb2stc7EAlahs+N8Up
    MD5:FF19F42E2BAED42E1CBC2F667A206E66
    SHA1:08D949FC52247568986861197126DCD6A9EB33A3
    SHA-256:48A3BAE5B17708BA201652B7CA6C82B2BAA2C2C890FFFC88AD656604781EE539
    SHA-512:33F8189DEAED075FF30D4944EA6880384CEA4EC84EB5968EAFCE005DDDB980F06F6CD12E91A6D5C09BDF4672E641EF0CB7EF5D8560DCBDA71FDE749EB3656626
    Malicious:false
    Preview:..#include <stdio.h>..#include <stdlib.h>..#include <string.h>..#include <assert.h>..#include <sys/types.h>....#include "httrack-library.h"../**/..//#include "htsglobal.h"..//#include "htsbase.h"..#include "htsopt.h"..#include "htsdefines.h"..#include "htsstrings.h"..#include "htssafe.h"....extern int linput(FILE* fp,char* s,int max);..extern int linput_trim(FILE* fp,char* s,int max);..extern int linput_cpp(FILE* fp,char* s,int max);..extern void rawlinput(FILE* fp,char* s,int max);..extern int binput(char* buff,char* s,int max);..extern int fexist(const char* s);..extern size_t fsize(const char* s);..extern TStamp time_local(void);....extern char* convtolower(char* catbuff,const char* a);..extern void hts_lowcase(char* s);....extern char* next_token(char* p,int flag);....// Engine internal variables..extern HTSEXT_API hts_stat_struct HTS_STAT;..extern int _DEBUG_HEAD;..extern FILE* ioinfo;....// various..#define copychar(a) concat(catbuff,(a),NULL)..

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\HtmlCtrl.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2694
    Entropy (8bit):5.343689658705698
    Encrypted:false
    SSDEEP:48:cuE9daLRbJ+QezubEOHNINJ+MFpZ1lJMdQf/ePr:cuEKLRFvez/UNINJ+MbZ1J/gr
    MD5:C47FC56394BE4B26940D2AB2498CA8FF
    SHA1:4747EF36DB1CC024AE76D5DBE6EAA543DDF7C264
    SHA-256:B25BA8FC54B2941378E36D0FD608944843DFD63BBAACECE044B6818E56D228B0
    SHA-512:1313894D37C5D81D9B3D6C37055BEC433C6FC98E419E45A7F5EC289D5AC67D0164BF4E6D4A04E6A6D7EEF0476726D65C97A2C761D776DBF19684E3308C10FE75
    Malicious:false
    Preview:////////////////////////////////////////////////////////////////..// Microsoft Systems Journal -- December 1999..// If this code works, it was written by Paul DiLascia...// If not, I don't know who wrote it...// Compiles with Visual C++ 6.0, runs on Windows 98 and probably NT too...//..#include "StdAfx.h"..#include "HtmlCtrl.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....IMPLEMENT_DYNAMIC(CHtmlCtrl, CHtmlView)..BEGIN_MESSAGE_MAP(CHtmlCtrl, CHtmlView)...ON_WM_DESTROY()...ON_WM_MOUSEACTIVATE()..END_MESSAGE_MAP()....//////////////////..// Create control in same position as an existing static control with..// the same ID (could be any kind of control, really)..//..BOOL CHtmlCtrl::CreateFromStatic(UINT nID, CWnd* pParent)..{...CStatic wndStatic;...if (!wndStatic.SubclassDlgItem(nID, pParent))....return FALSE;.....// Get static control rect, convert to parent's client coords....CRect rc;...wndStatic.GetWindowRect(&rc);...pParent->

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\HtmlCtrl.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1243
    Entropy (8bit):5.316503142019803
    Encrypted:false
    SSDEEP:24:cEvE9/RzaLRQSIG2QvezKgU5O9U6gysMIEH+BVXd6KGXv5jo1akPVk9xr:cuE9daLRzfezaOlgyiEM6tXBM1aWi
    MD5:2C637CD183F3E3631F9E84443EDF7DAB
    SHA1:03478CE703AF2D448372C126DC37FE86B6A65877
    SHA-256:1013B23577CB09650D1DCC2F7C814CCDBC222D030526F10086BA587640634EBD
    SHA-512:2A3192C7DA15285D8FDE87B2E2B46D7DEB4278F5E9CF6F734409B1903B4BAB916CA6C0DE5F93B1C66443B6743152C5020F7BF74422E3489CEE6658CF6A3D8C19
    Malicious:false
    Preview:////////////////////////////////////////////////////////////////..// Microsoft Systems Journal -- December 1999..// If this code works, it was written by Paul DiLascia...// If not, I don't know who wrote it...// Compiles with Visual C++ 6.0, runs on Windows 98 and probably NT too...//....#include <afxhtml.h>....class CHtmlCtrl : public CHtmlView {..public:...CHtmlCtrl() { }...~CHtmlCtrl() { }.....BOOL CreateFromStatic(UINT nID, CWnd* pParent);.....// Normally, CHtmlView destroys itself in PostNcDestroy,...// but we don't want to do that for a control since a control...// is usually implemented as a stack object in a dialog....//...virtual void PostNcDestroy() { }.....// overrides to bypass MFC doc/view frame dependencies...afx_msg void OnDestroy();...afx_msg int OnMouseActivate(CWnd* pDesktopWnd, UINT nHitTest, UINT msg);.....// override to trap "app:" pseudo protocol...virtual void OnBeforeNavigate2( LPCTSTR lpszURL,....DWORD nFlags,....LPCTSTR lpszTargetFrameName,....CByteArray& ba

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\HtmlFrm.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):3137
    Entropy (8bit):5.657314644449639
    Encrypted:false
    SSDEEP:48:u+pNuwezguAzOphUFxnyXR1xZBKs/r4rInSU8XKlQW1KMGUAob5p:TNuwezgOphyxyh9b5qKlQ8LTLn
    MD5:3F8E3EC4F591EF25E5F0F7CFEAADB10E
    SHA1:010966474D89A8F3761357934D3F54ABD22EFC6E
    SHA-256:6FFD31D3913FDD60E6B48A83B51B6DDDACF667E0D5C030B320B71F68AFCBA042
    SHA-512:EAFE69A5ED15B4C8681FC2AADDD7769E68D9858692C539D6012D3AE232F8FB67B4DD8263127AEFB26B795236EBCF16A945496B017435507EFEA15307C3FC568F
    Malicious:false
    Preview:// mainfrm.cpp : implementation of the CHtmlFrame class..//......#include "stdafx.h"..#include "htmlfrm.h"..#include "resource.h"....#include "HTMLHelp.h"......IMPLEMENT_DYNCREATE(CHtmlFrame, CMDIFrameWnd)..BEGIN_MESSAGE_MAP(CHtmlFrame, CMDIFrameWnd)...//{{AFX_MSG_MAP(CHtmlFrame)...ON_WM_CREATE()...//}}AFX_MSG_MAP..END_MESSAGE_MAP()....static UINT BASED_CODE buttons[] =..{...// same order as in the bitmap 'toolbar.bmp'...ID_FILE_NEW, ID_FILE_OPEN, ID_FILE_SAVE, 0,...ID_EDIT_CUT, ID_EDIT_COPY, ID_EDIT_PASTE, 0,...ID_FILE_PRINT, ID_APP_ABOUT,..};....static UINT BASED_CODE indicators[] =..{...0, ID_INDICATOR_CAPS, ID_INDICATOR_NUM, ID_INDICATOR_SCRL,..};....int CHtmlFrame::OnCreate(LPCREATESTRUCT lpCreateStruct)..{...if (CMDIFrameWnd::OnCreate(lpCreateStruct) == -1)....return -1;.... /*...if (!m_wndToolBar.CreateEx(this, TBSTYLE_FLAT, WS_CHILD | WS_VISIBLE | CBRS_TOP....| CBRS_GRIPPER | CBRS_TOOLTIPS | CBRS_FLYBY | CBRS_SIZE_DYNAMIC) ||....!m_wndToolBar.LoadToolBar(IDR_HELPFRM))...{....T

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\HtmlFrm.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):951
    Entropy (8bit):5.0289849434344545
    Encrypted:false
    SSDEEP:24:uKhfJDDt2SofJ7zT0v7fJSzUzCKS3QkJv5INLvM/kP:uifJDDkhfJ7kv7fJH65INjCW
    MD5:7756190569D66F6EB866780C270F5C6A
    SHA1:C6EF534FCACDF0284C8DFDADCA644E0A7FDF1BCB
    SHA-256:7DC645B13189AD47962F310B6E4767F8CBF315BFF0D40A14B26755BBAADDC2ED
    SHA-512:74F625C7418F1A00BC5B1E6633ABA2EA03231A8F1C42F48AEED5D64AF4F7E50631F1788A85F3DD496E26BABFC0E78136040AA17FC3252AD6148E5D57F1098A02
    Malicious:false
    Preview:// mainfrm.h : interface of the CHtmlFrame class..//..// This is a part of the Microsoft Foundation Classes C++ library...// Copyright (C) 1992-1998 Microsoft Corporation..// All rights reserved...//..// This source code is only intended as a supplement to the..// Microsoft Foundation Classes Reference and related..// electronic documentation provided with the library...// See these sources for detailed information regarding the..// Microsoft Foundation Classes product.........#ifndef __AFXEXT_H__..#include <afxext.h> // for access to CToolBar and CStatusBar..#endif....class CHtmlFrame : public CMDIFrameWnd..{...DECLARE_DYNCREATE(CHtmlFrame)....protected:...CStatusBar m_wndStatusBar;..//.CToolBar m_wndToolBar;....protected:...//{{AFX_MSG(CHtmlFrame)...afx_msg int OnCreate(LPCREATESTRUCT lpCreateStruct);...//}}AFX_MSG...DECLARE_MESSAGE_MAP()..};..../////////////////////////////////////////////////////////////////////////////..

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\InfoUrl.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):7945
    Entropy (8bit):5.286062180014344
    Encrypted:false
    SSDEEP:192:Z8Tmr6i6aIllwv+r2MfBznV4qgf7wOnlGNIcUh4LlGfs8a91:YZvaIlhNXNIcqu78a91
    MD5:4A10A87AB915DE74C112BCAAB8A6C92C
    SHA1:C088CE2A2225B46B3495BABFBC40DBCFE3E0EE86
    SHA-256:FE7C4E9D2C64925CA71D3C23AD144722169790C699121824BB99B6A00CCF69AB
    SHA-512:9A85939866C231968B3FBDD77D7F9B3060A88C15940D830EF3ED407648F88A2583C1CE890A3752ECCC2D52D5EA997CA3B48A21D8AE9954286844085854093CF2
    Malicious:false
    Preview:// InfoUrl.cpp : implementation file..//....#include "stdafx.h"..../* Externe C */..#include <WS2tcpip.h> // Note: weird C2894 error if not included here..extern "C" {.. #include "HTTrackInterface.h".. #include "htscore.h"..}....#include "Shell.h"..#include "InfoUrl.h"..#include "NewLang.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....extern HICON httrack_icon;..../////////////////////////////////////////////////////////////////////////////..// CInfoUrl dialog......CInfoUrl::CInfoUrl(CWnd* pParent /*=NULL*/)...: CDialog(CInfoUrl::IDD, pParent)..{...//{{AFX_DATA_INIT(CInfoUrl)....// NOTE: the ClassWizard will add member initialization here...//}}AFX_DATA_INIT..}......void CInfoUrl::DoDataExchange(CDataExchange* pDX)..{...CDialog::DoDataExchange(pDX);...//{{AFX_DATA_MAP(CInfoUrl)...DDX_Control(pDX, IDC_backlist, m_ctl_backlist);...DDX_Control(pDX, IDC_slider, m_slider);...//}}AFX_DATA_MAP..}......BEGIN_MESSAGE_MAP(CInfoUrl,

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\InfoUrl.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1574
    Entropy (8bit):5.515640357190352
    Encrypted:false
    SSDEEP:24:5bGb8alwFKoMSKvE2Ay3wN10rwm4cIWzRuwHGUKa4RiarpskDPUjJ7U82b0:5qhmR2RPwmqWTx349r+8PYl72I
    MD5:DE02A5988373ED8A2CEB6F5AA1E3D6DB
    SHA1:8BD126537F097E31F8FD04606B5DFDD73659F187
    SHA-256:509140FA7174623B5E205B42D084C9179EF1F346F13FCBF6DEA9113EB886CE72
    SHA-512:CD652FDBAC5AC1CE57F00B33D83629B4C79EC5433EAD7DA905D80681E1E96B23DB0AA0CBBD73A004E831B5C119699F73B0C2A831A0397A9861F7A762F5A088B4
    Malicious:false
    Preview:#if !defined(AFX_INFOURL_H__FF725966_B6BB_11D3_A2B3_0000E84E7CA1__INCLUDED_)..#define AFX_INFOURL_H__FF725966_B6BB_11D3_A2B3_0000E84E7CA1__INCLUDED_....#if _MSC_VER > 1000..#pragma once..#endif // _MSC_VER > 1000..// InfoUrl.h : header file..//....extern int termine;..extern void* StatsBufferback;..//extern lien_back* back;..extern int StatsBufferback_max;..../////////////////////////////////////////////////////////////////////////////..// CInfoUrl dialog....class CInfoUrl : public CDialog..{..// Construction..public:...CInfoUrl(CWnd* pParent = NULL); // standard constructor.. int id;..// Dialog Data...//{{AFX_DATA(CInfoUrl)...enum { IDD = IDD_InfoUrl };...CComboBox.m_ctl_backlist;...CProgressCtrl.m_slider;...//}}AFX_DATA......// Overrides...// ClassWizard generated virtual function overrides...//{{AFX_VIRTUAL(CInfoUrl)...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protected:.. UINT_PTR timer;.. void S

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\Infoend.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):7760
    Entropy (8bit):5.577528200387364
    Encrypted:false
    SSDEEP:192:WlIPhqwFDkkyasOtc94NolfpCCwMnHXPfT:aIPZDkkyaNtcCNoppCCw0/fT
    MD5:73B76A480C8BF612643C9C82DD1121C2
    SHA1:833855838E7E32A0B12104B3121908A3254B2C8A
    SHA-256:6DB2771A5B29123398F5E95583538466EDD52270953570DC25E525D28B349D35
    SHA-512:BA2D3691ED80D6421FC67D64D0D23FB48F9F734D3B8290105EDC012F44AA1833EC9E5F1B48DA0B567F1FB8594AB0E676093C0B22D64F9A7B730ED478D7751FA0
    Malicious:false
    Preview:// infoend.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "infoend.h"..#include "iplog.h"..#include "NewProj.h"....extern CNewProj* dialog0;..extern "C" {.. #include "HTTrackInterface.h".. //#include "htsbase.h".. HTS_INLINE int fspc(FILE* fp,const char* type);..}....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..extern HICON httrack_icon;....#include "winhttrack.h"..extern CWinHTTrackApp* this_app;....#include "inprogress.h"..extern Cinprogress* inprogress;..../* Externe C */..extern "C" {.. #include "HTTrackInterface.h"..};....// Helper..extern LaunchHelp* HtsHelper;..../* Main splitter frame */..#include "DialogContainer.h"..#include "splitter.h"..extern CSplitterFrame* this_CSplitterFrame;..../* Main WizTab frame */..#include "WizTab.h"..extern CWizTab* this_CWizTab;..extern CWizTab* this_intCWizTab2;..../* Objet lui m.me */..Cinfoend* this_Cinfoend=NULL;....///////////////////////////////

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\InsertUrl.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):6288
    Entropy (8bit):5.443731466101032
    Encrypted:false
    SSDEEP:96:Bx0Qv0TEhkHrBvByBRHM1BFBRBoBDBUaZV994TjgjZcgfqPo5CSU78zJEmydWVUD:r0fBdU/s17LelWqn94bgfqPo5F9EDuy
    MD5:C84983491EEF47668FF11C507C076EC6
    SHA1:7A4222F58695FF09B899B2A0FA288F508222C893
    SHA-256:5F52DCA0E0E8547B7AC4374F2708839E192BA6AC494261DED5DA8413AA3ED385
    SHA-512:DFA19E101DCAF63D16D5C4CAC6344F7BA82BD86CD3F28D64FA6947DB0C5E2267FFE8882A6F21BF976635A60060A2AE81FEA2633CE47E90BA801998D0525CD037
    Malicious:false
    Preview:// InsertUrl.cpp : implementation file..//....#include "stdafx.h"....// Note: weird C2894 error if not included here..#include <ws2tcpip.h>.#include <Wspiapi.h>.extern "C" {.. #include "HTTrackInterface.h".. //#include "htsglobal.h".. //#include "htsbase.h".. //#include "htslib.h"..}..//#include "winsock2.h"....#include "Shell.h"..#include "InsertUrl.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....extern HICON httrack_icon;....// Helper..extern LaunchHelp* HtsHelper;....../////////////////////////////////////////////////////////////////////////////..// CInsertUrl dialog......CInsertUrl::CInsertUrl(CWnd* pParent /*=NULL*/)...: CDialog(CInsertUrl::IDD, pParent)..{...//{{AFX_DATA_INIT(CInsertUrl)...m_urllogin = _T("");...m_urlpass = _T("");...m_urladr = _T("");...//}}AFX_DATA_INIT..}......void CInsertUrl::DoDataExchange(CDataExchange* pDX)..{...CDialog::DoDataExchange(pDX);...//{{AFX_DATA_MAP(CInsertUrl)...DDX_Text(pDX, IDC_

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\InsertUrl.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):1834
    Entropy (8bit):5.533129863793972
    Encrypted:false
    SSDEEP:24:CTTTjWlrke1ukw8SwI5nN3EZAyafnSopCYC4cIWz8uwHGUKaDiVW0HMQhtkDVJ7Q:7JkOifxmZ0fnDfCqWwx3IW0sQj8Vl78
    MD5:8D5504596DD9BD73F02F15AF875C6773
    SHA1:FC1262C1B1A74120FFCD89277794AD9AB090D519
    SHA-256:DD6AB1BE96BF9F2D8D456CAA7E64125A290BAA2E8155F8174AFB1E2EF737834D
    SHA-512:8B4C2F1F570AFC2C7D6F7CC6DF01DAA2AF98928C90CB2D929C8ED6D6877D7D383E17401B92DB6CB0FC4786AB96437678C09102B3C6D5E546B8733616553C53D6
    Malicious:false
    Preview:#if !defined(AFX_INSERTURL_H__2A8B8FE2_952E_11D3_A2B3_0000E84E7CA1__INCLUDED_)..#define AFX_INSERTURL_H__2A8B8FE2_952E_11D3_A2B3_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// InsertUrl.h : header file..//....// Attention, d.finition existante .galement dans htslib.h..// (. modifier avec celle-ci)..#define POSTTOK "?>post"..../* Externe C */..extern "C" {.. #include "htscatchurl.h"..}..extern "C" {.. #include "HTTrackInterface.h"...#include "httrack-library.h"..}....#include "CatchUrl.h"..../////////////////////////////////////////////////////////////////////////////..// CInsertUrl dialog....class CInsertUrl : public CDialog..{..// Construction..public:...CInsertUrl(CWnd* pParent = NULL); // standard constructor.. char* GetTip(int id);.. //.. CString dest_path;.. //.. CCatchUrl dial;.. T_SOC soc;.. char adr_prox[1024];.. int port_prox;....// Dialog Data...//{{AFX_DATA(CInsertUrl)...enum { IDD = IDD_InsertUrl };...CString.m_urll

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\Iplog.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):9564
    Entropy (8bit):5.355400751916496
    Encrypted:false
    SSDEEP:192:RLvCMcfajWBYioecAxx2GFQBP9BKVzNSw945Pfd45OduRih:RLXjWBYiodYAMQBP9BrwC5XcOdB
    MD5:0DC352326CF733EEE07048ECE5DC2058
    SHA1:09105F11C04116CB9B9F9D4B2F93D1B0F315FB8E
    SHA-256:BAE7984D0FA8ADBA3642C8BB4287AF4CF5DCDD9377BFE9C09B2E84483F739413
    SHA-512:25C17AB86D189E8293F77BD6227E3BD61B51D0BBA60197688E14F773F62BD1D8494C8F12224FAABD3B5455D9822D916E3642118BD6D8F611FE7AEB38D5014849
    Malicious:false
    Preview:// iplog.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "iplog.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....extern "C" {.. #include "HTTrackInterface.h"..}..extern HICON httrack_icon;....// Helper..extern LaunchHelp* HtsHelper;....#define LOW_MARK 127000..#define HIGH_MARK 128000..../////////////////////////////////////////////////////////////////////////////..// Ciplog dialog......Ciplog::Ciplog(CWnd* pParent /*=NULL*/)...: CDialog(Ciplog::IDD, pParent)..{.. timer=0;.. txt="\n";.. type=-1;.. type_filter=0;.. filter=0;...//{{AFX_DATA_INIT(Ciplog)...m_iplog = _T("");...//}}AFX_DATA_INIT..}......void Ciplog::DoDataExchange(CDataExchange* pDX)..{...CDialog::DoDataExchange(pDX);...//{{AFX_DATA_MAP(Ciplog)...DDX_Control(pDX, IDC_HIDEINFO, m_ctl_hideinfo);...DDX_Control(pDX, IDC_log, m_ctl_iplog);...DDX_Text(pDX, IDC_log, m_iplog);...//}}AFX_DATA_MAP..}......// typedef void (AFX_MSG_CALL

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\Iplog.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1981
    Entropy (8bit):5.531621318471066
    Encrypted:false
    SSDEEP:48:eYaYUfBZjCcHw2lhqWHx3LfYWqro0sgrUj8Vl7HY9:eL9vCLwdcLjr7Vl7Ho
    MD5:2F6A87B9B86F27D6247DE47FB381EDA9
    SHA1:56DB3A4AEB5945B50368B2A8052CB0CE4C53B82C
    SHA-256:56C23F7BEF4C841941756CF0C0432D0EEB386DD4B32D3CEA0CDBEE76548BE9FC
    SHA-512:D1B9EEABA9195101875F970335766E355C23EA9B90571A815A0BA0BB840AEBF197D1B9AF701BFEF6CB0BE39B300748644A8D296B74E3F60C4DADF25AB25E8B9F
    Malicious:false
    Preview:#if !defined(AFX_IPLOG_H__D416CFE1_8966_11D2_A2B1_0000E84E7CA1__INCLUDED_)..#define AFX_IPLOG_H__D416CFE1_8966_11D2_A2B1_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// iplog.h : header file..//..../* basic HTTrack defs */..extern "C" {..#include "htsglobal.h"..}..../////////////////////////////////////////////////////////////////////////////..// Ciplog dialog....class Ciplog : public CDialog..{..// Construction..public:...Ciplog(CWnd* pParent = NULL); // standard constructor.. char pathlog[HTS_URLMAXSIZE*2];.. int type_log;.. int type_filter;..private:.. FILE* fp;.. int wait_me;.. int type;.. int filter;.. CString txt;....public:..// Dialog Data...//{{AFX_DATA(Ciplog)...enum { IDD = IDD_iplog };...CComboBox.m_ctl_hideinfo;...CEdit.m_ctl_iplog;...CString.m_iplog;...//}}AFX_DATA......// Overrides...// ClassWizard generated virtual function overrides...//{{AFX_VIRTUAL(Ciplog)...public:...virtual BOOL DestroyWindow();...protected:...

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\LaunchHelp.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1062
    Entropy (8bit):5.334905242154601
    Encrypted:false
    SSDEEP:24:9Whr7pl2alplZaocbniHn5eAY7a9dR7D2Knv7JBApIEvfaxeyUQ8qeOrqd/KV7g6:GpJb/n7D2Kv7J+ISddqwu7gBYd5
    MD5:871819840BD7407CAA5FC2175264C743
    SHA1:7B73FA015CDCE25EFBD2200593D5061BEFE3ABF9
    SHA-256:8B9389F0FE1ACC4702BD372621EE3694749CDA774A81EDF2AB788CC10F5BB576
    SHA-512:0286D45DF66C62D7C67DB9C679404036FD73C3037960724267057BDF6575EB6D1E7E004C23D84567F680B2FF10230AFCADDE6F131365FA2F55C1F0048D217A0D
    Malicious:false
    Preview:// LaunchHelp.cpp : implementation file..//....#define VIEW_HELP 0....#include "stdafx.h"..#include "LaunchHelp.h"..#include "DialogHtmlHelp.h"..#include "process.h"....#if VIEW_HELP..#include "htmlfrm.h"..#endif....LaunchHelp::LaunchHelp() {.. page="";..}..LaunchHelp::~LaunchHelp() {.. if (b.m_hWnd) {.. b.EndDialog(IDCANCEL);.. }..}....void LaunchHelp::Help(CString page) {..#if VIEW_HELP..#else.. if (!b).. this->page=page;.. else {.. if (b.m_hWnd).. this->b.Go(page);.. else.. this->page=page;.. }..#endif.. GoHelp();..}....void LaunchHelp::Help() {.. Help("index.html");..}.. ..void LaunchHelp::GoHelp() {..#if VIEW_HELP.. CHtmlFrame* frm=new CHtmlFrame;...if (!frm->LoadFrame(IDR_HELPFRM))....return;.. frm->ShowWindow(SW_SHOWNORMAL);...frm->UpdateWindow();..#else.. if (!b.m_hWnd) {.. b.page=page;.. RECT rect;.. rect.bottom=rect.left=rect.right=rect.top=0;.. b.Create(NULL,NULL,WS_OVERLAPPEDWINDOW,rect,NULL,0);.. b.ShowWindow(SW_SHOWNORMAL);

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\LaunchHelp.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):441
    Entropy (8bit):5.380542547334683
    Encrypted:false
    SSDEEP:12:mhD01TmD01IAoQClAQE4OopCQFv9B5bne5cunPieDQXny71miA:gD01TmD01I7plMoHvD5bne5HnPjDQX4+
    MD5:F4EB01B5EAE4E8A79B48F3C63A1D72C6
    SHA1:D2461F614E0885F7522D2BF40AA9C4E6D9902512
    SHA-256:27A84977DD790B132288D25405F780488E5947DD2B3D53F6B645E0D01D9E18C2
    SHA-512:02FBEBA2A6455F53C2F7545A35561F3E8C66457D16D14D53F23FC34647509AC18CD9F5EC0565BB448616A6DADA29BDC05681FBC6BD4ECB63D119636DCC02C8BC
    Malicious:false
    Preview:..#if !defined(LAUNCHHELP_HGDHDGCJHHFIJKCHSOZIOJC5448545245451)..#define LAUNCHHELP_HGDHDGCJHHFIJKCHSOZIOJC5448545245451....#include "stdafx.h"..#include "DialogHtmlHelp.h"..//UINT RunBackHelp( LPVOID pP );....// Lancer aide..class LaunchHelp {..public:.. LaunchHelp::LaunchHelp();.. LaunchHelp::~LaunchHelp();.. void Help();.. void Help(CString page);.. CDialogHtmlHelp b;.. CString page;..private:.. void GoHelp();..};....#endif....

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\MainFrm.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):4071
    Entropy (8bit):5.631795857868612
    Encrypted:false
    SSDEEP:96:nluIyFkzgO1hyxyhhEqKlQ8LTLFAbtqKs5Jc:SFU5jmlQ8vxAbtP1
    MD5:FA99DF4A6014731A6024CEEF68F29195
    SHA1:0D8379B3F676C39112D526BD4AD9CD63FE5416EF
    SHA-256:DBCA18D0EFBC2CAFD919D3D000CF127A3438034C8520A08398A11BC8935A8BDC
    SHA-512:F741209455BAAEFED81395F998B570A7EA7520B7B3A5F53812DC12E36944BE1EA0BC25D0C5B9CEA5EB524F1517238873E33D47AE365E831BC2A376486744A40D
    Malicious:false
    Preview:// mainfrm.cpp : implementation of the CMainFrame class..//......#include "stdafx.h"..#include "mainfrm.h"..#include "resource.h"..#include "Shell.h"......IMPLEMENT_DYNCREATE(CMainFrame, CMDIFrameWnd)..BEGIN_MESSAGE_MAP(CMainFrame, CMDIFrameWnd)...//{{AFX_MSG_MAP(CMainFrame)...ON_WM_CREATE()...ON_WM_CLOSE()...//}}AFX_MSG_MAP..END_MESSAGE_MAP()....static UINT BASED_CODE buttons[] =..{...// same order as in the bitmap 'toolbar.bmp'...ID_FILE_NEW, ID_FILE_OPEN, ID_FILE_SAVE, 0,...ID_EDIT_CUT, ID_EDIT_COPY, ID_EDIT_PASTE, 0,...ID_FILE_PRINT, ID_APP_ABOUT,..};....static UINT BASED_CODE indicators[] =..{...0, ID_INDICATOR_CAPS, ID_INDICATOR_NUM, ID_INDICATOR_SCRL,..};....int CMainFrame::OnCreate(LPCREATESTRUCT lpCreateStruct)..{...if (CMDIFrameWnd::OnCreate(lpCreateStruct) == -1)....return -1;..../*...if (!m_wndToolBar.CreateEx(this, TBSTYLE_FLAT, WS_CHILD | WS_VISIBLE | CBRS_TOP....| CBRS_GRIPPER | CBRS_TOOLTIPS | CBRS_FLYBY | CBRS_SIZE_DYNAMIC) ||....!m_wndToolBar.LoadToolBar(IDR_MAINFRAME

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\MainFrm.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1038
    Entropy (8bit):5.08831605056832
    Encrypted:false
    SSDEEP:24:umfJDDt2SofJ7zT0v7fJSzUzCT3QkZymv0INnMxkP:umfJDDkhfJ7kv7fJvSy2NnUW
    MD5:56A04B1CDB4326404506C349F90C2C1E
    SHA1:1347DBCB4EA3B98C6996611CEE06E486D7746CC3
    SHA-256:9B6372B6FCCF852904C8A10B3799C2713BDE2DDC88451EF37F483DAD2489FA18
    SHA-512:6F4334F34C63DA9FDE7EA4C6525797E6A04C0D4B645DBC05F16471371E8DEFAB8AB3735157C231D3534702B6C39E99E24BD67072A0742483CAB480C2BAF28CC1
    Malicious:false
    Preview:// mainfrm.h : interface of the CMainFrame class..//..// This is a part of the Microsoft Foundation Classes C++ library...// Copyright (C) 1992-1998 Microsoft Corporation..// All rights reserved...//..// This source code is only intended as a supplement to the..// Microsoft Foundation Classes Reference and related..// electronic documentation provided with the library...// See these sources for detailed information regarding the..// Microsoft Foundation Classes product.........#ifndef __AFXEXT_H__..#include <afxext.h> // for access to CToolBar and CStatusBar..#endif....class CMainFrame : public CMDIFrameWnd..{...DECLARE_DYNCREATE(CMainFrame)....public:...void InitialShowWindow(UINT nCmdShow);....public:..//protected:...CStatusBar m_wndStatusBar;...CToolBar m_wndToolBar;....protected:...//{{AFX_MSG(CMainFrame)...afx_msg int OnCreate(LPCREATESTRUCT lpCreateStruct);...afx_msg void OnClose();...//}}AFX_MSG...DECLARE_MESSAGE_MAP()..};..../////////////////////////////////////////

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\MainTab.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):7982
    Entropy (8bit):5.47156103482403
    Encrypted:false
    SSDEEP:192:K/ehSQQ4QyU/bh6g2h1fvCz0KoSP9etYyTpLdXK6yE9P0NnFW6i9+D:K/ecQQ4QRbh6g2C9iTpLdXK6yE9P0NZ/
    MD5:519FDE5F80F88A43CD080607A52DDAF3
    SHA1:725DA548374C491FD5AF70E80ED0E9163ECC1C96
    SHA-256:4FDB653B99E5B09A5E719F877142EC50287178E8F6523BDBE54207DFC093A55E
    SHA-512:9AFAC68B4F752428E29CC8E04BBE82668F0894969710A3C5544768BECEBD006D0B5585D863D74A123E6AE19D1371DF67AEF9350B4788577F066E3B811FC6E442
    Malicious:false
    Preview:// Tab Control Principal....#include "stdafx.h"..#include "Shell.h"..#include "Maintab.h"..#include "direct.h"....#include "winsvc.h "....#include "windows.h"..#include <stdio.h>..#include <stdlib.h>..#include <string.h>....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....// Icone HTTrack..extern HICON httrack_icon;....// Helper..extern LaunchHelp* HtsHelper;....../////////////////////////////////////////////////////////////////////////////..// CMainTab....//IMPLEMENT_DYNAMIC(CMainTab, CPropertySheet)....//HINSTANCE hInst = NULL;..//SC_HANDLE hSCMan = NULL;......CMainTab::CMainTab(UINT nIDCaption, CWnd* pParentWnd, UINT iSelectPage)..:CPropertySheet(nIDCaption, pParentWnd, iSelectPage)..{.. AddControlPages();..}....CMainTab::CMainTab(LPCTSTR pszCaption, CWnd* pParentWnd, UINT iSelectPage)..:CPropertySheet(pszCaption, pParentWnd, iSelectPage)..{.. AddControlPages();..}....CMainTab::~CMainTab()..{..}....void CMainTab::AddControlPage

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\MainTab.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):2547
    Entropy (8bit):5.39400043494377
    Encrypted:false
    SSDEEP:48:u4ft1tt1R0wlFlSlnlEl8VMl2lrlIlylg4LzopPopz+o6BMtTG2UXQK5pPh/whMS:uotbt93UVi+mAReEq4Lzohod76Bgy2FR
    MD5:E5F9EFE4C9716D196AC17F0F73BC6FB7
    SHA1:9B7781FB63BE28550F0EC9D35F7A816B7E9E4305
    SHA-256:8994E1E0EE667172A8CBE6FAA32E1C157AC38C65749BAFF05E24403AB280A5B4
    SHA-512:E3DD77549EF05366D252047E6745496B2724EE9D02F6C2B7BD3DEF8EB9E4E069E25D3ABF6AB905F1537A37130CDB46634B32119C1FD0322E3CF9F0D67FE292CE
    Malicious:false
    Preview:#if !defined(__MAINTAB_H_HSGFYZEGCHXHVCHD52485454857545)..#define __MAINTAB_H_HSGFYZEGCHXHVCHD52485454857545....// Tab Control Principal....// En-t.te pour l'affichage des tabs..#include "OptionTab1.h"..#include "OptionTab2.h"..#include "OptionTab3.h"..#include "OptionTab4.h"..#include "OptionTab5.h"..#include "OptionTab6.h"..#include "OptionTab7.h"..#include "OptionTab8.h"..#include "OptionTab9.h"..#include "OptionTab10.h"..#include "OptionTab11.h"....class CMainTab : public CPropertySheet..{.. //DECLARE_DYNAMIC(CMainTab).. ..private:.. .. // Construction..public:.. CMainTab(UINT nIDCaption, CWnd* pParentWnd = NULL, UINT iSelectPage = 0);.. CMainTab(LPCTSTR pszCaption, CWnd* pParentWnd = NULL, UINT iSelectPage = 0);.. ..protected:.. void AddControlPages(void);.. .. // Attributes..public:.. // D.claration des classes-dialog pour les diff.rents Tab Control.. COptionTab1 m_option1;.. COptionTab2 m_option2;.. COptionTab3 m_option3;.. COptionTab4

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\MemRegister.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):1302
    Entropy (8bit):4.9291518235277145
    Encrypted:false
    SSDEEP:24:yOmR7plAX1GXfVLwkXfDAKBJNEqzgYVXfiGKBJNEqzEUeVIXf/n64KBJNEqzcEbN:Lmpps1AfZVfDAKBYqzj9fiGKBYqzE1qG
    MD5:396BD837C674CF3B5C49DC177A3044DF
    SHA1:7CBE22732C46F3B176D49D36EFE48627D443B8F0
    SHA-256:5A70E339269FA828C92D0A4EBD69137BE167EE128887FBF60774B511B7440FC3
    SHA-512:C155765398F0D5CBD8D42AAD68C99F49B6C0E4777227A37D0CE9956610337B07BC5E4CBFF4487E297AE7A5FF5E01FEB540259EEEF4F3A627D2BC6FEA0794FF1C
    Malicious:false
    Preview:// Classe de sauvegarde de cl.s (identifi.es par leur nom)..// . la mani.re de la base de registre (mais en plus basique)....#include "stdafx.h"..#include "MemRegister.h"......void MemRegister::deleteAll() {.. Mem_index.RemoveAll();.. Mem_value.RemoveAll();.. Mem_valueint.RemoveAll();..}..CString MemRegister::getString(CString name,CString defval) {.. int i;.. for(i=0;i<Mem_index.GetUpperBound()+1;i++) {.. if (Mem_index[i] == name).. return Mem_value[i];.. }.. return defval;..}..int MemRegister::getInt(CString name,int defval) {.. int i;.. for(i=0;i<Mem_index.GetUpperBound()+1;i++) {.. if (Mem_index[i] == name).. return Mem_valueint[i];.. }.. return defval;..}..bool MemRegister::setString(CString name,CString val) {.. int i;.. for(i=0;i<Mem_index.GetUpperBound()+1;i++) {.. if (Mem_index[i] == name) {.. Mem_value[i]=val;.. return true;.. }.. }.. Mem_index.Add(name);.. Mem_value.SetAtGrow(Mem_index.GetUpperBound(),val);.. return true;..}..

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\MemRegister.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):599
    Entropy (8bit):5.293613965134194
    Encrypted:false
    SSDEEP:12:jfmOcTA+B3/7iGfB23/7iGVJ2X0m4MoMPM8RCALwTLcnRmLcbnQY:yOmB3ziGp23ziGVIXdJJua86nQY
    MD5:65935CC5C60447C5FDFA82F1DB409F76
    SHA1:A1C0CA56225372762B5B3A2943BE7E8B97873D72
    SHA-256:B73445B0308990E2B0F73D3E867D5D84A8161CDDAECD387FB5F09A2040966F3D
    SHA-512:F2703968B51A6D49C40956045797FB54555761F42162FFCC216367778D065007BB25B06061E2E70FEE38AA672F0EED80849397EBD18C19BCDDD706A2F0C9C6F3
    Malicious:false
    Preview:// Classe de sauvegarde de cl.s (identifi.es par leur nom)..// . la mani.re de la base de registre (mais en plus basique)....#if !defined(MEMREGISTER_LIB_JHGFHIV25489654156HJRZDSCIOUJ5648654651)..#define MEMREGISTER_LIB_JHGFHIV25489654156HJRZDSCIOUJ5648654651....class MemRegister..{..private:.. CStringArray Mem_index;.. CStringArray Mem_value;.. CWordArray Mem_valueint;..public:.. void deleteAll();.. CString getString(CString name,CString defval);.. int getInt(CString name,int defval);.. bool setString(CString name,CString val);.. bool setInt(CString name,int val);..};......#endif....

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\NewFolder.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):986
    Entropy (8bit):5.120449934975005
    Encrypted:false
    SSDEEP:12:jLOtDuAoQClAUJlAJe/USh34AF1arYc3j2Nh8b1/fPvFHoXmJ2L3xM+HymPkeu2S:HOJu7plplEe/LhoAF+fT2Wk3m+3PkePQ
    MD5:95C7C8E0179EF2B4628612B1553EDADC
    SHA1:556951DD01F580B669595DB0EB284A05B7CF0FC8
    SHA-256:4ADE6C4539D8E16F1512CA6DD57B676F4F28ACF4EF95DD72828F5BC91D0AAAB6
    SHA-512:5A395A4E3371170E2F788A31EAE3BA7FACCB1CCF28789F6B076DF4C71F6E1B199BBB182318A1484C4194A4D583CFD9F774F6E31102FB8A926D41DB6B7F7C93B6
    Malicious:false
    Preview:// NewFolder.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "NewFolder.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../////////////////////////////////////////////////////////////////////////////..// CNewFolder dialog......CNewFolder::CNewFolder(CWnd* pParent /*=NULL*/)...: CDialog(CNewFolder::IDD, pParent)..{...//{{AFX_DATA_INIT(CNewFolder)...m_folder = _T("");...//}}AFX_DATA_INIT..}......void CNewFolder::DoDataExchange(CDataExchange* pDX)..{...CDialog::DoDataExchange(pDX);...//{{AFX_DATA_MAP(CNewFolder)...DDX_Text(pDX, IDC_Folder, m_folder);...//}}AFX_DATA_MAP..}......BEGIN_MESSAGE_MAP(CNewFolder, CDialog)...//{{AFX_MSG_MAP(CNewFolder)....// NOTE: the ClassWizard will add message map macros here...//}}AFX_MSG_MAP...ON_COMMAND(ID_HELP, OnHelp)..END_MESSAGE_MAP()..../////////////////////////////////////////////////////////////////////////////..// CNewFolder message handlers..

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\NewFolder.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1224
    Entropy (8bit):5.411643957192032
    Encrypted:false
    SSDEEP:24:A9B/Z9B/tClPuoAyWW+m4cIWzMuwHGUKaAiJOFskDVJ7U8T9B/S:8xm9uoUlmqW4x33OFs8Vl7Z8
    MD5:5733779F127F2314DF5D6978AB282E03
    SHA1:2BA326A3E1C38DA22E0FAF3E85CDB8F222C4A1E6
    SHA-256:CA67CEE129D92B986656502C6362393D3FC8ECA4B2DCA0C83F7C5228DDFF42C1
    SHA-512:6B71EA8BCC446B0FF3F61EFC4E0D0AF7A2E35AFEB8FD00D453BE2E2F85A2A09452D5AD373C7A4BA91FD69D125BCCA763D99F7ED2F6AD787F79DD498628DE0297
    Malicious:false
    Preview:#if !defined(AFX_NEWFOLDER_H__FC899FE4_9DCD_11D2_A2B1_0000E84E7CA1__INCLUDED_)..#define AFX_NEWFOLDER_H__FC899FE4_9DCD_11D2_A2B1_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// NewFolder.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// CNewFolder dialog....class CNewFolder : public CDialog..{..// Construction..public:...CNewFolder(CWnd* pParent = NULL); // standard constructor....// Dialog Data...//{{AFX_DATA(CNewFolder)...enum { IDD = IDD_NewFolder };...CString.m_folder;...//}}AFX_DATA......// Overrides...// ClassWizard generated virtual function overrides...//{{AFX_VIRTUAL(CNewFolder)...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protected:.....// Generated message map functions...//{{AFX_MSG(CNewFolder)....// NOTE: the ClassWizard will add member functions here...//}}AFX_MSG...DECLARE_MESSAGE_MAP()..};

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\NewProj.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):16902
    Entropy (8bit):5.443548525885058
    Encrypted:false
    SSDEEP:384:C2eHzNu/2K3C9K+TE6dZt/mLMsCYgTy2b5Y+K9s/Vcw5F/0zTibAfLk30:+zq2K3C9K+TE6dZt/mwaqeV9s/VnczTP
    MD5:3A01460241390F178BC09ECFDA0318E9
    SHA1:FF489317226603BEE440A2E73617A3DE82D71AC1
    SHA-256:50E0919D5A7723A5502AC1E1587C964AEB561BB3ECB609D89125816200860408
    SHA-512:880171274CDAAA1217F767AE8792C4F180ED14BCCB152A4C5099DC90C97A7D33997CC77C30A522C7D71FF4552FAD411B4A77257146DFA8B633C26C63EC3085EC
    Malicious:false
    Preview:// NewProj.cpp : implementation file..//....// pour lecture dir..//#include "kernel32.h"....#include "stdafx.h"..#include "Shell.h"..#include "NewProj.h"..../* Externe C */..#include <WS2tcpip.h> // Note: weird C2894 error if not included here..extern "C" {.. #include "HTTrackInterface.h".. #include "htscore.h"..}....#include "XSHBrowseForFolder.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....extern HICON httrack_icon;..extern CNewProj* dialog0;....// Helper..extern LaunchHelp* HtsHelper;..../* Main WizTab frame */..#include "WizTab.h"..extern CWizTab* this_CWizTab;..../* Main splitter frame */..#include "DialogContainer.h"..#include "splitter.h"..extern CSplitterFrame* this_CSplitterFrame;..../* DirTreeView */..#include "DirTreeView.h"..extern CDirTreeView* this_DirTreeView;..../* reference sur objet Wid1 */..#include "Wid1.h"..extern Wid1* dialog1;..../* shellapp */..extern CShellApp* CShellApp_app;..../* cr.ation struct

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\NewProj.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2312
    Entropy (8bit):5.46184786647678
    Encrypted:false
    SSDEEP:48:r5iFFnJ1E5wbieQE0tqWelx36xfr47tW5q0sQHYcVl7Ar:r5i7HGwycvd62JqhzPVl7Ar
    MD5:77DAB895CC04911233D52E51AD18F46D
    SHA1:D3DA980E9D55BD9A1FC136D7F730235EFC3987E3
    SHA-256:ABF1C794092C50DAB3B51771BC055464111BBC374C3A1E6177A96970352FD730
    SHA-512:79CE866B3341D0659A4671EC6F5D9FBB55823B3FE45209AB7FB5A6CE5F7F816049263BAD33835769407B1D50EF69F2523B0F8D12E4FA226AE3AB9C0907D1D4C6
    Malicious:false
    Preview:#if !defined(AFX_NEWPROJ_H__B87C5B22_80E5_11D3_A2B2_0000E84E7CA1__INCLUDED_)..#define AFX_NEWPROJ_H__B87C5B22_80E5_11D3_A2B2_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// NewProj.h : header file..//......#include "EasyDropTarget.h"..../////////////////////////////////////////////////////////////////////////////..// CNewProj dialog....class CNewProj : public CPropertyPage..{...DECLARE_DYNCREATE(CNewProj).... // Construction..public:...CNewProj(); // standard constructor...~CNewProj(); // standard destructor.. CString GetName(); // nom complet projet.. CString GetPath(); // path complet projet.. CString GetPath0(); // path complet projet sans dernier slash.. CString GetBasePath(); // base path....// Dialog Data...//{{AFX_DATA(CNewProj)...enum { IDD = IDD_NewProj };...CComboBox.m_ctl_projcateg;...CComboBox.m_ctl_projname;...CString.m_proj

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\OptionTab1.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):4376
    Entropy (8bit):5.450590198750292
    Encrypted:false
    SSDEEP:96:IzcHGdxdKLKl2didXD6hBgB6BjBZZVS94TceZAqFp:THGhdrTkmIxNg94v
    MD5:FC6C180BFCEB0E09F7BA7B7913F9A367
    SHA1:D154AF1FEE17A64DC4639DED9382CEB4C7461F26
    SHA-256:D140516BEFD9CDD1953FBEE4FFA4A19BF1BF9B6660A43DE94154F53CF7B3895B
    SHA-512:1AC99A43B6644A0C0E55501AFE319BE0E8174EFFD426CEC602EC63A3859E2808B49FBD2627F539CB85694929AE46E58CEA16EFC8645915F54F8E14D28D8CDD42
    Malicious:false
    Preview:// OptionTab1.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "OptionTab1.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../////////////////////////////////////////////////////////////////////////////..// COptionTab1 property page....IMPLEMENT_DYNCREATE(COptionTab1, CPropertyPage)....COptionTab1::COptionTab1() : CPropertyPage(COptionTab1::IDD)..{.. // Patcher titre.. if (LANG_T(-1)) { // Patcher en fran.ais.. m_psp.pszTitle=LANG(LANG_IOPT1); // titre.. m_psp.dwFlags|=PSP_USETITLE;.. }.. m_psp.dwFlags|=PSP_HASHELP;.. //.. //{{AFX_DATA_INIT(COptionTab1)...m_link = FALSE;...m_parseall = FALSE;...m_testall = FALSE;...m_htmlfirst = FALSE;...//}}AFX_DATA_INIT..}....COptionTab1::~COptionTab1()..{..}....void COptionTab1::DoDataExchange(CDataExchange* pDX)..{...CPropertyPage::DoDataExchange(pDX);...//{{AFX_DATA_MAP(COptionTab1)...DDX_Check(pDX, IDC_link, m_link);...DDX_Check(pDX, IDC_pa

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\OptionTab1.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1387
    Entropy (8bit):5.535460201607986
    Encrypted:false
    SSDEEP:24:jfTifTjnlbnku0fPuxaKK4471WzBuwHGUKaPiFhtkOVJ7U8yfT0:L8Htn10fWxS4YWrx3ejJVl7IA
    MD5:F5226579128490CB149B59973ABCE592
    SHA1:9773A802994BDBFD89A839F5462B3A19A2C64CA6
    SHA-256:7C42100FF810B02EA9AB1AD3BA6CAD840217CF1178725E25FC0440BF04D6C154
    SHA-512:F55DD337150C53ACC701E4B20485FE05309A48851B88CAA2B69393B010272D09B35D5A5CD94E61D3AA75FEFCD7386621F4BC8C0F210476B009D9AE7552F63D4A
    Malicious:false
    Preview:#if !defined(AFX_OPTIONTAB1_H__E6FA3FE2_A5B5_11D3_A2B3_0000E84E7CA1__INCLUDED_)..#define AFX_OPTIONTAB1_H__E6FA3FE2_A5B5_11D3_A2B3_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// OptionTab1.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// COptionTab1 dialog....class COptionTab1 : public CPropertyPage..{...DECLARE_DYNCREATE(COptionTab1)....// Construction..public:...COptionTab1();...~COptionTab1();.. char* GetTip(int id);.. int modify;....// Dialog Data...//{{AFX_DATA(COptionTab1)...enum { IDD = IDD_OPTION1 };...BOOL.m_link;...BOOL.m_parseall;...BOOL.m_testall;...BOOL.m_htmlfirst;...//}}AFX_DATA......// Overrides...// ClassWizard generate virtual function overrides...//{{AFX_VIRTUAL(COptionTab1)...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protected:...// Generated message map functions...//{{AFX_MSG(COpt

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\OptionTab10.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):12382
    Entropy (8bit):5.572628698414145
    Encrypted:false
    SSDEEP:384:s1zMvwjblA6pgNZcai4Xn8XZ8C7p+giiJynT:syyblA6pgNZcaiqs77p+giVnT
    MD5:06CCB839CC9ED3E6F00684A65FC7F854
    SHA1:D694627705D3FD6B3BE30BFFA79D090A23632A13
    SHA-256:A2E77373F09ADD9B3864C6DDEF813098F44F4CC083297D1126DA7D58D625571A
    SHA-512:31FBC8431ADB65A16302AC030C89863D811B5867E8CB51A1CDA65FA3606E48D67F4C741E03186249616EE6A5FCCB73945391F71A28AAAB0CE0ADC832EA1A5640
    Malicious:false
    Preview:// OptionTab10.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "OptionTab10.h"..#include "ProxyId.h"....#include <ws2tcpip.h>.#include <Wspiapi.h>.//#include <winsock2.h>....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../* Externe C */..extern "C" {.. #include "HTTrackInterface.h".. //#include "htsbase.h".. //#include "htslib.h"..}.... //extern char* jump_identification(char*);..../////////////////////////////////////////////////////////////////////////////..// COptionTab10 property page....IMPLEMENT_DYNCREATE(COptionTab10, CPropertyPage)....COptionTab10::COptionTab10() : CPropertyPage(COptionTab10::IDD)..{.. // Patcher titre.. if (LANG_T(-1)) { // Patcher en fran.ais.. m_psp.pszTitle=LANG(LANG_IOPT10); // titre.. m_psp.dwFlags|=PSP_USETITLE;.. }.. m_psp.dwFlags|=PSP_HASHELP;.. //...//{{AFX_DATA_INIT(COptionTab10)...m_proxy = _T("");...m_port = _T("");...m_ftpprox = FALSE;...//

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\OptionTab10.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2370
    Entropy (8bit):5.628371631322341
    Encrypted:false
    SSDEEP:48:mpnBOfW5uBq/1YWXx3lKJL/HwhS7sdOn/JVl71:mpgS28dlKZ/HwhS7sdOn/JVl71
    MD5:B47DD26375E52A869B0E7167281EEBB2
    SHA1:CD7BCFE0471409322DC601B2C1A67050EA0D00C5
    SHA-256:7B38DE16B02DB2AA97CA0ACEA40FE845511E19399938B3CE08B258BD1EDDD096
    SHA-512:08FA97D56CE791BA58E668E8E052CDF3160626BE8C7842302FDA28539E9D85FCB118B3811C859CED219C665877DC0351FA2C78997247656C7E4C6EB5CE15D1A8
    Malicious:false
    Preview:#if !defined(AFX_OPTIONTAB10_H__758B3902_A9A6_11D3_A2B3_0000E84E7CA1__INCLUDED_)..#define AFX_OPTIONTAB10_H__758B3902_A9A6_11D3_A2B3_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// OptionTab10.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// COptionTab10 dialog....class COptionTab10 : public CPropertyPage..{...DECLARE_DYNCREATE(COptionTab10)....// Construction..public:...COptionTab10();...~COptionTab10();.. char* GetTip(int id);.. int modify;.. int prox_status;.. char ProxyDetectBuff[16][1024];.. CString ProxyDetectName[16];....// Dialog Data...//{{AFX_DATA(COptionTab10)...enum { IDD = IDD_OPTION10 };...CComboBox.m_ctl_prox;...CButton.m_ctl_pwdhide;...CButton.m_ctl_ftpprox;...CEdit.m_ctl_portprox;...CStatic.m_ctl_proxtitle;...CString.m_proxy;...CString.m_port;...BOOL.m_ftpprox;...//}}AFX_DATA......// Overrides...// ClassWizard generate virtual function overrides...//{{AFX_VIRTUAL(

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\OptionTab11.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):6799
    Entropy (8bit):5.335837753516553
    Encrypted:false
    SSDEEP:96:D8qh6XBWr+xcY6B5BIZLBM1bSjypY3Wdo+DiZoXGN4cZV594TnI/+p:dh6XBNCjsLKB2ywb94ME
    MD5:A870991E3FB51AC692C7DCD7188E8A96
    SHA1:AF2AF3A97FC6C86948B5555AB98E36D9C44FF820
    SHA-256:93CB4B4ACC28D1792A005FA080876D46C0839D03DA050EFDA37AACD7F2328876
    SHA-512:9763AA628E348158B6CCD21ABD8FDA589C607D7C69AB2957DB4431E31797CE562EFB679DF54929D358EA7C25EEE80D8B6B50E113BA860F32DC82077C7F12D0E7
    Malicious:false
    Preview:// OptionTab11.cpp : implementation file..//....#include "stdafx.h"..#include "winhttrack.h"..#include "OptionTab11.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../////////////////////////////////////////////////////////////////////////////..// COptionTab11 property page....IMPLEMENT_DYNCREATE(COptionTab11, CPropertyPage)....COptionTab11::COptionTab11() : CPropertyPage(COptionTab11::IDD)..{.. // Patcher titre.. if (LANG_T(-1)) { // Patcher en fran.ais.. m_psp.pszTitle=LANG(LANG_IOPT11); // titre.. m_psp.dwFlags|=PSP_USETITLE;.. }.. m_psp.dwFlags|=PSP_HASHELP;...//{{AFX_DATA_INIT(COptionTab11)...m_ext1 = _T("");...m_ext2 = _T("");...m_ext3 = _T("");...m_ext4 = _T("");...m_ext5 = _T("");...m_ext6 = _T("");...m_ext7 = _T("");...m_ext8 = _T("");...m_mime1 = _T("");...m_mime2 = _T("");...m_mime3 = _T("");...m_mime4 = _T("");...m_mime5 = _T("");...m_mime6 = _T("");...m_mime7 = _T("");...m_mime8 = _T("");...//}}AFX_DAT

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\OptionTab11.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1616
    Entropy (8bit):5.541510557558805
    Encrypted:false
    SSDEEP:24:ymFhl1nkKpfPuxjQe59dse471Wz4uwHGUKaPiAhtkOPUjJ7U8td:ym7XnZpfWx/fDYWcx3ljJPYl7td
    MD5:55531EF2C32A3DFE0EAFF6FC65692437
    SHA1:2EE9C55A5E5A37B0AC7D1ECC09F6E87A29B89300
    SHA-256:5F58C7B2BAF0BCC67148A7E56173E874AF4FB0DBFC76CBD067CBE1815C361474
    SHA-512:277298274258542D7365C86B6CFF780C5E929D121549C1E7630382E172D80B83F671820FA03EE366AF9BF9DB9F35550CFF77B8B2AD1E541A94DB0D21BE83F8E9
    Malicious:false
    Preview:#if !defined(AFX_OPTIONTAB11_H__0203BCB7_9CC5_4316_B227_9F41CCFF513D__INCLUDED_)..#define AFX_OPTIONTAB11_H__0203BCB7_9CC5_4316_B227_9F41CCFF513D__INCLUDED_....#if _MSC_VER > 1000..#pragma once..#endif // _MSC_VER > 1000..// OptionTab11.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// COptionTab11 dialog....class COptionTab11 : public CPropertyPage..{...DECLARE_DYNCREATE(COptionTab11)....// Construction..public:...COptionTab11();...~COptionTab11();.. char* GetTip(int id);.. int modify;....// Dialog Data...//{{AFX_DATA(COptionTab11)...enum { IDD = IDD_OPTION11 };...CString.m_ext1;...CString.m_ext2;...CString.m_ext3;...CString.m_ext4;...CString.m_ext5;...CString.m_ext6;...CString.m_ext7;...CString.m_ext8;...CString.m_mime1;...CString.m_mime2;...CString.m_mime3;...CString.m_mime4;...CString.m_mime5;...CString.m_mime6;...CString.m_mime7;...CString.m_mime8;...//}}AFX_DATA......// Overrides...// ClassWizard generate virtual function o

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\OptionTab2.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):6756
    Entropy (8bit):5.539345486998181
    Encrypted:false
    SSDEEP:96:hzfaB2G3EjvBeidFBuBABjB/BwgBdgB0BWBjBpbkmFWVZVr94TNtMdim+:loMFQ21ZOgAKoFPkEU994b
    MD5:7365FA838C491C1F4B65FE60E304E19A
    SHA1:F16A5A0EB0925B54EDE4E43E37A24F1D65A1407C
    SHA-256:F30CFC478A507E21E0F000E0C2917E36C1182DAEC700F8CC8130BDD9B6E85113
    SHA-512:7DC12A082438C69999C944E106F9FC5F360D1BCDAFD624F65654F20271C98F05F15FBBEB969E3F5DFF974C2827B306D17776614B67814B81105C896BA741849E
    Malicious:false
    Preview:// OptionTab2.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "OptionTab2.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../////////////////////////////////////////////////////////////////////////////..// COptionTab2 property page....IMPLEMENT_DYNCREATE(COptionTab2, CPropertyPage)....COptionTab2::COptionTab2() : CPropertyPage(COptionTab2::IDD)..{.. // Patcher titre.. if (LANG_T(-1)) { // Patcher en fran.ais.. m_psp.pszTitle=LANG(LANG_IOPT2); // titre.. m_psp.dwFlags|=PSP_USETITLE;.. }.. m_psp.dwFlags|=PSP_HASHELP;.. //...//{{AFX_DATA_INIT(COptionTab2)...m_build = -1;...m_dos = FALSE;...m_errpage = FALSE;...m_external = FALSE;...m_nopurge = FALSE;...m_hidepwd = FALSE;...m_hidequery = FALSE;...m_iso9660 = FALSE;...//}}AFX_DATA_INIT..}....COptionTab2::~COptionTab2()..{..}....void COptionTab2::DoDataExchange(CDataExchange* pDX)..{...CPropertyPage::DoDataExchange(pDX);...//{{AFX_DATA

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\OptionTab2.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1627
    Entropy (8bit):5.564025972344135
    Encrypted:false
    SSDEEP:24:pTWTjzilPnkAJOuFfohvKDpsn2k471WzuuwHGUKaPi/IIhtkOVJ7U8GT0:p6mZnHxFfoyWYWmx3gjJVl7GA
    MD5:F41F22337C65AD5BEA161B44F133DB01
    SHA1:10AA229E65478BC6F865F0DBEEB0B2954EAB95CA
    SHA-256:D6D7335B078E3B8BB098327EEA2BC1FB1D75079D85EEAA3FBFFE3A31F7224DFA
    SHA-512:E5CCE2815F5820A98297E7C0302BF47FB2444EE93AA018EC571BD74627566F0E9219D102574FA90DDAE7F8566D03AA679835762A0C6CE867B721B6E2BB23EF6E
    Malicious:false
    Preview:#if !defined(AFX_OPTIONTAB2_H__E6FA3FE3_A5B5_11D3_A2B3_0000E84E7CA1__INCLUDED_)..#define AFX_OPTIONTAB2_H__E6FA3FE3_A5B5_11D3_A2B3_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000....#include "BuildOptions.h"....// OptionTab2.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// COptionTab2 dialog....class COptionTab2 : public CPropertyPage..{...DECLARE_DYNCREATE(COptionTab2)....// Construction..public:...COptionTab2();...~COptionTab2();...CBuildOptions Bopt;.. int modify;.. char* GetTip(int id);......// Dialog Data...//{{AFX_DATA(COptionTab2)...enum { IDD = IDD_OPTION2 };...CComboBox.m_ctl_build;...CButton.m_buildopt;...int..m_build;...BOOL.m_dos;...BOOL.m_errpage;...BOOL.m_external;...BOOL.m_nopurge;...BOOL.m_hidepwd;...BOOL.m_hidequery;...BOOL.m_iso9660;...//}}AFX_DATA......// Overrides...// ClassWizard generate virtual function overrides...//{{AFX_VIRTUAL(COptionTab2)...protected:...v

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\OptionTab3.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):5866
    Entropy (8bit):5.4921217734027215
    Encrypted:false
    SSDEEP:96:yzgizyPMV3VUXT0DidPBzBaBoBYBeB/BdZVM94TiBWY3U:3izUMVeoiPdwaC0J9m94b
    MD5:A44EA09EED4111C01CDAA730663FE7D3
    SHA1:218FD03BDE2B11931AFAA2DDD0C9D99D28AA1A20
    SHA-256:8C3CCF444C6167CEAB4E44BDF336F22D0EFB93E38C88E8BBAE1E89711EA4C27B
    SHA-512:855F63274EEE684FBE3A64B98A54160DBA8DEBFA17750B512BF36840D95EF081FACA0C40CF8B538FFA1D972DE5705D87C486A44593BE19176EA0DF24E0325E86
    Malicious:false
    Preview:// OptionTab3.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "OptionTab3.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../////////////////////////////////////////////////////////////////////////////..// COptionTab3 property page....IMPLEMENT_DYNCREATE(COptionTab3, CPropertyPage)....COptionTab3::COptionTab3() : CPropertyPage(COptionTab3::IDD)..{.. // Patcher titre.. if (LANG_T(-1)) { // Patcher en fran.ais.. m_psp.pszTitle=LANG(LANG_IOPT3); // titre.. m_psp.dwFlags|=PSP_USETITLE;.. }.. m_psp.dwFlags|=PSP_HASHELP;.. //...//{{AFX_DATA_INIT(COptionTab3)...m_filter = -1;...m_travel = -1;...m_travel2 = -1;...m_windebug = FALSE;...m_cache = FALSE;...m_travel3 = -1;...//}}AFX_DATA_INIT..}....COptionTab3::~COptionTab3()..{..}....void COptionTab3::DoDataExchange(CDataExchange* pDX)..{...CPropertyPage::DoDataExchange(pDX);...//{{AFX_DATA_MAP(COptionTab3)...DDX_Control(pDX, IDC_travel3, m

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\OptionTab3.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1528
    Entropy (8bit):5.53786040734039
    Encrypted:false
    SSDEEP:24:xhTQhTjZlPnkOSuFfoIyXW471WzbuwHGUKaPiLhtkOVJ7U8ghT0:xhUh5ZnJ/FfooYWBx3sjJVl7ghA
    MD5:63872C8B55CC56E6043BEBDB06A6D4F6
    SHA1:696A9B54AB119767E861C40567C2A80C9A8DABA8
    SHA-256:E28C452E08444B21FD8AD166D25ED926215CD757064808386A053162FBF7545B
    SHA-512:1C17D801391135DCDAA293EF6004A9B840C89EDDE5E05B959F610D03ED460D3C5787DC5F57BBC88CA5A567BDEF721DD3B133CCFD56538BA6B36C9171AAC7D320
    Malicious:false
    Preview:#if !defined(AFX_OPTIONTAB3_H__E6FA3FE4_A5B5_11D3_A2B3_0000E84E7CA1__INCLUDED_)..#define AFX_OPTIONTAB3_H__E6FA3FE4_A5B5_11D3_A2B3_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// OptionTab3.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// COptionTab3 dialog....class COptionTab3 : public CPropertyPage..{...DECLARE_DYNCREATE(COptionTab3)....// Construction..public:...COptionTab3();...~COptionTab3();.. int modify;.. char* GetTip(int id);......// Dialog Data...//{{AFX_DATA(COptionTab3)...enum { IDD = IDD_OPTION3 };...CComboBox.m_ctl_travel3;...CComboBox.m_ctl_travel2;...CComboBox.m_ctl_travel;...CComboBox.m_ctl_filter;...int..m_filter;...int..m_travel;...int..m_travel2;...BOOL.m_windebug;...BOOL.m_cache;...int..m_travel3;...//}}AFX_DATA......// Overrides...// ClassWizard generate virtual function overrides...//{{AFX_VIRTUAL(COptionTab3)...protected:...virtual void DoDataExchange(CDataExc

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\OptionTab4.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):4710
    Entropy (8bit):5.4152525816296775
    Encrypted:false
    SSDEEP:96:DzdhCArmAeidPBeBH4B3+gB6B6CBqlB4BzZVN94TTxJaYAw8U:13dPAuJ+gYYCkly7b94m+
    MD5:E9B2F45BE80075571F1FF2174D9D37B3
    SHA1:AB76A364F4C107D545FA92E6DF32BCAFC36ED515
    SHA-256:1135C44C11C1B8EAE94E0443BE4A57A5159B9BC853E5B7EDECDA212098D23E85
    SHA-512:3A10AB76DFA2D780EC8EE0F8454F8EDB791B86F9E01648992C4B06301EFD98937E145ED9C8416950A6584371A561A6C909AE961EEBFF7A5D2B2671C9C56AED19
    Malicious:false
    Preview:// OptionTab4.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "OptionTab4.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../////////////////////////////////////////////////////////////////////////////..// COptionTab4 property page....IMPLEMENT_DYNCREATE(COptionTab4, CPropertyPage)....COptionTab4::COptionTab4() : CPropertyPage(COptionTab4::IDD)..{.. // Patcher titre.. if (LANG_T(-1)) { // Patcher en fran.ais.. m_psp.pszTitle=LANG(LANG_IOPT4); // titre.. m_psp.dwFlags|=PSP_USETITLE;.. }.. m_psp.dwFlags|=PSP_HASHELP;.. //...//{{AFX_DATA_INIT(COptionTab4)...m_connexion = _T("");...m_remt = FALSE;...m_retry = _T("");...m_timeout = _T("");...m_rems = FALSE;...m_rate = _T("");...m_ka = FALSE;...//}}AFX_DATA_INIT..}....COptionTab4::~COptionTab4()..{..}....void COptionTab4::DoDataExchange(CDataExchange* pDX)..{...CPropertyPage::DoDataExchange(pDX);...//{{AFX_DATA_MAP(COptionTab4)...DDX_C

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\OptionTab4.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1426
    Entropy (8bit):5.5432157234315245
    Encrypted:false
    SSDEEP:24:lTiTjIl7nkzQddfovhV8RZ471WzouwHGUKaPi+htkOVJ7U8ST0:lWoVn/bfob8RZYWcx3ljJVl7SA
    MD5:CA22CCE78E0D0F34D56D65ACC74823CA
    SHA1:BBD6ACDED8F7D903DABCE18EA071F127F92F6D2E
    SHA-256:AD653576C50D488D0C66C91704D41D34B8721150678951AE44E3C92CC71DBB85
    SHA-512:52993B182323E414B94C129D7922694F39D84D8EEEB568DFAB1F786120135C89EEFC28D8523A1331F2923E55F3CFB04F52EB7836A4DFB50246F7C2C2E617E22A
    Malicious:false
    Preview:#if !defined(AFX_OPTIONTAB4_H__E6FA3FE5_A5B5_11D3_A2B3_0000E84E7CA1__INCLUDED_)..#define AFX_OPTIONTAB4_H__E6FA3FE5_A5B5_11D3_A2B3_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// OptionTab4.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// COptionTab4 dialog....class COptionTab4 : public CPropertyPage..{...DECLARE_DYNCREATE(COptionTab4)....// Construction..public:...COptionTab4();...~COptionTab4();.. char* GetTip(int id);......// Dialog Data...//{{AFX_DATA(COptionTab4)...enum { IDD = IDD_OPTION4 };...CString.m_connexion;...BOOL.m_remt;...CString.m_retry;...CString.m_timeout;...BOOL.m_rems;...CString.m_rate;...BOOL.m_ka;...//}}AFX_DATA......// Overrides...// ClassWizard generate virtual function overrides...//{{AFX_VIRTUAL(COptionTab4)...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protected:...// Generated m

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\OptionTab5.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):6158
    Entropy (8bit):5.461436665008754
    Encrypted:false
    SSDEEP:96:kzyfPye6Nk4eZd4idPBRdgBDBMgBGgBbBnB4BsBQB6BUB9ZV294TAUtdSkMp/D7e:Dh68FP/uVN3hJOGawip894Kk0/D7WF
    MD5:1DA610CE7ACD76D2EB6B3CE084787DC1
    SHA1:6DC272CB66EF8E0F8A686D424A727B5D7E4AB9DB
    SHA-256:618C2A206AF4B22585D371D88BC030A5595014BC094D1B498F3141B0220E63BD
    SHA-512:4E0099AD257F8AD2532956EA958DC7A68BE5E719FC9D5D188C2C094C940F8DEFFC842C467FD2BBC32D063982B2086A244BEC1A90A19061390342D0EE7C71998E
    Malicious:false
    Preview:// OptionTab5.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "OptionTab5.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../////////////////////////////////////////////////////////////////////////////..// COptionTab5 property page....IMPLEMENT_DYNCREATE(COptionTab5, CPropertyPage)....COptionTab5::COptionTab5() : CPropertyPage(COptionTab5::IDD)..{.. // Patcher titre.. if (LANG_T(-1)) { // Patcher en fran.ais.. m_psp.pszTitle=LANG(LANG_IOPT5); // titre.. m_psp.dwFlags|=PSP_USETITLE;.. }.. m_psp.dwFlags|=PSP_HASHELP;.. //...//{{AFX_DATA_INIT(COptionTab5)...m_maxhtml = _T("");...m_maxrate = _T("");...m_maxtime = _T("");...m_othermax = _T("");...m_sizemax = _T("");...m_depth = _T("");...m_maxconn = _T("");...m_depth2 = _T("");...m_pausebytes = _T("");...m_maxlinks = _T("");...//}}AFX_DATA_INIT..}....COptionTab5::~COptionTab5()..{..}....void COptionTab5::DoDataExchange(CDataExchange*

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\OptionTab5.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1612
    Entropy (8bit):5.546694513727209
    Encrypted:false
    SSDEEP:24:gwTXwTjblQInk2iIyFfEW7oLFDoW471WzymuwHGUKaPiFThtkOVJ7U8HwT0:7U7Fn1wf/7qYWXx3yjJVl7QA
    MD5:04EEE435BD2C197FB4922B55952857EA
    SHA1:DE123B04B38C8DF28A5EE3CA7632FE4DAF40E4D0
    SHA-256:8602B5932C4B3A0A5F2C8153CD5EA61D99636F62AC6C32EE8F1D6EAF30BDD1DE
    SHA-512:1D360253B8C979067BB2BA8CD21E4CC135E84FEB019266012D1FA0ABF532355ED5FA37E83BC78765E615E89700B3AFF32B36ABA3D363EB054D4E58F18656EBC3
    Malicious:false
    Preview:#if !defined(AFX_OPTIONTAB5_H__E6FA3FE6_A5B5_11D3_A2B3_0000E84E7CA1__INCLUDED_)..#define AFX_OPTIONTAB5_H__E6FA3FE6_A5B5_11D3_A2B3_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// OptionTab5.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// COptionTab5 dialog....class COptionTab5 : public CPropertyPage..{...DECLARE_DYNCREATE(COptionTab5)....// Construction..public:...COptionTab5();...~COptionTab5();.. char* GetTip(int id);.. int depth_status;......// Dialog Data...//{{AFX_DATA(COptionTab5)...enum { IDD = IDD_OPTION5 };...CEdit.m_ctl_pausebytes;...CComboBox.m_ctl_depth2;...CComboBox.m_ctl_depth;...CString.m_maxhtml;...CString.m_maxrate;...CString.m_maxtime;...CString.m_othermax;...CString.m_sizemax;...CString.m_depth;...CString.m_maxconn;...CString.m_depth2;...CString.m_pausebytes;...CString.m_maxlinks;...//}}AFX_DATA......// Overrides...// ClassWizard generate virtual function override

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\OptionTab6.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):3764
    Entropy (8bit):5.445743754927343
    Encrypted:false
    SSDEEP:96:dz+iM2JiNIaeidPBWBxBsBxBQZV/94TxpU:8igNPgjS/u594w
    MD5:51EBE545D4003E76BE6D1264ED58F08E
    SHA1:C71C6A8C730979DE5E1CAABA96C69F3A0DAA18A1
    SHA-256:F64E30B5F651B24E4EF19F937F4C919CBB4CB48CCD89C1828275B06C571DFCC4
    SHA-512:A6EE55BF9F6042AEF2E9EC3073C4AD346B9A910C64D2504CBB53C6E73A811A57935F31CF05820422E971738C0EB7A3C6C83D9F78009D8EA6C02478EF78DD27EF
    Malicious:false
    Preview:// OptionTab6.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "OptionTab6.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../////////////////////////////////////////////////////////////////////////////..// COptionTab6 property page....IMPLEMENT_DYNCREATE(COptionTab6, CPropertyPage)....COptionTab6::COptionTab6() : CPropertyPage(COptionTab6::IDD)..{.. // Patcher titre.. if (LANG_T(-1)) { // Patcher en fran.ais.. m_psp.pszTitle=LANG(LANG_IOPT6); // titre.. m_psp.dwFlags|=PSP_USETITLE;.. }.. m_psp.dwFlags|=PSP_HASHELP;.. //...//{{AFX_DATA_INIT(COptionTab6)...m_user = _T("");...m_footer = _T("");...m_accept_language = _T("");...m_other_headers = _T("");...m_default_referer = _T("");...//}}AFX_DATA_INIT..}....COptionTab6::~COptionTab6()..{..}....void COptionTab6::DoDataExchange(CDataExchange* pDX)..{...CPropertyPage::DoDataExchange(pDX);...//{{AFX_DATA_MAP(COptionTab6)...DDX_CBString(p

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\OptionTab6.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1423
    Entropy (8bit):5.536457327277861
    Encrypted:false
    SSDEEP:24:JT+TjalXnkg1fx1rctBWm471WzSuwHGUKaPiMhtkOVJ7U8uT0:JS65nf1fx2+mYWyx3rjJVl7uA
    MD5:4F05160B56B27B1C30FF1BC86DD64755
    SHA1:D3C0C588480B696A46830CA91AA84C58E0164CFD
    SHA-256:6A9643B06961B4BFB4840B4A4B41DD047291560C2F05C8A63F608528CCFE9039
    SHA-512:E2DF6BD6F078730CEA26E786A9F5CE10EE312E0DE4E58C7BDA694EDAB053B7721D745ADB9EAAC99952332FCD85947A5031300355F0A815C791DA00A9CBA2A444
    Malicious:false
    Preview:#if !defined(AFX_OPTIONTAB6_H__E6FA3FE7_A5B5_11D3_A2B3_0000E84E7CA1__INCLUDED_)..#define AFX_OPTIONTAB6_H__E6FA3FE7_A5B5_11D3_A2B3_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// OptionTab6.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// COptionTab6 dialog....class COptionTab6 : public CPropertyPage..{...DECLARE_DYNCREATE(COptionTab6)....// Construction..public:...COptionTab6();...~COptionTab6();.. char* GetTip(int id);....// Dialog Data...//{{AFX_DATA(COptionTab6)...enum { IDD = IDD_OPTION6 };...CString.m_user;...CString.m_footer;...CString.m_accept_language;...CString.m_other_headers;...CString.m_default_referer;...//}}AFX_DATA......// Overrides...// ClassWizard generate virtual function overrides...//{{AFX_VIRTUAL(COptionTab6)...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protected:...// Generated mess

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\OptionTab7.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):9716
    Entropy (8bit):5.362287167365494
    Encrypted:false
    SSDEEP:192:7KP8l6Pac2xogBLgdnC3NKT5qMArC0xC94Ee13nfX2mndb:I8cUogBLgRVh2C0xCCV1
    MD5:941CB26D26398C2486FDD7FB0865FC15
    SHA1:9E93DD54CCA7EE58A6749C5FF78C36A7FB9AB126
    SHA-256:E778A44F4CC753F42D02B136673FB22B2A621B2C42647C11D5CD39037C64EDEA
    SHA-512:EF1912E38932C8242D3F9BEDC21C81CAC54E971F49DBB99E49E63324AB03D2B88D5A99843E9875BEAB16796381B5A067C4C394267598ED0E8585CB86F7CEAA60
    Malicious:false
    Preview:// OptionTab7.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "OptionTab7.h"..#include "AddFilter.h"..../* basic HTTrack defs */..extern "C" {.. #include "HTTrackInterface.h".. //#include "htsglobal.h".. //#include "htsbase.h"..}....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../////////////////////////////////////////////////////////////////////////////..// COptionTab7 property page....IMPLEMENT_DYNCREATE(COptionTab7, CPropertyPage)....COptionTab7::COptionTab7() : CPropertyPage(COptionTab7::IDD)..{.. // Patcher titre.. if (LANG_T(-1)) { // Patcher en fran.ais.. m_psp.pszTitle=LANG(LANG_IOPT7); // titre.. m_psp.dwFlags|=PSP_USETITLE;.. }.. m_psp.dwFlags|=PSP_HASHELP;.. //...//{{AFX_DATA_INIT(COptionTab7)...m_url2 = _T("");...//}}AFX_DATA_INIT..}....COptionTab7::~COptionTab7()..{..}....void COptionTab7::DoDataExchange(CDataExchange* pDX)..{...CPropertyPage::DoDataExchange(pDX);..

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\OptionTab7.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1518
    Entropy (8bit):5.566804815962112
    Encrypted:false
    SSDEEP:24:rTwTj9lHnkm6fPuxs+i471WzDjuwHGUKaPimw8e0htk/VJ7U8gT0:rsdJnx6fWxwYWtx3i8e0joVl7gA
    MD5:7AB989FE19D9D581F01C9C48EFE4D28F
    SHA1:B2C05E8BBED81A5D61EE51D40B0AB941019F5D63
    SHA-256:905AD97F49A768272EA112FA2498C64A53922425DAD6A09CAACB64D4E9F33170
    SHA-512:6A97A66B51BC0A778E77AD4E0ED01D59340C1E4B59560B7FFAAACBB0ECA804666A4D3BA8842473C1532A5EFBB632894907C3FBA5A7C71930695EBA774496CD61
    Malicious:false
    Preview:#if !defined(AFX_OPTIONTAB7_H__E6FA3FE8_A5B5_11D3_A2B3_0000E84E7CA1__INCLUDED_)..#define AFX_OPTIONTAB7_H__E6FA3FE8_A5B5_11D3_A2B3_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// OptionTab7.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// COptionTab7 dialog....class COptionTab7 : public CPropertyPage..{...DECLARE_DYNCREATE(COptionTab7)....// Construction..public:...COptionTab7();...~COptionTab7();.. char* GetTip(int id);.. int modify;....// Dialog Data...//{{AFX_DATA(COptionTab7)...enum { IDD = IDD_OPTION7 };...CString.m_url2;...//}}AFX_DATA......// Overrides...// ClassWizard generate virtual function overrides...//{{AFX_VIRTUAL(COptionTab7)...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protected:...// Generated message map functions...//{{AFX_MSG(COptionTab7)...afx_msg void OnAdd1();...afx_msg void OnAdd

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\OptionTab8.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):5571
    Entropy (8bit):5.456040103377889
    Encrypted:false
    SSDEEP:96:/zJJXsHmMPanEIl4wBSyB2BsuBRBW1BoBUBO1ZVR94TXnrpbHA4T0p:9qURcZP01i+k394pb0
    MD5:48CB7AD98B1AFB40F3117B04F9E3F664
    SHA1:8C4B1D75F219987C114E95A3D4BB5C8F8A9203C6
    SHA-256:C823C5C37C66B35FAA919866A5D6E7C28074E095C67BFDBF51BB2A729940B1E8
    SHA-512:BD8B516CFA4B749253DB3F1BB9E6EAE38BCEB7F659819B236C96286DC13F0B3C8A3F4235109AB3F52E9EC1A105338D40D6C9D086410D2A51DFDDB53B390516BB
    Malicious:false
    Preview:// OptionTab8.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "OptionTab8.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../////////////////////////////////////////////////////////////////////////////..// COptionTab8 property page....IMPLEMENT_DYNCREATE(COptionTab8, CPropertyPage)....COptionTab8::COptionTab8() : CPropertyPage(COptionTab8::IDD)..{.. // Patcher titre.. if (LANG_T(-1)) { // Patcher en fran.ais.. m_psp.pszTitle=LANG(LANG_IOPT8); // titre.. m_psp.dwFlags|=PSP_USETITLE;.. }.. m_psp.dwFlags|=PSP_HASHELP;.. //...//{{AFX_DATA_INIT(COptionTab8)...m_checktype = -1;...m_cookies = FALSE;...m_parsejava = FALSE;...m_robots = -1;...m_http10 = FALSE;...m_toler = FALSE;...m_updhack = FALSE;...m_urlhack = FALSE;...//}}AFX_DATA_INIT..}....COptionTab8::~COptionTab8()..{..}....void COptionTab8::DoDataExchange(CDataExchange* pDX)..{...CPropertyPage::DoDataExchange(pDX);...//{{AFX_DATA

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\OptionTab8.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1460
    Entropy (8bit):5.541829124778632
    Encrypted:false
    SSDEEP:24:INUBNUjMlrnkk/PfPuxzPRlv471Wz8uwHGUKaPi6hEVJ7U8RNU0:CuLdnXXfWxdRYWYx35SVl7/N
    MD5:1188D47697D6931D18EFFEAB530237BA
    SHA1:6064A0AAD5B3CA52EAFE5E40EAC318E3BED82F26
    SHA-256:C599457021A3B2935D6C75935832D2996AC21CAC9A34578363DF0EA28DD4D334
    SHA-512:D6C5CD49D5F08595589EA256D4DA1837D57482EF0E64780DAE67E4E59215B0834736B4F313C7BC46AA48D8E2BFFBF2FAA76E2D763EC1599F44F811210E54893A
    Malicious:false
    Preview:#if !defined(AFX_OPTIONTAB8_H__8D023EA4_A8C3_11D3_A2B3_0000E84E7CA1__INCLUDED_)..#define AFX_OPTIONTAB8_H__8D023EA4_A8C3_11D3_A2B3_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// OptionTab8.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// COptionTab8 dialog....class COptionTab8 : public CPropertyPage..{...DECLARE_DYNCREATE(COptionTab8)....// Construction..public:...COptionTab8();...~COptionTab8();.. char* GetTip(int id);.. int modify;....// Dialog Data...//{{AFX_DATA(COptionTab8)...enum { IDD = IDD_OPTION8 };...int..m_checktype;...BOOL.m_cookies;...BOOL.m_parsejava;...int..m_robots;...BOOL.m_http10;...BOOL.m_toler;...BOOL.m_updhack;...BOOL.m_urlhack;...//}}AFX_DATA......// Overrides...// ClassWizard generate virtual function overrides...//{{AFX_VIRTUAL(COptionTab8)...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementa

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\OptionTab9.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):5020
    Entropy (8bit):5.504365827473373
    Encrypted:false
    SSDEEP:96:QzqaOSr3DSMo76BRMBYBnBABBBcXZVa94TUYayw1eU:jaOS6MMChCHypI94G3
    MD5:61778B66524D5E58CF08B608F9503541
    SHA1:80EF9AA99548B5A9C1E89B21D980BEDDD5FBF647
    SHA-256:D079078DAB3A3D6FA982F3682E523DFFBF648BDC7D629F4318746374025C376C
    SHA-512:AA017478867B765EC35EBD1F3FF7F9F4E54FF92FBB40E65BD77E26D8E9C9D61917271CDA8B3A145403068191F5D5A6BC01104A735B9C0B12C7447FFAE42227BB
    Malicious:false
    Preview:// OptionTab9.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "OptionTab9.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../////////////////////////////////////////////////////////////////////////////..// COptionTab9 property page....IMPLEMENT_DYNCREATE(COptionTab9, CPropertyPage)....COptionTab9::COptionTab9() : CPropertyPage(COptionTab9::IDD)..{.. // Patcher titre.. if (LANG_T(-1)) { // Patcher en fran.ais.. m_psp.pszTitle=LANG(LANG_IOPT9); // titre.. m_psp.dwFlags|=PSP_USETITLE;.. }.. m_psp.dwFlags|=PSP_HASHELP;.. //...//{{AFX_DATA_INIT(COptionTab9)...m_index = FALSE;...m_logf = FALSE;...m_Cache2 = FALSE;...m_logtype = -1;...m_norecatch = FALSE;...m_index2 = FALSE;...m_index_mail = FALSE;...//}}AFX_DATA_INIT..}....COptionTab9::~COptionTab9()..{..}....void COptionTab9::DoDataExchange(CDataExchange* pDX)..{...CPropertyPage::DoDataExchange(pDX);...//{{AFX_DATA_MAP(COptionTab9)...

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\OptionTab9.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1440
    Entropy (8bit):5.546752568271731
    Encrypted:false
    SSDEEP:24:vwjPlrnk+MfPuxiNBj0j/g471Wz5uwHGUKaPiNhEVJ7U8g0:Edn1MfWxCBw/gYWjx3GSVl75
    MD5:13F5A0FE29BBF8F0C71D4B21448107D9
    SHA1:0DFD4157CD4825A6C64AC7D37020835AA954006C
    SHA-256:07F38D80A80BD5E6092DC5B2BB1A2B25F8B44644AAD6E29B512526FC7D92FFBE
    SHA-512:5170D2A404D1DF281EAAD86214A2AAFEB9B566AAB109E27F657C23B5BC8C1ED73E68B576EA9D6EE9EEE5BCE193416F97817B1AE50A4C77C4FBFED8DECD97A481
    Malicious:false
    Preview:#if !defined(AFX_OPTIONTAB9_H__8D023EA5_A8C3_11D3_A2B3_0000E84E7CA1__INCLUDED_)..#define AFX_OPTIONTAB9_H__8D023EA5_A8C3_11D3_A2B3_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// OptionTab9.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// COptionTab9 dialog....class COptionTab9 : public CPropertyPage..{...DECLARE_DYNCREATE(COptionTab9)....// Construction..public:...COptionTab9();...~COptionTab9();.. char* GetTip(int id);.. int modify;....// Dialog Data...//{{AFX_DATA(COptionTab9)...enum { IDD = IDD_OPTION9 };...BOOL.m_index;...BOOL.m_logf;...BOOL.m_Cache2;...int..m_logtype;...BOOL.m_norecatch;...BOOL.m_index2;...BOOL.m_index_mail;...//}}AFX_DATA......// Overrides...// ClassWizard generate virtual function overrides...//{{AFX_VIRTUAL(COptionTab9)...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protected:.../

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\ProxyId.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):3930
    Entropy (8bit):5.462276879525385
    Encrypted:false
    SSDEEP:96:YzjSZo4htkHhB5BaB0BRCBDBDBURTCfkZVXO94TwKyUU:yKcr0S/C9lWRCfoQ94C
    MD5:ADEEFD6DC7D12835334C3485DE71AD84
    SHA1:74529D0F144ACDC390BFBA5295312E707F222DCC
    SHA-256:89DE58F8121AD133ABABDFAC3DD7C3918F2091F26DA25B341803CFCC7DE76A14
    SHA-512:43362CB6694589E307A4AE051E50FEB7D1FFD72E0E25BA192FB2C35A6E3A9E0C5646E791331E17D2C1F11EBF782C1496F943999DC1754569AFE60AF84AFE4EF7
    Malicious:false
    Preview:// ProxyId.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "ProxyId.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....extern HICON httrack_icon;....// Helper..extern LaunchHelp* HtsHelper;..../////////////////////////////////////////////////////////////////////////////..// CProxyId dialog......CProxyId::CProxyId(CWnd* pParent /*=NULL*/)...: CDialog(CProxyId::IDD, pParent)..{...//{{AFX_DATA_INIT(CProxyId)...m_proxadr = _T("");...m_proxlogin = _T("");...m_proxpass = _T("");...m_proxport = _T("");...//}}AFX_DATA_INIT..}......void CProxyId::DoDataExchange(CDataExchange* pDX)..{...CDialog::DoDataExchange(pDX);...//{{AFX_DATA_MAP(CProxyId)...DDX_Text(pDX, IDC_proxadr, m_proxadr);...DDX_Text(pDX, IDC_proxlogin, m_proxlogin);...DDX_Text(pDX, IDC_proxpass, m_proxpass);...DDX_Text(pDX, IDC_proxport, m_proxport);...//}}AFX_DATA_MAP..}......BEGIN_MESSAGE_MAP(CProxyId, CDialog)...//{{AFX_MSG_MAP(CProxyId).

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\ProxyId.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1422
    Entropy (8bit):5.561588027897596
    Encrypted:false
    SSDEEP:24:XGVbGC9l5dxfuAyWWtmK4cIWzhuwHGUKaLfWir0HMJhtkDVJ7U8eG7:aBf7mUM9qWbx3Lf70sJj8Vl7T
    MD5:D8D0E35343DD5F06AC9B5EEE306750F7
    SHA1:6A8BD7208F827E14290A28240388AC436196408A
    SHA-256:5A8936AD3BF482CE1E960B24C0780F594A5ACFE71A781B73C6B436E8E5083D5B
    SHA-512:9DCAB7E8334C957E612D00D48369D7EA25A4A1DB2DFCA8B79418D4517C86EC8409D0C40B155F87989EF9967205D6ED8FFF80BA9E0223167AD7511B575F4FAC58
    Malicious:false
    Preview:#if !defined(AFX_PROXYID_H__17B166A2_693D_11D3_A2B2_0000E84E7CA1__INCLUDED_)..#define AFX_PROXYID_H__17B166A2_693D_11D3_A2B2_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// ProxyId.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// CProxyId dialog....class CProxyId : public CDialog..{..// Construction..public:...CProxyId(CWnd* pParent = NULL); // standard constructor....// Dialog Data...//{{AFX_DATA(CProxyId)...enum { IDD = IDD_ProxyId };...CString.m_proxadr;...CString.m_proxlogin;...CString.m_proxpass;...CString.m_proxport;...//}}AFX_DATA......// Overrides...// ClassWizard generated virtual function overrides...//{{AFX_VIRTUAL(CProxyId)...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protected:.. char* GetTip(int id);...afx_msg void OnHelpInfo2();.......// Generated message map functions...//{{AFX_MSG(CProx

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\RasLoad.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1286
    Entropy (8bit):5.289635608832338
    Encrypted:false
    SSDEEP:12:U860Mtn9D7jzvODQNZwKhhAoQClASuGHGMSYRSB6MBA/XUGYVG0TElxl37y01C+X:VGDPmQ3vhh7plMMLMGldVC+MUMjuJLQY
    MD5:E228898EB7ED2C955246DAA4231B4517
    SHA1:9DA5A59866A10824D5BD244AA5DC9157A7647F77
    SHA-256:E7A238F5FEBDDA088283B1C378F6BBA257AFAA20EFC484BBA51E30976DE8E02F
    SHA-512:AC0D666856BF161BD51082D3B38010F0E78FD2D97A67C7CC59967620CEE14C1E1DB5AF30C56184E032A39402574B5CF5AEA2BF546C68332D1BC8D9DE2694B1AF
    Malicious:false
    Preview:/*----------------------------------------------------------------------..Copyright (c) 1998,1999 Gipsysoft. All Rights Reserved...File:.DynamicRAS.h..Owner:.russf@gipsysoft.com..Purpose:.Dynamically loaded RAS...----------------------------------------------------------------------*/..../* Thanks to Russ Freeman from gipsymedia */....#include "stdafx.h"..#include "RasLoad.h"....CDynamicRAS::CDynamicRAS()...: m_hInst( LoadLibrary( _T("rasapi32") ) )..., pRasEnumConnections( NULL )..., pRasHangUp( NULL )..., pRasGetConnectStatus( NULL ).. , pRasDial( NULL ).. , pRasEnumEntries( NULL ).. , pRasGetEntryDialParams( NULL )..{...if( IsRASLoaded() )...{....pRasEnumConnections = (PRASENUMCONNECTIONS)GetProcAddress( m_hInst, "RasEnumConnectionsA" );....pRasHangUp = (PRASHANGUP)GetProcAddress( m_hInst, "RasHangUpA" );....pRasGetConnectStatus = (PRASGETCONNECTSTATUS)GetProcAddress( m_hInst, "RasGetConnectStatusA" );....pRasDial = (PRASDIAL)GetProcAddress( m_hInst, "RasDialA" );.. pRasEnumEn

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\RasLoad.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2672
    Entropy (8bit):5.373600343439321
    Encrypted:false
    SSDEEP:48:VGLmQ3ZmlClWlODlRFAlrlKt4TBsAohNWJ9x5nx5+/75z35Yo7BF5u2oVxa0:qmGmlClWlODlRylrlKnACeTr5o5YW5+d
    MD5:3F464B7EF81A3C7478EFAEDBEA2B76D8
    SHA1:9C267DA0A40A784A495D6DBF6A54DF7475C7E045
    SHA-256:81EEE5AC5D3EE32B0D9373E1061C408AD95976DA80FB32EC8C328C026E7D30DD
    SHA-512:66466B76AF4AA76A46A953E1239305F096D01D4E1555CFE47FB8538B1A948C33ABC1038CB8F9856C2A2D9EA829787CB136742C65EF92219575B7CE8CCEA6C4A1
    Malicious:false
    Preview:/*----------------------------------------------------------------------..Copyright (c) 1998,1999 Gipsysoft. All Rights Reserved...File:.DynamicRAS.h..Owner:.russf@gipsysoft.com..Purpose:.Dynamically loaded RAS...----------------------------------------------------------------------*/..../* Thanks to Russ Freeman from gipsymedia */....#if !defined(RAS_LOAD_HTS_DYNAMIC)..#define RAS_LOAD_HTS_DYNAMIC....#include "ras.h"....typedef.DWORD (APIENTRY *PRASENUMCONNECTIONS)( LPRASCONNA, LPDWORD, LPDWORD );..typedef.DWORD (APIENTRY *PRASHANGUP)( HRASCONN );..typedef.DWORD (APIENTRY *PRASGETCONNECTSTATUS)( HRASCONN , LPRASCONNSTATUSA );..typedef.DWORD (APIENTRY *PRASDIAL)(LPRASDIALEXTENSIONS ,LPTSTR ,LPRASDIALPARAMS ,DWORD ,LPVOID ,LPHRASCONN);..typedef.DWORD (APIENTRY *PRASENUMENTRIES)(LPTSTR ,LPTSTR ,LPRASENTRYNAME ,LPDWORD ,LPDWORD );..typedef.DWORD (APIENTRY *PRASGETENTRYDIALPARAMS)(LPTSTR ,LPRASDIALPARAMS ,LPBOOL ); ....class CDynamicRAS {..public:...CDynamicRAS();...virtual ~CDynamicRAS();

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\Shell.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):114572
    Entropy (8bit):5.196810811160097
    Encrypted:false
    SSDEEP:1536:D+N49LubZC75PEKu6NfCwRsCNH1E5+dVS1CQa:n9GZCthuI
    MD5:94CD78E71BBB7276C4FAE6212E58C1A3
    SHA1:2A3F997FAFC26A22644C96F7571AC2FE451BB8A3
    SHA-256:D2C201E931A1BA105DE37236177FA63F8B23E585A0206AB1E0F3B4FF39153C41
    SHA-512:B3588A5A84EBACE0E4701C6B6BD46E2479456889C8C95B2890335DB35FFA8F10CC61B9CCB466A47014178F93CCBA71C6900620742E24C6A69D58635B29FED20D
    Malicious:false
    Preview:// Shell.cpp : Defines the class behaviors for the application...//....// thread windows..#include <process.h>....#include "stdafx.h"..#include "Shell.h"..#include "NewProj.h"....#include <WS2tcpip.h> // Note: weird C2894 error if not included here..extern "C" {.. #include "HTTrackInterface.h"..};..//#include "htsbase.h"....// Ras..#if USE_RAS ..#include "RasLoad.h"..#endif....#include <afxdisp.h>..#include "ras.h"..#include "mmsystem.h"....//#include "ShellDoc.h"..//#include "ShellView.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....// PATCH-->..// PATCH-->..#include "about.h"..#include "infoend.h"....// flag de termination..int termine=0;..int termine_requested=0;..int shell_terminated=0;..int soft_term_requested=0;..FILE* fp_debug=NULL;....#include "stdafx.h"..#include "Shell.h"..#include "process.h"..//#include "ShellDoc.h"..//#include "ShellView.h"..//#include "essai.h"..//#include "get.h"..//#include "parameter.h"..ex

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\Shell.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):7676
    Entropy (8bit):5.281791383197279
    Encrypted:false
    SSDEEP:192:y1L1ohNhPcotgqpMqCzJyV2HHqAYnfl1T:y1L1ozhfpMBdYN1T
    MD5:664D1226E9F83F17EED2B9D6F2AD6783
    SHA1:17745FF00F31FDE582E9AA2AF3CD6B24917BAF63
    SHA-256:4D8325D21F1A1BFEFCA15F788B55A5F635B9A00D1141890504516DA16A7F02B8
    SHA-512:B2281BEF8F3D7F533CF8DD5DEB20B9783F10804DC21C7646FFE60F168664E4BD00E32DA507159622DA45DEF2A602C4D4101084065F192E18D7981D37DE300369
    Malicious:false
    Preview:// Shell.h : main header file for the SHELL application..//....#if !defined(AFX_SHELL_H__ED81E637_E017_11D1_A97E_006097BC6150__INCLUDED_)..#define AFX_SHELL_H__ED81E637_E017_11D1_A97E_006097BC6150__INCLUDED_..#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..#ifndef __AFXWIN_H__...#error include 'stdafx.h' before including this file for PCH..#endif..../* basic HTTrack defs */..#include "htsnet.h"..#include "htsopt.h"..#include "htsdefines.h"....//..// connect. via HTTrack? (d.fini dans projet)..#define USE_RAS 1..//....// sleep (taux de refresh) en ms..#define HTS_SLEEP_WIN 100....#include "resource.h" // main symbols..#include "cpp_lang.h"..// Ras..#if USE_RAS..#include "RasLoad.h"..#endif..#include "MainTab.h"....// helper launcher..#include "LaunchHelp.h"....// lang.h..#include "newlang.h"....// message requests..#define wm_ViewRestart (WM_USER + 100)..// test ..#define wm_WizRequest1 (WM_USER + 101)..#define wm_WizRequest2 (WM_USER + 102)..#define wm_WizRequest3

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\StdAfx.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):201
    Entropy (8bit):4.593812152587498
    Encrypted:false
    SSDEEP:6:jGmyXH+5AMRNT15eA6YFm+yr5FdllZ+sMKcaGIA0RQbyn:jGXXHJYx5fJE+yr5JlZ+4cWAoQu
    MD5:B63F6E7BA7668B64FEDC0100D9C1D450
    SHA1:B861AFC6953C171A2F1CC4FDDA2F4E1430AE2AF0
    SHA-256:3C34BFF4AC7DAFFA33AD92DAF51FE12ADB113CF9B572D2E88536AA195DC9CC0C
    SHA-512:7002199F197EE1F0E6C56E60FB65FD98E542D9926B98D224D9CAAA4DA539892ED7847099A888BE6AD6BA7CC0FFAF786DCE4CC4A7F5345608BB8C81AF96FE8E0F
    Malicious:false
    Preview:// stdafx.cpp : source file that includes just the standard includes..//.Shell.pch will be the pre-compiled header..//.stdafx.obj will contain the pre-compiled type information....#include "stdafx.h"..

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\StdAfx.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1358
    Entropy (8bit):5.415781435150983
    Encrypted:false
    SSDEEP:24:FnCpbw11qw11TvA0u5EK5Iao61uvHSf6ofSVJ7U8xw11T:8pbs1qs1TvdzVl7xs1T
    MD5:A2CD31C6BAA9A0AFA9C89D68299AB9E8
    SHA1:3D792CAAC3622B4039D7515738AFBE68372A7188
    SHA-256:90B2849B9E2C654F7A1359C3203EA55F89AB848FE1463E4A7919C4B3E241084F
    SHA-512:07B9BC85B1E1DA6A84715199B03EE86F75AF06F6F4244D866A4A7F62B87B5475C196DA707C10D7BD4DCEFD3BFC99091C6645D288EE5C170235F31ACBADA64839
    Malicious:false
    Preview:// stdafx.h : include file for standard system include files,..// or project specific include files that are used frequently, but..// are changed infrequently..//....#if !defined(AFX_STDAFX_H__ED81E639_E017_11D1_A97E_006097BC6150__INCLUDED_)..#define AFX_STDAFX_H__ED81E639_E017_11D1_A97E_006097BC6150__INCLUDED_....// #define NTDDI_VERSION 0x05000000 // NTDDI_WIN2K....#ifndef WINVER..#define WINVER 0x0500 // _WIN32_WINNT_WIN2K..//#define WINVER 0x0400 // _WIN32_WINNT_NT4..#endif....#ifndef _WIN32_WINNT..#define _WIN32_WINNT 0x0500 // _WIN32_WINNT_WIN2K..//#define _WIN32_WINNT 0x0400 // _WIN32_WINNT_NT4..#endif....#ifndef _WIN32_IE..#define _WIN32_IE 0x0500..#endif....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000....#define VC_EXTRALEAN..// Exclude rarely-used stuff from Windows headers....#include <afxwin.h> // MFC core and standard components..#include <afxext.h> // MFC extensions..#include <afxdisp.h> // MFC OLE automation clas

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\TreeViewToolTip.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2042
    Entropy (8bit):5.206791549480484
    Encrypted:false
    SSDEEP:24:+u7plctl8Necq9D6EhxvRvBGCYLGxvRvBltfgusqhLJpwjaZGU7uYUjXmyB5xLN2:npOtsq9e8xYCVxBf/T9ZGUW3LN5ap
    MD5:41ADF7D5C2E86722F7B73308C0150CEC
    SHA1:15FDAFE19348818BDB94BF70AFEE0EB89D7474FC
    SHA-256:166038DD54AB9B608C3E98385416B81FFC4E8D4FA9DC4C513532E887CFCBCA04
    SHA-512:4F0DD77D53233B2BB7922F8F97D6D2F51CD926C2FA10C50807823A9E302B44760CE7540A37CF0A6C9CF7CA1C70D704AAA37CA9B9CDF9C5FF61D75CAC5DEBF64D
    Malicious:false
    Preview:// TreeViewToolTip.cpp : implementation file..//....#include "stdafx.h"..#include "winhttrack.h"..#include "TreeViewToolTip.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../////////////////////////////////////////////////////////////////////////////..// CTreeViewToolTip....CTreeViewToolTip::CTreeViewToolTip()..{.. EnableToolTips(true);..}....CTreeViewToolTip::~CTreeViewToolTip()..{..}......BEGIN_MESSAGE_MAP(CTreeViewToolTip, CToolTipCtrl)...//{{AFX_MSG_MAP(CTreeViewToolTip)....// NOTE - the ClassWizard will add and remove mapping macros here....//}}AFX_MSG_MAP.. ON_NOTIFY_EX( TTN_NEEDTEXT, 0, OnToolTipNotify )..END_MESSAGE_MAP()..../////////////////////////////////////////////////////////////////////////////..// CTreeViewToolTip message handlers........// ------------------------------------------------------------..// TOOL TIPS..//..// ajouter dans le .cpp:..// remplacer les deux Wid1:: par le nom de la classe::..// dans l

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\TreeViewToolTip.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1321
    Entropy (8bit):5.353920508989734
    Encrypted:false
    SSDEEP:24:ggegbzl5g4cIWzoUKa/NfKfOhmk6PUjJ7U8rg7:ggegP4qWf3FfKfOgLPYl7rg7
    MD5:196163FD2375CCFB7CD6E26CB1A5D219
    SHA1:3DB3847DC4C9787DDACA092D77D1824139D1226B
    SHA-256:312A4F60A8F5D9F35975D2CD42897116E52718FC2AD42E7EF370CB2E6496589C
    SHA-512:AB6B5C8D40CB6F19AB3BFCC69EBD75ACA3FFD9C995D701388065DEED2ABD35501FAEA81ABA3F228254A8A323DB8B6A81C355E8BB4C3E8756949EA5CDBDC7D532
    Malicious:false
    Preview:#if !defined(AFX_TREEVIEWTOOLTIP_H__C5F45954_56A7_49B9_84B2_9C8BEBC46D08__INCLUDED_)..#define AFX_TREEVIEWTOOLTIP_H__C5F45954_56A7_49B9_84B2_9C8BEBC46D08__INCLUDED_....#if _MSC_VER > 1000..#pragma once..#endif // _MSC_VER > 1000..// TreeViewToolTip.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// CTreeViewToolTip window....class CTreeViewToolTip : public CToolTipCtrl..{..// Construction..public:...CTreeViewToolTip();....// Attributes..public:....// Operations..public:....// Overrides...// ClassWizard generated virtual function overrides...//{{AFX_VIRTUAL(CTreeViewToolTip)...//}}AFX_VIRTUAL....// Implementation..public:...virtual ~CTreeViewToolTip();.....// Generated message map functions..protected:.. char* GetTip(int id);...//{{AFX_MSG(CTreeViewToolTip)....// NOTE - the ClassWizard will add and remove member functions here....//}}AFX_MSG.. afx_msg BOOL OnToolTipNotify( UINT id, NMHDR * pNMHDR, LRESULT * pResult );.....DECLARE_M

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\Wid1.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):26283
    Entropy (8bit):5.3704197362326145
    Encrypted:false
    SSDEEP:768:7doBP9HlFeA7VzBXbvcpwhMWN3AjIQWD4qcolcWoctyzcPeclyJcBdcBSgkexduR:SN3AjiD4Ah3RloSgk+uRHltb
    MD5:6FA96FDEF6376FD7FD0834B6DD21465D
    SHA1:A5E6D06F4C9369D6746DBF4B9F1750536B380715
    SHA-256:40F64FF8DAD46D568C229668832187E80F5E3F64850433E309C81BEB16D5E35B
    SHA-512:4DDF70112011D2E5F4DC68DAB494F66C59A404506672E1EF8F341D4EC94A22986681AFCA499D0E058B91D6F916550851B51EB005F3F4AE12D87DFC89E228FA8F
    Malicious:false
    Preview:// Wid1.cpp : implementation file..//....#include "stdafx.h"..#include <afxole.h>..#include "oledlg.h"..#include "afxodlgs.h"....#include "Shell.h"..#include "Wid1.h"....#include "NewProj.h"..#include "XSHBrowseForFolder.h"....#include <WS2tcpip.h> // Note: weird C2894 error if not included here..extern "C" {.. #include "HTTrackInterface.h"..}....#include "about.h"..#include "InsertUrl.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....extern CNewProj* dialog0;....extern int binput(char* buff,char* s,int max);....extern int check_continue(char* path_log);..extern int cmdl_opt(char* s);..extern void Write_profile(CString path,int load_path);..extern void Read_profile(CString path,int load_path);..extern CShellApp* CShellApp_app;....// Helper..extern LaunchHelp* HtsHelper;....// reference sur objet..extern Wid1* dialog1;..../* Main WizTab frame */..#include "WizTab.h"..extern CWizTab* this_CWizTab;..../* Main splitter frame */..

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\Wid1.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2867
    Entropy (8bit):5.458337638766277
    Encrypted:false
    SSDEEP:48:JkfnC66Y1pMtgWqW6x33D4+2ffoO0s7DtWo9kH8UDY75fm6Vl7I:qfqapg0VdTfNERHs8AY75+6Vl7I
    MD5:03C01F338E416C357C214B5826621133
    SHA1:D30DA4249DAEEC1E0E28A171139F505D8ACB68D7
    SHA-256:50C0DDF1786B62EC93D98AB41040A042E08A01027846DF156B3F899767B8AD5D
    SHA-512:F0CD55B42D17EF49341D5E570CDBBD946AD592FF2CB5DEC98CF4F4BABABE19CCBEFC34F74E52D564B1C976E124970C37F7E2EEA8741346EB898F07D395901BD4
    Malicious:false
    Preview:#if !defined(AFX_WID1_H__8FF0CA01_F5EE_11D1_B222_006097BCBD81__INCLUDED_)..#define AFX_WID1_H__8FF0CA01_F5EE_11D1_B222_006097BCBD81__INCLUDED_....#include <afxole.h>..#include "EasyDropTarget.h"....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// Wid1.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// Wid1 dialog....class Wid1 : public CPropertyPage..{...DECLARE_DYNCREATE(Wid1)..// Construction..public:...Wid1(); // standard constructor...~Wid1(); // standard constructor.. void OnChangepathlog();.. static CString TextToUrl(CString st,CLIPFORMAT cfFormat);.. //...int filtreok;...int cancel;.. int direction;.. int url_status;.. int filelist_status;.. int depth_status;.. int log_flip;.. int mir_status;.. int proj_status;.. int continue_status;.. int LAST_ACTION;.. int interact; // entre les 2 champs...// Dialog Data...//{{AFX_DATA(Wid1)...enum { IDD = IDD_WIZ1 };...CStatic.m_mirtitle;...CComboBox.

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\WinHTTrack.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):23778
    Entropy (8bit):5.475761286229779
    Encrypted:false
    SSDEEP:384:drm76qVCEzTCUEok0Lm1k7kXK8nX2AWRYIgRpa:mf/Eok0ae7kXK8nXcYIge
    MD5:AC61BFA06857D7169AE27E305AB3583A
    SHA1:6830283EB753EC3C796D6C461CF7574CCD4064F9
    SHA-256:8D223D752408181D60A30494EEC001482A5F953C05A112621FBF1EBA1D0C46EF
    SHA-512:84FE83EE9EE1A6BD9E27F3AE965C94AE4D3949C777642FE68D345E6CC527A699F133B2B76EF7C86EAAA4FF34EEE4CF9485E76E3EC26D5511D1BE5766AE03DCF7
    Malicious:false
    Preview:// WinHTTrack.cpp : Defines the class behaviors for the application...//....#include "stdafx.h"..#include "WinHTTrack.h"....#include "Shell.h"....#include "wid1.h"..#include "maintab.h"....#include "MainFrm.h"..#include "splitter.h"..#include "about.h"....#include "WinHTTrackDoc.h"..#include "WinHTTrackView.h"....#include "inprogress.h"....#include "CrashReport.h"....// KB955045 (http://support.microsoft.com/kb/955045).// To execute an application using this function on earlier versions of Windows.// (Windows 2000, Windows NT, and Windows Me/98/95), then it is mandatary to #include Ws2tcpip.h.// and also Wspiapi.h. When the Wspiapi.h header file is included, the 'getaddrinfo' function is.// #defined to the 'WspiapiGetAddrInfo' inline function in Wspiapi.h. .#include <ws2tcpip.h>.#include <Wspiapi.h>.#ifndef getaddrinfo.#error getaddrinfo "should be defined".#define getaddrinfo WspiapiGetAddrInfo.#endif..../* HTS - HTTRACK */..extern "C" {.. #include "HTTrackInterface.h".. //#include

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\WinHTTrack.dsp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):13812
    Entropy (8bit):5.324265902180561
    Encrypted:false
    SSDEEP:384:pgT1rCcOBchLhLBzZIsq6T/giV4ake+wkcPXUv72e7Oo1+AjAWufzXCkBSn4FmLe:pgT1rCcOBchLhLBzZIsqTLq
    MD5:796E3916CD10AD2B0560C48F94AD542F
    SHA1:A9BAA9BFF70EA3C06BA2E67EEBC2409D3FD5B122
    SHA-256:9B25F3752B297EE30F9548F7D98ED78B9CCD2A95626511BBFAF2094005A460A3
    SHA-512:53F096BC16E5CFCB58C23E67E0218E287B25C5E2969D49DED26D5DFA2B42AC7145C538F45C5A2E136BF2C2104EA7AA0C212477D8AD52223745C9EAD64CEBBE19
    Malicious:false
    Preview:# Microsoft Developer Studio Project File - Name="WinHTTrack" - Package Owner=<4>..# Microsoft Developer Studio Generated Build File, Format Version 6.00..# ** DO NOT EDIT **....# TARGTYPE "Win32 (x86) Application" 0x0101....CFG=WinHTTrack - Win32 Debug..!MESSAGE This is not a valid makefile. To build this project using NMAKE,..!MESSAGE use the Export Makefile command and run..!MESSAGE ..!MESSAGE NMAKE /f "WinHTTrack.mak"...!MESSAGE ..!MESSAGE You can specify a configuration when running NMAKE..!MESSAGE by defining the macro CFG on the command line. For example:..!MESSAGE ..!MESSAGE NMAKE /f "WinHTTrack.mak" CFG="WinHTTrack - Win32 Debug"..!MESSAGE ..!MESSAGE Possible choices for configuration are:..!MESSAGE ..!MESSAGE "WinHTTrack - Win32 Release" (based on "Win32 (x86) Application")..!MESSAGE "WinHTTrack - Win32 Debug" (based on "Win32 (x86) Application")..!MESSAGE "WinHTTrack - Win32 Debug release" (based on "Win32 (x86) Application")..!MESSAGE ....# Begin Project..# PROP AllowPerCon

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\WinHTTrack.dsw (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):841
    Entropy (8bit):4.202538775239331
    Encrypted:false
    SSDEEP:12:zTYcgcg2NDr5tnEP2XEczz34FmMejzzYpzb:zacpjtnEP2XEAz3smBPz2zb
    MD5:5C9288AF00DD9FDEF33CC5AFDDEA62EC
    SHA1:161A1754077F658015A67B025C36490A371F8ECC
    SHA-256:02C20644425B4D3DB7586520DB00F2A090B7BBD05350640897DD547F06F04354
    SHA-512:A8C813CFBBB08E4C4D5C9D51D6EDA5D5EE6A174A1BD43BE360A97BB2E467009AA9A5226B87CF01D5FECF6E9BF420908A1E8F6F151B3525DA68BA4E909F83AFAA
    Malicious:false
    Preview:Microsoft Developer Studio Workspace File, Format Version 6.00..# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!....###############################################################################....Project: "WinHTTrack"=.\WinHTTrack.dsp - Package Owner=<4>....Package=<5>..{{{..}}}....Package=<4>..{{{.. Begin Project Dependency.. Project_Dep_Name libhttrack.. End Project Dependency..}}}....###############################################################################....Project: "libhttrack"=..\libhttrack\libhttrack.dsp - Package Owner=<4>....Package=<5>..{{{..}}}....Package=<4>..{{{..}}}....###############################################################################....Global:....Package=<5>..{{{..}}}....Package=<3>..{{{..}}}....###############################################################################....

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\WinHTTrack.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):3228
    Entropy (8bit):5.432666658734526
    Encrypted:false
    SSDEEP:96:dUrUxp/pY7UUYGrvRjRUg6dTQcH8qetaQBzUwP80wLf7dbuLWxKQl71pu:dzxVFw63HHeIouxxE
    MD5:33637BC47CD28273E26DAAC40F19F8BB
    SHA1:3EB0B9452152E038329047A00FA1033A93BE843B
    SHA-256:D3CA7F0ED5A71332F31AC0941793C62C2ADAABEC73F10655E91B79DB92D11E96
    SHA-512:C2DBC7D4C45B21001009554E13F54143CB45EF1AFB4CB038D9FFC936CA89DFEF3575B3D04D8BFFAAC095160BDA74490CE81FDCC45F8446A8B9F92B56C015C1CA
    Malicious:false
    Preview:// WinHTTrack.h : main header file for the WINHTTRACK application..//....#if !defined(AFX_WINHTTRACK_H__C54E332B_F6D3_4407_A9CC_77943F9B45CC__INCLUDED_)..#define AFX_WINHTTRACK_H__C54E332B_F6D3_4407_A9CC_77943F9B45CC__INCLUDED_....#if _MSC_VER > 1000..#pragma once..#endif // _MSC_VER > 1000....#ifndef __AFXWIN_H__...#error include 'stdafx.h' before including this file for PCH..#endif....#include "resource.h" // main symbols..#include "shell.h"..../////////////////////////////////////////////////////////////////////////////..// CWinHTTrackApp:..// See WinHTTrack.cpp for the implementation of this class..//....// En-t.te pour l'affichage des tabs..#include "NewProj.h"..#include "Wid1.h"..#include "trans.h"..#include "FirstInfo.h"..#include "inprogress.h"..#include "infoend.h"......class CWinHTTrackApp : public CWinApp..{..public:...CWinHTTrackApp();...~CWinHTTrackApp();.. void NewTabs(); /* recr.er control tabs */.. //.. CFirstInfo* m_tab0;.. CNewProj* m_t

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\WinHTTrack.rc (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):96302
    Entropy (8bit):5.10253160113025
    Encrypted:false
    SSDEEP:1536:4NltKTSf2zjSjjvfx+lIQuzHFCLBAI1ltvzn2jcjkr6LDEOwVx912zy0TdsGALJB:4offwVx912O0T+GALJNbkAIyNo455hdV
    MD5:FDA463C5C79CEDDA3812884F055F1290
    SHA1:AE682EB75114870B2CA5B3D5DB337BBAA9AD7657
    SHA-256:CC61FEB72220B757393FB070A720116E8B9E630DD4D28BE24D23F325229D4CB9
    SHA-512:378A3F98125F6D25B3EBBB82CFD9601A75AC3F2DEEEE70828C13CD55059A3AE9FE807B499E3C90F5A863877DAF13CC42773EDD24D5F75465A91B2D1723C52D43
    Malicious:false
    Preview:// Microsoft Visual C++ generated resource script...//..#include "resource.h"....#define APSTUDIO_READONLY_SYMBOLS../////////////////////////////////////////////////////////////////////////////..//..// Generated from the TEXTINCLUDE 2 resource...//..#include "afxres.h"..../////////////////////////////////////////////////////////////////////////////..#undef APSTUDIO_READONLY_SYMBOLS..../////////////////////////////////////////////////////////////////////////////..// English (U.S.) resources....#if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_ENU)..#ifdef _WIN32..LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US..#pragma code_page(1252)..#endif //_WIN32..../////////////////////////////////////////////////////////////////////////////..//..// Icon..//....// Icon with lowest ID value placed first to ensure application icon..// remains consistent on all systems...IDR_MAINFRAME ICON "res\\Shell.ico"..IDR_WINHTTTYPE ICON "res\\Shell.ico"..IDI_

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\WinHTTrack.sln (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):64869
    Entropy (8bit):5.393001067858612
    Encrypted:false
    SSDEEP:1536:XCaYfsCbdTZKgaUeoqI3BPN7xP579z5f9zVucOgy0OES1DnAS70u/dT1zpTFiYSe:b
    MD5:7302B0D7172C833356BD0D441CE13FA8
    SHA1:DD2EB1838145C75F9803854F71F765E88CB54DDF
    SHA-256:4B047EB3CCC319439862E902B1A2FFC5DDE043CF75F9EE59D44476F94C218886
    SHA-512:CA29536D06CF2E31C792C8E81BBDD9F52882E377916127B7FE33AF74D3AABB92C44726E3A8DA4190993DFB32D1DFC292B1F3A81664F10EA132316E165F5B2E32
    Malicious:false
    Preview:Microsoft Visual Studio Solution File, Format Version 10.00..# Visual Studio 2008..Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "WinHTTrack", "WinHTTrack.vcproj", "{4707CDEB-E576-4664-98A8-94D99BA190B8}"...ProjectSection(ProjectDependencies) = postProject....{2F353408-2C6C-4D31-9AC0-08BDC064DF64} = {2F353408-2C6C-4D31-9AC0-08BDC064DF64}....{A8989022-60C3-4B84-8768-8967DC4DE06E} = {A8989022-60C3-4B84-8768-8967DC4DE06E}....{E76AD871-54C1-45E8-A657-6117ADEFFB46} = {E76AD871-54C1-45E8-A657-6117ADEFFB46}...EndProjectSection..EndProject..Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libhttrack", "..\libhttrack\libhttrack.vcproj", "{E76AD871-54C1-45E8-A657-6117ADEFFB46}"...ProjectSection(ProjectDependencies) = postProject....{8FD826F8-3739-44E6-8CC8-997122E53B8D} = {8FD826F8-3739-44E6-8CC8-997122E53B8D}...EndProjectSection..EndProject..Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "httrack", "..\httrack.vcproj", "{D0E894E7-F64C-4722-9807-9ABB1054D43A}"...ProjectSection(Pro

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\WinHTTrack.suo (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Composite Document File V2 Document, Cannot read section info
    Category:dropped
    Size (bytes):15360
    Entropy (8bit):3.2724477704253823
    Encrypted:false
    SSDEEP:192:43qhLH78VaeAhYm/zvFzCbs+ieTjrGdKEsSWkl+DlcB0DSeyxO:QeLbGaEm7dzxThK11kEDmCWzO
    MD5:975C59B9D4319284F6C94038DCA0C90C
    SHA1:5ABC683BC0A9EC2362184CF14D40184E033A42A9
    SHA-256:06357CF34C52840A9AA04013DF60C074A3B4C11D8F1A744DFC5576D08B564322
    SHA-512:ACEBA1D56DB0B56279570CB24979DAEF0A563CB1DBD25B7A2EA0C8A7A0BC0EB4EDEE2B558D59F8C04C42AEFD4CCBBB9425768713209EAED49D39A4171291169A
    Malicious:false
    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\WinHTTrack.vcproj (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):110327
    Entropy (8bit):4.770219261755178
    Encrypted:false
    SSDEEP:384:Bfacu6eypacu6eKkDuYzWHuiqOsu3zcNunSOvfqfw+R+iznUvfqfw+R+iznQvfqF:xacdeeacdeXDzSHlvsEIN8M
    MD5:68D599791817FF80EF4273F37A93B7EE
    SHA1:23FD8A0733C7CA3E0B8BC15F755F880AB4A1AF58
    SHA-256:70D548B2B1D66964AB03F617430709080A550346811AC7F579CF49A6C62E5804
    SHA-512:167CB2E7FCE8A439769D90E5907440B9FFD0AE572172EEB2065E441E528C6C866649B782C816CFE6A2B6C81CD84FDE11FC214E026BC6DCD289B8D44E3EE8BE92
    Malicious:false
    Preview:<?xml version="1.0" encoding="Windows-1252"?>..<VisualStudioProject...ProjectType="Visual C++"...Version="9,00"...Name="WinHTTrack"...ProjectGUID="{4707CDEB-E576-4664-98A8-94D99BA190B8}"...RootNamespace="WinHTTrack"...Keyword="MFCProj"...TargetFrameworkVersion="131072"...>...<Platforms>....<Platform.....Name="Win32"..../>....<Platform.....Name="x64"..../>...</Platforms>...<ToolFiles>...</ToolFiles>...<Configurations>....<Configuration.....Name="Debug release|Win32".....OutputDirectory="c:\temp\VCDebug".....IntermediateDirectory="c:\temp\VCDebug".....ConfigurationType="1".....InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops".....UseOfMFC="2".....ATLMinimizesCRunTimeLibraryUsage="false".....CharacterSet="2".....>.....<Tool......Name="VCPreBuildEventTool"...../>.....<Tool......Name="VCCustomBuildTool"...../>.....<Tool......Name="VCXMLDataGeneratorTool"...../>.....<Tool......Name="VCWebServiceProxyGeneratorTool"...../>.....<Tool......Name="VCMIDLTool"......

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\WinHTTrackDoc.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):4814
    Entropy (8bit):5.197574594102746
    Encrypted:false
    SSDEEP:96:dU4EZBRM2adQP6httyxl6OmFD/18Bs/V9OLmK6xuLz4xdjTjTpp3dxZx7NGgg6Sm:doLWfF2BxCE0/pp3Xb7Ug8zfBDp1RJRC
    MD5:2A5A01896D2B968784F6D5F60C30F041
    SHA1:E4DF22F9B837CDBF84EB6DFB23796C64149FE860
    SHA-256:4E71D764BAF8FC7F87E5E6B6778ABEB8BC3B7A4C45D0AFE11AC4FB5056C6E27B
    SHA-512:CAC618588BF6EEA46FB0185699560E9FD806932E68A71F72F7728BA76CB4AADAF3674480155FBDE0E10CDF70F32AB8EA3AA6AB0AF0CA782238CB06292424D178
    Malicious:false
    Preview:// WinHTTrackDoc.cpp : implementation of the CWinHTTrackDoc class..//....#include "stdafx.h"..#include "WinHTTrack.h"....#include "WinHTTrackDoc.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....extern "C" {.. #include "HTTrackInterface.h"..}..../* dialog0 */..#include "NewProj.h"..extern CNewProj* dialog0;..../* Main WizTab frame */..#include "WizTab.h"..extern CWizTab* this_CWizTab;....// dirtreeview..#include "DirTreeView.h"..extern CDirTreeView* this_DirTreeView;..../////////////////////////////////////////////////////////////////////////////..// CWinHTTrackDoc....IMPLEMENT_DYNCREATE(CWinHTTrackDoc, CDocument)....BEGIN_MESSAGE_MAP(CWinHTTrackDoc, CDocument)...//{{AFX_MSG_MAP(CWinHTTrackDoc)....// NOTE - the ClassWizard will add and remove mapping macros here.....// DO NOT EDIT what you see in these blocks of generated code!...//}}AFX_MSG_MAP..END_MESSAGE_MAP()..../////////////////////////////////////////////////////////

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\WinHTTrackDoc.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1660
    Entropy (8bit):5.444124660884002
    Encrypted:false
    SSDEEP:48:dXEnEPNBNZEHWEfAEMqWZEu5WVPWVo3LEYu8ETf7LPYl71NY:dUEPXYHDZDtQuPuqwtTf3Ql712
    MD5:7101C69E49F062BB09BFCBE5C2FD5AE1
    SHA1:E190A3B9D25D318A54C573F425ACC4D306285B70
    SHA-256:E8C665855B4635B5CEF101BFFE56D3A902479C5D6091928C0D9D18BD23B43B97
    SHA-512:3813DECD43AA6A37D9459A4D878EC7D1229DC31699BB01017D4AC38D7DB9F8EC93C1BFB98B2CC39E20D141DDA1E6481F9E1C5C5C6887F9CECB7AFE60BB91554D
    Malicious:false
    Preview:// WinHTTrackDoc.h : interface of the CWinHTTrackDoc class..//../////////////////////////////////////////////////////////////////////////////....#if !defined(AFX_WINHTTRACKDOC_H__2DCA7A1F_3A25_4E86_A859_31511341823A__INCLUDED_)..#define AFX_WINHTTRACKDOC_H__2DCA7A1F_3A25_4E86_A859_31511341823A__INCLUDED_....#if _MSC_VER > 1000..#pragma once..#endif // _MSC_VER > 1000......class CWinHTTrackDoc : public CDocument..{..protected: // create from serialization only...CWinHTTrackDoc();...DECLARE_DYNCREATE(CWinHTTrackDoc)....// Attributes..public:....// Operations..public:....// Overrides...// ClassWizard generated virtual function overrides...//{{AFX_VIRTUAL(CWinHTTrackDoc)...public:...virtual BOOL OnNewDocument();...virtual void Serialize(CArchive& ar);...virtual BOOL OnSaveDocument(LPCTSTR lpszPathName);.. virtual BOOL OnOpenDocument(LPCTSTR lpszPathName);...virtual void OnCloseDocument();...//}}AFX_VIRTUAL....// Implementation..public:...virtual ~CWinHTTrackDoc();..#ifdef _DEBUG...virtual

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\WinHTTrackView.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2007
    Entropy (8bit):4.996517047478625
    Encrypted:false
    SSDEEP:48:dXEeEDpoEgEKoE+EGHEKEcEcZElETEqBEhEeZEXoQCdYBbEnED+E6oPEPVEedH+D:dUbdZBKZ7Tf1c6eIqySe6XTgEf6o8Put
    MD5:7C188C6D4101B8A74A1A7A266396F05E
    SHA1:59BCC708290A82243893C301836013B9F55FC2BC
    SHA-256:DD2E72AAC37C4075DC8B2D8B506FA25B4445858166AC7F053684097C51DD2AE4
    SHA-512:C4D4826B5F324EFB76D82234FF1460C2A35EAE80EC3E87286B183CA6525173E8FE5040BC4F5DF99A95BD982842C1247FE12CDC0E66F2249C2397ACCDA4DB67E1
    Malicious:false
    Preview:// WinHTTrackView.cpp : implementation of the CWinHTTrackView class..//....#include "stdafx.h"..#include "WinHTTrack.h"....#include "WinHTTrackDoc.h"..#include "WinHTTrackView.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../////////////////////////////////////////////////////////////////////////////..// CWinHTTrackView....IMPLEMENT_DYNCREATE(CWinHTTrackView, CView)....BEGIN_MESSAGE_MAP(CWinHTTrackView, CView)...//{{AFX_MSG_MAP(CWinHTTrackView)....// NOTE - the ClassWizard will add and remove mapping macros here.....// DO NOT EDIT what you see in these blocks of generated code!...//}}AFX_MSG_MAP..END_MESSAGE_MAP()..../////////////////////////////////////////////////////////////////////////////..// CWinHTTrackView construction/destruction....CWinHTTrackView::CWinHTTrackView()..{...// TODO: add construction code here....}....CWinHTTrackView::~CWinHTTrackView()..{..}....BOOL CWinHTTrackView::PreCreateWindow(CREATESTRUCT& cs).

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\WinHTTrackView.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1782
    Entropy (8bit):5.449657890981836
    Encrypted:false
    SSDEEP:48:dXEIEIa9ta99EuWEUAE3E1qWZEdTL3LEvu8Eef7Z3XEOEWElEKPYl71a9M:dU5IytymuDM0EtdTDwIefFUrDeKQl71z
    MD5:BCB292110F44E98B819BA2532D7D88D2
    SHA1:2D6A7F0646FE808440040581510E2BB77940C1EF
    SHA-256:89850EE6440B93FA19AA779EA96A98A05BA6CD61C0A60BA33652F5356B3A3AFF
    SHA-512:78ACD4FACE0395A2BB513EFC717B3114EB8FFA85218DDC84DC3C2CC2969D74101FEA3C69BD933DEA4D20E1D78FE71A012107B2BFEA4E5E21E8F4B8D091F24512
    Malicious:false
    Preview:// WinHTTrackView.h : interface of the CWinHTTrackView class..//../////////////////////////////////////////////////////////////////////////////....#if !defined(AFX_WINHTTRACKVIEW_H__812065CF_6988_4DE1_857D_61123451A159__INCLUDED_)..#define AFX_WINHTTRACKVIEW_H__812065CF_6988_4DE1_857D_61123451A159__INCLUDED_....#if _MSC_VER > 1000..#pragma once..#endif // _MSC_VER > 1000......class CWinHTTrackView : public CView..{..protected: // create from serialization only...CWinHTTrackView();...DECLARE_DYNCREATE(CWinHTTrackView)....// Attributes..public:...CWinHTTrackDoc* GetDocument();....// Operations..public:....// Overrides...// ClassWizard generated virtual function overrides...//{{AFX_VIRTUAL(CWinHTTrackView)...public:...virtual void OnDraw(CDC* pDC); // overridden to draw this view...virtual BOOL PreCreateWindow(CREATESTRUCT& cs);...protected:...//}}AFX_VIRTUAL....// Implementation..public:...virtual ~CWinHTTrackView();..#ifdef _DEBUG...virtual void AssertValid() const;...virtual void Dump

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\WizLinks.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):2755
    Entropy (8bit):5.476139663211629
    Encrypted:false
    SSDEEP:48:EpzkWATgf09vCWdCVidFB1im9BaBFBGW0B2BlBQBpB6eLfgBykhRwW4yQL:Az3x09aW8VidFB8sBaBFB90B2B7QBpB5
    MD5:F37BC4B2853864D224BEDEB168680B59
    SHA1:719A0479A6B70741DC8E7D4D875F55F11FA58162
    SHA-256:A507610715AD525E5EA24F89613283CD38602F52A310F36E431B34567BD241FC
    SHA-512:07D35180964E0EE1F6D71B51B4AA521D79791E82E32109B7928FB6606B86A21A87C849B2CD1E07A0D818F67D5B261B6B89CFB9C3BA070C89F1BAB87A4E49FAEA
    Malicious:false
    Preview:// WizLinks.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "WizLinks.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..extern HICON httrack_icon;..../////////////////////////////////////////////////////////////////////////////..// WizLinks dialog......WizLinks::WizLinks(CWnd* pParent /*=NULL*/)...: CDialog(WizLinks::IDD, pParent)..{...//{{AFX_DATA_INIT(WizLinks)...m_lnk = -1;...m_url = _T("");...//}}AFX_DATA_INIT..}......void WizLinks::DoDataExchange(CDataExchange* pDX)..{...CDialog::DoDataExchange(pDX);...//{{AFX_DATA_MAP(WizLinks)...DDX_Radio(pDX, IDC_ch1, m_lnk);...DDX_Text(pDX, IDC_URL, m_url);...//}}AFX_DATA_MAP..}......BEGIN_MESSAGE_MAP(WizLinks, CDialog)...//{{AFX_MSG_MAP(WizLinks)...ON_BN_CLICKED(IDskipall, Onskipall)...ON_WM_DESTROY()...ON_WM_TIMER()...//}}AFX_MSG_MAP...ON_COMMAND(ID_HELP, OnHelp)..END_MESSAGE_MAP()....///////////////////////////////////////////////////////////////////

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\WizLinks.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1390
    Entropy (8bit):5.530158574253851
    Encrypted:false
    SSDEEP:24:5iVzlHPUvAyWtm24cIWzGNuwHGUKaAinrlkDVJ7U8cK:5iBVPiUtm2qWyx3prl8Vl7cK
    MD5:AEA68509AD1F23FF45BF6989CA70D7D5
    SHA1:7DE65CF683AE0346B8699B71D55CF29EE8D125C2
    SHA-256:84F1098F69264675288A7300CAA55B22406031AAA2260F967FBC2669A84ADA00
    SHA-512:5D48E15DA73F2FE66E4310EEF0097FB2D523136335934692B14166FEB182293D46856723D2DFA72BEDB0C07B6E5AA93EAFDCF3BF3C04E8E8D98DC88D73480DB6
    Malicious:false
    Preview:#if !defined(AFX_WIZLINKS_H__1D129B83_1981_11D2_A290_60D144C12802__INCLUDED_)..#define AFX_WIZLINKS_H__1D129B83_1981_11D2_A290_60D144C12802__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// WizLinks.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// WizLinks dialog....class WizLinks : public CDialog..{.. // gestion timer flash.. bool wflag; .. UINT_PTR tm;....// Construction..public:...WizLinks(CWnd* pParent = NULL); // standard constructor....// Dialog Data...//{{AFX_DATA(WizLinks)...enum { IDD = IDD_wizard_lnk };...int..m_lnk;...CString.m_url;...//}}AFX_DATA......// Overrides...// ClassWizard generated virtual function overrides...//{{AFX_VIRTUAL(WizLinks)...public:...virtual INT_PTR DoModal();...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protected:.....// Generated message map functions...//{{AFX_MSG(WizLinks)...af

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\WizTab.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):7867
    Entropy (8bit):5.453708752572845
    Encrypted:false
    SSDEEP:192:l22VFm4DXReUQ9lQ4c3vV6gxwPyn9kQzs5N94n:l22VFm4DBeUQDQ4eV6gxF9kQzeNCn
    MD5:A740A85144BA5B3C22E576F1212EB5F9
    SHA1:07149F5BD78FFDC25A6E381163B094E3EBC594FD
    SHA-256:FC15A6CEF32AEB2BA1B93F69FBA5A94DB4917517401E5C6A58ECFD91D73B7B23
    SHA-512:F0AEA30FF48144AE59B837C82FEA89C22965C7106C2A9DF1238B30F0AD1540A41AD5058587C17795C0F44FBBA5C5057C249F7CB23EA622DAA72DA8DB67A91913
    Malicious:false
    Preview:// Tab Control Principal....#include "stdafx.h"..#include "Shell.h"..#include "WizTab.h"..#include "direct.h"....#include "winsvc.h "....#include "windows.h"..#include <stdio.h>..#include <stdlib.h>..#include <string.h>....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....CWizTab* this_CWizTab;..CWizTab* this_intCWizTab;..CWizTab* this_intCWizTab2;....// Icone HTTrack..extern HICON httrack_icon;....// Instance WinHTTrack..#include "WinHTTrack.h"..extern CWinHTTrackApp* this_app;....// Helper..extern LaunchHelp* HtsHelper;..extern CMainTab* maintab;..../* Main splitter frame */..#include "DialogContainer.h"..#include "splitter.h"..extern CSplitterFrame* this_CSplitterFrame;..../////////////////////////////////////////////////////////////////////////////..// CWizTab....IMPLEMENT_DYNAMIC(CWizTab, CPropertySheet)....CWizTab::CWizTab(UINT nIDCaption, CWnd* pParentWnd, UINT iSelectPage)..:CPropertySheet(nIDCaption, pParentWnd, iSelectPage)

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\WizTab.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):2085
    Entropy (8bit):5.382601798690171
    Encrypted:false
    SSDEEP:48:uJ11E11RRGrvRfbRDMbaropMnopMhpz+o6B0m4yT28hqwpsXKgf20s3W7WxxXX:uJ1i1JGrvRjRDMaroanoahd76B0a28hB
    MD5:846AF0FB8A5A2BD5CC3604DD47DE6228
    SHA1:A1501FB67F52F48D456EAD32FCBF981F1F240FF8
    SHA-256:0BD1A9A875D5CEA80389C25B2EEF549CA404CE69DF8D27AB23B89EDA96AE88C9
    SHA-512:323DCDC3CE02542C7B50716409622DFBAB2C54C39853F26215BD7C98FD10EEC238AB44EDAAC898E69AA2A56671A3BE71AE687B64AD8E2FC9E9ACFCF6A67F075F
    Malicious:false
    Preview:#if !defined(__WizTab_H_HSGFYZEGCHXHVCHD52485454857545)..#define __WizTab_H_HSGFYZEGCHXHVCHD52485454857545....// Tab Control Principal....// En-t.te pour l'affichage des tabs..#include "NewProj.h"..#include "Wid1.h"..#include "trans.h"..#include "FirstInfo.h"..#include "inprogress.h"..#include "infoend.h"....class CWizTab : public CPropertySheet..{.. DECLARE_DYNAMIC(CWizTab).. ..private:.. int is_inProgress;.... // Construction..public:.. CWizTab(UINT nIDCaption, CWnd* pParentWnd = NULL, UINT iSelectPage = 0);.. CWizTab(LPCTSTR pszCaption, CWnd* pParentWnd = NULL, UINT iSelectPage = 0);.. CWizTab(LPCTSTR pszCaption, int num, CWnd* pParentWnd = NULL, UINT iSelectPage = 0);.. ..protected:.. void AddControlPages(void);.. .. // Attributes..public:.. // D.claration des classes-dialog pour les diff.rents Tab Control.. CFirstInfo* m_tab0;.. CNewProj* m_tab1;.. Wid1* m_tab2;.. Ctrans* m_tab3;.. Cinprogress* m_tabprogress;.. Cinfoe

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\Wizard.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):1582
    Entropy (8bit):5.343163979184146
    Encrypted:false
    SSDEEP:24:xJu7plpl7/ezvbueL1oAtcmbRTYQAJ5CUkeNgCv/EY/E5VvIZd3PuipmaBEbkz:opzMloAjbtYj5z3sVidWiJBcm
    MD5:2358C8061DAF592FBD37229A04BD2A75
    SHA1:C61A81F55B5C9CC847F4A3A6AA3796D33CA8E8C1
    SHA-256:08CEA7E51ABC9F1EF0212912EA352C2318908D12CB498CD6C5894230D1049FCD
    SHA-512:08697D7DAFA27A84B4A237824485D323DB5CB74E0100D47DA03A1EE979C490728332FA9DF8DB376EECE2D4FB36E156BACABB049562D2115805288CA1DBAD9E67
    Malicious:false
    Preview:// wizard.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "wizard.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..extern HICON httrack_icon;..../////////////////////////////////////////////////////////////////////////////..// wizard dialog......wizard::wizard(CWnd* pParent /*=NULL*/)...: CDialog(wizard::IDD, pParent)..{...//{{AFX_DATA_INIT(wizard)...m_reponse = _T("");...m_question = _T("");...//}}AFX_DATA_INIT..}......void wizard::DoDataExchange(CDataExchange* pDX)..{...CDialog::DoDataExchange(pDX);...//{{AFX_DATA_MAP(wizard)...DDX_Text(pDX, IDC_reponse, m_reponse);...DDX_Text(pDX, IDC_question, m_question);...//}}AFX_DATA_MAP..}......BEGIN_MESSAGE_MAP(wizard, CDialog)...//{{AFX_MSG_MAP(wizard)...//}}AFX_MSG_MAP...ON_COMMAND(ID_HELP, OnHelp)..END_MESSAGE_MAP()..../////////////////////////////////////////////////////////////////////////////..// wizard message handlers....BOOL wizard::OnInitDia

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\Wizard2.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):1722
    Entropy (8bit):5.513517334171567
    Encrypted:false
    SSDEEP:24:xu7plpl7PezvEnunuSAtUFQE3AGYckex6v/EY/ESiVvIZd3PuipmrVABBrMkj14j:Gpz5nMbAKP2s6CVidWiGVABdM04W4HSu
    MD5:11DA65434E4AF26DC724BC3E39880115
    SHA1:5724BCF7055E7747C26F18D6AE297E3A397976CA
    SHA-256:5D6792A571BC678335EB70AE806298E2A73FB4EE50A234589125807ABFBE236F
    SHA-512:A589907B15C53F26FCE0564E589E7FEEE4D0CA08A700666CBEF31AF59E6B0A3112CDAA0F834BB738D9F6C7405D2F2D6C714AC1FA6C07A878DCCE6221D0C817EC
    Malicious:false
    Preview:// wizard2.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "wizard2.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..extern HICON httrack_icon;....../////////////////////////////////////////////////////////////////////////////..// wizard2 dialog......wizard2::wizard2(CWnd* pParent /*=NULL*/)...: CDialog(wizard2::IDD, pParent)..{...//{{AFX_DATA_INIT(wizard2)...m_question = _T("");...//}}AFX_DATA_INIT..}......void wizard2::DoDataExchange(CDataExchange* pDX)..{...CDialog::DoDataExchange(pDX);...//{{AFX_DATA_MAP(wizard2)...DDX_Text(pDX, IDC_question, m_question);...//}}AFX_DATA_MAP..}......BEGIN_MESSAGE_MAP(wizard2, CDialog)...//{{AFX_MSG_MAP(wizard2)...ON_WM_TIMER()...ON_WM_DESTROY()...//}}AFX_MSG_MAP...ON_COMMAND(ID_HELP, OnHelp)..END_MESSAGE_MAP()........BOOL wizard2::OnInitDialog() ..{...CDialog::OnInitDialog();..... SetIcon(httrack_icon,false);.. SetIcon(httrack_icon,true); ..... tm=SetTim

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\XSHBrowseForFolder.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):8985
    Entropy (8bit):5.205348387996107
    Encrypted:false
    SSDEEP:192:joiXUAcN+/TD/hdfmm2guJu0vMPNTLxH4uUuUdbSoNc0:hERELD/hdfg4VsOoNP
    MD5:5493B6CCA9485D122B74D616A70C77DF
    SHA1:38532604877A24A42F6360091A1491AEB27052A1
    SHA-256:5834A663CC55495AE17E1EA1625E43DE1D37EA6280405A15DBEE97CAC5E5068C
    SHA-512:681081BDD45B7B56B953CF6082C94D0D4B6F4276AF6D449C026EF07E38F7E3E4B56C647C76CC43A8A1AC32129C57C3305AFAF804C37F12D8DA107FD6BE39301A
    Malicious:false
    Preview:// ----------------------------------------------------------------------..// 'extended' SHBrowseForFolder routine. ('New folder' button added)..// Written by Xavier Roche, with the help of Gil Rosin, ..// Todd Fast's routines from Pencilneck Software and other Usenet contributors...// Freeware, but no warranty!..// ..// Usage: (example)..// CString path = XSHBrowseForFolder(this->m_hWnd,"Select path","c:\\") {..//..// To DO:..//..// #include "XSHBrowseForFolder.h"..//..// Then Add to the .rc file:..//..// IDD_NewFolder DIALOG DISCARDABLE 0, 0, 237, 46..// STYLE DS_MODALFRAME | WS_POPUP | WS_CAPTION | WS_SYSMENU..// CAPTION "Create New Folder"..// FONT 8, "MS Sans Serif"..// BEGIN..// EDITTEXT IDC_Folder,7,7,167,14,ES_AUTOHSCROLL..// DEFPUSHBUTTON "OK",IDOK,180,7,50,14..// PUSHBUTTON "Cancel",IDCANCEL,180,24,50,14..// END..// ----------------------------------------------------------------------....// TODO: Put in XSHBrowseForFolder.h your ressource definitio

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\XSHBrowseForFolder.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1242
    Entropy (8bit):5.1777517901423895
    Encrypted:false
    SSDEEP:24:Br1y3oY0oFHIvP1hAOtoy8y5qKgMBgMkedAAIlA51IfmFkImQ2pDX2C9MMn9Rmo0:d1Yd6zAO+Mq8r3RIKmybyXPMmRcZX
    MD5:4F8F53ABE0A9FD6B9EB214C2D311D51B
    SHA1:73115A97CA3A3211A318786BEF84CFD7542D7C83
    SHA-256:B98D040188CEDA0F36B208014F8413033B001266F0201B9AF3B49185F89D1B5D
    SHA-512:81590374E5263ED09D5D31C6B6CAC234CC9794857F39765A61FEE58364BC53FB99C528074C2ECA5EE20E4E5D99F8F772C89EF7BBEC3C67F19474E7A370AAC672
    Malicious:false
    Preview:// ----------------------------------------------------------------------..// 'extended' SHBrowseForFolder routine. ('New folder' button added)..// Written by Xavier Roche, with the help of Gil Rosin, ..// Todd Fast's routines from Pencilneck Software and other Usenet contributors...// ..// Usage: (example)..// CString path = XSHBrowseForFolder(this->m_hWnd,"Select path","c:\\") {..//..// Freeware, but no warranty!..//..// #include "NewFolder.h" for Input dialog (new folder)..// #include <direct.h> for _mkdir..// ----------------------------------------------------------------------....#if !defined(__XSHBrowseForFolder_routines)..#define __XSHBrowseForFolder_routines ....// TODO: Put here your ressource definition..#include "resource.h"..#include "NewFolder.h"....#include <direct.h>..#include "shlobj.h"....#define XSHBrowseForFolder_SETSTRING 1234..#define XSHBrowseForFolder_OK 1....CString XSHBrowseForFolder (HWND hwnd,char* title,char* _path);..LRESU

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\about.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):7279
    Entropy (8bit):5.440649525053119
    Encrypted:false
    SSDEEP:192:40Jx6LI9IN45cYO+Irj1Pfnw94eRjbqRIejbs:40i0o45cYO7j1XnwC/If
    MD5:4E787379CEBF63255A6318E28E901DA4
    SHA1:49E33A3931B5BCCE70C286963C2A01E4822727D6
    SHA-256:0B477AE6F33F0E1978E99D58009D4185C4966A86BC38A958D26DDC6F9989DB09
    SHA-512:3EDEE4DC3D7008C1BE1E0F7C5565BD341AE891BD27EF984AC76E452DE94A1D31FE2DFC9DB0572CCF4C4C1CB80E246A34E77055E462BAA302D8E3099E359EFAEB
    Malicious:false
    Preview:// about.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "about.h"..//#include "about_sh.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....//extern "C" {..// #include "htsbase.h"..//}....extern HICON httrack_icon;..extern CString _HTTRACK_VERSION;....extern int LANG_T(int);..// Helper..extern LaunchHelp* HtsHelper;..extern "C" {.. #include "HTTrackInterface.h".. #include "httrack-library.h"..}..../////////////////////////////////////////////////////////////////////////////..// Cabout dialog......Cabout::Cabout(CWnd* pParent /*=NULL*/)...: CDialog(Cabout::IDD, pParent)..{...//{{AFX_DATA_INIT(Cabout)...m_infover = _T("");...m_lang = -1;...//}}AFX_DATA_INIT..}......void Cabout::DoDataExchange(CDataExchange* pDX)..{...CDialog::DoDataExchange(pDX);...//{{AFX_DATA_MAP(Cabout)...DDX_Control(pDX, IDC_SPLASH, m_splash);...DDX_Control(pDX, IDC_lang, m_ctl_lang);...DDX_Text(pDX, IDC_INFOVER, m_infover

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\about.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1597
    Entropy (8bit):5.53168336378504
    Encrypted:false
    SSDEEP:24:ARVD5llWAyafx2c5N4cIWzxuwHGUKaTiyQ0HMEs+o+ihtkDVJ7U8zK:ARp5rW0fxfNqWDx3PQ0sV+o+ij8Vl7zK
    MD5:57BEDA123F09A2415F499D11CEFBBFBA
    SHA1:6B0FF65E5B532704F6B948D7D489085236E4A2CC
    SHA-256:94BF0548D3D39709CCE3DA2464FAA10FBF0FC46723921272A31C410FF093A02D
    SHA-512:D82820F2E1AFD047E24B2B1C0A626EE4FDA4699859E52B7186E0FE3184C243BA1ACAE56C844FEB6E6D837072FADD7E17769E2F10309BEF2E5AA810F4B5C78E2D
    Malicious:false
    Preview:#if !defined(AFX_ABOUT_H__E4D816E1_19A9_11D2_A290_60D144C12802__INCLUDED_)..#define AFX_ABOUT_H__E4D816E1_19A9_11D2_A290_60D144C12802__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// about.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// Cabout dialog....class Cabout : public CDialog..{..// Construction..public:...Cabout(CWnd* pParent = NULL); // standard constructor.. char* GetTip(int id);....// Dialog Data...//{{AFX_DATA(Cabout)...enum { IDD = IDD_ABOUT };...CStatic.m_splash;...CComboBox.m_ctl_lang;...CString.m_infover;...int..m_lang;...//}}AFX_DATA......// Overrides...// ClassWizard generated virtual function overrides...//{{AFX_VIRTUAL(Cabout)...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protected:.. void OnHelpInfo2();.. void setlang();.... HCURSOR currentCurs;.....// Generated message map functions...//{{AFX

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\cpp_lang.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):17274
    Entropy (8bit):4.673348347540594
    Encrypted:false
    SSDEEP:192:OALOEtqkQ/sVKCvHVptwpnJDf3cTtuDV+kBH4PZUWoxd+6tnATLYmrYr1YMj+kU0:OAg7QgYazqLrVkB
    MD5:DF2755C3639BF0127B8392F4DFBA226A
    SHA1:DECBF6405856B2AB51D5B8E94F6062D63D60F7B3
    SHA-256:5342BBF7E3630D3596D614894EA137345CF62690E01D10CF384FBC738F9134E2
    SHA-512:EB8D6BB2A276E15B8FE65A79AEADE7C7F4A7A4FF248A03AFBEFB8F2EB98C7183063BE629677AE5DE1C8D359A007D8B3C437E6A496F6CFDF0C184D9AADEFA4FF0
    Malicious:false
    Preview:/* Generated by cpp_lang_make */..#ifndef HTS_CPPLANG_H.#define HTS_CPPLANG_H...#define LANGUAGE_NAME LANGSEL("LANGUAGE_NAME")..#define LANGUAGE_ISO LANGSEL("LANGUAGE_ISO")..#define LANGUAGE_CHARSET LANGSEL("LANGUAGE_CHARSET").#define LANGUAGE_WINDOWSID LANGSEL("LANGUAGE_WINDOWSID").#define LANG_OK LANGSEL("LANG_OK").#define LANG_CANCEL LANGSEL("LANG_CANCEL").#define LANG_QUIT LANGSEL("LANG_QUIT").#define LANG_CLOSE LANGSEL("LANG_CLOSE").#define LANG_TIPCANCEL LANGSEL("LANG_TIPCANCEL").#define LANG_TIPOK LANGSEL("LANG_TIPOK").#define LANG_TIPHELP LANGSEL("LANG_TIPHELP").#define LANG_TIPPREV LANGSEL("LANG_TIPPREV").#define LANG_TIPNEXT LANGSEL("LANG_TIPNEXT").#define LANG_HIDEPWD LANGSEL("LANG_HIDEPWD").#define LANG_SAVEPROJECT LANGSEL("LANG_SAVEPROJECT").#define LANG_CLOSEPRJ LANGSEL("LANG_CLOSEPRJ").#define LANG_DELETECONF LANGSEL("LANG_DELETECONF").#define LANG_DELETEEMPTYCONF LANGSEL("LANG_DELETEEMPTYCONF").#define LANG_ACTIONNYP LANGSEL("LANG_ACTIONNYP").#define LANG_ERRORDEL LANGS

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\gpl.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):35821
    Entropy (8bit):4.622128610438848
    Encrypted:false
    SSDEEP:768:A7Y+tNdSz3ZlqXOWoInuzx3Y8N3WiYD0v:AVtNIq1uzZY1C
    MD5:3C34AFDC3ADF82D2448F12715A255122
    SHA1:7713A1753CE88F2C7E6B054ECC8E4C786DF76300
    SHA-256:0B383D5A63DA644F628D99C33976EA6487ED89AAA59F0B3257992DEAC1171E6B
    SHA-512:4937848B94F5B50EA16C51F9E98FDCD3953ACA63D63CA3BB05D8A62C107E382B71C496838D130AE504A52032398630B957ACAEA6C48032081A6366D27CBA5EA9
    Malicious:false
    Preview: GNU GENERAL PUBLIC LICENSE.. Version 3, 29 June 2007.... Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>.. Everyone is permitted to copy and distribute verbatim copies.. of this license document, but changing it is not allowed..... Preamble.... The GNU General Public License is a free, copyleft license for..software and other kinds of works..... The licenses for most software and other practical works are designed..to take away your freedom to share and change the works. By contrast,..the GNU General Public License is intended to guarantee your freedom to..share and change all versions of a program--to make sure it remains free..software for all its users. We, the Free Software Foundation, use the..GNU General Public License for most of our software; it applies also to..any other work released this way by its authors. You can apply it to..your programs, too..... When we speak of free software

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\htssystem.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):239
    Entropy (8bit):4.724194705795073
    Encrypted:false
    SSDEEP:6:jsRp3TMuoFfdXRm4g2te0gwzybgwNJU/f:jO3ZoxdXRm/2ewzLwNW3
    MD5:C7855286C0881844289914E81AB60ACD
    SHA1:1D10A915688BC9E651F5B4F0BAA785E0E230D160
    SHA-256:34AB2E125063B51D2A952CB4B49998D08DF055F5E2BD6AB07B40F0B8A21880BC
    SHA-512:1D3642B2F2491495672E4C4A8D1AC4330DC5A6E56DDC098B84BDB5B5604C25693AA99476A2C3741AD5CDCA70A43BA1CC070A8E3DF3CB73D4C3B675B476166B09
    Malicious:false
    Preview:// D.finition de la plate-forme utilis.e..// Sun Solaris .......... 0 .// Windows/95 ........... 1 .// Ibm 580 .............. 2..#define HTS_PLATFORM 1.#define HTS_ANALYSTE 1...// SHELL.//#define HTS_ANALYSTE 2...// Fin de la d.finition...

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\infoend.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1780
    Entropy (8bit):5.472029813316649
    Encrypted:false
    SSDEEP:24:qntJlaoRP+i+8sAyWC4cIWzCuwHGUKaLfb9Ri4o0HMIrBh3440CvkEGVJ7U8tS:0pRm95UCqWSx3LfZY0sIrB504jGVl7E
    MD5:AE06B83EBD3FEA74DAD644563A39FD35
    SHA1:BA3617798377548F0B7090D843B8EA7653A64B58
    SHA-256:349090902FB745CC0F14ED3DD52BE05AFED44969783EF9E32B6A4B398EB02E22
    SHA-512:F8C2F0EDD554F2BD3E335B4B2ECF9A84A590114C59F7F593DCCE04A9331C0E6558EC40CD9C51060C1DD8819C1CD6EC5D7290B5E29D7B42FA68F92F669D4CE9AD
    Malicious:false
    Preview:#if !defined(AFX_INFOEND_H__B057B1C2_A192_11D2_A2B1_0000E84E7CA1__INCLUDED_)..#define AFX_INFOEND_H__B057B1C2_A192_11D2_A2B1_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// infoend.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// Cinfoend dialog....class Cinfoend : public CPropertyPage..{..public:...Cinfoend(); // protected constructor used by dynamic creation...~Cinfoend(); // protected constructor used by dynamic creation.. DECLARE_DYNCREATE(Cinfoend).. // Construction..public:...//Cinfoend(CWnd* pParent = NULL); // standard constructor....// Dialog Data...//{{AFX_DATA(Cinfoend)...enum { IDD = IDD_fin };...//}}AFX_DATA......// Overrides...// ClassWizard generated virtual function overrides...//{{AFX_VIRTUAL(Cinfoend)...public:...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protect

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\inprogress.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):31436
    Entropy (8bit):5.535040687472308
    Encrypted:false
    SSDEEP:384:Ywwf9Z54YF4RRNmSuumrfQula1Cq3iX0RU3NHdZt2G4qs7BPCq6KpL4btC:gARRSQula1Cq3iX063dgG4qs8i4ZC
    MD5:5AA963BE67A36F7D58BC6114BE74B38A
    SHA1:8871FB5923021896F686054BE0368782DD12F778
    SHA-256:9D127812EAB78175840C53B0A0278384B5E3989A7DE6F628FE08F9DDEE5E9463
    SHA-512:972E587C2EE05FC63FE1EAD6FAC02D42BF03BFFAAA9EAC84E1403AC797B1A21079479198A92CC9807EA76481B3EF4CDA579D0CB809F8757E4824FDD07424736C
    Malicious:false
    Preview:// inprogress.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "inprogress.h"..#include "about.h"..#include "iplog.h"....#include "NewProj.h"..//#include "option.h"..../* Externe C */..extern "C" {.. #include "HTTrackInterface.h"..}....#include "Wid1.h"..#include "EasyDropTarget.h"....#include "InfoUrl.h"....extern CNewProj* dialog0;..extern CMainTab* maintab;....extern int termine_requested;..extern int termine;..extern int soft_term_requested;..extern HICON httrack_icon;..extern int termine;....// Helper..extern LaunchHelp* HtsHelper;....// InfoUrl..extern CInfoUrl* _Cinprogress_inst;....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....// Refresh..//extern int INFILLMEM_LOCKED; // refresh m.moire en cours..extern InpInfo SInfo;..int inprogress_refresh();....// this app..#include "Winhttrack.h"..extern CWinHTTrackApp* this_app;......// objet..extern Cinprogress* inprogress;....../* pour la fin

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\inprogress.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):4884
    Entropy (8bit):5.4658854251058715
    Encrypted:false
    SSDEEP:96:cnevRKt0P4Ij8g7AG6dtXCk2vkaPSzAryWtAO2Vl7VK:O84jyAG6dt11MryWzn
    MD5:B51AA1E339B57109FF47AA5A2CA1231A
    SHA1:33B5528C481603288B2B39D31FC5DBBE9EB0BA75
    SHA-256:1BD916D4D75DE941540733A8F52696EE40FBBE7E532F74FAAA279AE6AF9870A5
    SHA-512:F7A3CD781E38B7B1B45537B2CD35A3192FB33B28CE1C0C2A5D0AD8472C247D99E3024705B187699E40AE2E14879BC53C87B0DED901ACC907CF17D460B33826FC
    Malicious:false
    Preview:#if !defined(AFX_INPROGRESS_H__BAF427E1_1910_11D2_A290_502047C1F032__INCLUDED_)..#define AFX_INPROGRESS_H__BAF427E1_1910_11D2_A290_502047C1F032__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// inprogress.h : header file..//....#include "Shell.h"..#include "iplog.h"..#include "EasyDropTarget.h"....../////////////////////////////////////////////////////////////////////////////..// Cinprogress dialog....class Cinprogress : public CPropertyPage..{..private:.. CEasyDropTarget* drag;..// Construction..public:...Cinprogress(); // protected constructor used by dynamic creation...DECLARE_DYNCREATE(Cinprogress)..public:.. void StatsBuffer_cancel(int id);.. void StatsBuffer_info(int id);.. void StopTimer();.... CWnd* element[5][NStatsBuffer]; // ici 10=NStatsBuffer -- les .l.ments (status nom slide bouton)...//Cinprogress(CWnd* pParent = NULL); // standard constructor.. CWinThread * BackAffLog;.. Ciplog form;.. char pathlog[256];....// Dialog

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-07JAV.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):16902
    Entropy (8bit):5.443548525885058
    Encrypted:false
    SSDEEP:384:C2eHzNu/2K3C9K+TE6dZt/mLMsCYgTy2b5Y+K9s/Vcw5F/0zTibAfLk30:+zq2K3C9K+TE6dZt/mwaqeV9s/VnczTP
    MD5:3A01460241390F178BC09ECFDA0318E9
    SHA1:FF489317226603BEE440A2E73617A3DE82D71AC1
    SHA-256:50E0919D5A7723A5502AC1E1587C964AEB561BB3ECB609D89125816200860408
    SHA-512:880171274CDAAA1217F767AE8792C4F180ED14BCCB152A4C5099DC90C97A7D33997CC77C30A522C7D71FF4552FAD411B4A77257146DFA8B633C26C63EC3085EC
    Malicious:false
    Preview:// NewProj.cpp : implementation file..//....// pour lecture dir..//#include "kernel32.h"....#include "stdafx.h"..#include "Shell.h"..#include "NewProj.h"..../* Externe C */..#include <WS2tcpip.h> // Note: weird C2894 error if not included here..extern "C" {.. #include "HTTrackInterface.h".. #include "htscore.h"..}....#include "XSHBrowseForFolder.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....extern HICON httrack_icon;..extern CNewProj* dialog0;....// Helper..extern LaunchHelp* HtsHelper;..../* Main WizTab frame */..#include "WizTab.h"..extern CWizTab* this_CWizTab;..../* Main splitter frame */..#include "DialogContainer.h"..#include "splitter.h"..extern CSplitterFrame* this_CSplitterFrame;..../* DirTreeView */..#include "DirTreeView.h"..extern CDirTreeView* this_DirTreeView;..../* reference sur objet Wid1 */..#include "Wid1.h"..extern Wid1* dialog1;..../* shellapp */..extern CShellApp* CShellApp_app;..../* cr.ation struct

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-0TICM.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):17274
    Entropy (8bit):4.673348347540594
    Encrypted:false
    SSDEEP:192:OALOEtqkQ/sVKCvHVptwpnJDf3cTtuDV+kBH4PZUWoxd+6tnATLYmrYr1YMj+kU0:OAg7QgYazqLrVkB
    MD5:DF2755C3639BF0127B8392F4DFBA226A
    SHA1:DECBF6405856B2AB51D5B8E94F6062D63D60F7B3
    SHA-256:5342BBF7E3630D3596D614894EA137345CF62690E01D10CF384FBC738F9134E2
    SHA-512:EB8D6BB2A276E15B8FE65A79AEADE7C7F4A7A4FF248A03AFBEFB8F2EB98C7183063BE629677AE5DE1C8D359A007D8B3C437E6A496F6CFDF0C184D9AADEFA4FF0
    Malicious:false
    Preview:/* Generated by cpp_lang_make */..#ifndef HTS_CPPLANG_H.#define HTS_CPPLANG_H...#define LANGUAGE_NAME LANGSEL("LANGUAGE_NAME")..#define LANGUAGE_ISO LANGSEL("LANGUAGE_ISO")..#define LANGUAGE_CHARSET LANGSEL("LANGUAGE_CHARSET").#define LANGUAGE_WINDOWSID LANGSEL("LANGUAGE_WINDOWSID").#define LANG_OK LANGSEL("LANG_OK").#define LANG_CANCEL LANGSEL("LANG_CANCEL").#define LANG_QUIT LANGSEL("LANG_QUIT").#define LANG_CLOSE LANGSEL("LANG_CLOSE").#define LANG_TIPCANCEL LANGSEL("LANG_TIPCANCEL").#define LANG_TIPOK LANGSEL("LANG_TIPOK").#define LANG_TIPHELP LANGSEL("LANG_TIPHELP").#define LANG_TIPPREV LANGSEL("LANG_TIPPREV").#define LANG_TIPNEXT LANGSEL("LANG_TIPNEXT").#define LANG_HIDEPWD LANGSEL("LANG_HIDEPWD").#define LANG_SAVEPROJECT LANGSEL("LANG_SAVEPROJECT").#define LANG_CLOSEPRJ LANGSEL("LANG_CLOSEPRJ").#define LANG_DELETECONF LANGSEL("LANG_DELETECONF").#define LANG_DELETEEMPTYCONF LANGSEL("LANG_DELETEEMPTYCONF").#define LANG_ACTIONNYP LANGSEL("LANG_ACTIONNYP").#define LANG_ERRORDEL LANGS

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-2117L.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1008
    Entropy (8bit):5.395983785063817
    Encrypted:false
    SSDEEP:24:xcTr7YBIGFrgrUOvil6V+BwxGEUoE8LApMLY:xiwIG2r6l6V+BwxVUr8L2MLY
    MD5:B90FD66616A75EFC4B311C63EFCF6E7F
    SHA1:92BD952E8A708150374EBA202A606FDE11A3209E
    SHA-256:6281510C7A8788CB4A40AD5E011744E399102A2DB72E7E8295DFBE071A5149DA
    SHA-512:14131473265FFA2FD1DFEC690721B38477F46BAB6AC447C9ECDB19E8500D7343612120432DC17193695D9EF6736050B98A1469215C03D507409E0DD60C6EA797
    Malicious:false
    Preview:..#ifndef HTS_DEFNEWLANG..#define HTS_DEFNEWLANG....void LANG_LOAD(char* limit_to);..void LANG_INIT();..int LANG_T(int);..int QLANG_T(int l);..//char* LANGSEL(char* lang0,...);..char* LANGSEL(char* name);..char* LANGINTKEY(char* name);..void LANG_DELETE();..void conv_printf(char* from,char* to);..#define LANG(A) A....BOOL SetDlgItemTextCP(HWND hDlg, int nIDDlgItem, LPCSTR lpString);..BOOL SetDlgItemTextCP(CWnd* wnd, int nIDDlgItem, LPCSTR lpString);..BOOL SetDlgItemTextUTF8(HWND hDlg, int nIDDlgItem, LPCSTR lpString);..BOOL SetDlgItemTextUTF8(CWnd* wnd, int nIDDlgItem, LPCSTR lpString);..BOOL SetWindowTextCP(HWND hWnd, LPCSTR lpString);..BOOL SetWindowTextCP(CWnd* wnd, LPCSTR lpString);..BOOL SetWindowTextUTF8(HWND hWnd, LPCSTR lpString);..BOOL SetWindowTextUTF8(CWnd* wnd, LPCSTR lpString);..BOOL ModifyMenuCP(HMENU hMnu, UINT uPosition, UINT uFlags, UINT uIDNewItem, LPCSTR lpNewItem);..BOOL ModifyMenuCP(CMenu* menu, UINT uPosition, UINT uFlags, UINT uIDNewItem, LPCSTR lpNewItem);....#e

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-251N2.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2672
    Entropy (8bit):5.373600343439321
    Encrypted:false
    SSDEEP:48:VGLmQ3ZmlClWlODlRFAlrlKt4TBsAohNWJ9x5nx5+/75z35Yo7BF5u2oVxa0:qmGmlClWlODlRylrlKnACeTr5o5YW5+d
    MD5:3F464B7EF81A3C7478EFAEDBEA2B76D8
    SHA1:9C267DA0A40A784A495D6DBF6A54DF7475C7E045
    SHA-256:81EEE5AC5D3EE32B0D9373E1061C408AD95976DA80FB32EC8C328C026E7D30DD
    SHA-512:66466B76AF4AA76A46A953E1239305F096D01D4E1555CFE47FB8538B1A948C33ABC1038CB8F9856C2A2D9EA829787CB136742C65EF92219575B7CE8CCEA6C4A1
    Malicious:false
    Preview:/*----------------------------------------------------------------------..Copyright (c) 1998,1999 Gipsysoft. All Rights Reserved...File:.DynamicRAS.h..Owner:.russf@gipsysoft.com..Purpose:.Dynamically loaded RAS...----------------------------------------------------------------------*/..../* Thanks to Russ Freeman from gipsymedia */....#if !defined(RAS_LOAD_HTS_DYNAMIC)..#define RAS_LOAD_HTS_DYNAMIC....#include "ras.h"....typedef.DWORD (APIENTRY *PRASENUMCONNECTIONS)( LPRASCONNA, LPDWORD, LPDWORD );..typedef.DWORD (APIENTRY *PRASHANGUP)( HRASCONN );..typedef.DWORD (APIENTRY *PRASGETCONNECTSTATUS)( HRASCONN , LPRASCONNSTATUSA );..typedef.DWORD (APIENTRY *PRASDIAL)(LPRASDIALEXTENSIONS ,LPTSTR ,LPRASDIALPARAMS ,DWORD ,LPVOID ,LPHRASCONN);..typedef.DWORD (APIENTRY *PRASENUMENTRIES)(LPTSTR ,LPTSTR ,LPRASENTRYNAME ,LPDWORD ,LPDWORD );..typedef.DWORD (APIENTRY *PRASGETENTRYDIALPARAMS)(LPTSTR ,LPRASDIALPARAMS ,LPBOOL ); ....class CDynamicRAS {..public:...CDynamicRAS();...virtual ~CDynamicRAS();

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-2ILUL.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):96302
    Entropy (8bit):5.10253160113025
    Encrypted:false
    SSDEEP:1536:4NltKTSf2zjSjjvfx+lIQuzHFCLBAI1ltvzn2jcjkr6LDEOwVx912zy0TdsGALJB:4offwVx912O0T+GALJNbkAIyNo455hdV
    MD5:FDA463C5C79CEDDA3812884F055F1290
    SHA1:AE682EB75114870B2CA5B3D5DB337BBAA9AD7657
    SHA-256:CC61FEB72220B757393FB070A720116E8B9E630DD4D28BE24D23F325229D4CB9
    SHA-512:378A3F98125F6D25B3EBBB82CFD9601A75AC3F2DEEEE70828C13CD55059A3AE9FE807B499E3C90F5A863877DAF13CC42773EDD24D5F75465A91B2D1723C52D43
    Malicious:false
    Preview:// Microsoft Visual C++ generated resource script...//..#include "resource.h"....#define APSTUDIO_READONLY_SYMBOLS../////////////////////////////////////////////////////////////////////////////..//..// Generated from the TEXTINCLUDE 2 resource...//..#include "afxres.h"..../////////////////////////////////////////////////////////////////////////////..#undef APSTUDIO_READONLY_SYMBOLS..../////////////////////////////////////////////////////////////////////////////..// English (U.S.) resources....#if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_ENU)..#ifdef _WIN32..LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US..#pragma code_page(1252)..#endif //_WIN32..../////////////////////////////////////////////////////////////////////////////..//..// Icon..//....// Icon with lowest ID value placed first to ensure application icon..// remains consistent on all systems...IDR_MAINFRAME ICON "res\\Shell.ico"..IDR_WINHTTTYPE ICON "res\\Shell.ico"..IDI_

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-2MH7U.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):7760
    Entropy (8bit):5.577528200387364
    Encrypted:false
    SSDEEP:192:WlIPhqwFDkkyasOtc94NolfpCCwMnHXPfT:aIPZDkkyaNtcCNoppCCw0/fT
    MD5:73B76A480C8BF612643C9C82DD1121C2
    SHA1:833855838E7E32A0B12104B3121908A3254B2C8A
    SHA-256:6DB2771A5B29123398F5E95583538466EDD52270953570DC25E525D28B349D35
    SHA-512:BA2D3691ED80D6421FC67D64D0D23FB48F9F734D3B8290105EDC012F44AA1833EC9E5F1B48DA0B567F1FB8594AB0E676093C0B22D64F9A7B730ED478D7751FA0
    Malicious:false
    Preview:// infoend.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "infoend.h"..#include "iplog.h"..#include "NewProj.h"....extern CNewProj* dialog0;..extern "C" {.. #include "HTTrackInterface.h".. //#include "htsbase.h".. HTS_INLINE int fspc(FILE* fp,const char* type);..}....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..extern HICON httrack_icon;....#include "winhttrack.h"..extern CWinHTTrackApp* this_app;....#include "inprogress.h"..extern Cinprogress* inprogress;..../* Externe C */..extern "C" {.. #include "HTTrackInterface.h"..};....// Helper..extern LaunchHelp* HtsHelper;..../* Main splitter frame */..#include "DialogContainer.h"..#include "splitter.h"..extern CSplitterFrame* this_CSplitterFrame;..../* Main WizTab frame */..#include "WizTab.h"..extern CWizTab* this_CWizTab;..extern CWizTab* this_intCWizTab2;..../* Objet lui m.me */..Cinfoend* this_Cinfoend=NULL;....///////////////////////////////

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-31IQ6.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):26503
    Entropy (8bit):3.750747618739003
    Encrypted:false
    SSDEEP:384:iJtRpKwWuUI4ljXQB1XGzDPytEqBKYOTMZJmm3efe385m:iTRpKwWub4ljXQ+jMnmmIe3x
    MD5:DF129E9A2738A2C2FE365F21907BDFA0
    SHA1:AFC5F8F83F1180E9B7816136C7D4375533B184E3
    SHA-256:DD877B51EC53AE39880283DBD80C252CF696DCD3D98F4B402A0722567BB540F1
    SHA-512:E9EC0396F1F5B94436C3A6DA87632DB9FC50C2F6D20E21E9C718E367A88AF6DD3909EEE0D3B16CFDBAA7A27C6392DA3DD77B4BEB2F4059B06C40B9C6E05BAF6C
    Malicious:false
    Preview://{{NO_DEPENDENCIES}}..// Microsoft Visual C++ generated include file...// Used by WinHTTrack.rc..//..#define IDC_NewProject 2..#define IDlog 3..#define ID_setopt 3..#define ID_capt 3..#define IDCANCEL2 4..#define IDbrowse 4..#define IDCANCEL3 5..#define IDD_ABOUTBOX 100..#define IDD_DIALOGCONTAINER_FORM 106..#define IDR_DIALOGCONTAINER_TMPL 107..#define IDR_MAINFRAME 128..#define IDR_SHELLTYPE 129..#define IDD_DIALOG1 131..#define IDD_DIALOG2 132..#define IDD_DIALOG3 133..#define IDD_DIALOG4 134..#define IDD_DIALOG5 135..#define IDD_WIZ1 138..#define IDD_DIALOG6 141..#define IDD_WIZ2 142..#define IDD_

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-388GQ.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):4942
    Entropy (8bit):5.059134068643704
    Encrypted:false
    SSDEEP:96:JFrDTWFTWUnva3BaHmDg0Gvypoj1u0o8+W3BwDttj/9FbUnESsy4K1L:JFrDTW9WivaxaHCg5vypk1uO1xQF9Fbg
    MD5:4490040B14E60BCA5C06D2023A88B125
    SHA1:B8C3F0C54EC28E2D97162430AE9E96C2B71A9EBF
    SHA-256:CD75E6CFE49AD759F7C946D4408A89EDF268F1265BD46AC2568339AA32E4354F
    SHA-512:F0FA57405D103056E17244FA5154057765624E041CD4A06E0D1F47A06E97FB38F7C3544610DE8012E9C10749FE7C22DC9C9C560FB446F7D26E274F1375479C8C
    Malicious:false
    Preview:/* ------------------------------------------------------------ */../*..HTTrack Website Copier, Offline Browser for Windows and Unix..Copyright (C) Xavier Roche and other contributors....This program is free software; you can redistribute it and/or..modify it under the terms of the GNU General Public License..as published by the Free Software Foundation; either version 3..of the License, or any later version.....This program is distributed in the hope that it will be useful,..but WITHOUT ANY WARRANTY; without even the implied warranty of..MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the..GNU General Public License for more details.....You should have received a copy of the GNU General Public License..along with this program; if not, write to the Free Software..Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.......Important notes:....- We hereby ask people using this source NOT to use it in purpose of grabbing..emails addresses, or collecting any

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-3DA6Q.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):5571
    Entropy (8bit):5.456040103377889
    Encrypted:false
    SSDEEP:96:/zJJXsHmMPanEIl4wBSyB2BsuBRBW1BoBUBO1ZVR94TXnrpbHA4T0p:9qURcZP01i+k394pb0
    MD5:48CB7AD98B1AFB40F3117B04F9E3F664
    SHA1:8C4B1D75F219987C114E95A3D4BB5C8F8A9203C6
    SHA-256:C823C5C37C66B35FAA919866A5D6E7C28074E095C67BFDBF51BB2A729940B1E8
    SHA-512:BD8B516CFA4B749253DB3F1BB9E6EAE38BCEB7F659819B236C96286DC13F0B3C8A3F4235109AB3F52E9EC1A105338D40D6C9D086410D2A51DFDDB53B390516BB
    Malicious:false
    Preview:// OptionTab8.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "OptionTab8.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../////////////////////////////////////////////////////////////////////////////..// COptionTab8 property page....IMPLEMENT_DYNCREATE(COptionTab8, CPropertyPage)....COptionTab8::COptionTab8() : CPropertyPage(COptionTab8::IDD)..{.. // Patcher titre.. if (LANG_T(-1)) { // Patcher en fran.ais.. m_psp.pszTitle=LANG(LANG_IOPT8); // titre.. m_psp.dwFlags|=PSP_USETITLE;.. }.. m_psp.dwFlags|=PSP_HASHELP;.. //...//{{AFX_DATA_INIT(COptionTab8)...m_checktype = -1;...m_cookies = FALSE;...m_parsejava = FALSE;...m_robots = -1;...m_http10 = FALSE;...m_toler = FALSE;...m_updhack = FALSE;...m_urlhack = FALSE;...//}}AFX_DATA_INIT..}....COptionTab8::~COptionTab8()..{..}....void COptionTab8::DoDataExchange(CDataExchange* pDX)..{...CPropertyPage::DoDataExchange(pDX);...//{{AFX_DATA

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-3I3F5.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1780
    Entropy (8bit):5.472029813316649
    Encrypted:false
    SSDEEP:24:qntJlaoRP+i+8sAyWC4cIWzCuwHGUKaLfb9Ri4o0HMIrBh3440CvkEGVJ7U8tS:0pRm95UCqWSx3LfZY0sIrB504jGVl7E
    MD5:AE06B83EBD3FEA74DAD644563A39FD35
    SHA1:BA3617798377548F0B7090D843B8EA7653A64B58
    SHA-256:349090902FB745CC0F14ED3DD52BE05AFED44969783EF9E32B6A4B398EB02E22
    SHA-512:F8C2F0EDD554F2BD3E335B4B2ECF9A84A590114C59F7F593DCCE04A9331C0E6558EC40CD9C51060C1DD8819C1CD6EC5D7290B5E29D7B42FA68F92F669D4CE9AD
    Malicious:false
    Preview:#if !defined(AFX_INFOEND_H__B057B1C2_A192_11D2_A2B1_0000E84E7CA1__INCLUDED_)..#define AFX_INFOEND_H__B057B1C2_A192_11D2_A2B1_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// infoend.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// Cinfoend dialog....class Cinfoend : public CPropertyPage..{..public:...Cinfoend(); // protected constructor used by dynamic creation...~Cinfoend(); // protected constructor used by dynamic creation.. DECLARE_DYNCREATE(Cinfoend).. // Construction..public:...//Cinfoend(CWnd* pParent = NULL); // standard constructor....// Dialog Data...//{{AFX_DATA(Cinfoend)...enum { IDD = IDD_fin };...//}}AFX_DATA......// Overrides...// ClassWizard generated virtual function overrides...//{{AFX_VIRTUAL(Cinfoend)...public:...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protect

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-3KHMR.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2034
    Entropy (8bit):5.52718198110644
    Encrypted:false
    SSDEEP:48:NzKzSKj1n05mEqWMlx3LfecFK0sp7tW0lOE8Vl7izs:ZK5pzdK4WsVl71
    MD5:8079346EEAE3ABD1434353006D82104C
    SHA1:1BA3EBC6F2109DEEC1284469F53C2DD06B71DFC5
    SHA-256:EA1F92CEA5E89534203373CA5AC294050A4282382D7EB9BC1FC4FBC24FCB6DD2
    SHA-512:0350777444543E07C390DB9D25FA1DD3A8C500572F809772409AF35EFDEBFED5D362056B51243DB90F219C602A2B0660B249A801917F63B51097092C4987CF34
    Malicious:false
    Preview:#if !defined(AFX_TRANS_H__437D7274_F613_11D1_B222_006097BCBD81__INCLUDED_)..#define AFX_TRANS_H__437D7274_F613_11D1_B222_006097BCBD81__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// trans.h : header file..//....#include "ras.h"..../////////////////////////////////////////////////////////////////////////////..// Ctrans dialog....class Ctrans : public CPropertyPage..{...DECLARE_DYNCREATE(Ctrans)..public:.. char RasString[256];.. RASDIALPARAMS dial;.. int hms;..// Construction...Ctrans(); // standard constructor...~Ctrans(); // standard constructor....// Dialog Data...//{{AFX_DATA(Ctrans)...enum { IDD = IDD_Debut };...CButton.m_ctl_rasshut;...CButton.m_ctl_rasdisc;...CStatic.m_ctlcnx;...CComboBox.m_ctlrasid;...CStatic.m_ctl_wait;...CEdit.m_ctl_ss;...CEdit.m_ctl_mm;...CEdit.m_ctl_hh;...CString.m_hh;...CString.m_mm;...CString.m_ss;...BOOL.m_wait;...int..m_rasid;...BOOL.m_rasdisc;...BOOL.m_rasshut;...//}}AFX_DATA......// Overrides...// ClassWizard gene

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-42PJK.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):951
    Entropy (8bit):5.0289849434344545
    Encrypted:false
    SSDEEP:24:uKhfJDDt2SofJ7zT0v7fJSzUzCKS3QkJv5INLvM/kP:uifJDDkhfJ7kv7fJH65INjCW
    MD5:7756190569D66F6EB866780C270F5C6A
    SHA1:C6EF534FCACDF0284C8DFDADCA644E0A7FDF1BCB
    SHA-256:7DC645B13189AD47962F310B6E4767F8CBF315BFF0D40A14B26755BBAADDC2ED
    SHA-512:74F625C7418F1A00BC5B1E6633ABA2EA03231A8F1C42F48AEED5D64AF4F7E50631F1788A85F3DD496E26BABFC0E78136040AA17FC3252AD6148E5D57F1098A02
    Malicious:false
    Preview:// mainfrm.h : interface of the CHtmlFrame class..//..// This is a part of the Microsoft Foundation Classes C++ library...// Copyright (C) 1992-1998 Microsoft Corporation..// All rights reserved...//..// This source code is only intended as a supplement to the..// Microsoft Foundation Classes Reference and related..// electronic documentation provided with the library...// See these sources for detailed information regarding the..// Microsoft Foundation Classes product.........#ifndef __AFXEXT_H__..#include <afxext.h> // for access to CToolBar and CStatusBar..#endif....class CHtmlFrame : public CMDIFrameWnd..{...DECLARE_DYNCREATE(CHtmlFrame)....protected:...CStatusBar m_wndStatusBar;..//.CToolBar m_wndToolBar;....protected:...//{{AFX_MSG(CHtmlFrame)...afx_msg int OnCreate(LPCREATESTRUCT lpCreateStruct);...//}}AFX_MSG...DECLARE_MESSAGE_MAP()..};..../////////////////////////////////////////////////////////////////////////////..

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-44EF6.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):3137
    Entropy (8bit):5.657314644449639
    Encrypted:false
    SSDEEP:48:u+pNuwezguAzOphUFxnyXR1xZBKs/r4rInSU8XKlQW1KMGUAob5p:TNuwezgOphyxyh9b5qKlQ8LTLn
    MD5:3F8E3EC4F591EF25E5F0F7CFEAADB10E
    SHA1:010966474D89A8F3761357934D3F54ABD22EFC6E
    SHA-256:6FFD31D3913FDD60E6B48A83B51B6DDDACF667E0D5C030B320B71F68AFCBA042
    SHA-512:EAFE69A5ED15B4C8681FC2AADDD7769E68D9858692C539D6012D3AE232F8FB67B4DD8263127AEFB26B795236EBCF16A945496B017435507EFEA15307C3FC568F
    Malicious:false
    Preview:// mainfrm.cpp : implementation of the CHtmlFrame class..//......#include "stdafx.h"..#include "htmlfrm.h"..#include "resource.h"....#include "HTMLHelp.h"......IMPLEMENT_DYNCREATE(CHtmlFrame, CMDIFrameWnd)..BEGIN_MESSAGE_MAP(CHtmlFrame, CMDIFrameWnd)...//{{AFX_MSG_MAP(CHtmlFrame)...ON_WM_CREATE()...//}}AFX_MSG_MAP..END_MESSAGE_MAP()....static UINT BASED_CODE buttons[] =..{...// same order as in the bitmap 'toolbar.bmp'...ID_FILE_NEW, ID_FILE_OPEN, ID_FILE_SAVE, 0,...ID_EDIT_CUT, ID_EDIT_COPY, ID_EDIT_PASTE, 0,...ID_FILE_PRINT, ID_APP_ABOUT,..};....static UINT BASED_CODE indicators[] =..{...0, ID_INDICATOR_CAPS, ID_INDICATOR_NUM, ID_INDICATOR_SCRL,..};....int CHtmlFrame::OnCreate(LPCREATESTRUCT lpCreateStruct)..{...if (CMDIFrameWnd::OnCreate(lpCreateStruct) == -1)....return -1;.... /*...if (!m_wndToolBar.CreateEx(this, TBSTYLE_FLAT, WS_CHILD | WS_VISIBLE | CBRS_TOP....| CBRS_GRIPPER | CBRS_TOOLTIPS | CBRS_FLYBY | CBRS_SIZE_DYNAMIC) ||....!m_wndToolBar.LoadToolBar(IDR_HELPFRM))...{....T

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-4MUBP.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1440
    Entropy (8bit):5.546752568271731
    Encrypted:false
    SSDEEP:24:vwjPlrnk+MfPuxiNBj0j/g471Wz5uwHGUKaPiNhEVJ7U8g0:Edn1MfWxCBw/gYWjx3GSVl75
    MD5:13F5A0FE29BBF8F0C71D4B21448107D9
    SHA1:0DFD4157CD4825A6C64AC7D37020835AA954006C
    SHA-256:07F38D80A80BD5E6092DC5B2BB1A2B25F8B44644AAD6E29B512526FC7D92FFBE
    SHA-512:5170D2A404D1DF281EAAD86214A2AAFEB9B566AAB109E27F657C23B5BC8C1ED73E68B576EA9D6EE9EEE5BCE193416F97817B1AE50A4C77C4FBFED8DECD97A481
    Malicious:false
    Preview:#if !defined(AFX_OPTIONTAB9_H__8D023EA5_A8C3_11D3_A2B3_0000E84E7CA1__INCLUDED_)..#define AFX_OPTIONTAB9_H__8D023EA5_A8C3_11D3_A2B3_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// OptionTab9.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// COptionTab9 dialog....class COptionTab9 : public CPropertyPage..{...DECLARE_DYNCREATE(COptionTab9)....// Construction..public:...COptionTab9();...~COptionTab9();.. char* GetTip(int id);.. int modify;....// Dialog Data...//{{AFX_DATA(COptionTab9)...enum { IDD = IDD_OPTION9 };...BOOL.m_index;...BOOL.m_logf;...BOOL.m_Cache2;...int..m_logtype;...BOOL.m_norecatch;...BOOL.m_index2;...BOOL.m_index_mail;...//}}AFX_DATA......// Overrides...// ClassWizard generate virtual function overrides...//{{AFX_VIRTUAL(COptionTab9)...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protected:.../

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-4PIO7.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1616
    Entropy (8bit):5.541510557558805
    Encrypted:false
    SSDEEP:24:ymFhl1nkKpfPuxjQe59dse471Wz4uwHGUKaPiAhtkOPUjJ7U8td:ym7XnZpfWx/fDYWcx3ljJPYl7td
    MD5:55531EF2C32A3DFE0EAFF6FC65692437
    SHA1:2EE9C55A5E5A37B0AC7D1ECC09F6E87A29B89300
    SHA-256:5F58C7B2BAF0BCC67148A7E56173E874AF4FB0DBFC76CBD067CBE1815C361474
    SHA-512:277298274258542D7365C86B6CFF780C5E929D121549C1E7630382E172D80B83F671820FA03EE366AF9BF9DB9F35550CFF77B8B2AD1E541A94DB0D21BE83F8E9
    Malicious:false
    Preview:#if !defined(AFX_OPTIONTAB11_H__0203BCB7_9CC5_4316_B227_9F41CCFF513D__INCLUDED_)..#define AFX_OPTIONTAB11_H__0203BCB7_9CC5_4316_B227_9F41CCFF513D__INCLUDED_....#if _MSC_VER > 1000..#pragma once..#endif // _MSC_VER > 1000..// OptionTab11.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// COptionTab11 dialog....class COptionTab11 : public CPropertyPage..{...DECLARE_DYNCREATE(COptionTab11)....// Construction..public:...COptionTab11();...~COptionTab11();.. char* GetTip(int id);.. int modify;....// Dialog Data...//{{AFX_DATA(COptionTab11)...enum { IDD = IDD_OPTION11 };...CString.m_ext1;...CString.m_ext2;...CString.m_ext3;...CString.m_ext4;...CString.m_ext5;...CString.m_ext6;...CString.m_ext7;...CString.m_ext8;...CString.m_mime1;...CString.m_mime2;...CString.m_mime3;...CString.m_mime4;...CString.m_mime5;...CString.m_mime6;...CString.m_mime7;...CString.m_mime8;...//}}AFX_DATA......// Overrides...// ClassWizard generate virtual function o

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-4Q4M4.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1597
    Entropy (8bit):5.53168336378504
    Encrypted:false
    SSDEEP:24:ARVD5llWAyafx2c5N4cIWzxuwHGUKaTiyQ0HMEs+o+ihtkDVJ7U8zK:ARp5rW0fxfNqWDx3PQ0sV+o+ij8Vl7zK
    MD5:57BEDA123F09A2415F499D11CEFBBFBA
    SHA1:6B0FF65E5B532704F6B948D7D489085236E4A2CC
    SHA-256:94BF0548D3D39709CCE3DA2464FAA10FBF0FC46723921272A31C410FF093A02D
    SHA-512:D82820F2E1AFD047E24B2B1C0A626EE4FDA4699859E52B7186E0FE3184C243BA1ACAE56C844FEB6E6D837072FADD7E17769E2F10309BEF2E5AA810F4B5C78E2D
    Malicious:false
    Preview:#if !defined(AFX_ABOUT_H__E4D816E1_19A9_11D2_A290_60D144C12802__INCLUDED_)..#define AFX_ABOUT_H__E4D816E1_19A9_11D2_A290_60D144C12802__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// about.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// Cabout dialog....class Cabout : public CDialog..{..// Construction..public:...Cabout(CWnd* pParent = NULL); // standard constructor.. char* GetTip(int id);....// Dialog Data...//{{AFX_DATA(Cabout)...enum { IDD = IDD_ABOUT };...CStatic.m_splash;...CComboBox.m_ctl_lang;...CString.m_infover;...int..m_lang;...//}}AFX_DATA......// Overrides...// ClassWizard generated virtual function overrides...//{{AFX_VIRTUAL(Cabout)...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protected:.. void OnHelpInfo2();.. void setlang();.... HCURSOR currentCurs;.....// Generated message map functions...//{{AFX

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-4RGFC.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1355
    Entropy (8bit):5.479905408806
    Encrypted:false
    SSDEEP:24:lu23u232lkInkFb5Nnz5la3471WztuwHGUKaPisOFskOPUjJ7U8Mu2/:crPJnYXvgYWfx33OFsJPYl71+
    MD5:A831EF9FB3C98F3CEEAA6095D93280A6
    SHA1:18E5573CA473AB77706E969AE56A35301ACEA330
    SHA-256:529598FF251817538160FEE642E9A6E7CA927BE21E1D351C8246EE3F293827C1
    SHA-512:E35369E654F8B3B97ED1107A8C8B0F6CF18577BCA5BA6C5AD127BE68739A6D7BE0F9A51E18025858340A7F560B1B02DACA5460B0E0A472D6862D9B9B4A8FFBF1
    Malicious:false
    Preview:#if !defined(AFX_BATCHUPDATE_H__27459ED9_CCB3_4BA7_B2E3_442733B41467__INCLUDED_)..#define AFX_BATCHUPDATE_H__27459ED9_CCB3_4BA7_B2E3_442733B41467__INCLUDED_....#if _MSC_VER > 1000..#pragma once..#endif // _MSC_VER > 1000..// BatchUpdate.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// CBatchUpdate dialog....class CBatchUpdate : public CPropertyPage..{...DECLARE_DYNCREATE(CBatchUpdate)....// Construction..public:...CBatchUpdate();...~CBatchUpdate();....// Dialog Data...//{{AFX_DATA(CBatchUpdate)...enum { IDD = IDD_BatchUpdate };....// NOTE - ClassWizard will add data members here.....// DO NOT EDIT what you see in these blocks of generated code !...//}}AFX_DATA......// Overrides...// ClassWizard generate virtual function overrides...//{{AFX_VIRTUAL(CBatchUpdate)...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protected:...// Generated message map funct

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-4U37A.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):31436
    Entropy (8bit):5.535040687472308
    Encrypted:false
    SSDEEP:384:Ywwf9Z54YF4RRNmSuumrfQula1Cq3iX0RU3NHdZt2G4qs7BPCq6KpL4btC:gARRSQula1Cq3iX063dgG4qs8i4ZC
    MD5:5AA963BE67A36F7D58BC6114BE74B38A
    SHA1:8871FB5923021896F686054BE0368782DD12F778
    SHA-256:9D127812EAB78175840C53B0A0278384B5E3989A7DE6F628FE08F9DDEE5E9463
    SHA-512:972E587C2EE05FC63FE1EAD6FAC02D42BF03BFFAAA9EAC84E1403AC797B1A21079479198A92CC9807EA76481B3EF4CDA579D0CB809F8757E4824FDD07424736C
    Malicious:false
    Preview:// inprogress.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "inprogress.h"..#include "about.h"..#include "iplog.h"....#include "NewProj.h"..//#include "option.h"..../* Externe C */..extern "C" {.. #include "HTTrackInterface.h"..}....#include "Wid1.h"..#include "EasyDropTarget.h"....#include "InfoUrl.h"....extern CNewProj* dialog0;..extern CMainTab* maintab;....extern int termine_requested;..extern int termine;..extern int soft_term_requested;..extern HICON httrack_icon;..extern int termine;....// Helper..extern LaunchHelp* HtsHelper;....// InfoUrl..extern CInfoUrl* _Cinprogress_inst;....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....// Refresh..//extern int INFILLMEM_LOCKED; // refresh m.moire en cours..extern InpInfo SInfo;..int inprogress_refresh();....// this app..#include "Winhttrack.h"..extern CWinHTTrackApp* this_app;......// objet..extern Cinprogress* inprogress;....../* pour la fin

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-4U6UG.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1390
    Entropy (8bit):5.530158574253851
    Encrypted:false
    SSDEEP:24:5iVzlHPUvAyWtm24cIWzGNuwHGUKaAinrlkDVJ7U8cK:5iBVPiUtm2qWyx3prl8Vl7cK
    MD5:AEA68509AD1F23FF45BF6989CA70D7D5
    SHA1:7DE65CF683AE0346B8699B71D55CF29EE8D125C2
    SHA-256:84F1098F69264675288A7300CAA55B22406031AAA2260F967FBC2669A84ADA00
    SHA-512:5D48E15DA73F2FE66E4310EEF0097FB2D523136335934692B14166FEB182293D46856723D2DFA72BEDB0C07B6E5AA93EAFDCF3BF3C04E8E8D98DC88D73480DB6
    Malicious:false
    Preview:#if !defined(AFX_WIZLINKS_H__1D129B83_1981_11D2_A290_60D144C12802__INCLUDED_)..#define AFX_WIZLINKS_H__1D129B83_1981_11D2_A290_60D144C12802__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// WizLinks.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// WizLinks dialog....class WizLinks : public CDialog..{.. // gestion timer flash.. bool wflag; .. UINT_PTR tm;....// Construction..public:...WizLinks(CWnd* pParent = NULL); // standard constructor....// Dialog Data...//{{AFX_DATA(WizLinks)...enum { IDD = IDD_wizard_lnk };...int..m_lnk;...CString.m_url;...//}}AFX_DATA......// Overrides...// ClassWizard generated virtual function overrides...//{{AFX_VIRTUAL(WizLinks)...public:...virtual INT_PTR DoModal();...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protected:.....// Generated message map functions...//{{AFX_MSG(WizLinks)...af

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-50G65.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1782
    Entropy (8bit):5.449657890981836
    Encrypted:false
    SSDEEP:48:dXEIEIa9ta99EuWEUAE3E1qWZEdTL3LEvu8Eef7Z3XEOEWElEKPYl71a9M:dU5IytymuDM0EtdTDwIefFUrDeKQl71z
    MD5:BCB292110F44E98B819BA2532D7D88D2
    SHA1:2D6A7F0646FE808440040581510E2BB77940C1EF
    SHA-256:89850EE6440B93FA19AA779EA96A98A05BA6CD61C0A60BA33652F5356B3A3AFF
    SHA-512:78ACD4FACE0395A2BB513EFC717B3114EB8FFA85218DDC84DC3C2CC2969D74101FEA3C69BD933DEA4D20E1D78FE71A012107B2BFEA4E5E21E8F4B8D091F24512
    Malicious:false
    Preview:// WinHTTrackView.h : interface of the CWinHTTrackView class..//../////////////////////////////////////////////////////////////////////////////....#if !defined(AFX_WINHTTRACKVIEW_H__812065CF_6988_4DE1_857D_61123451A159__INCLUDED_)..#define AFX_WINHTTRACKVIEW_H__812065CF_6988_4DE1_857D_61123451A159__INCLUDED_....#if _MSC_VER > 1000..#pragma once..#endif // _MSC_VER > 1000......class CWinHTTrackView : public CView..{..protected: // create from serialization only...CWinHTTrackView();...DECLARE_DYNCREATE(CWinHTTrackView)....// Attributes..public:...CWinHTTrackDoc* GetDocument();....// Operations..public:....// Overrides...// ClassWizard generated virtual function overrides...//{{AFX_VIRTUAL(CWinHTTrackView)...public:...virtual void OnDraw(CDC* pDC); // overridden to draw this view...virtual BOOL PreCreateWindow(CREATESTRUCT& cs);...protected:...//}}AFX_VIRTUAL....// Implementation..public:...virtual ~CWinHTTrackView();..#ifdef _DEBUG...virtual void AssertValid() const;...virtual void Dump

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-54MVT.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1038
    Entropy (8bit):5.08831605056832
    Encrypted:false
    SSDEEP:24:umfJDDt2SofJ7zT0v7fJSzUzCT3QkZymv0INnMxkP:umfJDDkhfJ7kv7fJvSy2NnUW
    MD5:56A04B1CDB4326404506C349F90C2C1E
    SHA1:1347DBCB4EA3B98C6996611CEE06E486D7746CC3
    SHA-256:9B6372B6FCCF852904C8A10B3799C2713BDE2DDC88451EF37F483DAD2489FA18
    SHA-512:6F4334F34C63DA9FDE7EA4C6525797E6A04C0D4B645DBC05F16471371E8DEFAB8AB3735157C231D3534702B6C39E99E24BD67072A0742483CAB480C2BAF28CC1
    Malicious:false
    Preview:// mainfrm.h : interface of the CMainFrame class..//..// This is a part of the Microsoft Foundation Classes C++ library...// Copyright (C) 1992-1998 Microsoft Corporation..// All rights reserved...//..// This source code is only intended as a supplement to the..// Microsoft Foundation Classes Reference and related..// electronic documentation provided with the library...// See these sources for detailed information regarding the..// Microsoft Foundation Classes product.........#ifndef __AFXEXT_H__..#include <afxext.h> // for access to CToolBar and CStatusBar..#endif....class CMainFrame : public CMDIFrameWnd..{...DECLARE_DYNCREATE(CMainFrame)....public:...void InitialShowWindow(UINT nCmdShow);....public:..//protected:...CStatusBar m_wndStatusBar;...CToolBar m_wndToolBar;....protected:...//{{AFX_MSG(CMainFrame)...afx_msg int OnCreate(LPCREATESTRUCT lpCreateStruct);...afx_msg void OnClose();...//}}AFX_MSG...DECLARE_MESSAGE_MAP()..};..../////////////////////////////////////////

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-5506D.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2370
    Entropy (8bit):5.628371631322341
    Encrypted:false
    SSDEEP:48:mpnBOfW5uBq/1YWXx3lKJL/HwhS7sdOn/JVl71:mpgS28dlKZ/HwhS7sdOn/JVl71
    MD5:B47DD26375E52A869B0E7167281EEBB2
    SHA1:CD7BCFE0471409322DC601B2C1A67050EA0D00C5
    SHA-256:7B38DE16B02DB2AA97CA0ACEA40FE845511E19399938B3CE08B258BD1EDDD096
    SHA-512:08FA97D56CE791BA58E668E8E052CDF3160626BE8C7842302FDA28539E9D85FCB118B3811C859CED219C665877DC0351FA2C78997247656C7E4C6EB5CE15D1A8
    Malicious:false
    Preview:#if !defined(AFX_OPTIONTAB10_H__758B3902_A9A6_11D3_A2B3_0000E84E7CA1__INCLUDED_)..#define AFX_OPTIONTAB10_H__758B3902_A9A6_11D3_A2B3_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// OptionTab10.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// COptionTab10 dialog....class COptionTab10 : public CPropertyPage..{...DECLARE_DYNCREATE(COptionTab10)....// Construction..public:...COptionTab10();...~COptionTab10();.. char* GetTip(int id);.. int modify;.. int prox_status;.. char ProxyDetectBuff[16][1024];.. CString ProxyDetectName[16];....// Dialog Data...//{{AFX_DATA(COptionTab10)...enum { IDD = IDD_OPTION10 };...CComboBox.m_ctl_prox;...CButton.m_ctl_pwdhide;...CButton.m_ctl_ftpprox;...CEdit.m_ctl_portprox;...CStatic.m_ctl_proxtitle;...CString.m_proxy;...CString.m_port;...BOOL.m_ftpprox;...//}}AFX_DATA......// Overrides...// ClassWizard generate virtual function overrides...//{{AFX_VIRTUAL(

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-58QEU.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):3228
    Entropy (8bit):5.432666658734526
    Encrypted:false
    SSDEEP:96:dUrUxp/pY7UUYGrvRjRUg6dTQcH8qetaQBzUwP80wLf7dbuLWxKQl71pu:dzxVFw63HHeIouxxE
    MD5:33637BC47CD28273E26DAAC40F19F8BB
    SHA1:3EB0B9452152E038329047A00FA1033A93BE843B
    SHA-256:D3CA7F0ED5A71332F31AC0941793C62C2ADAABEC73F10655E91B79DB92D11E96
    SHA-512:C2DBC7D4C45B21001009554E13F54143CB45EF1AFB4CB038D9FFC936CA89DFEF3575B3D04D8BFFAAC095160BDA74490CE81FDCC45F8446A8B9F92B56C015C1CA
    Malicious:false
    Preview:// WinHTTrack.h : main header file for the WINHTTRACK application..//....#if !defined(AFX_WINHTTRACK_H__C54E332B_F6D3_4407_A9CC_77943F9B45CC__INCLUDED_)..#define AFX_WINHTTRACK_H__C54E332B_F6D3_4407_A9CC_77943F9B45CC__INCLUDED_....#if _MSC_VER > 1000..#pragma once..#endif // _MSC_VER > 1000....#ifndef __AFXWIN_H__...#error include 'stdafx.h' before including this file for PCH..#endif....#include "resource.h" // main symbols..#include "shell.h"..../////////////////////////////////////////////////////////////////////////////..// CWinHTTrackApp:..// See WinHTTrack.cpp for the implementation of this class..//....// En-t.te pour l'affichage des tabs..#include "NewProj.h"..#include "Wid1.h"..#include "trans.h"..#include "FirstInfo.h"..#include "inprogress.h"..#include "infoend.h"......class CWinHTTrackApp : public CWinApp..{..public:...CWinHTTrackApp();...~CWinHTTrackApp();.. void NewTabs(); /* recr.er control tabs */.. //.. CFirstInfo* m_tab0;.. CNewProj* m_t

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-59VG2.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1660
    Entropy (8bit):5.444124660884002
    Encrypted:false
    SSDEEP:48:dXEnEPNBNZEHWEfAEMqWZEu5WVPWVo3LEYu8ETf7LPYl71NY:dUEPXYHDZDtQuPuqwtTf3Ql712
    MD5:7101C69E49F062BB09BFCBE5C2FD5AE1
    SHA1:E190A3B9D25D318A54C573F425ACC4D306285B70
    SHA-256:E8C665855B4635B5CEF101BFFE56D3A902479C5D6091928C0D9D18BD23B43B97
    SHA-512:3813DECD43AA6A37D9459A4D878EC7D1229DC31699BB01017D4AC38D7DB9F8EC93C1BFB98B2CC39E20D141DDA1E6481F9E1C5C5C6887F9CECB7AFE60BB91554D
    Malicious:false
    Preview:// WinHTTrackDoc.h : interface of the CWinHTTrackDoc class..//../////////////////////////////////////////////////////////////////////////////....#if !defined(AFX_WINHTTRACKDOC_H__2DCA7A1F_3A25_4E86_A859_31511341823A__INCLUDED_)..#define AFX_WINHTTRACKDOC_H__2DCA7A1F_3A25_4E86_A859_31511341823A__INCLUDED_....#if _MSC_VER > 1000..#pragma once..#endif // _MSC_VER > 1000......class CWinHTTrackDoc : public CDocument..{..protected: // create from serialization only...CWinHTTrackDoc();...DECLARE_DYNCREATE(CWinHTTrackDoc)....// Attributes..public:....// Operations..public:....// Overrides...// ClassWizard generated virtual function overrides...//{{AFX_VIRTUAL(CWinHTTrackDoc)...public:...virtual BOOL OnNewDocument();...virtual void Serialize(CArchive& ar);...virtual BOOL OnSaveDocument(LPCTSTR lpszPathName);.. virtual BOOL OnOpenDocument(LPCTSTR lpszPathName);...virtual void OnCloseDocument();...//}}AFX_VIRTUAL....// Implementation..public:...virtual ~CWinHTTrackDoc();..#ifdef _DEBUG...virtual

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-5LMLQ.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1242
    Entropy (8bit):5.1777517901423895
    Encrypted:false
    SSDEEP:24:Br1y3oY0oFHIvP1hAOtoy8y5qKgMBgMkedAAIlA51IfmFkImQ2pDX2C9MMn9Rmo0:d1Yd6zAO+Mq8r3RIKmybyXPMmRcZX
    MD5:4F8F53ABE0A9FD6B9EB214C2D311D51B
    SHA1:73115A97CA3A3211A318786BEF84CFD7542D7C83
    SHA-256:B98D040188CEDA0F36B208014F8413033B001266F0201B9AF3B49185F89D1B5D
    SHA-512:81590374E5263ED09D5D31C6B6CAC234CC9794857F39765A61FEE58364BC53FB99C528074C2ECA5EE20E4E5D99F8F772C89EF7BBEC3C67F19474E7A370AAC672
    Malicious:false
    Preview:// ----------------------------------------------------------------------..// 'extended' SHBrowseForFolder routine. ('New folder' button added)..// Written by Xavier Roche, with the help of Gil Rosin, ..// Todd Fast's routines from Pencilneck Software and other Usenet contributors...// ..// Usage: (example)..// CString path = XSHBrowseForFolder(this->m_hWnd,"Select path","c:\\") {..//..// Freeware, but no warranty!..//..// #include "NewFolder.h" for Input dialog (new folder)..// #include <direct.h> for _mkdir..// ----------------------------------------------------------------------....#if !defined(__XSHBrowseForFolder_routines)..#define __XSHBrowseForFolder_routines ....// TODO: Put here your ressource definition..#include "resource.h"..#include "NewFolder.h"....#include <direct.h>..#include "shlobj.h"....#define XSHBrowseForFolder_SETSTRING 1234..#define XSHBrowseForFolder_OK 1....CString XSHBrowseForFolder (HWND hwnd,char* title,char* _path);..LRESU

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-6MKT6.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1528
    Entropy (8bit):5.53786040734039
    Encrypted:false
    SSDEEP:24:xhTQhTjZlPnkOSuFfoIyXW471WzbuwHGUKaPiLhtkOVJ7U8ghT0:xhUh5ZnJ/FfooYWBx3sjJVl7ghA
    MD5:63872C8B55CC56E6043BEBDB06A6D4F6
    SHA1:696A9B54AB119767E861C40567C2A80C9A8DABA8
    SHA-256:E28C452E08444B21FD8AD166D25ED926215CD757064808386A053162FBF7545B
    SHA-512:1C17D801391135DCDAA293EF6004A9B840C89EDDE5E05B959F610D03ED460D3C5787DC5F57BBC88CA5A567BDEF721DD3B133CCFD56538BA6B36C9171AAC7D320
    Malicious:false
    Preview:#if !defined(AFX_OPTIONTAB3_H__E6FA3FE4_A5B5_11D3_A2B3_0000E84E7CA1__INCLUDED_)..#define AFX_OPTIONTAB3_H__E6FA3FE4_A5B5_11D3_A2B3_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// OptionTab3.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// COptionTab3 dialog....class COptionTab3 : public CPropertyPage..{...DECLARE_DYNCREATE(COptionTab3)....// Construction..public:...COptionTab3();...~COptionTab3();.. int modify;.. char* GetTip(int id);......// Dialog Data...//{{AFX_DATA(COptionTab3)...enum { IDD = IDD_OPTION3 };...CComboBox.m_ctl_travel3;...CComboBox.m_ctl_travel2;...CComboBox.m_ctl_travel;...CComboBox.m_ctl_filter;...int..m_filter;...int..m_travel;...int..m_travel2;...BOOL.m_windebug;...BOOL.m_cache;...int..m_travel3;...//}}AFX_DATA......// Overrides...// ClassWizard generate virtual function overrides...//{{AFX_VIRTUAL(COptionTab3)...protected:...virtual void DoDataExchange(CDataExc

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-79R2A.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):9564
    Entropy (8bit):5.355400751916496
    Encrypted:false
    SSDEEP:192:RLvCMcfajWBYioecAxx2GFQBP9BKVzNSw945Pfd45OduRih:RLXjWBYiodYAMQBP9BrwC5XcOdB
    MD5:0DC352326CF733EEE07048ECE5DC2058
    SHA1:09105F11C04116CB9B9F9D4B2F93D1B0F315FB8E
    SHA-256:BAE7984D0FA8ADBA3642C8BB4287AF4CF5DCDD9377BFE9C09B2E84483F739413
    SHA-512:25C17AB86D189E8293F77BD6227E3BD61B51D0BBA60197688E14F773F62BD1D8494C8F12224FAABD3B5455D9822D916E3642118BD6D8F611FE7AEB38D5014849
    Malicious:false
    Preview:// iplog.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "iplog.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....extern "C" {.. #include "HTTrackInterface.h"..}..extern HICON httrack_icon;....// Helper..extern LaunchHelp* HtsHelper;....#define LOW_MARK 127000..#define HIGH_MARK 128000..../////////////////////////////////////////////////////////////////////////////..// Ciplog dialog......Ciplog::Ciplog(CWnd* pParent /*=NULL*/)...: CDialog(Ciplog::IDD, pParent)..{.. timer=0;.. txt="\n";.. type=-1;.. type_filter=0;.. filter=0;...//{{AFX_DATA_INIT(Ciplog)...m_iplog = _T("");...//}}AFX_DATA_INIT..}......void Ciplog::DoDataExchange(CDataExchange* pDX)..{...CDialog::DoDataExchange(pDX);...//{{AFX_DATA_MAP(Ciplog)...DDX_Control(pDX, IDC_HIDEINFO, m_ctl_hideinfo);...DDX_Control(pDX, IDC_log, m_ctl_iplog);...DDX_Text(pDX, IDC_log, m_iplog);...//}}AFX_DATA_MAP..}......// typedef void (AFX_MSG_CALL

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-7CLGN.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):12703
    Entropy (8bit):5.446120697418617
    Encrypted:false
    SSDEEP:384:pmi8c8U3wWOifYiATH62Xys4JXCpnS2p2uSmK944:cWOifYiATH62XyqG144
    MD5:74BA4EF4A94585B175C745362818F13C
    SHA1:3C245F8504A861351E73EF89D1C1923BE05E5718
    SHA-256:565D6DDA41F311EF91A094F74DA665E236E0349D64B3CF360CC1551C27229B47
    SHA-512:F8A32CF45AE0E7D877DD4F096FA8E2CB3289C9B2D780CB65FF665AC33155100AA44FD99D237C8A8BEDBD9119DC7903918CA45FCC44B4B5F1A5F80151C078DF02
    Malicious:false
    Preview:// trans.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "trans.h"....extern "C" {.. #include "HTTrackInterface.h"..}....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....extern char OPTIONhh[32];..extern char OPTIONmm[32];..extern char OPTIONss[32];..extern HICON httrack_icon;....// Chargement des librairies RAS..#if USE_RAS..extern CDynamicRAS* LibRas;..extern int LibRasUse;..#endif....// Helper..extern LaunchHelp* HtsHelper;....// reference sur objet..extern Ctrans* dialog2;..../* Main WizTab frame */..#include "WizTab.h"..extern CWizTab* this_CWizTab;..extern CWizTab* this_intCWizTab2;..../* Main splitter frame */..#include "DialogContainer.h"..#include "splitter.h"..extern CSplitterFrame* this_CSplitterFrame;....// prise en compte prefs..extern void compute_options() ;..../* Back to FirstInfo */..//#include "FirstInfo.h"..../* Dialog final */..#include "inprogress.h"..../* maintab */..#include

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-7CRE7.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):1302
    Entropy (8bit):4.9291518235277145
    Encrypted:false
    SSDEEP:24:yOmR7plAX1GXfVLwkXfDAKBJNEqzgYVXfiGKBJNEqzEUeVIXf/n64KBJNEqzcEbN:Lmpps1AfZVfDAKBYqzj9fiGKBYqzE1qG
    MD5:396BD837C674CF3B5C49DC177A3044DF
    SHA1:7CBE22732C46F3B176D49D36EFE48627D443B8F0
    SHA-256:5A70E339269FA828C92D0A4EBD69137BE167EE128887FBF60774B511B7440FC3
    SHA-512:C155765398F0D5CBD8D42AAD68C99F49B6C0E4777227A37D0CE9956610337B07BC5E4CBFF4487E297AE7A5FF5E01FEB540259EEEF4F3A627D2BC6FEA0794FF1C
    Malicious:false
    Preview:// Classe de sauvegarde de cl.s (identifi.es par leur nom)..// . la mani.re de la base de registre (mais en plus basique)....#include "stdafx.h"..#include "MemRegister.h"......void MemRegister::deleteAll() {.. Mem_index.RemoveAll();.. Mem_value.RemoveAll();.. Mem_valueint.RemoveAll();..}..CString MemRegister::getString(CString name,CString defval) {.. int i;.. for(i=0;i<Mem_index.GetUpperBound()+1;i++) {.. if (Mem_index[i] == name).. return Mem_value[i];.. }.. return defval;..}..int MemRegister::getInt(CString name,int defval) {.. int i;.. for(i=0;i<Mem_index.GetUpperBound()+1;i++) {.. if (Mem_index[i] == name).. return Mem_valueint[i];.. }.. return defval;..}..bool MemRegister::setString(CString name,CString val) {.. int i;.. for(i=0;i<Mem_index.GetUpperBound()+1;i++) {.. if (Mem_index[i] == name) {.. Mem_value[i]=val;.. return true;.. }.. }.. Mem_index.Add(name);.. Mem_value.SetAtGrow(Mem_index.GetUpperBound(),val);.. return true;..}..

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-7IJ87.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):26283
    Entropy (8bit):5.3704197362326145
    Encrypted:false
    SSDEEP:768:7doBP9HlFeA7VzBXbvcpwhMWN3AjIQWD4qcolcWoctyzcPeclyJcBdcBSgkexduR:SN3AjiD4Ah3RloSgk+uRHltb
    MD5:6FA96FDEF6376FD7FD0834B6DD21465D
    SHA1:A5E6D06F4C9369D6746DBF4B9F1750536B380715
    SHA-256:40F64FF8DAD46D568C229668832187E80F5E3F64850433E309C81BEB16D5E35B
    SHA-512:4DDF70112011D2E5F4DC68DAB494F66C59A404506672E1EF8F341D4EC94A22986681AFCA499D0E058B91D6F916550851B51EB005F3F4AE12D87DFC89E228FA8F
    Malicious:false
    Preview:// Wid1.cpp : implementation file..//....#include "stdafx.h"..#include <afxole.h>..#include "oledlg.h"..#include "afxodlgs.h"....#include "Shell.h"..#include "Wid1.h"....#include "NewProj.h"..#include "XSHBrowseForFolder.h"....#include <WS2tcpip.h> // Note: weird C2894 error if not included here..extern "C" {.. #include "HTTrackInterface.h"..}....#include "about.h"..#include "InsertUrl.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....extern CNewProj* dialog0;....extern int binput(char* buff,char* s,int max);....extern int check_continue(char* path_log);..extern int cmdl_opt(char* s);..extern void Write_profile(CString path,int load_path);..extern void Read_profile(CString path,int load_path);..extern CShellApp* CShellApp_app;....// Helper..extern LaunchHelp* HtsHelper;....// reference sur objet..extern Wid1* dialog1;..../* Main WizTab frame */..#include "WizTab.h"..extern CWizTab* this_CWizTab;..../* Main splitter frame */..

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-7RKBA.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):2100
    Entropy (8bit):5.417118430337453
    Encrypted:false
    SSDEEP:48:cWpzp2ktEAT8R+7rQgmtsaxf9dgDidCixBagB7wBUyBHBVfm:9z5CtR+AtPfaid5xBagB7wBUyBHBVO
    MD5:C4702F2353B66C592B571B3EDAE3EEF6
    SHA1:B79D6A0069BFA47B57CABF0B27A57546AC5C4727
    SHA-256:34414C585C7F72100CFBA431050E44E323C27694177A6430E7B713F980E1EDC7
    SHA-512:0E4C160A1BC9DAB0E3D91D446E0B4A84BDAA3366259AC1F5F4B47422AD9E96B2A077CE4556475BC0EA9DC70948308E889D9080563F205F4B714F885A90635F59
    Malicious:false
    Preview:// BuildOptions.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "BuildOptions.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....// Helper..extern LaunchHelp* HtsHelper;....../////////////////////////////////////////////////////////////////////////////..// CBuildOptions dialog......CBuildOptions::CBuildOptions(CWnd* pParent /*=NULL*/)...: CDialog(CBuildOptions::IDD, pParent)..{...//{{AFX_DATA_INIT(CBuildOptions)...m_BuildString = _T("");...//}}AFX_DATA_INIT..}......void CBuildOptions::DoDataExchange(CDataExchange* pDX)..{...CDialog::DoDataExchange(pDX);...//{{AFX_DATA_MAP(CBuildOptions)...DDX_Text(pDX, IDC_BuildString, m_BuildString);...//}}AFX_DATA_MAP..}......BEGIN_MESSAGE_MAP(CBuildOptions, CDialog)...//{{AFX_MSG_MAP(CBuildOptions)...ON_WM_HELPINFO()...//}}AFX_MSG_MAP.. ON_COMMAND(ID_HELP_FINDER,OnHelpInfo2).. ON_COMMAND(ID_HELP,OnHelpInfo2)...ON_COMMAND(ID_DEFAULT_HELP,OnHelpInfo2)..END_M

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-8FSCC.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1574
    Entropy (8bit):5.514671519718005
    Encrypted:false
    SSDEEP:24:x222t5HlwEVioAyWEFm1ox05j4cIWzxuwHGUKaLfhiK0HMJhdVJ7U8E2S:SH6EVioUEo9qW7x3LfV0sJPVl7y
    MD5:BEFA507BF6861977DF8508140B8435D5
    SHA1:C5B40F74DD46CE3640C063D4BDA89AA8A318268F
    SHA-256:95BE83020B3EE78EE7095C8FE2E1EA2EEDBBCB5EF2F0D647260A3CE43E84FC7F
    SHA-512:81A375D8E1FAE79ED0ECF8AD1E51AAFD7E11411DEC4DD816CA10F42817BC6696E227644D4147143284B7FF8D92472C86D92453F7E39BDD93DD5D435B4949DF18
    Malicious:false
    Preview:#if !defined(AFX_ADDFILTER_H__B88718A1_6113_11D2_A2B1_0000E84E7CA1__INCLUDED_)..#define AFX_ADDFILTER_H__B88718A1_6113_11D2_A2B1_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// AddFilter.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// CAddFilter dialog....class CAddFilter : public CDialog..{..// Construction..public:.. int type;...CAddFilter(CWnd* pParent = NULL); // standard constructor....// Dialog Data...//{{AFX_DATA(CAddFilter)...enum { IDD = IDD_AddFilter };...CStatic.m_ctl_affkeyword;...CEdit.m_ctl_afext;...CButton.m_ctl_ok;...CComboBox.m_ctl_aftype;...CString.m_addtype;...CString.m_afquery;...int..m_aftype;...//}}AFX_DATA......// Overrides...// ClassWizard generated virtual function overrides...//{{AFX_VIRTUAL(CAddFilter)...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protected:.. char* GetTip(in

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-9N1U6.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):7982
    Entropy (8bit):5.47156103482403
    Encrypted:false
    SSDEEP:192:K/ehSQQ4QyU/bh6g2h1fvCz0KoSP9etYyTpLdXK6yE9P0NnFW6i9+D:K/ecQQ4QRbh6g2C9iTpLdXK6yE9P0NZ/
    MD5:519FDE5F80F88A43CD080607A52DDAF3
    SHA1:725DA548374C491FD5AF70E80ED0E9163ECC1C96
    SHA-256:4FDB653B99E5B09A5E719F877142EC50287178E8F6523BDBE54207DFC093A55E
    SHA-512:9AFAC68B4F752428E29CC8E04BBE82668F0894969710A3C5544768BECEBD006D0B5585D863D74A123E6AE19D1371DF67AEF9350B4788577F066E3B811FC6E442
    Malicious:false
    Preview:// Tab Control Principal....#include "stdafx.h"..#include "Shell.h"..#include "Maintab.h"..#include "direct.h"....#include "winsvc.h "....#include "windows.h"..#include <stdio.h>..#include <stdlib.h>..#include <string.h>....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....// Icone HTTrack..extern HICON httrack_icon;....// Helper..extern LaunchHelp* HtsHelper;....../////////////////////////////////////////////////////////////////////////////..// CMainTab....//IMPLEMENT_DYNAMIC(CMainTab, CPropertySheet)....//HINSTANCE hInst = NULL;..//SC_HANDLE hSCMan = NULL;......CMainTab::CMainTab(UINT nIDCaption, CWnd* pParentWnd, UINT iSelectPage)..:CPropertySheet(nIDCaption, pParentWnd, iSelectPage)..{.. AddControlPages();..}....CMainTab::CMainTab(LPCTSTR pszCaption, CWnd* pParentWnd, UINT iSelectPage)..:CPropertySheet(pszCaption, pParentWnd, iSelectPage)..{.. AddControlPages();..}....CMainTab::~CMainTab()..{..}....void CMainTab::AddControlPage

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-9NJPN.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):4376
    Entropy (8bit):5.450590198750292
    Encrypted:false
    SSDEEP:96:IzcHGdxdKLKl2didXD6hBgB6BjBZZVS94TceZAqFp:THGhdrTkmIxNg94v
    MD5:FC6C180BFCEB0E09F7BA7B7913F9A367
    SHA1:D154AF1FEE17A64DC4639DED9382CEB4C7461F26
    SHA-256:D140516BEFD9CDD1953FBEE4FFA4A19BF1BF9B6660A43DE94154F53CF7B3895B
    SHA-512:1AC99A43B6644A0C0E55501AFE319BE0E8174EFFD426CEC602EC63A3859E2808B49FBD2627F539CB85694929AE46E58CEA16EFC8645915F54F8E14D28D8CDD42
    Malicious:false
    Preview:// OptionTab1.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "OptionTab1.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../////////////////////////////////////////////////////////////////////////////..// COptionTab1 property page....IMPLEMENT_DYNCREATE(COptionTab1, CPropertyPage)....COptionTab1::COptionTab1() : CPropertyPage(COptionTab1::IDD)..{.. // Patcher titre.. if (LANG_T(-1)) { // Patcher en fran.ais.. m_psp.pszTitle=LANG(LANG_IOPT1); // titre.. m_psp.dwFlags|=PSP_USETITLE;.. }.. m_psp.dwFlags|=PSP_HASHELP;.. //.. //{{AFX_DATA_INIT(COptionTab1)...m_link = FALSE;...m_parseall = FALSE;...m_testall = FALSE;...m_htmlfirst = FALSE;...//}}AFX_DATA_INIT..}....COptionTab1::~COptionTab1()..{..}....void COptionTab1::DoDataExchange(CDataExchange* pDX)..{...CPropertyPage::DoDataExchange(pDX);...//{{AFX_DATA_MAP(COptionTab1)...DDX_Check(pDX, IDC_link, m_link);...DDX_Check(pDX, IDC_pa

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-9S3AK.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2042
    Entropy (8bit):5.206791549480484
    Encrypted:false
    SSDEEP:24:+u7plctl8Necq9D6EhxvRvBGCYLGxvRvBltfgusqhLJpwjaZGU7uYUjXmyB5xLN2:npOtsq9e8xYCVxBf/T9ZGUW3LN5ap
    MD5:41ADF7D5C2E86722F7B73308C0150CEC
    SHA1:15FDAFE19348818BDB94BF70AFEE0EB89D7474FC
    SHA-256:166038DD54AB9B608C3E98385416B81FFC4E8D4FA9DC4C513532E887CFCBCA04
    SHA-512:4F0DD77D53233B2BB7922F8F97D6D2F51CD926C2FA10C50807823A9E302B44760CE7540A37CF0A6C9CF7CA1C70D704AAA37CA9B9CDF9C5FF61D75CAC5DEBF64D
    Malicious:false
    Preview:// TreeViewToolTip.cpp : implementation file..//....#include "stdafx.h"..#include "winhttrack.h"..#include "TreeViewToolTip.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../////////////////////////////////////////////////////////////////////////////..// CTreeViewToolTip....CTreeViewToolTip::CTreeViewToolTip()..{.. EnableToolTips(true);..}....CTreeViewToolTip::~CTreeViewToolTip()..{..}......BEGIN_MESSAGE_MAP(CTreeViewToolTip, CToolTipCtrl)...//{{AFX_MSG_MAP(CTreeViewToolTip)....// NOTE - the ClassWizard will add and remove mapping macros here....//}}AFX_MSG_MAP.. ON_NOTIFY_EX( TTN_NEEDTEXT, 0, OnToolTipNotify )..END_MESSAGE_MAP()..../////////////////////////////////////////////////////////////////////////////..// CTreeViewToolTip message handlers........// ------------------------------------------------------------..// TOOL TIPS..//..// ajouter dans le .cpp:..// remplacer les deux Wid1:: par le nom de la classe::..// dans l

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-A9H8Q.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):7403
    Entropy (8bit):5.305374521449437
    Encrypted:false
    SSDEEP:192:9DEws1E+tlmwuUgUEzyw2vFg2QiluR9DJmIX09sDMdkp1:9jsnvsX2NGR9DJmoX
    MD5:AE6FC8308B470AB0CA5EAD378F0C42DF
    SHA1:15FB349B6B325E05E437D6BC35F406262DACE2BF
    SHA-256:7792B9257BB2086AAD036072689397B15C962B1A91B7711A65D28682BA0E3C0F
    SHA-512:A17A2380557A035CC1592447DA39696801845A70C3BA749967C9FEC739FA485DAAA19F279ADB91D0BCF36803E74D86CE99CDAEEBFFB4DA7CD5AE67805618B345
    Malicious:false
    Preview:/*.. Implementation example:.. .. 1. In the .h file: add....#include "EasyDropTarget.h".......private: .. CEasyDropTarget* drag;....... // Generated message map functions.. afx_msg LRESULT DragDropText(WPARAM wParam,LPARAM lParam);......... 2. In the cpp file: add....#include "EasyDropTarget.h".......#define wm_CEasyDropTargetCallback (WM_USER + 1)..BEGIN_MESSAGE_MAP(Wid1, CDialog)....... ON_MESSAGE( wm_CEasyDropTargetCallback, DragDropText).......END_MESSAGE_MAP()...........int CMyDialogClass::OnCreate(LPCREATESTRUCT lpCreateStruct) ....... // Drag&Drop.. drag=new CEasyDropTarget(this);.. if (drag->IsRegistered()) {.. drag->SetTextCallback(wm_CEasyDropTargetCallback);.. }.......}.... 2b. Add the callback function....// Message from CEasyDropTarget..LRESULT CMyDialogClass::DragDropText(WPARAM wParam,LPARAM lParam) {.. if (lParam) {.. CString st=*((CString*) lParam);.. CLIPFORMAT cfFormat=wParam;.. if (cfFormat==CF_TEXT).. AfxMessageBox("Raw text : "+st);.

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-ABTE7.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):3935
    Entropy (8bit):5.500197148247776
    Encrypted:false
    SSDEEP:96:f8fe6roGWMqlKZLZidy/+SbJPs+SbqRYCY:6eZDMoKGy/jb6jbqRDY
    MD5:770BB417E083E07DCBC4D1C12F7823FB
    SHA1:0A0BB935544F87A540BFDFEF8B7377FF2AC40434
    SHA-256:4DE98CFC5B7979A9D56E9CE2779C1E3DD0F83EEB5469A2C82E58C4727D0634B9
    SHA-512:DB8F33EF36EAC4359F08A906659CA77176495FC6FABA4B0DE3C2871F04D7E8EC1E4579CA84DA16238BE4D516859231F3628830E38303A3B275AF7999C1787104
    Malicious:false
    Preview:// FirstInfo.cpp : implementation file..//....#include "stdafx.h"..#include "winhttrack.h"..#include "FirstInfo.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../* Main WizTab frame */..#include "WizTab.h"..extern CWizTab* this_CWizTab;..../* Main splitter frame */..#include "DialogContainer.h"..#include "splitter.h"..extern CSplitterFrame* this_CSplitterFrame;..../* DirTreeView */..#include "DirTreeView.h"..extern CDirTreeView* this_DirTreeView;....../////////////////////////////////////////////////////////////////////////////..// CFirstInfo property page....IMPLEMENT_DYNCREATE(CFirstInfo, CPropertyPage)....CFirstInfo::CFirstInfo() : CPropertyPage(CFirstInfo::IDD)..{...//{{AFX_DATA_INIT(CFirstInfo)....// NOTE: the ClassWizard will add member initialization here...//}}AFX_DATA_INIT..}....CFirstInfo::~CFirstInfo()..{..}....void CFirstInfo::DoDataExchange(CDataExchange* pDX)..{...CPropertyPage::DoDataExchange(pDX);...//{{AFX_DAT

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-AOD0G.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Composite Document File V2 Document, Cannot read section info
    Category:dropped
    Size (bytes):15360
    Entropy (8bit):3.2724477704253823
    Encrypted:false
    SSDEEP:192:43qhLH78VaeAhYm/zvFzCbs+ieTjrGdKEsSWkl+DlcB0DSeyxO:QeLbGaEm7dzxThK11kEDmCWzO
    MD5:975C59B9D4319284F6C94038DCA0C90C
    SHA1:5ABC683BC0A9EC2362184CF14D40184E033A42A9
    SHA-256:06357CF34C52840A9AA04013DF60C074A3B4C11D8F1A744DFC5576D08B564322
    SHA-512:ACEBA1D56DB0B56279570CB24979DAEF0A563CB1DBD25B7A2EA0C8A7A0BC0EB4EDEE2B558D59F8C04C42AEFD4CCBBB9425768713209EAED49D39A4171291169A
    Malicious:false
    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-AQKCS.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with very long lines (361), with CRLF line terminators
    Category:dropped
    Size (bytes):4675
    Entropy (8bit):5.486954205867068
    Encrypted:false
    SSDEEP:96:yRawfIT5irfjQNhNQEPTRE+LjUGNCNvrdTWv+SHNAbA0vBPxW2ad1c:eATUjjQF9vUHK2StAbAUhrad1c
    MD5:35135743C08319C957256CFFE0F4351F
    SHA1:309A185090DF7367EAC9E0F1E394E5540CFE708B
    SHA-256:47D89C19732CBEF46373812043F5A8508B5FBFFDB072B515093324D97B7C8E88
    SHA-512:4EDC7B3F0EB36905E4120C807C55C57642072B760533D718275123E429F624743FA3F8BFA9586B17A0DE0369A159F46AA8CB82DC9D6BC6D7C4190F80A602DFB7
    Malicious:false
    Preview:# Microsoft Developer Studio Project File - Name="webhttrack" - Package Owner=<4>..# Microsoft Developer Studio Generated Build File, Format Version 6.00..# ** DO NOT EDIT **....# TARGTYPE "Win32 (x86) Console Application" 0x0103....CFG=webhttrack - Win32 Debug..!MESSAGE This is not a valid makefile. To build this project using NMAKE,..!MESSAGE use the Export Makefile command and run..!MESSAGE ..!MESSAGE NMAKE /f "webhttrack.mak"...!MESSAGE ..!MESSAGE You can specify a configuration when running NMAKE..!MESSAGE by defining the macro CFG on the command line. For example:..!MESSAGE ..!MESSAGE NMAKE /f "webhttrack.mak" CFG="webhttrack - Win32 Debug"..!MESSAGE ..!MESSAGE Possible choices for configuration are:..!MESSAGE ..!MESSAGE "webhttrack - Win32 Release" (based on "Win32 (x86) Console Application")..!MESSAGE "webhttrack - Win32 Debug" (based on "Win32 (x86) Console Application")..!MESSAGE ....# Begin Project..# PROP AllowPerConfigDependencies 0..# PROP Scc_ProjName ""..# PROP Scc_Loca

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-BKLFT.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):20515
    Entropy (8bit):5.247551435437972
    Encrypted:false
    SSDEEP:384:+8kaK3b6+bpOZP14pqu20VIw2W/tJGLEOeNZy2NYpcj5JWlY:ZkaKu9GUpw9jzWlY
    MD5:186D64AE5FB8B47D242344FA18F878BD
    SHA1:4023CDC7A2FED142FFA5CA5D93DF1299BD6518ED
    SHA-256:D5D6E1A026AFBC1CEF870912F5E06A0C2B884F7BA5A30199A04AF6E7A880C459
    SHA-512:8D7C538702326B918AD68B2FB7F92B1CBB27BB0687F3F8E0CAAD9B4F881E1966D9C44BDC7E5AB6ED643B53007B345AAD63EB28A2EC0C6BE5D89ECB32000C2846
    Malicious:false
    Preview:// DirTreeView.cpp : implementation file..//....#include "stdafx.h"..#include "winhttrack.h"..#include "DirTreeView.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....extern "C" {.. #include "HTTrackInterface.h".. //#include "htsbase.h"..};....#include "MainFrm.h"....CDirTreeView* this_DirTreeView=NULL;..../////////////////////////////////////////////////////////////////////////////..// CDirTreeView....IMPLEMENT_DYNCREATE(CDirTreeView, CTreeView)....CDirTreeView::CDirTreeView()..{.. this_DirTreeView=this;.. redraw_in_progress=0;.. timer=0;.. count_whandle=0;.. docType="<nullType>";..}....CDirTreeView::~CDirTreeView()..{.. WaitThreads();.. this_DirTreeView=NULL;.. if (imagelist.m_hImageList) {.. imagelist.Detach();.. imagelist.m_hImageList=NULL;.. }..}......BEGIN_MESSAGE_MAP(CDirTreeView, CTreeView)...//{{AFX_MSG_MAP(CDirTreeView)...ON_WM_TIMER()...ON_WM_SHOWWINDOW()...ON_NOTIFY_REFLECT(TVN_ITEMEXPANDING, OnIteme

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-C1RR1.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):3514
    Entropy (8bit):5.493243515782507
    Encrypted:false
    SSDEEP:96:FQXbLJ7i0Vr0p0JI2Wt4wiZgKkWtr+P+1qCqQl7J:Og4VmWtruCN
    MD5:F8E6376D22085A85DCBC15099C51B10C
    SHA1:43875154CF793D98D3E677F0A1114044C27AF578
    SHA-256:B4E0C467EB26AB0224FA147EA95D0C73FFE21626728A6913CB4B0EB100D9D3B1
    SHA-512:A587DD820B2DB03BB766F932DF548F8754A1A7D12EA371C76F4068B0DAB74F78C77B85B96CD2C197A5EC46731BE6C5C45CF2EA506A3E3EE6DDC8CC6A6FF04AB1
    Malicious:false
    Preview:#if !defined(AFX_DIRTREEVIEW_H__DFB224E0_828F_426D_A9A3_471D7A2F5108__INCLUDED_)..#define AFX_DIRTREEVIEW_H__DFB224E0_828F_426D_A9A3_471D7A2F5108__INCLUDED_....#if _MSC_VER > 1000..#pragma once..#endif // _MSC_VER > 1000..// DirTreeView.h : header file..//....#include <afxcview.h>..#include "TreeViewToolTip.h"..../////////////////////////////////////////////////////////////////////////////..// CDirTreeView view....class CDirTreeView : public CTreeView..{..protected:...CDirTreeView(); // protected constructor used by dynamic creation...DECLARE_DYNCREATE(CDirTreeView)..protected:.. UINT_PTR timer;.. HANDLE whandle[1024];.. HTREEITEM pos_whandle[1024];.. int count_whandle;.. void StartTimer();.. void StopTimer();.. //.. void BuildTrackHandles();.. void DestroyTrackHandles();.. void DoTrackHandles();....// Attributes..public:...CTreeViewToolTip m_TreeViewToolTip;.. //.. CString refreshPath; /* callback */.. CString docType; /* document type (ex

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-CLC1G.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1360
    Entropy (8bit):5.49755263464226
    Encrypted:false
    SSDEEP:24:ZI/lI/tjxlKQnkYlxuXd471Wz7uwHGUKaPim+hs+m4KSVkOPUjJ7U8mI/1:bxTnJxutYWBx3h+G+cSJPYl7T
    MD5:D978711C9EBB6794156F313E8DE95115
    SHA1:2C3ED61C3D24A80E77B2E56DE255D010F7CBBAA0
    SHA-256:3F48242B543A1044DF492BB16E0BEDD50E9C144347C153CBD7A670A898B5BA8D
    SHA-512:523F104F7E57CD3D0C0C5285A79D7B9FCBA4487350A219CD97E6A043754015F3C3131F479AB2A964BEFAC9EF65FB69FF610F0CEDF43DA658D1C11A8ACD2B317B
    Malicious:false
    Preview:#if !defined(AFX_FirstInfo_H__DC893229_C7D6_448C_860C_54F4E35FFA84__INCLUDED_)..#define AFX_FirstInfo_H__DC893229_C7D6_448C_860C_54F4E35FFA84__INCLUDED_....#if _MSC_VER > 1000..#pragma once..#endif // _MSC_VER > 1000..// FirstInfo.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// CFirstInfo dialog....class CFirstInfo : public CPropertyPage..{...DECLARE_DYNCREATE(CFirstInfo)....// Construction..public:...CFirstInfo();...~CFirstInfo();....// Dialog Data...//{{AFX_DATA(CFirstInfo)...enum { IDD = IDD_FirstInfo };...CStatic.m_splash;...//}}AFX_DATA......// Overrides...// ClassWizard generate virtual function overrides...//{{AFX_VIRTUAL(CFirstInfo)...public:...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protected:...// Generated message map functions...//{{AFX_MSG(CFirstInfo)...afx_msg void OnMouseMove(UINT nFlags, CPoint point);...afx_msg void OnLButtonDown(

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-D1UIR.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1127
    Entropy (8bit):5.149631965953755
    Encrypted:false
    SSDEEP:12:jvDuAoQClARtlAZOe8N4UqaKferYQfIYnNwIOlTY1/fRjFzeoMlmpJ2ZaUHymZ5E:vu7plctlReifrIYnqIOY5e5oO37Q
    MD5:07EE882416D4D9B3589BEA4775C063E9
    SHA1:6251FE41CB0D6166928AD559DF0E47AD9E31C172
    SHA-256:A5E926ACBA02C3E4317B6E67C32640D91308975EC39E4C45E8380EBE715A1CF4
    SHA-512:BE96CCABEF1A1D0B7B32106D352DBC3D4DCC9AA5E5AF1AFEA179E7718FA65375C5D1C8B436B08397AD76B0A190B17E971447397BF1E205C70200E3BA25397B79
    Malicious:false
    Preview:// BatchUpdate.cpp : implementation file..//....#include "stdafx.h"..#include "winhttrack.h"..#include "BatchUpdate.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../////////////////////////////////////////////////////////////////////////////..// CBatchUpdate property page....IMPLEMENT_DYNCREATE(CBatchUpdate, CPropertyPage)....CBatchUpdate::CBatchUpdate() : CPropertyPage(CBatchUpdate::IDD)..{...//{{AFX_DATA_INIT(CBatchUpdate)....// NOTE: the ClassWizard will add member initialization here...//}}AFX_DATA_INIT..}....CBatchUpdate::~CBatchUpdate()..{..}....void CBatchUpdate::DoDataExchange(CDataExchange* pDX)..{...CPropertyPage::DoDataExchange(pDX);...//{{AFX_DATA_MAP(CBatchUpdate)....// NOTE: the ClassWizard will add DDX and DDV calls here...//}}AFX_DATA_MAP..}......BEGIN_MESSAGE_MAP(CBatchUpdate, CPropertyPage)...//{{AFX_MSG_MAP(CBatchUpdate)....// NOTE: the ClassWizard will add message map macros here...//}}AFX_MSG_MAP..END_MES

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-D3QLR.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1180
    Entropy (8bit):5.486691593330864
    Encrypted:false
    SSDEEP:24:KpFpFvlLz+1oAyWN+E2urz4cIWzW1uwHGUKaAijGkDVJ7U8Tp6:W3N94oUN+3ozqW67x3xG8Vl7N6
    MD5:CAECD7ADB30B37E2773EC7C679A7050E
    SHA1:4D658681A9661EBFFCCB878E4AB6EFD7FD5D1623
    SHA-256:810E65FD962E75D6B06934AFEC89CEF7122DAD9F1B096A122C24AF62A4C3E9D3
    SHA-512:77EA1E564A08957FDCE150B886AEB454352C4C08DCA29BD1CA4854C72B4DC4C91B226BA2810252CF9202C1F61E65770F91F7B30617907B5641FB5B1622A920F2
    Malicious:false
    Preview:#if !defined(AFX_WIZARD_H__55E76A32_F652_11D1_B223_006097BCBD81__INCLUDED_)..#define AFX_WIZARD_H__55E76A32_F652_11D1_B223_006097BCBD81__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// wizard.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// wizard dialog....class wizard : public CDialog..{..// Construction..public:...wizard(CWnd* pParent = NULL); // standard constructor....// Dialog Data...//{{AFX_DATA(wizard)...enum { IDD = IDD_wizard };...CString.m_reponse;...CString.m_question;...//}}AFX_DATA......// Overrides...// ClassWizard generated virtual function overrides...//{{AFX_VIRTUAL(wizard)...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protected:.....// Generated message map functions...//{{AFX_MSG(wizard)...virtual BOOL OnInitDialog();...//}}AFX_MSG...DECLARE_MESSAGE_MAP()..};....//{{AFX_INSERT_LOCATION}}..// Microso

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-DLOI9.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1422
    Entropy (8bit):5.561588027897596
    Encrypted:false
    SSDEEP:24:XGVbGC9l5dxfuAyWWtmK4cIWzhuwHGUKaLfWir0HMJhtkDVJ7U8eG7:aBf7mUM9qWbx3Lf70sJj8Vl7T
    MD5:D8D0E35343DD5F06AC9B5EEE306750F7
    SHA1:6A8BD7208F827E14290A28240388AC436196408A
    SHA-256:5A8936AD3BF482CE1E960B24C0780F594A5ACFE71A781B73C6B436E8E5083D5B
    SHA-512:9DCAB7E8334C957E612D00D48369D7EA25A4A1DB2DFCA8B79418D4517C86EC8409D0C40B155F87989EF9967205D6ED8FFF80BA9E0223167AD7511B575F4FAC58
    Malicious:false
    Preview:#if !defined(AFX_PROXYID_H__17B166A2_693D_11D3_A2B2_0000E84E7CA1__INCLUDED_)..#define AFX_PROXYID_H__17B166A2_693D_11D3_A2B2_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// ProxyId.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// CProxyId dialog....class CProxyId : public CDialog..{..// Construction..public:...CProxyId(CWnd* pParent = NULL); // standard constructor....// Dialog Data...//{{AFX_DATA(CProxyId)...enum { IDD = IDD_ProxyId };...CString.m_proxadr;...CString.m_proxlogin;...CString.m_proxpass;...CString.m_proxport;...//}}AFX_DATA......// Overrides...// ClassWizard generated virtual function overrides...//{{AFX_VIRTUAL(CProxyId)...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protected:.. char* GetTip(int id);...afx_msg void OnHelpInfo2();.......// Generated message map functions...//{{AFX_MSG(CProx

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-DP7PG.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):7945
    Entropy (8bit):5.286062180014344
    Encrypted:false
    SSDEEP:192:Z8Tmr6i6aIllwv+r2MfBznV4qgf7wOnlGNIcUh4LlGfs8a91:YZvaIlhNXNIcqu78a91
    MD5:4A10A87AB915DE74C112BCAAB8A6C92C
    SHA1:C088CE2A2225B46B3495BABFBC40DBCFE3E0EE86
    SHA-256:FE7C4E9D2C64925CA71D3C23AD144722169790C699121824BB99B6A00CCF69AB
    SHA-512:9A85939866C231968B3FBDD77D7F9B3060A88C15940D830EF3ED407648F88A2583C1CE890A3752ECCC2D52D5EA997CA3B48A21D8AE9954286844085854093CF2
    Malicious:false
    Preview:// InfoUrl.cpp : implementation file..//....#include "stdafx.h"..../* Externe C */..#include <WS2tcpip.h> // Note: weird C2894 error if not included here..extern "C" {.. #include "HTTrackInterface.h".. #include "htscore.h"..}....#include "Shell.h"..#include "InfoUrl.h"..#include "NewLang.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....extern HICON httrack_icon;..../////////////////////////////////////////////////////////////////////////////..// CInfoUrl dialog......CInfoUrl::CInfoUrl(CWnd* pParent /*=NULL*/)...: CDialog(CInfoUrl::IDD, pParent)..{...//{{AFX_DATA_INIT(CInfoUrl)....// NOTE: the ClassWizard will add member initialization here...//}}AFX_DATA_INIT..}......void CInfoUrl::DoDataExchange(CDataExchange* pDX)..{...CDialog::DoDataExchange(pDX);...//{{AFX_DATA_MAP(CInfoUrl)...DDX_Control(pDX, IDC_backlist, m_ctl_backlist);...DDX_Control(pDX, IDC_slider, m_slider);...//}}AFX_DATA_MAP..}......BEGIN_MESSAGE_MAP(CInfoUrl,

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-DSHVF.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):6288
    Entropy (8bit):5.443731466101032
    Encrypted:false
    SSDEEP:96:Bx0Qv0TEhkHrBvByBRHM1BFBRBoBDBUaZV994TjgjZcgfqPo5CSU78zJEmydWVUD:r0fBdU/s17LelWqn94bgfqPo5F9EDuy
    MD5:C84983491EEF47668FF11C507C076EC6
    SHA1:7A4222F58695FF09B899B2A0FA288F508222C893
    SHA-256:5F52DCA0E0E8547B7AC4374F2708839E192BA6AC494261DED5DA8413AA3ED385
    SHA-512:DFA19E101DCAF63D16D5C4CAC6344F7BA82BD86CD3F28D64FA6947DB0C5E2267FFE8882A6F21BF976635A60060A2AE81FEA2633CE47E90BA801998D0525CD037
    Malicious:false
    Preview:// InsertUrl.cpp : implementation file..//....#include "stdafx.h"....// Note: weird C2894 error if not included here..#include <ws2tcpip.h>.#include <Wspiapi.h>.extern "C" {.. #include "HTTrackInterface.h".. //#include "htsglobal.h".. //#include "htsbase.h".. //#include "htslib.h"..}..//#include "winsock2.h"....#include "Shell.h"..#include "InsertUrl.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....extern HICON httrack_icon;....// Helper..extern LaunchHelp* HtsHelper;....../////////////////////////////////////////////////////////////////////////////..// CInsertUrl dialog......CInsertUrl::CInsertUrl(CWnd* pParent /*=NULL*/)...: CDialog(CInsertUrl::IDD, pParent)..{...//{{AFX_DATA_INIT(CInsertUrl)...m_urllogin = _T("");...m_urlpass = _T("");...m_urladr = _T("");...//}}AFX_DATA_INIT..}......void CInsertUrl::DoDataExchange(CDataExchange* pDX)..{...CDialog::DoDataExchange(pDX);...//{{AFX_DATA_MAP(CInsertUrl)...DDX_Text(pDX, IDC_

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-E69PU.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):965
    Entropy (8bit):5.078763920482896
    Encrypted:false
    SSDEEP:24:O0uCoeIZJNBJjPlhl8l9olrhcRhckhcSahc/cIRvdlaMCFe+TR5qsxp:iJRb2stc7EAlahs+N8Up
    MD5:FF19F42E2BAED42E1CBC2F667A206E66
    SHA1:08D949FC52247568986861197126DCD6A9EB33A3
    SHA-256:48A3BAE5B17708BA201652B7CA6C82B2BAA2C2C890FFFC88AD656604781EE539
    SHA-512:33F8189DEAED075FF30D4944EA6880384CEA4EC84EB5968EAFCE005DDDB980F06F6CD12E91A6D5C09BDF4672E641EF0CB7EF5D8560DCBDA71FDE749EB3656626
    Malicious:false
    Preview:..#include <stdio.h>..#include <stdlib.h>..#include <string.h>..#include <assert.h>..#include <sys/types.h>....#include "httrack-library.h"../**/..//#include "htsglobal.h"..//#include "htsbase.h"..#include "htsopt.h"..#include "htsdefines.h"..#include "htsstrings.h"..#include "htssafe.h"....extern int linput(FILE* fp,char* s,int max);..extern int linput_trim(FILE* fp,char* s,int max);..extern int linput_cpp(FILE* fp,char* s,int max);..extern void rawlinput(FILE* fp,char* s,int max);..extern int binput(char* buff,char* s,int max);..extern int fexist(const char* s);..extern size_t fsize(const char* s);..extern TStamp time_local(void);....extern char* convtolower(char* catbuff,const char* a);..extern void hts_lowcase(char* s);....extern char* next_token(char* p,int flag);....// Engine internal variables..extern HTSEXT_API hts_stat_struct HTS_STAT;..extern int _DEBUG_HEAD;..extern FILE* ioinfo;....// various..#define copychar(a) concat(catbuff,(a),NULL)..

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-EEUMN.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2312
    Entropy (8bit):5.46184786647678
    Encrypted:false
    SSDEEP:48:r5iFFnJ1E5wbieQE0tqWelx36xfr47tW5q0sQHYcVl7Ar:r5i7HGwycvd62JqhzPVl7Ar
    MD5:77DAB895CC04911233D52E51AD18F46D
    SHA1:D3DA980E9D55BD9A1FC136D7F730235EFC3987E3
    SHA-256:ABF1C794092C50DAB3B51771BC055464111BBC374C3A1E6177A96970352FD730
    SHA-512:79CE866B3341D0659A4671EC6F5D9FBB55823B3FE45209AB7FB5A6CE5F7F816049263BAD33835769407B1D50EF69F2523B0F8D12E4FA226AE3AB9C0907D1D4C6
    Malicious:false
    Preview:#if !defined(AFX_NEWPROJ_H__B87C5B22_80E5_11D3_A2B2_0000E84E7CA1__INCLUDED_)..#define AFX_NEWPROJ_H__B87C5B22_80E5_11D3_A2B2_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// NewProj.h : header file..//......#include "EasyDropTarget.h"..../////////////////////////////////////////////////////////////////////////////..// CNewProj dialog....class CNewProj : public CPropertyPage..{...DECLARE_DYNCREATE(CNewProj).... // Construction..public:...CNewProj(); // standard constructor...~CNewProj(); // standard destructor.. CString GetName(); // nom complet projet.. CString GetPath(); // path complet projet.. CString GetPath0(); // path complet projet sans dernier slash.. CString GetBasePath(); // base path....// Dialog Data...//{{AFX_DATA(CNewProj)...enum { IDD = IDD_NewProj };...CComboBox.m_ctl_projcateg;...CComboBox.m_ctl_projname;...CString.m_proj

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-EIM5D.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):14404
    Entropy (8bit):5.549556951592952
    Encrypted:false
    SSDEEP:384:sMNvWT5MGcbfjUjuR1p2RwAjd0txYiwaqakv:sKhXHYiw2G
    MD5:7DB14C7D96D3EB065639589860D9E114
    SHA1:199753166BB741DF13707E9853D979CF4DD664C1
    SHA-256:71830D095B6013CA4B723C697E915C5CFC862DDCE5AD87DF42C22974F2B98464
    SHA-512:D722DC1D92E31DD6727290FCF9532306E7BB53DC0175E895C834D9CEAEF14DCB15C855715B395B04C2AE92F38DF2D6E366740775DF4615F8C20BC3FA75AD9634
    Malicious:false
    Preview:// splitter.cpp : implementation file..//....#include "resource.h"..#include "stdafx.h"..#include "splitter.h"..#include "DialogContainer.h"..#include "cpp_lang.h"....#include "afxpriv.h"....// CDirTreeView..#include "DirTreeView.h"....// Pointeur sur nous..#include "WinHTTrack.h"..extern CWinHTTrackApp* this_app;....extern "C" {.. #include "HTTrackInterface.h"..};....//#include "htsbase.h"....#ifdef _DEBUG..#undef THIS_FILE..static char BASED_CODE THIS_FILE[] = __FILE__;..#endif....extern "C" {.. #include "HTTrackInterface.h"..};....static UINT indicators[] =..{...ID_SEPARATOR, // status line indicator...ID_INDICATOR_CAPS,...ID_INDICATOR_NUM,...ID_INDICATOR_SCRL,..};....// splitter frame..extern CSplitterFrame* this_CSplitterFrame;..// termine flag..extern int termine;..../* DirTreeView */..#include "DirTreeView.h"..extern CDirTreeView* this_DirTreeView;......../////////////////////////////////////////////////////////////////////////////..// CSplitterFrame....// Create a s

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-EN8PP.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):4814
    Entropy (8bit):5.197574594102746
    Encrypted:false
    SSDEEP:96:dU4EZBRM2adQP6httyxl6OmFD/18Bs/V9OLmK6xuLz4xdjTjTpp3dxZx7NGgg6Sm:doLWfF2BxCE0/pp3Xb7Ug8zfBDp1RJRC
    MD5:2A5A01896D2B968784F6D5F60C30F041
    SHA1:E4DF22F9B837CDBF84EB6DFB23796C64149FE860
    SHA-256:4E71D764BAF8FC7F87E5E6B6778ABEB8BC3B7A4C45D0AFE11AC4FB5056C6E27B
    SHA-512:CAC618588BF6EEA46FB0185699560E9FD806932E68A71F72F7728BA76CB4AADAF3674480155FBDE0E10CDF70F32AB8EA3AA6AB0AF0CA782238CB06292424D178
    Malicious:false
    Preview:// WinHTTrackDoc.cpp : implementation of the CWinHTTrackDoc class..//....#include "stdafx.h"..#include "WinHTTrack.h"....#include "WinHTTrackDoc.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....extern "C" {.. #include "HTTrackInterface.h"..}..../* dialog0 */..#include "NewProj.h"..extern CNewProj* dialog0;..../* Main WizTab frame */..#include "WizTab.h"..extern CWizTab* this_CWizTab;....// dirtreeview..#include "DirTreeView.h"..extern CDirTreeView* this_DirTreeView;..../////////////////////////////////////////////////////////////////////////////..// CWinHTTrackDoc....IMPLEMENT_DYNCREATE(CWinHTTrackDoc, CDocument)....BEGIN_MESSAGE_MAP(CWinHTTrackDoc, CDocument)...//{{AFX_MSG_MAP(CWinHTTrackDoc)....// NOTE - the ClassWizard will add and remove mapping macros here.....// DO NOT EDIT what you see in these blocks of generated code!...//}}AFX_MSG_MAP..END_MESSAGE_MAP()..../////////////////////////////////////////////////////////

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-F8EH5.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1243
    Entropy (8bit):5.316503142019803
    Encrypted:false
    SSDEEP:24:cEvE9/RzaLRQSIG2QvezKgU5O9U6gysMIEH+BVXd6KGXv5jo1akPVk9xr:cuE9daLRzfezaOlgyiEM6tXBM1aWi
    MD5:2C637CD183F3E3631F9E84443EDF7DAB
    SHA1:03478CE703AF2D448372C126DC37FE86B6A65877
    SHA-256:1013B23577CB09650D1DCC2F7C814CCDBC222D030526F10086BA587640634EBD
    SHA-512:2A3192C7DA15285D8FDE87B2E2B46D7DEB4278F5E9CF6F734409B1903B4BAB916CA6C0DE5F93B1C66443B6743152C5020F7BF74422E3489CEE6658CF6A3D8C19
    Malicious:false
    Preview:////////////////////////////////////////////////////////////////..// Microsoft Systems Journal -- December 1999..// If this code works, it was written by Paul DiLascia...// If not, I don't know who wrote it...// Compiles with Visual C++ 6.0, runs on Windows 98 and probably NT too...//....#include <afxhtml.h>....class CHtmlCtrl : public CHtmlView {..public:...CHtmlCtrl() { }...~CHtmlCtrl() { }.....BOOL CreateFromStatic(UINT nID, CWnd* pParent);.....// Normally, CHtmlView destroys itself in PostNcDestroy,...// but we don't want to do that for a control since a control...// is usually implemented as a stack object in a dialog....//...virtual void PostNcDestroy() { }.....// overrides to bypass MFC doc/view frame dependencies...afx_msg void OnDestroy();...afx_msg int OnMouseActivate(CWnd* pDesktopWnd, UINT nHitTest, UINT msg);.....// override to trap "app:" pseudo protocol...virtual void OnBeforeNavigate2( LPCTSTR lpszURL,....DWORD nFlags,....LPCTSTR lpszTargetFrameName,....CByteArray& ba

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-FCJ53.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):441
    Entropy (8bit):5.380542547334683
    Encrypted:false
    SSDEEP:12:mhD01TmD01IAoQClAQE4OopCQFv9B5bne5cunPieDQXny71miA:gD01TmD01I7plMoHvD5bne5HnPjDQX4+
    MD5:F4EB01B5EAE4E8A79B48F3C63A1D72C6
    SHA1:D2461F614E0885F7522D2BF40AA9C4E6D9902512
    SHA-256:27A84977DD790B132288D25405F780488E5947DD2B3D53F6B645E0D01D9E18C2
    SHA-512:02FBEBA2A6455F53C2F7545A35561F3E8C66457D16D14D53F23FC34647509AC18CD9F5EC0565BB448616A6DADA29BDC05681FBC6BD4ECB63D119636DCC02C8BC
    Malicious:false
    Preview:..#if !defined(LAUNCHHELP_HGDHDGCJHHFIJKCHSOZIOJC5448545245451)..#define LAUNCHHELP_HGDHDGCJHHFIJKCHSOZIOJC5448545245451....#include "stdafx.h"..#include "DialogHtmlHelp.h"..//UINT RunBackHelp( LPVOID pP );....// Lancer aide..class LaunchHelp {..public:.. LaunchHelp::LaunchHelp();.. LaunchHelp::~LaunchHelp();.. void Help();.. void Help(CString page);.. CDialogHtmlHelp b;.. CString page;..private:.. void GoHelp();..};....#endif....

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-FIUR0.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1426
    Entropy (8bit):5.5432157234315245
    Encrypted:false
    SSDEEP:24:lTiTjIl7nkzQddfovhV8RZ471WzouwHGUKaPi+htkOVJ7U8ST0:lWoVn/bfob8RZYWcx3ljJVl7SA
    MD5:CA22CCE78E0D0F34D56D65ACC74823CA
    SHA1:BBD6ACDED8F7D903DABCE18EA071F127F92F6D2E
    SHA-256:AD653576C50D488D0C66C91704D41D34B8721150678951AE44E3C92CC71DBB85
    SHA-512:52993B182323E414B94C129D7922694F39D84D8EEEB568DFAB1F786120135C89EEFC28D8523A1331F2923E55F3CFB04F52EB7836A4DFB50246F7C2C2E617E22A
    Malicious:false
    Preview:#if !defined(AFX_OPTIONTAB4_H__E6FA3FE5_A5B5_11D3_A2B3_0000E84E7CA1__INCLUDED_)..#define AFX_OPTIONTAB4_H__E6FA3FE5_A5B5_11D3_A2B3_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// OptionTab4.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// COptionTab4 dialog....class COptionTab4 : public CPropertyPage..{...DECLARE_DYNCREATE(COptionTab4)....// Construction..public:...COptionTab4();...~COptionTab4();.. char* GetTip(int id);......// Dialog Data...//{{AFX_DATA(COptionTab4)...enum { IDD = IDD_OPTION4 };...CString.m_connexion;...BOOL.m_remt;...CString.m_retry;...CString.m_timeout;...BOOL.m_rems;...CString.m_rate;...BOOL.m_ka;...//}}AFX_DATA......// Overrides...// ClassWizard generate virtual function overrides...//{{AFX_VIRTUAL(COptionTab4)...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protected:...// Generated m

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-FQOI5.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):13812
    Entropy (8bit):5.324265902180561
    Encrypted:false
    SSDEEP:384:pgT1rCcOBchLhLBzZIsq6T/giV4ake+wkcPXUv72e7Oo1+AjAWufzXCkBSn4FmLe:pgT1rCcOBchLhLBzZIsqTLq
    MD5:796E3916CD10AD2B0560C48F94AD542F
    SHA1:A9BAA9BFF70EA3C06BA2E67EEBC2409D3FD5B122
    SHA-256:9B25F3752B297EE30F9548F7D98ED78B9CCD2A95626511BBFAF2094005A460A3
    SHA-512:53F096BC16E5CFCB58C23E67E0218E287B25C5E2969D49DED26D5DFA2B42AC7145C538F45C5A2E136BF2C2104EA7AA0C212477D8AD52223745C9EAD64CEBBE19
    Malicious:false
    Preview:# Microsoft Developer Studio Project File - Name="WinHTTrack" - Package Owner=<4>..# Microsoft Developer Studio Generated Build File, Format Version 6.00..# ** DO NOT EDIT **....# TARGTYPE "Win32 (x86) Application" 0x0101....CFG=WinHTTrack - Win32 Debug..!MESSAGE This is not a valid makefile. To build this project using NMAKE,..!MESSAGE use the Export Makefile command and run..!MESSAGE ..!MESSAGE NMAKE /f "WinHTTrack.mak"...!MESSAGE ..!MESSAGE You can specify a configuration when running NMAKE..!MESSAGE by defining the macro CFG on the command line. For example:..!MESSAGE ..!MESSAGE NMAKE /f "WinHTTrack.mak" CFG="WinHTTrack - Win32 Debug"..!MESSAGE ..!MESSAGE Possible choices for configuration are:..!MESSAGE ..!MESSAGE "WinHTTrack - Win32 Release" (based on "Win32 (x86) Application")..!MESSAGE "WinHTTrack - Win32 Debug" (based on "Win32 (x86) Application")..!MESSAGE "WinHTTrack - Win32 Debug release" (based on "Win32 (x86) Application")..!MESSAGE ....# Begin Project..# PROP AllowPerCon

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-FUCQU.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):7867
    Entropy (8bit):5.453708752572845
    Encrypted:false
    SSDEEP:192:l22VFm4DXReUQ9lQ4c3vV6gxwPyn9kQzs5N94n:l22VFm4DBeUQDQ4eV6gxF9kQzeNCn
    MD5:A740A85144BA5B3C22E576F1212EB5F9
    SHA1:07149F5BD78FFDC25A6E381163B094E3EBC594FD
    SHA-256:FC15A6CEF32AEB2BA1B93F69FBA5A94DB4917517401E5C6A58ECFD91D73B7B23
    SHA-512:F0AEA30FF48144AE59B837C82FEA89C22965C7106C2A9DF1238B30F0AD1540A41AD5058587C17795C0F44FBBA5C5057C249F7CB23EA622DAA72DA8DB67A91913
    Malicious:false
    Preview:// Tab Control Principal....#include "stdafx.h"..#include "Shell.h"..#include "WizTab.h"..#include "direct.h"....#include "winsvc.h "....#include "windows.h"..#include <stdio.h>..#include <stdlib.h>..#include <string.h>....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....CWizTab* this_CWizTab;..CWizTab* this_intCWizTab;..CWizTab* this_intCWizTab2;....// Icone HTTrack..extern HICON httrack_icon;....// Instance WinHTTrack..#include "WinHTTrack.h"..extern CWinHTTrackApp* this_app;....// Helper..extern LaunchHelp* HtsHelper;..extern CMainTab* maintab;..../* Main splitter frame */..#include "DialogContainer.h"..#include "splitter.h"..extern CSplitterFrame* this_CSplitterFrame;..../////////////////////////////////////////////////////////////////////////////..// CWizTab....IMPLEMENT_DYNAMIC(CWizTab, CPropertySheet)....CWizTab::CWizTab(UINT nIDCaption, CWnd* pParentWnd, UINT iSelectPage)..:CPropertySheet(nIDCaption, pParentWnd, iSelectPage)

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-GSC7B.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):9716
    Entropy (8bit):5.362287167365494
    Encrypted:false
    SSDEEP:192:7KP8l6Pac2xogBLgdnC3NKT5qMArC0xC94Ee13nfX2mndb:I8cUogBLgRVh2C0xCCV1
    MD5:941CB26D26398C2486FDD7FB0865FC15
    SHA1:9E93DD54CCA7EE58A6749C5FF78C36A7FB9AB126
    SHA-256:E778A44F4CC753F42D02B136673FB22B2A621B2C42647C11D5CD39037C64EDEA
    SHA-512:EF1912E38932C8242D3F9BEDC21C81CAC54E971F49DBB99E49E63324AB03D2B88D5A99843E9875BEAB16796381B5A067C4C394267598ED0E8585CB86F7CEAA60
    Malicious:false
    Preview:// OptionTab7.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "OptionTab7.h"..#include "AddFilter.h"..../* basic HTTrack defs */..extern "C" {.. #include "HTTrackInterface.h".. //#include "htsglobal.h".. //#include "htsbase.h"..}....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../////////////////////////////////////////////////////////////////////////////..// COptionTab7 property page....IMPLEMENT_DYNCREATE(COptionTab7, CPropertyPage)....COptionTab7::COptionTab7() : CPropertyPage(COptionTab7::IDD)..{.. // Patcher titre.. if (LANG_T(-1)) { // Patcher en fran.ais.. m_psp.pszTitle=LANG(LANG_IOPT7); // titre.. m_psp.dwFlags|=PSP_USETITLE;.. }.. m_psp.dwFlags|=PSP_HASHELP;.. //...//{{AFX_DATA_INIT(COptionTab7)...m_url2 = _T("");...//}}AFX_DATA_INIT..}....COptionTab7::~COptionTab7()..{..}....void COptionTab7::DoDataExchange(CDataExchange* pDX)..{...CPropertyPage::DoDataExchange(pDX);..

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-H833P.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):6756
    Entropy (8bit):5.539345486998181
    Encrypted:false
    SSDEEP:96:hzfaB2G3EjvBeidFBuBABjB/BwgBdgB0BWBjBpbkmFWVZVr94TNtMdim+:loMFQ21ZOgAKoFPkEU994b
    MD5:7365FA838C491C1F4B65FE60E304E19A
    SHA1:F16A5A0EB0925B54EDE4E43E37A24F1D65A1407C
    SHA-256:F30CFC478A507E21E0F000E0C2917E36C1182DAEC700F8CC8130BDD9B6E85113
    SHA-512:7DC12A082438C69999C944E106F9FC5F360D1BCDAFD624F65654F20271C98F05F15FBBEB969E3F5DFF974C2827B306D17776614B67814B81105C896BA741849E
    Malicious:false
    Preview:// OptionTab2.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "OptionTab2.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../////////////////////////////////////////////////////////////////////////////..// COptionTab2 property page....IMPLEMENT_DYNCREATE(COptionTab2, CPropertyPage)....COptionTab2::COptionTab2() : CPropertyPage(COptionTab2::IDD)..{.. // Patcher titre.. if (LANG_T(-1)) { // Patcher en fran.ais.. m_psp.pszTitle=LANG(LANG_IOPT2); // titre.. m_psp.dwFlags|=PSP_USETITLE;.. }.. m_psp.dwFlags|=PSP_HASHELP;.. //...//{{AFX_DATA_INIT(COptionTab2)...m_build = -1;...m_dos = FALSE;...m_errpage = FALSE;...m_external = FALSE;...m_nopurge = FALSE;...m_hidepwd = FALSE;...m_hidequery = FALSE;...m_iso9660 = FALSE;...//}}AFX_DATA_INIT..}....COptionTab2::~COptionTab2()..{..}....void COptionTab2::DoDataExchange(CDataExchange* pDX)..{...CPropertyPage::DoDataExchange(pDX);...//{{AFX_DATA

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-HK6GT.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1627
    Entropy (8bit):5.564025972344135
    Encrypted:false
    SSDEEP:24:pTWTjzilPnkAJOuFfohvKDpsn2k471WzuuwHGUKaPi/IIhtkOVJ7U8GT0:p6mZnHxFfoyWYWmx3gjJVl7GA
    MD5:F41F22337C65AD5BEA161B44F133DB01
    SHA1:10AA229E65478BC6F865F0DBEEB0B2954EAB95CA
    SHA-256:D6D7335B078E3B8BB098327EEA2BC1FB1D75079D85EEAA3FBFFE3A31F7224DFA
    SHA-512:E5CCE2815F5820A98297E7C0302BF47FB2444EE93AA018EC571BD74627566F0E9219D102574FA90DDAE7F8566D03AA679835762A0C6CE867B721B6E2BB23EF6E
    Malicious:false
    Preview:#if !defined(AFX_OPTIONTAB2_H__E6FA3FE3_A5B5_11D3_A2B3_0000E84E7CA1__INCLUDED_)..#define AFX_OPTIONTAB2_H__E6FA3FE3_A5B5_11D3_A2B3_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000....#include "BuildOptions.h"....// OptionTab2.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// COptionTab2 dialog....class COptionTab2 : public CPropertyPage..{...DECLARE_DYNCREATE(COptionTab2)....// Construction..public:...COptionTab2();...~COptionTab2();...CBuildOptions Bopt;.. int modify;.. char* GetTip(int id);......// Dialog Data...//{{AFX_DATA(COptionTab2)...enum { IDD = IDD_OPTION2 };...CComboBox.m_ctl_build;...CButton.m_buildopt;...int..m_build;...BOOL.m_dos;...BOOL.m_errpage;...BOOL.m_external;...BOOL.m_nopurge;...BOOL.m_hidepwd;...BOOL.m_hidequery;...BOOL.m_iso9660;...//}}AFX_DATA......// Overrides...// ClassWizard generate virtual function overrides...//{{AFX_VIRTUAL(COptionTab2)...protected:...v

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-HP82M.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):7676
    Entropy (8bit):5.281791383197279
    Encrypted:false
    SSDEEP:192:y1L1ohNhPcotgqpMqCzJyV2HHqAYnfl1T:y1L1ozhfpMBdYN1T
    MD5:664D1226E9F83F17EED2B9D6F2AD6783
    SHA1:17745FF00F31FDE582E9AA2AF3CD6B24917BAF63
    SHA-256:4D8325D21F1A1BFEFCA15F788B55A5F635B9A00D1141890504516DA16A7F02B8
    SHA-512:B2281BEF8F3D7F533CF8DD5DEB20B9783F10804DC21C7646FFE60F168664E4BD00E32DA507159622DA45DEF2A602C4D4101084065F192E18D7981D37DE300369
    Malicious:false
    Preview:// Shell.h : main header file for the SHELL application..//....#if !defined(AFX_SHELL_H__ED81E637_E017_11D1_A97E_006097BC6150__INCLUDED_)..#define AFX_SHELL_H__ED81E637_E017_11D1_A97E_006097BC6150__INCLUDED_..#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..#ifndef __AFXWIN_H__...#error include 'stdafx.h' before including this file for PCH..#endif..../* basic HTTrack defs */..#include "htsnet.h"..#include "htsopt.h"..#include "htsdefines.h"....//..// connect. via HTTrack? (d.fini dans projet)..#define USE_RAS 1..//....// sleep (taux de refresh) en ms..#define HTS_SLEEP_WIN 100....#include "resource.h" // main symbols..#include "cpp_lang.h"..// Ras..#if USE_RAS..#include "RasLoad.h"..#endif..#include "MainTab.h"....// helper launcher..#include "LaunchHelp.h"....// lang.h..#include "newlang.h"....// message requests..#define wm_ViewRestart (WM_USER + 100)..// test ..#define wm_WizRequest1 (WM_USER + 101)..#define wm_WizRequest2 (WM_USER + 102)..#define wm_WizRequest3

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-HQ7QV.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):4884
    Entropy (8bit):5.4658854251058715
    Encrypted:false
    SSDEEP:96:cnevRKt0P4Ij8g7AG6dtXCk2vkaPSzAryWtAO2Vl7VK:O84jyAG6dt11MryWzn
    MD5:B51AA1E339B57109FF47AA5A2CA1231A
    SHA1:33B5528C481603288B2B39D31FC5DBBE9EB0BA75
    SHA-256:1BD916D4D75DE941540733A8F52696EE40FBBE7E532F74FAAA279AE6AF9870A5
    SHA-512:F7A3CD781E38B7B1B45537B2CD35A3192FB33B28CE1C0C2A5D0AD8472C247D99E3024705B187699E40AE2E14879BC53C87B0DED901ACC907CF17D460B33826FC
    Malicious:false
    Preview:#if !defined(AFX_INPROGRESS_H__BAF427E1_1910_11D2_A290_502047C1F032__INCLUDED_)..#define AFX_INPROGRESS_H__BAF427E1_1910_11D2_A290_502047C1F032__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// inprogress.h : header file..//....#include "Shell.h"..#include "iplog.h"..#include "EasyDropTarget.h"....../////////////////////////////////////////////////////////////////////////////..// Cinprogress dialog....class Cinprogress : public CPropertyPage..{..private:.. CEasyDropTarget* drag;..// Construction..public:...Cinprogress(); // protected constructor used by dynamic creation...DECLARE_DYNCREATE(Cinprogress)..public:.. void StatsBuffer_cancel(int id);.. void StatsBuffer_info(int id);.. void StopTimer();.... CWnd* element[5][NStatsBuffer]; // ici 10=NStatsBuffer -- les .l.ments (status nom slide bouton)...//Cinprogress(CWnd* pParent = NULL); // standard constructor.. CWinThread * BackAffLog;.. Ciplog form;.. char pathlog[256];....// Dialog

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-HTJCE.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1574
    Entropy (8bit):5.515640357190352
    Encrypted:false
    SSDEEP:24:5bGb8alwFKoMSKvE2Ay3wN10rwm4cIWzRuwHGUKa4RiarpskDPUjJ7U82b0:5qhmR2RPwmqWTx349r+8PYl72I
    MD5:DE02A5988373ED8A2CEB6F5AA1E3D6DB
    SHA1:8BD126537F097E31F8FD04606B5DFDD73659F187
    SHA-256:509140FA7174623B5E205B42D084C9179EF1F346F13FCBF6DEA9113EB886CE72
    SHA-512:CD652FDBAC5AC1CE57F00B33D83629B4C79EC5433EAD7DA905D80681E1E96B23DB0AA0CBBD73A004E831B5C119699F73B0C2A831A0397A9861F7A762F5A088B4
    Malicious:false
    Preview:#if !defined(AFX_INFOURL_H__FF725966_B6BB_11D3_A2B3_0000E84E7CA1__INCLUDED_)..#define AFX_INFOURL_H__FF725966_B6BB_11D3_A2B3_0000E84E7CA1__INCLUDED_....#if _MSC_VER > 1000..#pragma once..#endif // _MSC_VER > 1000..// InfoUrl.h : header file..//....extern int termine;..extern void* StatsBufferback;..//extern lien_back* back;..extern int StatsBufferback_max;..../////////////////////////////////////////////////////////////////////////////..// CInfoUrl dialog....class CInfoUrl : public CDialog..{..// Construction..public:...CInfoUrl(CWnd* pParent = NULL); // standard constructor.. int id;..// Dialog Data...//{{AFX_DATA(CInfoUrl)...enum { IDD = IDD_InfoUrl };...CComboBox.m_ctl_backlist;...CProgressCtrl.m_slider;...//}}AFX_DATA......// Overrides...// ClassWizard generated virtual function overrides...//{{AFX_VIRTUAL(CInfoUrl)...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protected:.. UINT_PTR timer;.. void S

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-ISIU4.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):7230
    Entropy (8bit):5.54103277983292
    Encrypted:false
    SSDEEP:96:IzL3o5ZTMTPKLe8idFB8sB3B/PBUvBesd73m3hR6B8+Cfvz74FraZVW94TYHhoMb:UIdeF3h5WvQsdkn6Ig946RPfp
    MD5:997F45386F5DE42F62CE20D62644540C
    SHA1:C8FBB31CEEFD1CB82C9920531BA70E2DB67DC45A
    SHA-256:92BDA932D5550DC25E4885338EAEFA8FFC733BE54FB43D0732895AA40A83B705
    SHA-512:5706E8DE5F2D78C337736CA759D0D0284DFE288459812CACE1C60D72B7A932A57C08C2ECDA4FADCD42606F46B73932334791B47B2406025769493AB3F3765F65
    Malicious:false
    Preview:// AddFilter.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "AddFilter.h"....extern "C" {.. #include "HTTrackInterface.h".. //#include "htsbase.h"..};....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....extern HICON httrack_icon;..// Helper..extern LaunchHelp* HtsHelper;..../////////////////////////////////////////////////////////////////////////////..// CAddFilter dialog......CAddFilter::CAddFilter(CWnd* pParent /*=NULL*/)...: CDialog(CAddFilter::IDD, pParent)..{...//{{AFX_DATA_INIT(CAddFilter)...m_addtype = _T("");...m_afquery = _T("");...m_aftype = -1;...//}}AFX_DATA_INIT..}......void CAddFilter::DoDataExchange(CDataExchange* pDX)..{...CDialog::DoDataExchange(pDX);...//{{AFX_DATA_MAP(CAddFilter)...DDX_Control(pDX, IDC_affkeyword, m_ctl_affkeyword);...DDX_Control(pDX, IDC_AFext, m_ctl_afext);...DDX_Control(pDX, IDOK, m_ctl_ok);...DDX_Control(pDX, IDC_AFtype, m_ctl_aftype);...DDX_Text(pDX, IDC_

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-JD4B5.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):6799
    Entropy (8bit):5.335837753516553
    Encrypted:false
    SSDEEP:96:D8qh6XBWr+xcY6B5BIZLBM1bSjypY3Wdo+DiZoXGN4cZV594TnI/+p:dh6XBNCjsLKB2ywb94ME
    MD5:A870991E3FB51AC692C7DCD7188E8A96
    SHA1:AF2AF3A97FC6C86948B5555AB98E36D9C44FF820
    SHA-256:93CB4B4ACC28D1792A005FA080876D46C0839D03DA050EFDA37AACD7F2328876
    SHA-512:9763AA628E348158B6CCD21ABD8FDA589C607D7C69AB2957DB4431E31797CE562EFB679DF54929D358EA7C25EEE80D8B6B50E113BA860F32DC82077C7F12D0E7
    Malicious:false
    Preview:// OptionTab11.cpp : implementation file..//....#include "stdafx.h"..#include "winhttrack.h"..#include "OptionTab11.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../////////////////////////////////////////////////////////////////////////////..// COptionTab11 property page....IMPLEMENT_DYNCREATE(COptionTab11, CPropertyPage)....COptionTab11::COptionTab11() : CPropertyPage(COptionTab11::IDD)..{.. // Patcher titre.. if (LANG_T(-1)) { // Patcher en fran.ais.. m_psp.pszTitle=LANG(LANG_IOPT11); // titre.. m_psp.dwFlags|=PSP_USETITLE;.. }.. m_psp.dwFlags|=PSP_HASHELP;...//{{AFX_DATA_INIT(COptionTab11)...m_ext1 = _T("");...m_ext2 = _T("");...m_ext3 = _T("");...m_ext4 = _T("");...m_ext5 = _T("");...m_ext6 = _T("");...m_ext7 = _T("");...m_ext8 = _T("");...m_mime1 = _T("");...m_mime2 = _T("");...m_mime3 = _T("");...m_mime4 = _T("");...m_mime5 = _T("");...m_mime6 = _T("");...m_mime7 = _T("");...m_mime8 = _T("");...//}}AFX_DAT

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-JETI7.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1518
    Entropy (8bit):5.566804815962112
    Encrypted:false
    SSDEEP:24:rTwTj9lHnkm6fPuxs+i471WzDjuwHGUKaPimw8e0htk/VJ7U8gT0:rsdJnx6fWxwYWtx3i8e0joVl7gA
    MD5:7AB989FE19D9D581F01C9C48EFE4D28F
    SHA1:B2C05E8BBED81A5D61EE51D40B0AB941019F5D63
    SHA-256:905AD97F49A768272EA112FA2498C64A53922425DAD6A09CAACB64D4E9F33170
    SHA-512:6A97A66B51BC0A778E77AD4E0ED01D59340C1E4B59560B7FFAAACBB0ECA804666A4D3BA8842473C1532A5EFBB632894907C3FBA5A7C71930695EBA774496CD61
    Malicious:false
    Preview:#if !defined(AFX_OPTIONTAB7_H__E6FA3FE8_A5B5_11D3_A2B3_0000E84E7CA1__INCLUDED_)..#define AFX_OPTIONTAB7_H__E6FA3FE8_A5B5_11D3_A2B3_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// OptionTab7.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// COptionTab7 dialog....class COptionTab7 : public CPropertyPage..{...DECLARE_DYNCREATE(COptionTab7)....// Construction..public:...COptionTab7();...~COptionTab7();.. char* GetTip(int id);.. int modify;....// Dialog Data...//{{AFX_DATA(COptionTab7)...enum { IDD = IDD_OPTION7 };...CString.m_url2;...//}}AFX_DATA......// Overrides...// ClassWizard generate virtual function overrides...//{{AFX_VIRTUAL(COptionTab7)...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protected:...// Generated message map functions...//{{AFX_MSG(COptionTab7)...afx_msg void OnAdd1();...afx_msg void OnAdd

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-JH7BM.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):7083
    Entropy (8bit):5.567690739151063
    Encrypted:false
    SSDEEP:96:Vz+tvCeMikuz82dmIlEVzNbBtJuvHIvo7OZVz94TV2oMxfKIDi:gCIz8F/VzN3Juvovjx94sDi
    MD5:D00C4251A8414CEF7A6976E571852B71
    SHA1:C03E8B97DEC1938FA1DEA9B7EB638B5EDD57485C
    SHA-256:3883EC37E08D8EC151A46EB5C5E8549C539D5316A705BEDCF31CEEAD4EA0ECCF
    SHA-512:0F528E519A2382A986F9FD95201C6328FE157AE44B8A55C7B39A11DA880A6B552A41CFBBE63C848AE7BC7CFD0DC8B4E20CA7842FE7B62534C21AD668624B7262
    Malicious:false
    Preview:// DialogHtmlHelp.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "DialogHtmlHelp.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....extern "C" {.. #include "HTTrackInterface.h".. //#include "htsbase.h"..};....extern HICON httrack_icon;..../////////////////////////////////////////////////////////////////////////////..// CDialogHtmlHelp dialog......CDialogHtmlHelp::CDialogHtmlHelp(CWnd* pParent /*=NULL*/)...: CDialog(CDialogHtmlHelp::IDD, pParent)..{.. page="";...//{{AFX_DATA_INIT(CDialogHtmlHelp)...//}}AFX_DATA_INIT..}......void CDialogHtmlHelp::DoDataExchange(CDataExchange* pDX)..{...CDialog::DoDataExchange(pDX);...//{{AFX_DATA_MAP(CDialogHtmlHelp)...//}}AFX_DATA_MAP..}......BEGIN_MESSAGE_MAP(CDialogHtmlHelp, CDialog)...//{{AFX_MSG_MAP(CDialogHtmlHelp)...ON_WM_SIZE()...ON_WM_CREATE()...ON_BN_CLICKED(IDC_BACK, OnBack)...ON_BN_CLICKED(IDC_FORWARD, OnForward)...ON_BN_CLICKED(IDC_STOP, OnStop).

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-JIDOM.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):4071
    Entropy (8bit):5.631795857868612
    Encrypted:false
    SSDEEP:96:nluIyFkzgO1hyxyhhEqKlQ8LTLFAbtqKs5Jc:SFU5jmlQ8vxAbtP1
    MD5:FA99DF4A6014731A6024CEEF68F29195
    SHA1:0D8379B3F676C39112D526BD4AD9CD63FE5416EF
    SHA-256:DBCA18D0EFBC2CAFD919D3D000CF127A3438034C8520A08398A11BC8935A8BDC
    SHA-512:F741209455BAAEFED81395F998B570A7EA7520B7B3A5F53812DC12E36944BE1EA0BC25D0C5B9CEA5EB524F1517238873E33D47AE365E831BC2A376486744A40D
    Malicious:false
    Preview:// mainfrm.cpp : implementation of the CMainFrame class..//......#include "stdafx.h"..#include "mainfrm.h"..#include "resource.h"..#include "Shell.h"......IMPLEMENT_DYNCREATE(CMainFrame, CMDIFrameWnd)..BEGIN_MESSAGE_MAP(CMainFrame, CMDIFrameWnd)...//{{AFX_MSG_MAP(CMainFrame)...ON_WM_CREATE()...ON_WM_CLOSE()...//}}AFX_MSG_MAP..END_MESSAGE_MAP()....static UINT BASED_CODE buttons[] =..{...// same order as in the bitmap 'toolbar.bmp'...ID_FILE_NEW, ID_FILE_OPEN, ID_FILE_SAVE, 0,...ID_EDIT_CUT, ID_EDIT_COPY, ID_EDIT_PASTE, 0,...ID_FILE_PRINT, ID_APP_ABOUT,..};....static UINT BASED_CODE indicators[] =..{...0, ID_INDICATOR_CAPS, ID_INDICATOR_NUM, ID_INDICATOR_SCRL,..};....int CMainFrame::OnCreate(LPCREATESTRUCT lpCreateStruct)..{...if (CMDIFrameWnd::OnCreate(lpCreateStruct) == -1)....return -1;..../*...if (!m_wndToolBar.CreateEx(this, TBSTYLE_FLAT, WS_CHILD | WS_VISIBLE | CBRS_TOP....| CBRS_GRIPPER | CBRS_TOOLTIPS | CBRS_FLYBY | CBRS_SIZE_DYNAMIC) ||....!m_wndToolBar.LoadToolBar(IDR_MAINFRAME

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-JPSG2.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):1195
    Entropy (8bit):4.911086399144892
    Encrypted:false
    SSDEEP:24:yE59+EDDWkyEOkH5CTbVpTjFvW4/mFTxUQ36s:yO9PDDNygHWTjFvWJUyN
    MD5:F93E24FD6A95D2489D5DB275ADD84D2A
    SHA1:624FAC7C36C2F90AA432D75B603E0BAA79A53654
    SHA-256:D62DDB7AE57B89BA7FB237BA9AA7FEFA2C59D764BE3840BE026CD5E12FE410B6
    SHA-512:CC264A926D42B113C66DEAD4EF7831461866B1F72BE2B0DD7C85DE07E051F7577AF1F052DDD6026983D3F171C6989CD9BD69B3AD947D9064F9F346248AC569D9
    Malicious:false
    Preview:HTTrack Website Copier License Agreement:....HTTrack Website Copier, Offline Browser for Windows and Unix..Copyright (C) Xavier Roche and other contributors.....This program is free software; you can redistribute it and/or..modify it under the terms of the GNU General Public License..as published by the Free Software Foundation; either version 3..of the License, or any later version.....This program is distributed in the hope that it will be useful,..but WITHOUT ANY WARRANTY; without even the implied warranty of..MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the..GNU General Public License for more details.....You should have received a copy of the GNU General Public License..along with this program; if not, write to the Free Software..Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.......Important notes:....- We hereby ask people using this source NOT to use it in purpose of grabbing..emails addresses, or collecting any other private informations

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-JQG6M.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):3764
    Entropy (8bit):5.445743754927343
    Encrypted:false
    SSDEEP:96:dz+iM2JiNIaeidPBWBxBsBxBQZV/94TxpU:8igNPgjS/u594w
    MD5:51EBE545D4003E76BE6D1264ED58F08E
    SHA1:C71C6A8C730979DE5E1CAABA96C69F3A0DAA18A1
    SHA-256:F64E30B5F651B24E4EF19F937F4C919CBB4CB48CCD89C1828275B06C571DFCC4
    SHA-512:A6EE55BF9F6042AEF2E9EC3073C4AD346B9A910C64D2504CBB53C6E73A811A57935F31CF05820422E971738C0EB7A3C6C83D9F78009D8EA6C02478EF78DD27EF
    Malicious:false
    Preview:// OptionTab6.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "OptionTab6.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../////////////////////////////////////////////////////////////////////////////..// COptionTab6 property page....IMPLEMENT_DYNCREATE(COptionTab6, CPropertyPage)....COptionTab6::COptionTab6() : CPropertyPage(COptionTab6::IDD)..{.. // Patcher titre.. if (LANG_T(-1)) { // Patcher en fran.ais.. m_psp.pszTitle=LANG(LANG_IOPT6); // titre.. m_psp.dwFlags|=PSP_USETITLE;.. }.. m_psp.dwFlags|=PSP_HASHELP;.. //...//{{AFX_DATA_INIT(COptionTab6)...m_user = _T("");...m_footer = _T("");...m_accept_language = _T("");...m_other_headers = _T("");...m_default_referer = _T("");...//}}AFX_DATA_INIT..}....COptionTab6::~COptionTab6()..{..}....void COptionTab6::DoDataExchange(CDataExchange* pDX)..{...CPropertyPage::DoDataExchange(pDX);...//{{AFX_DATA_MAP(COptionTab6)...DDX_CBString(p

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-JVQNP.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1321
    Entropy (8bit):5.353920508989734
    Encrypted:false
    SSDEEP:24:ggegbzl5g4cIWzoUKa/NfKfOhmk6PUjJ7U8rg7:ggegP4qWf3FfKfOgLPYl7rg7
    MD5:196163FD2375CCFB7CD6E26CB1A5D219
    SHA1:3DB3847DC4C9787DDACA092D77D1824139D1226B
    SHA-256:312A4F60A8F5D9F35975D2CD42897116E52718FC2AD42E7EF370CB2E6496589C
    SHA-512:AB6B5C8D40CB6F19AB3BFCC69EBD75ACA3FFD9C995D701388065DEED2ABD35501FAEA81ABA3F228254A8A323DB8B6A81C355E8BB4C3E8756949EA5CDBDC7D532
    Malicious:false
    Preview:#if !defined(AFX_TREEVIEWTOOLTIP_H__C5F45954_56A7_49B9_84B2_9C8BEBC46D08__INCLUDED_)..#define AFX_TREEVIEWTOOLTIP_H__C5F45954_56A7_49B9_84B2_9C8BEBC46D08__INCLUDED_....#if _MSC_VER > 1000..#pragma once..#endif // _MSC_VER > 1000..// TreeViewToolTip.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// CTreeViewToolTip window....class CTreeViewToolTip : public CToolTipCtrl..{..// Construction..public:...CTreeViewToolTip();....// Attributes..public:....// Operations..public:....// Overrides...// ClassWizard generated virtual function overrides...//{{AFX_VIRTUAL(CTreeViewToolTip)...//}}AFX_VIRTUAL....// Implementation..public:...virtual ~CTreeViewToolTip();.....// Generated message map functions..protected:.. char* GetTip(int id);...//{{AFX_MSG(CTreeViewToolTip)....// NOTE - the ClassWizard will add and remove member functions here....//}}AFX_MSG.. afx_msg BOOL OnToolTipNotify( UINT id, NMHDR * pNMHDR, LRESULT * pResult );.....DECLARE_M

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-KTSFS.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):5020
    Entropy (8bit):5.504365827473373
    Encrypted:false
    SSDEEP:96:QzqaOSr3DSMo76BRMBYBnBABBBcXZVa94TUYayw1eU:jaOS6MMChCHypI94G3
    MD5:61778B66524D5E58CF08B608F9503541
    SHA1:80EF9AA99548B5A9C1E89B21D980BEDDD5FBF647
    SHA-256:D079078DAB3A3D6FA982F3682E523DFFBF648BDC7D629F4318746374025C376C
    SHA-512:AA017478867B765EC35EBD1F3FF7F9F4E54FF92FBB40E65BD77E26D8E9C9D61917271CDA8B3A145403068191F5D5A6BC01104A735B9C0B12C7447FFAE42227BB
    Malicious:false
    Preview:// OptionTab9.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "OptionTab9.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../////////////////////////////////////////////////////////////////////////////..// COptionTab9 property page....IMPLEMENT_DYNCREATE(COptionTab9, CPropertyPage)....COptionTab9::COptionTab9() : CPropertyPage(COptionTab9::IDD)..{.. // Patcher titre.. if (LANG_T(-1)) { // Patcher en fran.ais.. m_psp.pszTitle=LANG(LANG_IOPT9); // titre.. m_psp.dwFlags|=PSP_USETITLE;.. }.. m_psp.dwFlags|=PSP_HASHELP;.. //...//{{AFX_DATA_INIT(COptionTab9)...m_index = FALSE;...m_logf = FALSE;...m_Cache2 = FALSE;...m_logtype = -1;...m_norecatch = FALSE;...m_index2 = FALSE;...m_index_mail = FALSE;...//}}AFX_DATA_INIT..}....COptionTab9::~COptionTab9()..{..}....void COptionTab9::DoDataExchange(CDataExchange* pDX)..{...CPropertyPage::DoDataExchange(pDX);...//{{AFX_DATA_MAP(COptionTab9)...

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-KV2TE.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1423
    Entropy (8bit):5.536457327277861
    Encrypted:false
    SSDEEP:24:JT+TjalXnkg1fx1rctBWm471WzSuwHGUKaPiMhtkOVJ7U8uT0:JS65nf1fx2+mYWyx3rjJVl7uA
    MD5:4F05160B56B27B1C30FF1BC86DD64755
    SHA1:D3C0C588480B696A46830CA91AA84C58E0164CFD
    SHA-256:6A9643B06961B4BFB4840B4A4B41DD047291560C2F05C8A63F608528CCFE9039
    SHA-512:E2DF6BD6F078730CEA26E786A9F5CE10EE312E0DE4E58C7BDA694EDAB053B7721D745ADB9EAAC99952332FCD85947A5031300355F0A815C791DA00A9CBA2A444
    Malicious:false
    Preview:#if !defined(AFX_OPTIONTAB6_H__E6FA3FE7_A5B5_11D3_A2B3_0000E84E7CA1__INCLUDED_)..#define AFX_OPTIONTAB6_H__E6FA3FE7_A5B5_11D3_A2B3_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// OptionTab6.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// COptionTab6 dialog....class COptionTab6 : public CPropertyPage..{...DECLARE_DYNCREATE(COptionTab6)....// Construction..public:...COptionTab6();...~COptionTab6();.. char* GetTip(int id);....// Dialog Data...//{{AFX_DATA(COptionTab6)...enum { IDD = IDD_OPTION6 };...CString.m_user;...CString.m_footer;...CString.m_accept_language;...CString.m_other_headers;...CString.m_default_referer;...//}}AFX_DATA......// Overrides...// ClassWizard generate virtual function overrides...//{{AFX_VIRTUAL(COptionTab6)...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protected:...// Generated mess

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-L6NEE.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):986
    Entropy (8bit):5.120449934975005
    Encrypted:false
    SSDEEP:12:jLOtDuAoQClAUJlAJe/USh34AF1arYc3j2Nh8b1/fPvFHoXmJ2L3xM+HymPkeu2S:HOJu7plplEe/LhoAF+fT2Wk3m+3PkePQ
    MD5:95C7C8E0179EF2B4628612B1553EDADC
    SHA1:556951DD01F580B669595DB0EB284A05B7CF0FC8
    SHA-256:4ADE6C4539D8E16F1512CA6DD57B676F4F28ACF4EF95DD72828F5BC91D0AAAB6
    SHA-512:5A395A4E3371170E2F788A31EAE3BA7FACCB1CCF28789F6B076DF4C71F6E1B199BBB182318A1484C4194A4D583CFD9F774F6E31102FB8A926D41DB6B7F7C93B6
    Malicious:false
    Preview:// NewFolder.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "NewFolder.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../////////////////////////////////////////////////////////////////////////////..// CNewFolder dialog......CNewFolder::CNewFolder(CWnd* pParent /*=NULL*/)...: CDialog(CNewFolder::IDD, pParent)..{...//{{AFX_DATA_INIT(CNewFolder)...m_folder = _T("");...//}}AFX_DATA_INIT..}......void CNewFolder::DoDataExchange(CDataExchange* pDX)..{...CDialog::DoDataExchange(pDX);...//{{AFX_DATA_MAP(CNewFolder)...DDX_Text(pDX, IDC_Folder, m_folder);...//}}AFX_DATA_MAP..}......BEGIN_MESSAGE_MAP(CNewFolder, CDialog)...//{{AFX_MSG_MAP(CNewFolder)....// NOTE: the ClassWizard will add message map macros here...//}}AFX_MSG_MAP...ON_COMMAND(ID_HELP, OnHelp)..END_MESSAGE_MAP()..../////////////////////////////////////////////////////////////////////////////..// CNewFolder message handlers..

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-M6T8F.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1593
    Entropy (8bit):5.3715337048974625
    Encrypted:false
    SSDEEP:24:aX6Xhrlqb7ezlem/a3/+6Vk0emjX4cIWzOuwHGUKah+h3wpoiUf2k6PUjJ7U8DXB:KqlYv8zpaZeoXqW2x3Cumf2LPYl7zB
    MD5:A307277482EAABAA60092549B2FB7B77
    SHA1:64451D4A473A0C92DFB47774BDABB2A1FB111B89
    SHA-256:8840ABE7DDC315C9DA9C97B2B57A94041279D1FE164D079AD84F4CD0BA99C2D2
    SHA-512:08CDDA27A9A8B887400D8F2583D1BBFB653CE0FEB5EB644C70F5EADD8326D1C7FB2369DD52BB411B10086F899AC76544B8E83B3B98FBB79672396962A08C3B91
    Malicious:false
    Preview:#if !defined(AFX_HTMLHELP_H__CA6ABCFD_0D37_4DC2_A214_AD0BB7AFBBD5__INCLUDED_)..#define AFX_HTMLHELP_H__CA6ABCFD_0D37_4DC2_A214_AD0BB7AFBBD5__INCLUDED_....#if _MSC_VER > 1000..#pragma once..#endif // _MSC_VER > 1000..// HTMLHelp.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// CHTMLHelp html view....#ifndef __AFXEXT_H__..#include <afxext.h>..#endif..#include <afxhtml.h>....class CHTMLHelp : public CHtmlView..{..public:...CHTMLHelp(); // protected constructor used by dynamic creation...DECLARE_DYNCREATE(CHTMLHelp)....// html Data..public:...//{{AFX_DATA(CHTMLHelp)....// NOTE: the ClassWizard will add data members here...//}}AFX_DATA....// Attributes..public:....// Operations..public:....// Overrides...// ClassWizard generated virtual function overrides...//{{AFX_VIRTUAL(CHTMLHelp)...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..public:...virtual

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-M7U18.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):841
    Entropy (8bit):4.202538775239331
    Encrypted:false
    SSDEEP:12:zTYcgcg2NDr5tnEP2XEczz34FmMejzzYpzb:zacpjtnEP2XEAz3smBPz2zb
    MD5:5C9288AF00DD9FDEF33CC5AFDDEA62EC
    SHA1:161A1754077F658015A67B025C36490A371F8ECC
    SHA-256:02C20644425B4D3DB7586520DB00F2A090B7BBD05350640897DD547F06F04354
    SHA-512:A8C813CFBBB08E4C4D5C9D51D6EDA5D5EE6A174A1BD43BE360A97BB2E467009AA9A5226B87CF01D5FECF6E9BF420908A1E8F6F151B3525DA68BA4E909F83AFAA
    Malicious:false
    Preview:Microsoft Developer Studio Workspace File, Format Version 6.00..# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!....###############################################################################....Project: "WinHTTrack"=.\WinHTTrack.dsp - Package Owner=<4>....Package=<5>..{{{..}}}....Package=<4>..{{{.. Begin Project Dependency.. Project_Dep_Name libhttrack.. End Project Dependency..}}}....###############################################################################....Project: "libhttrack"=..\libhttrack\libhttrack.dsp - Package Owner=<4>....Package=<5>..{{{..}}}....Package=<4>..{{{..}}}....###############################################################################....Global:....Package=<5>..{{{..}}}....Package=<3>..{{{..}}}....###############################################################################....

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-MD5GB.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1358
    Entropy (8bit):5.415781435150983
    Encrypted:false
    SSDEEP:24:FnCpbw11qw11TvA0u5EK5Iao61uvHSf6ofSVJ7U8xw11T:8pbs1qs1TvdzVl7xs1T
    MD5:A2CD31C6BAA9A0AFA9C89D68299AB9E8
    SHA1:3D792CAAC3622B4039D7515738AFBE68372A7188
    SHA-256:90B2849B9E2C654F7A1359C3203EA55F89AB848FE1463E4A7919C4B3E241084F
    SHA-512:07B9BC85B1E1DA6A84715199B03EE86F75AF06F6F4244D866A4A7F62B87B5475C196DA707C10D7BD4DCEFD3BFC99091C6645D288EE5C170235F31ACBADA64839
    Malicious:false
    Preview:// stdafx.h : include file for standard system include files,..// or project specific include files that are used frequently, but..// are changed infrequently..//....#if !defined(AFX_STDAFX_H__ED81E639_E017_11D1_A97E_006097BC6150__INCLUDED_)..#define AFX_STDAFX_H__ED81E639_E017_11D1_A97E_006097BC6150__INCLUDED_....// #define NTDDI_VERSION 0x05000000 // NTDDI_WIN2K....#ifndef WINVER..#define WINVER 0x0500 // _WIN32_WINNT_WIN2K..//#define WINVER 0x0400 // _WIN32_WINNT_NT4..#endif....#ifndef _WIN32_WINNT..#define _WIN32_WINNT 0x0500 // _WIN32_WINNT_WIN2K..//#define _WIN32_WINNT 0x0400 // _WIN32_WINNT_NT4..#endif....#ifndef _WIN32_IE..#define _WIN32_IE 0x0500..#endif....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000....#define VC_EXTRALEAN..// Exclude rarely-used stuff from Windows headers....#include <afxwin.h> // MFC core and standard components..#include <afxext.h> // MFC extensions..#include <afxdisp.h> // MFC OLE automation clas

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-MJ2O8.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):2755
    Entropy (8bit):5.476139663211629
    Encrypted:false
    SSDEEP:48:EpzkWATgf09vCWdCVidFB1im9BaBFBGW0B2BlBQBpB6eLfgBykhRwW4yQL:Az3x09aW8VidFB8sBaBFB90B2B7QBpB5
    MD5:F37BC4B2853864D224BEDEB168680B59
    SHA1:719A0479A6B70741DC8E7D4D875F55F11FA58162
    SHA-256:A507610715AD525E5EA24F89613283CD38602F52A310F36E431B34567BD241FC
    SHA-512:07D35180964E0EE1F6D71B51B4AA521D79791E82E32109B7928FB6606B86A21A87C849B2CD1E07A0D818F67D5B261B6B89CFB9C3BA070C89F1BAB87A4E49FAEA
    Malicious:false
    Preview:// WizLinks.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "WizLinks.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..extern HICON httrack_icon;..../////////////////////////////////////////////////////////////////////////////..// WizLinks dialog......WizLinks::WizLinks(CWnd* pParent /*=NULL*/)...: CDialog(WizLinks::IDD, pParent)..{...//{{AFX_DATA_INIT(WizLinks)...m_lnk = -1;...m_url = _T("");...//}}AFX_DATA_INIT..}......void WizLinks::DoDataExchange(CDataExchange* pDX)..{...CDialog::DoDataExchange(pDX);...//{{AFX_DATA_MAP(WizLinks)...DDX_Radio(pDX, IDC_ch1, m_lnk);...DDX_Text(pDX, IDC_URL, m_url);...//}}AFX_DATA_MAP..}......BEGIN_MESSAGE_MAP(WizLinks, CDialog)...//{{AFX_MSG_MAP(WizLinks)...ON_BN_CLICKED(IDskipall, Onskipall)...ON_WM_DESTROY()...ON_WM_TIMER()...//}}AFX_MSG_MAP...ON_COMMAND(ID_HELP, OnHelp)..END_MESSAGE_MAP()....///////////////////////////////////////////////////////////////////

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-MPI80.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):7279
    Entropy (8bit):5.440649525053119
    Encrypted:false
    SSDEEP:192:40Jx6LI9IN45cYO+Irj1Pfnw94eRjbqRIejbs:40i0o45cYO7j1XnwC/If
    MD5:4E787379CEBF63255A6318E28E901DA4
    SHA1:49E33A3931B5BCCE70C286963C2A01E4822727D6
    SHA-256:0B477AE6F33F0E1978E99D58009D4185C4966A86BC38A958D26DDC6F9989DB09
    SHA-512:3EDEE4DC3D7008C1BE1E0F7C5565BD341AE891BD27EF984AC76E452DE94A1D31FE2DFC9DB0572CCF4C4C1CB80E246A34E77055E462BAA302D8E3099E359EFAEB
    Malicious:false
    Preview:// about.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "about.h"..//#include "about_sh.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....//extern "C" {..// #include "htsbase.h"..//}....extern HICON httrack_icon;..extern CString _HTTRACK_VERSION;....extern int LANG_T(int);..// Helper..extern LaunchHelp* HtsHelper;..extern "C" {.. #include "HTTrackInterface.h".. #include "httrack-library.h"..}..../////////////////////////////////////////////////////////////////////////////..// Cabout dialog......Cabout::Cabout(CWnd* pParent /*=NULL*/)...: CDialog(Cabout::IDD, pParent)..{...//{{AFX_DATA_INIT(Cabout)...m_infover = _T("");...m_lang = -1;...//}}AFX_DATA_INIT..}......void Cabout::DoDataExchange(CDataExchange* pDX)..{...CDialog::DoDataExchange(pDX);...//{{AFX_DATA_MAP(Cabout)...DDX_Control(pDX, IDC_SPLASH, m_splash);...DDX_Control(pDX, IDC_lang, m_ctl_lang);...DDX_Text(pDX, IDC_INFOVER, m_infover

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-MTNIO.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):5866
    Entropy (8bit):5.4921217734027215
    Encrypted:false
    SSDEEP:96:yzgizyPMV3VUXT0DidPBzBaBoBYBeB/BdZVM94TiBWY3U:3izUMVeoiPdwaC0J9m94b
    MD5:A44EA09EED4111C01CDAA730663FE7D3
    SHA1:218FD03BDE2B11931AFAA2DDD0C9D99D28AA1A20
    SHA-256:8C3CCF444C6167CEAB4E44BDF336F22D0EFB93E38C88E8BBAE1E89711EA4C27B
    SHA-512:855F63274EEE684FBE3A64B98A54160DBA8DEBFA17750B512BF36840D95EF081FACA0C40CF8B538FFA1D972DE5705D87C486A44593BE19176EA0DF24E0325E86
    Malicious:false
    Preview:// OptionTab3.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "OptionTab3.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../////////////////////////////////////////////////////////////////////////////..// COptionTab3 property page....IMPLEMENT_DYNCREATE(COptionTab3, CPropertyPage)....COptionTab3::COptionTab3() : CPropertyPage(COptionTab3::IDD)..{.. // Patcher titre.. if (LANG_T(-1)) { // Patcher en fran.ais.. m_psp.pszTitle=LANG(LANG_IOPT3); // titre.. m_psp.dwFlags|=PSP_USETITLE;.. }.. m_psp.dwFlags|=PSP_HASHELP;.. //...//{{AFX_DATA_INIT(COptionTab3)...m_filter = -1;...m_travel = -1;...m_travel2 = -1;...m_windebug = FALSE;...m_cache = FALSE;...m_travel3 = -1;...//}}AFX_DATA_INIT..}....COptionTab3::~COptionTab3()..{..}....void COptionTab3::DoDataExchange(CDataExchange* pDX)..{...CPropertyPage::DoDataExchange(pDX);...//{{AFX_DATA_MAP(COptionTab3)...DDX_Control(pDX, IDC_travel3, m

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-NC44B.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2323
    Entropy (8bit):5.5735624275786355
    Encrypted:false
    SSDEEP:48:yEfCKIereEHy6yf5iYXVUEfqWuXQK5pLW0sQ/grG5f8PYl793:hCvB6mYeKfV70Ql79
    MD5:77715DD91792513BC991640577479E6F
    SHA1:6329486275AC675DAD6F0CF4C4B05E1364A14166
    SHA-256:9FECBD1445B7210E177CCEED7887BA98B85B424F9D42AAD75B221EDDAC1BEAB7
    SHA-512:9807CB645A74C1ACA561056C731E9894E1FE471713A8ED7BEC0AE9364AE3F7E9A9358F059F9C3CD4E566FEF03562C186629FF3EB514F8958F330BBD304C51EAE
    Malicious:false
    Preview:#if !defined(AFX_DIALOGHTMLHELP_H__FED0CE81_AB10_11D3_A2B3_0000E84E7CA1__INCLUDED_)..#define AFX_DIALOGHTMLHELP_H__FED0CE81_AB10_11D3_A2B3_0000E84E7CA1__INCLUDED_....#if _MSC_VER > 1000..#pragma once..#endif // _MSC_VER > 1000..// DialogHtmlHelp.h : header file..//....#include "resource.h"..//#include "LaunchHelpBase.h"..#include "HtmlCtrl.h"....// type callback..typedef void (* Helper_CallBack ) (CWnd*);..typedef void (* OnSize_CallBack ) (CWnd*,UINT nType, int cx, int cy); ..../////////////////////////////////////////////////////////////////////////////..// CDialogHtmlHelp dialog....class CDialogHtmlHelp : public CDialog..{..// Construction..public:.. void Go(CString st);...CDialogHtmlHelp(CWnd* pParent = NULL); // standard constructor.. Helper_CallBack callback;.. OnSize_CallBack callbackOnSize;.. char* GetTip(int id);.. //.. CString page;..protected:...CHtmlCtrl m_page;...CToolBar m_wndToolBar;.. char home[1024];.. char home_dir[1024];..//private:..// LaunchHelpBase

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-NCIH2.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1322
    Entropy (8bit):5.084423059700499
    Encrypted:false
    SSDEEP:24:2u7plctlYeG+8IYnsbSDe5oPIh9wB/ifBi39rQ:/pOtOIYve5oPIcUM3tQ
    MD5:DBCB9FEFF5D5348EB6B6683C88EE5381
    SHA1:8F29514EAA20F991FD03F92D2AFAB9CF5E821AEE
    SHA-256:9DF1B6FF9C6674A3A7C9902071E550B8843C2FC190162A62DF7222BA7D0D419D
    SHA-512:1E43C82821EC2B406BB45E63A5D355EA5282600EDEBC39D3C0A7E6054CC2452C3FE65DBAD36CD2F9FF042AD7EBBE36F4053A2E61491C7E9B2BC76AB63C451638
    Malicious:false
    Preview:// HTMLHelp.cpp : implementation file..//....#include "stdafx.h"..#include "winhttrack.h"..#include "HTMLHelp.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../////////////////////////////////////////////////////////////////////////////..// CHTMLHelp....IMPLEMENT_DYNCREATE(CHTMLHelp, CHtmlView)....CHTMLHelp::CHTMLHelp()..{...//{{AFX_DATA_INIT(CHTMLHelp)....// NOTE: the ClassWizard will add member initialization here...//}}AFX_DATA_INIT..}....CHTMLHelp::~CHTMLHelp()..{..}....void CHTMLHelp::DoDataExchange(CDataExchange* pDX)..{...CHtmlView::DoDataExchange(pDX);...//{{AFX_DATA_MAP(CHTMLHelp)....// NOTE: the ClassWizard will add DDX and DDV calls here...//}}AFX_DATA_MAP..}......BEGIN_MESSAGE_MAP(CHTMLHelp, CHtmlView)...//{{AFX_MSG_MAP(CHTMLHelp)....// NOTE - the ClassWizard will add and remove mapping macros here....//}}AFX_MSG_MAP..END_MESSAGE_MAP()..../////////////////////////////////////////////////////////////////////////////

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-NJCUJ.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):23778
    Entropy (8bit):5.475761286229779
    Encrypted:false
    SSDEEP:384:drm76qVCEzTCUEok0Lm1k7kXK8nX2AWRYIgRpa:mf/Eok0ae7kXK8nXcYIge
    MD5:AC61BFA06857D7169AE27E305AB3583A
    SHA1:6830283EB753EC3C796D6C461CF7574CCD4064F9
    SHA-256:8D223D752408181D60A30494EEC001482A5F953C05A112621FBF1EBA1D0C46EF
    SHA-512:84FE83EE9EE1A6BD9E27F3AE965C94AE4D3949C777642FE68D345E6CC527A699F133B2B76EF7C86EAAA4FF34EEE4CF9485E76E3EC26D5511D1BE5766AE03DCF7
    Malicious:false
    Preview:// WinHTTrack.cpp : Defines the class behaviors for the application...//....#include "stdafx.h"..#include "WinHTTrack.h"....#include "Shell.h"....#include "wid1.h"..#include "maintab.h"....#include "MainFrm.h"..#include "splitter.h"..#include "about.h"....#include "WinHTTrackDoc.h"..#include "WinHTTrackView.h"....#include "inprogress.h"....#include "CrashReport.h"....// KB955045 (http://support.microsoft.com/kb/955045).// To execute an application using this function on earlier versions of Windows.// (Windows 2000, Windows NT, and Windows Me/98/95), then it is mandatary to #include Ws2tcpip.h.// and also Wspiapi.h. When the Wspiapi.h header file is included, the 'getaddrinfo' function is.// #defined to the 'WspiapiGetAddrInfo' inline function in Wspiapi.h. .#include <ws2tcpip.h>.#include <Wspiapi.h>.#ifndef getaddrinfo.#error getaddrinfo "should be defined".#define getaddrinfo WspiapiGetAddrInfo.#endif..../* HTS - HTTRACK */..extern "C" {.. #include "HTTrackInterface.h".. //#include

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-NJDAL.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):23150
    Entropy (8bit):4.97504110345696
    Encrypted:false
    SSDEEP:384:ddRl8Q8g109TmNtrolb7PhlmiKDH1Ick8EaMLy8s/K+erQ7S9:nRSQ31y4olbTmSckfaMDQ7S9
    MD5:3475646B86C1B3368DA812CD6AB2355A
    SHA1:DABC982D6434AD0B30BBB1AA68246FFFF829B4FF
    SHA-256:A2F3F7A399AA94F4804E9BEA8F051E5694195A3F949F4D2CFBEAA255665C3374
    SHA-512:10D343C4E55C038015AC48C3AD488568941915B526993C40C00BD307A511B1DBF730B121E8D5B4D00B72FD8DA234D4DF45059BE9785E86495A03D447BA11ED99
    Malicious:false
    Preview:..// Win includes..#include "stdafx.h"..#include "Shell.h"..#include <comdef.h>....// Hash for lang.h..extern "C" {.. #include "HTTrackInterface.h"..#define HTS_INTERNAL_BYTECODE.. #include "coucal.h"..#undef HTS_INTERNAL_BYTECODE..};..#include "newlang.h"....// test..#ifndef _MBCS..#error "MBCS/DBCS support not found"..#endif..#include <locale.h>......int NewLangStrSz=1024;..coucal NewLangStr=NULL;..int NewLangStrKeysSz=1024;..coucal NewLangStrKeys=NULL;..UINT NewLangCP = CP_THREAD_ACP;..UINT NewLangFileCP = CP_THREAD_ACP;....typedef struct WinLangid {.. int langId;.. const char* name;..} WinLangid;....WinLangid WINDOWS_LANGID[] = {.. { 0x0436, "Afrikaans" },.. { 0x041c, "Albanian" },.. { 0x0401, "Arabic (Saudi Arabia)" },.. { 0x0801, "Arabic (Iraq)" },.. { 0x0c01, "Arabic (Egypt)" },.. { 0x1001, "Arabic (Libya)" },.. { 0x1401, "Arabic (Algeria)" },.. { 0x1801, "Arabic (Morocco)" },.. { 0x1c01, "Arabic (Tunisia)" },.. { 0x2001, "Arabic (Oman)" },.. { 0x2401, "Arabic (Ye

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-NMCK7.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):35821
    Entropy (8bit):4.622128610438848
    Encrypted:false
    SSDEEP:768:A7Y+tNdSz3ZlqXOWoInuzx3Y8N3WiYD0v:AVtNIq1uzZY1C
    MD5:3C34AFDC3ADF82D2448F12715A255122
    SHA1:7713A1753CE88F2C7E6B054ECC8E4C786DF76300
    SHA-256:0B383D5A63DA644F628D99C33976EA6487ED89AAA59F0B3257992DEAC1171E6B
    SHA-512:4937848B94F5B50EA16C51F9E98FDCD3953ACA63D63CA3BB05D8A62C107E382B71C496838D130AE504A52032398630B957ACAEA6C48032081A6366D27CBA5EA9
    Malicious:false
    Preview: GNU GENERAL PUBLIC LICENSE.. Version 3, 29 June 2007.... Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>.. Everyone is permitted to copy and distribute verbatim copies.. of this license document, but changing it is not allowed..... Preamble.... The GNU General Public License is a free, copyleft license for..software and other kinds of works..... The licenses for most software and other practical works are designed..to take away your freedom to share and change the works. By contrast,..the GNU General Public License is intended to guarantee your freedom to..share and change all versions of a program--to make sure it remains free..software for all its users. We, the Free Software Foundation, use the..GNU General Public License for most of our software; it applies also to..any other work released this way by its authors. You can apply it to..your programs, too..... When we speak of free software

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-OAGHN.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):201
    Entropy (8bit):4.593812152587498
    Encrypted:false
    SSDEEP:6:jGmyXH+5AMRNT15eA6YFm+yr5FdllZ+sMKcaGIA0RQbyn:jGXXHJYx5fJE+yr5JlZ+4cWAoQu
    MD5:B63F6E7BA7668B64FEDC0100D9C1D450
    SHA1:B861AFC6953C171A2F1CC4FDDA2F4E1430AE2AF0
    SHA-256:3C34BFF4AC7DAFFA33AD92DAF51FE12ADB113CF9B572D2E88536AA195DC9CC0C
    SHA-512:7002199F197EE1F0E6C56E60FB65FD98E542D9926B98D224D9CAAA4DA539892ED7847099A888BE6AD6BA7CC0FFAF786DCE4CC4A7F5345608BB8C81AF96FE8E0F
    Malicious:false
    Preview:// stdafx.cpp : source file that includes just the standard includes..//.Shell.pch will be the pre-compiled header..//.stdafx.obj will contain the pre-compiled type information....#include "stdafx.h"..

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-OCVP4.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):8985
    Entropy (8bit):5.205348387996107
    Encrypted:false
    SSDEEP:192:joiXUAcN+/TD/hdfmm2guJu0vMPNTLxH4uUuUdbSoNc0:hERELD/hdfg4VsOoNP
    MD5:5493B6CCA9485D122B74D616A70C77DF
    SHA1:38532604877A24A42F6360091A1491AEB27052A1
    SHA-256:5834A663CC55495AE17E1EA1625E43DE1D37EA6280405A15DBEE97CAC5E5068C
    SHA-512:681081BDD45B7B56B953CF6082C94D0D4B6F4276AF6D449C026EF07E38F7E3E4B56C647C76CC43A8A1AC32129C57C3305AFAF804C37F12D8DA107FD6BE39301A
    Malicious:false
    Preview:// ----------------------------------------------------------------------..// 'extended' SHBrowseForFolder routine. ('New folder' button added)..// Written by Xavier Roche, with the help of Gil Rosin, ..// Todd Fast's routines from Pencilneck Software and other Usenet contributors...// Freeware, but no warranty!..// ..// Usage: (example)..// CString path = XSHBrowseForFolder(this->m_hWnd,"Select path","c:\\") {..//..// To DO:..//..// #include "XSHBrowseForFolder.h"..//..// Then Add to the .rc file:..//..// IDD_NewFolder DIALOG DISCARDABLE 0, 0, 237, 46..// STYLE DS_MODALFRAME | WS_POPUP | WS_CAPTION | WS_SYSMENU..// CAPTION "Create New Folder"..// FONT 8, "MS Sans Serif"..// BEGIN..// EDITTEXT IDC_Folder,7,7,167,14,ES_AUTOHSCROLL..// DEFPUSHBUTTON "OK",IDOK,180,7,50,14..// PUSHBUTTON "Cancel",IDCANCEL,180,24,50,14..// END..// ----------------------------------------------------------------------....// TODO: Put in XSHBrowseForFolder.h your ressource definitio

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-P55A0.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):2741
    Entropy (8bit):5.381560892737094
    Encrypted:false
    SSDEEP:48:BpzD5zIAkYtC4o5g1fUZITxYCVxBf/qk9ZGUWq6bNzeiYX2hidCifBDBRgB9C:7ziL4tKZUZVB94T3zPrhid5fBDBRgB9C
    MD5:ADCD43B513B791B48446FCBDB277F292
    SHA1:698E55748DCF50EC25DE2FCC4896BC27C7DEF4DA
    SHA-256:85C122A61C3AD72F522C5E6F97F34F8887CED80FB9E7D0B9E0A7DEC55A041AB5
    SHA-512:49039379FF1FB5CCD655D2A33703C7B6AB9802A06936547D1A37B9803C213DEB6697DB31E6D2669701C39865D6CECD7910347BD315B2475EB1D398471C0A5701
    Malicious:false
    Preview:// CatchUrl.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "CatchUrl.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../////////////////////////////////////////////////////////////////////////////..// CCatchUrl dialog......CCatchUrl::CCatchUrl(CWnd* pParent /*=NULL*/)...: CDialog(CCatchUrl::IDD, pParent)..{...//{{AFX_DATA_INIT(CCatchUrl)...m_info = _T("");...//}}AFX_DATA_INIT..}......void CCatchUrl::DoDataExchange(CDataExchange* pDX)..{...CDialog::DoDataExchange(pDX);...//{{AFX_DATA_MAP(CCatchUrl)...DDX_Text(pDX, IDC_info, m_info);...//}}AFX_DATA_MAP..}....BEGIN_MESSAGE_MAP(CCatchUrl, CDialog)...//{{AFX_MSG_MAP(CCatchUrl)...ON_WM_CLOSE()...//}}AFX_MSG_MAP.. ON_NOTIFY_EX( TTN_NEEDTEXT, 0, OnToolTipNotify )..END_MESSAGE_MAP()..../////////////////////////////////////////////////////////////////////////////..// CCatchUrl message handlers....void CCatchUrl::OnClose() ..{...// TODO: Add your messag

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-P6RHL.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):3930
    Entropy (8bit):5.462276879525385
    Encrypted:false
    SSDEEP:96:YzjSZo4htkHhB5BaB0BRCBDBDBURTCfkZVXO94TwKyUU:yKcr0S/C9lWRCfoQ94C
    MD5:ADEEFD6DC7D12835334C3485DE71AD84
    SHA1:74529D0F144ACDC390BFBA5295312E707F222DCC
    SHA-256:89DE58F8121AD133ABABDFAC3DD7C3918F2091F26DA25B341803CFCC7DE76A14
    SHA-512:43362CB6694589E307A4AE051E50FEB7D1FFD72E0E25BA192FB2C35A6E3A9E0C5646E791331E17D2C1F11EBF782C1496F943999DC1754569AFE60AF84AFE4EF7
    Malicious:false
    Preview:// ProxyId.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "ProxyId.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....extern HICON httrack_icon;....// Helper..extern LaunchHelp* HtsHelper;..../////////////////////////////////////////////////////////////////////////////..// CProxyId dialog......CProxyId::CProxyId(CWnd* pParent /*=NULL*/)...: CDialog(CProxyId::IDD, pParent)..{...//{{AFX_DATA_INIT(CProxyId)...m_proxadr = _T("");...m_proxlogin = _T("");...m_proxpass = _T("");...m_proxport = _T("");...//}}AFX_DATA_INIT..}......void CProxyId::DoDataExchange(CDataExchange* pDX)..{...CDialog::DoDataExchange(pDX);...//{{AFX_DATA_MAP(CProxyId)...DDX_Text(pDX, IDC_proxadr, m_proxadr);...DDX_Text(pDX, IDC_proxlogin, m_proxlogin);...DDX_Text(pDX, IDC_proxpass, m_proxpass);...DDX_Text(pDX, IDC_proxport, m_proxport);...//}}AFX_DATA_MAP..}......BEGIN_MESSAGE_MAP(CProxyId, CDialog)...//{{AFX_MSG_MAP(CProxyId).

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-PF6RE.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):2085
    Entropy (8bit):5.382601798690171
    Encrypted:false
    SSDEEP:48:uJ11E11RRGrvRfbRDMbaropMnopMhpz+o6B0m4yT28hqwpsXKgf20s3W7WxxXX:uJ1i1JGrvRjRDMaroanoahd76B0a28hB
    MD5:846AF0FB8A5A2BD5CC3604DD47DE6228
    SHA1:A1501FB67F52F48D456EAD32FCBF981F1F240FF8
    SHA-256:0BD1A9A875D5CEA80389C25B2EEF549CA404CE69DF8D27AB23B89EDA96AE88C9
    SHA-512:323DCDC3CE02542C7B50716409622DFBAB2C54C39853F26215BD7C98FD10EEC238AB44EDAAC898E69AA2A56671A3BE71AE687B64AD8E2FC9E9ACFCF6A67F075F
    Malicious:false
    Preview:#if !defined(__WizTab_H_HSGFYZEGCHXHVCHD52485454857545)..#define __WizTab_H_HSGFYZEGCHXHVCHD52485454857545....// Tab Control Principal....// En-t.te pour l'affichage des tabs..#include "NewProj.h"..#include "Wid1.h"..#include "trans.h"..#include "FirstInfo.h"..#include "inprogress.h"..#include "infoend.h"....class CWizTab : public CPropertySheet..{.. DECLARE_DYNAMIC(CWizTab).. ..private:.. int is_inProgress;.... // Construction..public:.. CWizTab(UINT nIDCaption, CWnd* pParentWnd = NULL, UINT iSelectPage = 0);.. CWizTab(LPCTSTR pszCaption, CWnd* pParentWnd = NULL, UINT iSelectPage = 0);.. CWizTab(LPCTSTR pszCaption, int num, CWnd* pParentWnd = NULL, UINT iSelectPage = 0);.. ..protected:.. void AddControlPages(void);.. .. // Attributes..public:.. // D.claration des classes-dialog pour les diff.rents Tab Control.. CFirstInfo* m_tab0;.. CNewProj* m_tab1;.. Wid1* m_tab2;.. Ctrans* m_tab3;.. Cinprogress* m_tabprogress;.. Cinfoe

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-PM7GN.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):1582
    Entropy (8bit):5.343163979184146
    Encrypted:false
    SSDEEP:24:xJu7plpl7/ezvbueL1oAtcmbRTYQAJ5CUkeNgCv/EY/E5VvIZd3PuipmaBEbkz:opzMloAjbtYj5z3sVidWiJBcm
    MD5:2358C8061DAF592FBD37229A04BD2A75
    SHA1:C61A81F55B5C9CC847F4A3A6AA3796D33CA8E8C1
    SHA-256:08CEA7E51ABC9F1EF0212912EA352C2318908D12CB498CD6C5894230D1049FCD
    SHA-512:08697D7DAFA27A84B4A237824485D323DB5CB74E0100D47DA03A1EE979C490728332FA9DF8DB376EECE2D4FB36E156BACABB049562D2115805288CA1DBAD9E67
    Malicious:false
    Preview:// wizard.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "wizard.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..extern HICON httrack_icon;..../////////////////////////////////////////////////////////////////////////////..// wizard dialog......wizard::wizard(CWnd* pParent /*=NULL*/)...: CDialog(wizard::IDD, pParent)..{...//{{AFX_DATA_INIT(wizard)...m_reponse = _T("");...m_question = _T("");...//}}AFX_DATA_INIT..}......void wizard::DoDataExchange(CDataExchange* pDX)..{...CDialog::DoDataExchange(pDX);...//{{AFX_DATA_MAP(wizard)...DDX_Text(pDX, IDC_reponse, m_reponse);...DDX_Text(pDX, IDC_question, m_question);...//}}AFX_DATA_MAP..}......BEGIN_MESSAGE_MAP(wizard, CDialog)...//{{AFX_MSG_MAP(wizard)...//}}AFX_MSG_MAP...ON_COMMAND(ID_HELP, OnHelp)..END_MESSAGE_MAP()..../////////////////////////////////////////////////////////////////////////////..// wizard message handlers....BOOL wizard::OnInitDia

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-PVO65.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):110327
    Entropy (8bit):4.770219261755178
    Encrypted:false
    SSDEEP:384:Bfacu6eypacu6eKkDuYzWHuiqOsu3zcNunSOvfqfw+R+iznUvfqfw+R+iznQvfqF:xacdeeacdeXDzSHlvsEIN8M
    MD5:68D599791817FF80EF4273F37A93B7EE
    SHA1:23FD8A0733C7CA3E0B8BC15F755F880AB4A1AF58
    SHA-256:70D548B2B1D66964AB03F617430709080A550346811AC7F579CF49A6C62E5804
    SHA-512:167CB2E7FCE8A439769D90E5907440B9FFD0AE572172EEB2065E441E528C6C866649B782C816CFE6A2B6C81CD84FDE11FC214E026BC6DCD289B8D44E3EE8BE92
    Malicious:false
    Preview:<?xml version="1.0" encoding="Windows-1252"?>..<VisualStudioProject...ProjectType="Visual C++"...Version="9,00"...Name="WinHTTrack"...ProjectGUID="{4707CDEB-E576-4664-98A8-94D99BA190B8}"...RootNamespace="WinHTTrack"...Keyword="MFCProj"...TargetFrameworkVersion="131072"...>...<Platforms>....<Platform.....Name="Win32"..../>....<Platform.....Name="x64"..../>...</Platforms>...<ToolFiles>...</ToolFiles>...<Configurations>....<Configuration.....Name="Debug release|Win32".....OutputDirectory="c:\temp\VCDebug".....IntermediateDirectory="c:\temp\VCDebug".....ConfigurationType="1".....InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops".....UseOfMFC="2".....ATLMinimizesCRunTimeLibraryUsage="false".....CharacterSet="2".....>.....<Tool......Name="VCPreBuildEventTool"...../>.....<Tool......Name="VCCustomBuildTool"...../>.....<Tool......Name="VCXMLDataGeneratorTool"...../>.....<Tool......Name="VCWebServiceProxyGeneratorTool"...../>.....<Tool......Name="VCMIDLTool"......

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-QCNAG.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):3872
    Entropy (8bit):5.380568069875657
    Encrypted:false
    SSDEEP:96:+8hiTxiB3jmpUoC4luwKyB5Pd7RWR7xNHfXltHpIXfOGNDOm7mSw:xzDol/LxRWRtNHfXltHpCO4u
    MD5:FB56AE23B73B5AC74FC9075C52E7B471
    SHA1:DFFB866EF7A3B885C35601F3DD0FA7CB0A7F7659
    SHA-256:6EB263DBC5244B79DFDC5722FBA45DAC3A568C42127F993AFD6B7A38EC98F850
    SHA-512:AC5BCCFD7D982438462071025EA51A76EC3AF53DFE909FF3F42B291E462BE99019015292CF8217C37ECACBDB0ABBEA81EE1072A8DD67700DB1F6FC29B210B5FC
    Malicious:false
    Preview:// DialogContainer.cpp : implementation file..//....// Les dialogues doivent avoir comme flags:..// CHILD, NONE, VISIBLE..// Et surcharger Oncancel et OnOK......#include "stdafx.h"..#include "winhttrack.h"..#include "DialogContainer.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../////////////////////////////////////////////////////////////////////////////..// CDialogContainer....IMPLEMENT_DYNCREATE(CDialogContainer, CFormView)....CDialogContainer::CDialogContainer()...: CFormView(CDialogContainer::IDD)..{.. scrollsize_declared=FALSE;.. tab=new CWizTab("WinHTTrack Website Copier",0);.. tab2=new CWizTab("WinHTTrack Website Copier",1);...//{{AFX_DATA_INIT(CDialogContainer)....// NOTE: the ClassWizard will add member initialization here...//}}AFX_DATA_INIT..}....CDialogContainer::~CDialogContainer()..{.. /*.. voir WizTab.cpp.. delete tab;.. delete tab2;.. tab=tab2=NULL;.. */..}....void CDialogContainer::DoDataExchange(C

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-QEDD0.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2694
    Entropy (8bit):5.343689658705698
    Encrypted:false
    SSDEEP:48:cuE9daLRbJ+QezubEOHNINJ+MFpZ1lJMdQf/ePr:cuEKLRFvez/UNINJ+MbZ1J/gr
    MD5:C47FC56394BE4B26940D2AB2498CA8FF
    SHA1:4747EF36DB1CC024AE76D5DBE6EAA543DDF7C264
    SHA-256:B25BA8FC54B2941378E36D0FD608944843DFD63BBAACECE044B6818E56D228B0
    SHA-512:1313894D37C5D81D9B3D6C37055BEC433C6FC98E419E45A7F5EC289D5AC67D0164BF4E6D4A04E6A6D7EEF0476726D65C97A2C761D776DBF19684E3308C10FE75
    Malicious:false
    Preview:////////////////////////////////////////////////////////////////..// Microsoft Systems Journal -- December 1999..// If this code works, it was written by Paul DiLascia...// If not, I don't know who wrote it...// Compiles with Visual C++ 6.0, runs on Windows 98 and probably NT too...//..#include "StdAfx.h"..#include "HtmlCtrl.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....IMPLEMENT_DYNAMIC(CHtmlCtrl, CHtmlView)..BEGIN_MESSAGE_MAP(CHtmlCtrl, CHtmlView)...ON_WM_DESTROY()...ON_WM_MOUSEACTIVATE()..END_MESSAGE_MAP()....//////////////////..// Create control in same position as an existing static control with..// the same ID (could be any kind of control, really)..//..BOOL CHtmlCtrl::CreateFromStatic(UINT nID, CWnd* pParent)..{...CStatic wndStatic;...if (!wndStatic.SubclassDlgItem(nID, pParent))....return FALSE;.....// Get static control rect, convert to parent's client coords....CRect rc;...wndStatic.GetWindowRect(&rc);...pParent->

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-QGIQQ.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):114572
    Entropy (8bit):5.196810811160097
    Encrypted:false
    SSDEEP:1536:D+N49LubZC75PEKu6NfCwRsCNH1E5+dVS1CQa:n9GZCthuI
    MD5:94CD78E71BBB7276C4FAE6212E58C1A3
    SHA1:2A3F997FAFC26A22644C96F7571AC2FE451BB8A3
    SHA-256:D2C201E931A1BA105DE37236177FA63F8B23E585A0206AB1E0F3B4FF39153C41
    SHA-512:B3588A5A84EBACE0E4701C6B6BD46E2479456889C8C95B2890335DB35FFA8F10CC61B9CCB466A47014178F93CCBA71C6900620742E24C6A69D58635B29FED20D
    Malicious:false
    Preview:// Shell.cpp : Defines the class behaviors for the application...//....// thread windows..#include <process.h>....#include "stdafx.h"..#include "Shell.h"..#include "NewProj.h"....#include <WS2tcpip.h> // Note: weird C2894 error if not included here..extern "C" {.. #include "HTTrackInterface.h"..};..//#include "htsbase.h"....// Ras..#if USE_RAS ..#include "RasLoad.h"..#endif....#include <afxdisp.h>..#include "ras.h"..#include "mmsystem.h"....//#include "ShellDoc.h"..//#include "ShellView.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....// PATCH-->..// PATCH-->..#include "about.h"..#include "infoend.h"....// flag de termination..int termine=0;..int termine_requested=0;..int shell_terminated=0;..int soft_term_requested=0;..FILE* fp_debug=NULL;....#include "stdafx.h"..#include "Shell.h"..#include "process.h"..//#include "ShellDoc.h"..//#include "ShellView.h"..//#include "essai.h"..//#include "get.h"..//#include "parameter.h"..ex

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-QHRH3.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1224
    Entropy (8bit):5.411643957192032
    Encrypted:false
    SSDEEP:24:A9B/Z9B/tClPuoAyWW+m4cIWzMuwHGUKaAiJOFskDVJ7U8T9B/S:8xm9uoUlmqW4x33OFs8Vl7Z8
    MD5:5733779F127F2314DF5D6978AB282E03
    SHA1:2BA326A3E1C38DA22E0FAF3E85CDB8F222C4A1E6
    SHA-256:CA67CEE129D92B986656502C6362393D3FC8ECA4B2DCA0C83F7C5228DDFF42C1
    SHA-512:6B71EA8BCC446B0FF3F61EFC4E0D0AF7A2E35AFEB8FD00D453BE2E2F85A2A09452D5AD373C7A4BA91FD69D125BCCA763D99F7ED2F6AD787F79DD498628DE0297
    Malicious:false
    Preview:#if !defined(AFX_NEWFOLDER_H__FC899FE4_9DCD_11D2_A2B1_0000E84E7CA1__INCLUDED_)..#define AFX_NEWFOLDER_H__FC899FE4_9DCD_11D2_A2B1_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// NewFolder.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// CNewFolder dialog....class CNewFolder : public CDialog..{..// Construction..public:...CNewFolder(CWnd* pParent = NULL); // standard constructor....// Dialog Data...//{{AFX_DATA(CNewFolder)...enum { IDD = IDD_NewFolder };...CString.m_folder;...//}}AFX_DATA......// Overrides...// ClassWizard generated virtual function overrides...//{{AFX_VIRTUAL(CNewFolder)...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protected:.....// Generated message map functions...//{{AFX_MSG(CNewFolder)....// NOTE: the ClassWizard will add member functions here...//}}AFX_MSG...DECLARE_MESSAGE_MAP()..};

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-QJV4U.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1460
    Entropy (8bit):5.541829124778632
    Encrypted:false
    SSDEEP:24:INUBNUjMlrnkk/PfPuxzPRlv471Wz8uwHGUKaPi6hEVJ7U8RNU0:CuLdnXXfWxdRYWYx35SVl7/N
    MD5:1188D47697D6931D18EFFEAB530237BA
    SHA1:6064A0AAD5B3CA52EAFE5E40EAC318E3BED82F26
    SHA-256:C599457021A3B2935D6C75935832D2996AC21CAC9A34578363DF0EA28DD4D334
    SHA-512:D6C5CD49D5F08595589EA256D4DA1837D57482EF0E64780DAE67E4E59215B0834736B4F313C7BC46AA48D8E2BFFBF2FAA76E2D763EC1599F44F811210E54893A
    Malicious:false
    Preview:#if !defined(AFX_OPTIONTAB8_H__8D023EA4_A8C3_11D3_A2B3_0000E84E7CA1__INCLUDED_)..#define AFX_OPTIONTAB8_H__8D023EA4_A8C3_11D3_A2B3_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// OptionTab8.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// COptionTab8 dialog....class COptionTab8 : public CPropertyPage..{...DECLARE_DYNCREATE(COptionTab8)....// Construction..public:...COptionTab8();...~COptionTab8();.. char* GetTip(int id);.. int modify;....// Dialog Data...//{{AFX_DATA(COptionTab8)...enum { IDD = IDD_OPTION8 };...int..m_checktype;...BOOL.m_cookies;...BOOL.m_parsejava;...int..m_robots;...BOOL.m_http10;...BOOL.m_toler;...BOOL.m_updhack;...BOOL.m_urlhack;...//}}AFX_DATA......// Overrides...// ClassWizard generate virtual function overrides...//{{AFX_VIRTUAL(COptionTab8)...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementa

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-QROQ8.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):1942
    Entropy (8bit):4.728618230001425
    Encrypted:false
    SSDEEP:24:yqRJiz7WtyPOkHMlCTbVO2ylFvP4/mFhxUwIXEXq/QsKp8TfEprkmvzx:FRC7iyZHc1FvPHUwIXEXMQfpEMp4A
    MD5:14BD5687E82C347CF48ED328F03267EE
    SHA1:76C7BF00F01F1E993BEF7F0E22CBC56671EDEB2E
    SHA-256:BED3015D5F74BB43ADA10A864F18D579AC5D5C09CB950143237254EF21C42AD8
    SHA-512:CFCB55F2B14D840FBC0A517876E42BB3BE60715A1991ECCBCF1DF5A534DC14F467D1787B3CBAAA3748EE75CB4ADD42A19F57F66A818060FE02EE3A2F3F75983C
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2014 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-R7GOQ.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):2547
    Entropy (8bit):5.39400043494377
    Encrypted:false
    SSDEEP:48:u4ft1tt1R0wlFlSlnlEl8VMl2lrlIlylg4LzopPopz+o6BMtTG2UXQK5pPh/whMS:uotbt93UVi+mAReEq4Lzohod76Bgy2FR
    MD5:E5F9EFE4C9716D196AC17F0F73BC6FB7
    SHA1:9B7781FB63BE28550F0EC9D35F7A816B7E9E4305
    SHA-256:8994E1E0EE667172A8CBE6FAA32E1C157AC38C65749BAFF05E24403AB280A5B4
    SHA-512:E3DD77549EF05366D252047E6745496B2724EE9D02F6C2B7BD3DEF8EB9E4E069E25D3ABF6AB905F1537A37130CDB46634B32119C1FD0322E3CF9F0D67FE292CE
    Malicious:false
    Preview:#if !defined(__MAINTAB_H_HSGFYZEGCHXHVCHD52485454857545)..#define __MAINTAB_H_HSGFYZEGCHXHVCHD52485454857545....// Tab Control Principal....// En-t.te pour l'affichage des tabs..#include "OptionTab1.h"..#include "OptionTab2.h"..#include "OptionTab3.h"..#include "OptionTab4.h"..#include "OptionTab5.h"..#include "OptionTab6.h"..#include "OptionTab7.h"..#include "OptionTab8.h"..#include "OptionTab9.h"..#include "OptionTab10.h"..#include "OptionTab11.h"....class CMainTab : public CPropertySheet..{.. //DECLARE_DYNAMIC(CMainTab).. ..private:.. .. // Construction..public:.. CMainTab(UINT nIDCaption, CWnd* pParentWnd = NULL, UINT iSelectPage = 0);.. CMainTab(LPCTSTR pszCaption, CWnd* pParentWnd = NULL, UINT iSelectPage = 0);.. ..protected:.. void AddControlPages(void);.. .. // Attributes..public:.. // D.claration des classes-dialog pour les diff.rents Tab Control.. COptionTab1 m_option1;.. COptionTab2 m_option2;.. COptionTab3 m_option3;.. COptionTab4

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-R9ROE.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1062
    Entropy (8bit):5.334905242154601
    Encrypted:false
    SSDEEP:24:9Whr7pl2alplZaocbniHn5eAY7a9dR7D2Knv7JBApIEvfaxeyUQ8qeOrqd/KV7g6:GpJb/n7D2Kv7J+ISddqwu7gBYd5
    MD5:871819840BD7407CAA5FC2175264C743
    SHA1:7B73FA015CDCE25EFBD2200593D5061BEFE3ABF9
    SHA-256:8B9389F0FE1ACC4702BD372621EE3694749CDA774A81EDF2AB788CC10F5BB576
    SHA-512:0286D45DF66C62D7C67DB9C679404036FD73C3037960724267057BDF6575EB6D1E7E004C23D84567F680B2FF10230AFCADDE6F131365FA2F55C1F0048D217A0D
    Malicious:false
    Preview:// LaunchHelp.cpp : implementation file..//....#define VIEW_HELP 0....#include "stdafx.h"..#include "LaunchHelp.h"..#include "DialogHtmlHelp.h"..#include "process.h"....#if VIEW_HELP..#include "htmlfrm.h"..#endif....LaunchHelp::LaunchHelp() {.. page="";..}..LaunchHelp::~LaunchHelp() {.. if (b.m_hWnd) {.. b.EndDialog(IDCANCEL);.. }..}....void LaunchHelp::Help(CString page) {..#if VIEW_HELP..#else.. if (!b).. this->page=page;.. else {.. if (b.m_hWnd).. this->b.Go(page);.. else.. this->page=page;.. }..#endif.. GoHelp();..}....void LaunchHelp::Help() {.. Help("index.html");..}.. ..void LaunchHelp::GoHelp() {..#if VIEW_HELP.. CHtmlFrame* frm=new CHtmlFrame;...if (!frm->LoadFrame(IDR_HELPFRM))....return;.. frm->ShowWindow(SW_SHOWNORMAL);...frm->UpdateWindow();..#else.. if (!b.m_hWnd) {.. b.page=page;.. RECT rect;.. rect.bottom=rect.left=rect.right=rect.top=0;.. b.Create(NULL,NULL,WS_OVERLAPPEDWINDOW,rect,NULL,0);.. b.ShowWindow(SW_SHOWNORMAL);

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-RE86N.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2867
    Entropy (8bit):5.458337638766277
    Encrypted:false
    SSDEEP:48:JkfnC66Y1pMtgWqW6x33D4+2ffoO0s7DtWo9kH8UDY75fm6Vl7I:qfqapg0VdTfNERHs8AY75+6Vl7I
    MD5:03C01F338E416C357C214B5826621133
    SHA1:D30DA4249DAEEC1E0E28A171139F505D8ACB68D7
    SHA-256:50C0DDF1786B62EC93D98AB41040A042E08A01027846DF156B3F899767B8AD5D
    SHA-512:F0CD55B42D17EF49341D5E570CDBBD946AD592FF2CB5DEC98CF4F4BABABE19CCBEFC34F74E52D564B1C976E124970C37F7E2EEA8741346EB898F07D395901BD4
    Malicious:false
    Preview:#if !defined(AFX_WID1_H__8FF0CA01_F5EE_11D1_B222_006097BCBD81__INCLUDED_)..#define AFX_WID1_H__8FF0CA01_F5EE_11D1_B222_006097BCBD81__INCLUDED_....#include <afxole.h>..#include "EasyDropTarget.h"....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// Wid1.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// Wid1 dialog....class Wid1 : public CPropertyPage..{...DECLARE_DYNCREATE(Wid1)..// Construction..public:...Wid1(); // standard constructor...~Wid1(); // standard constructor.. void OnChangepathlog();.. static CString TextToUrl(CString st,CLIPFORMAT cfFormat);.. //...int filtreok;...int cancel;.. int direction;.. int url_status;.. int filelist_status;.. int depth_status;.. int log_flip;.. int mir_status;.. int proj_status;.. int continue_status;.. int LAST_ACTION;.. int interact; // entre les 2 champs...// Dialog Data...//{{AFX_DATA(Wid1)...enum { IDD = IDD_WIZ1 };...CStatic.m_mirtitle;...CComboBox.

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-RF052.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (630), with CRLF line terminators
    Category:dropped
    Size (bytes):11089
    Entropy (8bit):5.072672774080955
    Encrypted:false
    SSDEEP:192:M9xEgj7ulaVsMOvEtsGthTIpJxmGxhn30T2th8IpAKwYXA41ir069cVXERfZL8gd:cVuEsMODQIToIt4+1oFOqNX
    MD5:E4041E5C367BF117DF9EFEB7CD6F48C8
    SHA1:83CFD7A6CD5EBE75111000AD329404E180C9865C
    SHA-256:FA41F1E16BB5C29D53062C927BF5A9705E88FBF90753093F684CEEFDF6A32D91
    SHA-512:7BFEA7763DE2EEAEE86EA563828AA6DABC10F35F60436C7609695A0BBA593FA724D6DC390584DF00BC9725073B4830224B93FBB636C46693308C95F7C8CFB99B
    Malicious:false
    Preview:<HTML>..<HEAD>..<TITLE>Microsoft IPv6 Technology Preview for Windows&nbsp;2000</TITLE>..</HEAD>..<BODY bgcolor="#FFFFFF">....<H1>Microsoft IPv6 Technology Preview for Windows&nbsp;2000</H1>....<font size="+1"><B>September 25, 2000</B></font>..<font size="-1">(Check..<a href="http://msdn.microsoft.com/downloads/sdks/platform/tpipv6/ReadMe.asp">here</a>..for the latest version.)</font>....<H2>Introduction to the Microsoft IPv6 Technology Preview for Windows&nbsp;2000</H2>....<P>..The Microsoft IPv6 Technology Preview for Windows&nbsp;2000 is intended for application software developers who are developing network applications using the Windows Sockets (Winsock) application programming interface...</P>....<P>..The eventual migration from Internet Protocol version 4 (IPv4), the current version used on organization intranets and the Internet, to IP version 6 (IPv6), the next generation of IP, will be a gradual one involving the upgrading of client and server computers, networking infrastruct

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-RRNR8.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2322
    Entropy (8bit):5.15826603064037
    Encrypted:false
    SSDEEP:48:bKHSUfJDDkhfJ7kv7fJlJaXRleuyZ2cdS5ZmN2Y/WCWpDXJm8pUyGEGI/keshzgs:uHrf5DkhfODfPWauJo4+2Y18mftO1olh
    MD5:4C5EBE5BC00F607C3AFF3D18109EF7F2
    SHA1:323CEB8A29E1BB683EA84D4BD70478ED5F62F65A
    SHA-256:A2E3D388BE6F2AAA4DDE8829CDCD86FBA9E833D6F6A9BA6800E4A593A19BC59A
    SHA-512:AE54D6B5F28A9F10A2847A9FAFFE47A3EA413D40803659CF91D6166D83E17E3F40AB87B70CEA6FFED7CB9DB6BC5436DEA94526B9459979DFAF0AF92DD916DB22
    Malicious:false
    Preview:// splitter.h : custom splitter control and frame that contains it..//..// This is a part of the Microsoft Foundation Classes C++ library...// Copyright (C) 1992-1998 Microsoft Corporation..// All rights reserved...//..// This source code is only intended as a supplement to the..// Microsoft Foundation Classes Reference and related..// electronic documentation provided with the library...// See these sources for detailed information regarding the..// Microsoft Foundation Classes product...../////////////////////////////////////////////////////////////////////////////..// CSplitterFrame frame with splitter/wiper....class CSplitterFrame : public CMDIChildWnd..{...DECLARE_DYNCREATE(CSplitterFrame)..protected:...CSplitterFrame(); // protected constructor used by dynamic creation....public:.. void SetMenuPrefs();...afx_msg void Onhide();.. BOOL SetNewName(CString name);.. BOOL SetSaved();.. BOOL SetCurrentCategory(CString name);.. CString GetCurrentCategory(void);.... // Attributes..

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-S895H.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1286
    Entropy (8bit):5.289635608832338
    Encrypted:false
    SSDEEP:12:U860Mtn9D7jzvODQNZwKhhAoQClASuGHGMSYRSB6MBA/XUGYVG0TElxl37y01C+X:VGDPmQ3vhh7plMMLMGldVC+MUMjuJLQY
    MD5:E228898EB7ED2C955246DAA4231B4517
    SHA1:9DA5A59866A10824D5BD244AA5DC9157A7647F77
    SHA-256:E7A238F5FEBDDA088283B1C378F6BBA257AFAA20EFC484BBA51E30976DE8E02F
    SHA-512:AC0D666856BF161BD51082D3B38010F0E78FD2D97A67C7CC59967620CEE14C1E1DB5AF30C56184E032A39402574B5CF5AEA2BF546C68332D1BC8D9DE2694B1AF
    Malicious:false
    Preview:/*----------------------------------------------------------------------..Copyright (c) 1998,1999 Gipsysoft. All Rights Reserved...File:.DynamicRAS.h..Owner:.russf@gipsysoft.com..Purpose:.Dynamically loaded RAS...----------------------------------------------------------------------*/..../* Thanks to Russ Freeman from gipsymedia */....#include "stdafx.h"..#include "RasLoad.h"....CDynamicRAS::CDynamicRAS()...: m_hInst( LoadLibrary( _T("rasapi32") ) )..., pRasEnumConnections( NULL )..., pRasHangUp( NULL )..., pRasGetConnectStatus( NULL ).. , pRasDial( NULL ).. , pRasEnumEntries( NULL ).. , pRasGetEntryDialParams( NULL )..{...if( IsRASLoaded() )...{....pRasEnumConnections = (PRASENUMCONNECTIONS)GetProcAddress( m_hInst, "RasEnumConnectionsA" );....pRasHangUp = (PRASHANGUP)GetProcAddress( m_hInst, "RasHangUpA" );....pRasGetConnectStatus = (PRASGETCONNECTSTATUS)GetProcAddress( m_hInst, "RasGetConnectStatusA" );....pRasDial = (PRASDIAL)GetProcAddress( m_hInst, "RasDialA" );.. pRasEnumEn

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-SDHNJ.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1612
    Entropy (8bit):5.546694513727209
    Encrypted:false
    SSDEEP:24:gwTXwTjblQInk2iIyFfEW7oLFDoW471WzymuwHGUKaPiFThtkOVJ7U8HwT0:7U7Fn1wf/7qYWXx3yjJVl7QA
    MD5:04EEE435BD2C197FB4922B55952857EA
    SHA1:DE123B04B38C8DF28A5EE3CA7632FE4DAF40E4D0
    SHA-256:8602B5932C4B3A0A5F2C8153CD5EA61D99636F62AC6C32EE8F1D6EAF30BDD1DE
    SHA-512:1D360253B8C979067BB2BA8CD21E4CC135E84FEB019266012D1FA0ABF532355ED5FA37E83BC78765E615E89700B3AFF32B36ABA3D363EB054D4E58F18656EBC3
    Malicious:false
    Preview:#if !defined(AFX_OPTIONTAB5_H__E6FA3FE6_A5B5_11D3_A2B3_0000E84E7CA1__INCLUDED_)..#define AFX_OPTIONTAB5_H__E6FA3FE6_A5B5_11D3_A2B3_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// OptionTab5.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// COptionTab5 dialog....class COptionTab5 : public CPropertyPage..{...DECLARE_DYNCREATE(COptionTab5)....// Construction..public:...COptionTab5();...~COptionTab5();.. char* GetTip(int id);.. int depth_status;......// Dialog Data...//{{AFX_DATA(COptionTab5)...enum { IDD = IDD_OPTION5 };...CEdit.m_ctl_pausebytes;...CComboBox.m_ctl_depth2;...CComboBox.m_ctl_depth;...CString.m_maxhtml;...CString.m_maxrate;...CString.m_maxtime;...CString.m_othermax;...CString.m_sizemax;...CString.m_depth;...CString.m_maxconn;...CString.m_depth2;...CString.m_pausebytes;...CString.m_maxlinks;...//}}AFX_DATA......// Overrides...// ClassWizard generate virtual function override

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-SFE0U.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1981
    Entropy (8bit):5.531621318471066
    Encrypted:false
    SSDEEP:48:eYaYUfBZjCcHw2lhqWHx3LfYWqro0sgrUj8Vl7HY9:eL9vCLwdcLjr7Vl7Ho
    MD5:2F6A87B9B86F27D6247DE47FB381EDA9
    SHA1:56DB3A4AEB5945B50368B2A8052CB0CE4C53B82C
    SHA-256:56C23F7BEF4C841941756CF0C0432D0EEB386DD4B32D3CEA0CDBEE76548BE9FC
    SHA-512:D1B9EEABA9195101875F970335766E355C23EA9B90571A815A0BA0BB840AEBF197D1B9AF701BFEF6CB0BE39B300748644A8D296B74E3F60C4DADF25AB25E8B9F
    Malicious:false
    Preview:#if !defined(AFX_IPLOG_H__D416CFE1_8966_11D2_A2B1_0000E84E7CA1__INCLUDED_)..#define AFX_IPLOG_H__D416CFE1_8966_11D2_A2B1_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// iplog.h : header file..//..../* basic HTTrack defs */..extern "C" {..#include "htsglobal.h"..}..../////////////////////////////////////////////////////////////////////////////..// Ciplog dialog....class Ciplog : public CDialog..{..// Construction..public:...Ciplog(CWnd* pParent = NULL); // standard constructor.. char pathlog[HTS_URLMAXSIZE*2];.. int type_log;.. int type_filter;..private:.. FILE* fp;.. int wait_me;.. int type;.. int filter;.. CString txt;....public:..// Dialog Data...//{{AFX_DATA(Ciplog)...enum { IDD = IDD_iplog };...CComboBox.m_ctl_hideinfo;...CEdit.m_ctl_iplog;...CString.m_iplog;...//}}AFX_DATA......// Overrides...// ClassWizard generated virtual function overrides...//{{AFX_VIRTUAL(Ciplog)...public:...virtual BOOL DestroyWindow();...protected:...

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-SIA5D.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):64869
    Entropy (8bit):5.393001067858612
    Encrypted:false
    SSDEEP:1536:XCaYfsCbdTZKgaUeoqI3BPN7xP579z5f9zVucOgy0OES1DnAS70u/dT1zpTFiYSe:b
    MD5:7302B0D7172C833356BD0D441CE13FA8
    SHA1:DD2EB1838145C75F9803854F71F765E88CB54DDF
    SHA-256:4B047EB3CCC319439862E902B1A2FFC5DDE043CF75F9EE59D44476F94C218886
    SHA-512:CA29536D06CF2E31C792C8E81BBDD9F52882E377916127B7FE33AF74D3AABB92C44726E3A8DA4190993DFB32D1DFC292B1F3A81664F10EA132316E165F5B2E32
    Malicious:false
    Preview:Microsoft Visual Studio Solution File, Format Version 10.00..# Visual Studio 2008..Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "WinHTTrack", "WinHTTrack.vcproj", "{4707CDEB-E576-4664-98A8-94D99BA190B8}"...ProjectSection(ProjectDependencies) = postProject....{2F353408-2C6C-4D31-9AC0-08BDC064DF64} = {2F353408-2C6C-4D31-9AC0-08BDC064DF64}....{A8989022-60C3-4B84-8768-8967DC4DE06E} = {A8989022-60C3-4B84-8768-8967DC4DE06E}....{E76AD871-54C1-45E8-A657-6117ADEFFB46} = {E76AD871-54C1-45E8-A657-6117ADEFFB46}...EndProjectSection..EndProject..Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libhttrack", "..\libhttrack\libhttrack.vcproj", "{E76AD871-54C1-45E8-A657-6117ADEFFB46}"...ProjectSection(ProjectDependencies) = postProject....{8FD826F8-3739-44E6-8CC8-997122E53B8D} = {8FD826F8-3739-44E6-8CC8-997122E53B8D}...EndProjectSection..EndProject..Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "httrack", "..\httrack.vcproj", "{D0E894E7-F64C-4722-9807-9ABB1054D43A}"...ProjectSection(Pro

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-SLB4M.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2007
    Entropy (8bit):4.996517047478625
    Encrypted:false
    SSDEEP:48:dXEeEDpoEgEKoE+EGHEKEcEcZElETEqBEhEeZEXoQCdYBbEnED+E6oPEPVEedH+D:dUbdZBKZ7Tf1c6eIqySe6XTgEf6o8Put
    MD5:7C188C6D4101B8A74A1A7A266396F05E
    SHA1:59BCC708290A82243893C301836013B9F55FC2BC
    SHA-256:DD2E72AAC37C4075DC8B2D8B506FA25B4445858166AC7F053684097C51DD2AE4
    SHA-512:C4D4826B5F324EFB76D82234FF1460C2A35EAE80EC3E87286B183CA6525173E8FE5040BC4F5DF99A95BD982842C1247FE12CDC0E66F2249C2397ACCDA4DB67E1
    Malicious:false
    Preview:// WinHTTrackView.cpp : implementation of the CWinHTTrackView class..//....#include "stdafx.h"..#include "WinHTTrack.h"....#include "WinHTTrackDoc.h"..#include "WinHTTrackView.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../////////////////////////////////////////////////////////////////////////////..// CWinHTTrackView....IMPLEMENT_DYNCREATE(CWinHTTrackView, CView)....BEGIN_MESSAGE_MAP(CWinHTTrackView, CView)...//{{AFX_MSG_MAP(CWinHTTrackView)....// NOTE - the ClassWizard will add and remove mapping macros here.....// DO NOT EDIT what you see in these blocks of generated code!...//}}AFX_MSG_MAP..END_MESSAGE_MAP()..../////////////////////////////////////////////////////////////////////////////..// CWinHTTrackView construction/destruction....CWinHTTrackView::CWinHTTrackView()..{...// TODO: add construction code here....}....CWinHTTrackView::~CWinHTTrackView()..{..}....BOOL CWinHTTrackView::PreCreateWindow(CREATESTRUCT& cs).

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-SM787.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):6158
    Entropy (8bit):5.461436665008754
    Encrypted:false
    SSDEEP:96:kzyfPye6Nk4eZd4idPBRdgBDBMgBGgBbBnB4BsBQB6BUB9ZV294TAUtdSkMp/D7e:Dh68FP/uVN3hJOGawip894Kk0/D7WF
    MD5:1DA610CE7ACD76D2EB6B3CE084787DC1
    SHA1:6DC272CB66EF8E0F8A686D424A727B5D7E4AB9DB
    SHA-256:618C2A206AF4B22585D371D88BC030A5595014BC094D1B498F3141B0220E63BD
    SHA-512:4E0099AD257F8AD2532956EA958DC7A68BE5E719FC9D5D188C2C094C940F8DEFFC842C467FD2BBC32D063982B2086A244BEC1A90A19061390342D0EE7C71998E
    Malicious:false
    Preview:// OptionTab5.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "OptionTab5.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../////////////////////////////////////////////////////////////////////////////..// COptionTab5 property page....IMPLEMENT_DYNCREATE(COptionTab5, CPropertyPage)....COptionTab5::COptionTab5() : CPropertyPage(COptionTab5::IDD)..{.. // Patcher titre.. if (LANG_T(-1)) { // Patcher en fran.ais.. m_psp.pszTitle=LANG(LANG_IOPT5); // titre.. m_psp.dwFlags|=PSP_USETITLE;.. }.. m_psp.dwFlags|=PSP_HASHELP;.. //...//{{AFX_DATA_INIT(COptionTab5)...m_maxhtml = _T("");...m_maxrate = _T("");...m_maxtime = _T("");...m_othermax = _T("");...m_sizemax = _T("");...m_depth = _T("");...m_maxconn = _T("");...m_depth2 = _T("");...m_pausebytes = _T("");...m_maxlinks = _T("");...//}}AFX_DATA_INIT..}....COptionTab5::~COptionTab5()..{..}....void COptionTab5::DoDataExchange(CDataExchange*

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-T4R0J.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):1722
    Entropy (8bit):5.513517334171567
    Encrypted:false
    SSDEEP:24:xu7plpl7PezvEnunuSAtUFQE3AGYckex6v/EY/ESiVvIZd3PuipmrVABBrMkj14j:Gpz5nMbAKP2s6CVidWiGVABdM04W4HSu
    MD5:11DA65434E4AF26DC724BC3E39880115
    SHA1:5724BCF7055E7747C26F18D6AE297E3A397976CA
    SHA-256:5D6792A571BC678335EB70AE806298E2A73FB4EE50A234589125807ABFBE236F
    SHA-512:A589907B15C53F26FCE0564E589E7FEEE4D0CA08A700666CBEF31AF59E6B0A3112CDAA0F834BB738D9F6C7405D2F2D6C714AC1FA6C07A878DCCE6221D0C817EC
    Malicious:false
    Preview:// wizard2.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "wizard2.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..extern HICON httrack_icon;....../////////////////////////////////////////////////////////////////////////////..// wizard2 dialog......wizard2::wizard2(CWnd* pParent /*=NULL*/)...: CDialog(wizard2::IDD, pParent)..{...//{{AFX_DATA_INIT(wizard2)...m_question = _T("");...//}}AFX_DATA_INIT..}......void wizard2::DoDataExchange(CDataExchange* pDX)..{...CDialog::DoDataExchange(pDX);...//{{AFX_DATA_MAP(wizard2)...DDX_Text(pDX, IDC_question, m_question);...//}}AFX_DATA_MAP..}......BEGIN_MESSAGE_MAP(wizard2, CDialog)...//{{AFX_MSG_MAP(wizard2)...ON_WM_TIMER()...ON_WM_DESTROY()...//}}AFX_MSG_MAP...ON_COMMAND(ID_HELP, OnHelp)..END_MESSAGE_MAP()........BOOL wizard2::OnInitDialog() ..{...CDialog::OnInitDialog();..... SetIcon(httrack_icon,false);.. SetIcon(httrack_icon,true); ..... tm=SetTim

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-T7GR2.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):12811
    Entropy (8bit):5.386551841420844
    Encrypted:false
    SSDEEP:192:FRC732IEMQuhadbP+9zXngeQYbr+vr/7T7QXrEiSDcxFfNhirKPQAobE:FoL2It3nI2xiOB
    MD5:9E0FCE04E8D460AF1E1C7126AE7C7564
    SHA1:4EFBC70B4EADBBA41307898E23F3EC85DE797686
    SHA-256:DEF32945E85F3339B05FF0EFEBC1A9E18104C438DE9E6CF85A2758BF97AB0B61
    SHA-512:89571C35A02A0AC774518080F095B1D4D079F64D501018B2E2DEB4D2408A4DAB14FD79664B1A639231F95CA506B2633EEA183D6FA0CED97DDEF999748CE3627D
    Malicious:false
    Preview:/* ------------------------------------------------------------ */./*.HTTrack Website Copier, Offline Browser for Windows and Unix.Copyright (C) 1998-2014 Xavier Roche and other contributors..This program is free software: you can redistribute it and/or modify.it under the terms of the GNU General Public License as published by.the Free Software Foundation, either version 3 of the License, or.(at your option) any later version...This program is distributed in the hope that it will be useful,.but WITHOUT ANY WARRANTY; without even the implied warranty of.MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.GNU General Public License for more details...You should have received a copy of the GNU General Public License.along with this program. If not, see <http://www.gnu.org/licenses/>...Important notes:..- We hereby ask people using this source NOT to use it in purpose of grabbing.emails addresses, or collecting any other private information on persons..This would disgrace our wo

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-TANNK.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):4710
    Entropy (8bit):5.4152525816296775
    Encrypted:false
    SSDEEP:96:DzdhCArmAeidPBeBH4B3+gB6B6CBqlB4BzZVN94TTxJaYAw8U:13dPAuJ+gYYCkly7b94m+
    MD5:E9B2F45BE80075571F1FF2174D9D37B3
    SHA1:AB76A364F4C107D545FA92E6DF32BCAFC36ED515
    SHA-256:1135C44C11C1B8EAE94E0443BE4A57A5159B9BC853E5B7EDECDA212098D23E85
    SHA-512:3A10AB76DFA2D780EC8EE0F8454F8EDB791B86F9E01648992C4B06301EFD98937E145ED9C8416950A6584371A561A6C909AE961EEBFF7A5D2B2671C9C56AED19
    Malicious:false
    Preview:// OptionTab4.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "OptionTab4.h"....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../////////////////////////////////////////////////////////////////////////////..// COptionTab4 property page....IMPLEMENT_DYNCREATE(COptionTab4, CPropertyPage)....COptionTab4::COptionTab4() : CPropertyPage(COptionTab4::IDD)..{.. // Patcher titre.. if (LANG_T(-1)) { // Patcher en fran.ais.. m_psp.pszTitle=LANG(LANG_IOPT4); // titre.. m_psp.dwFlags|=PSP_USETITLE;.. }.. m_psp.dwFlags|=PSP_HASHELP;.. //...//{{AFX_DATA_INIT(COptionTab4)...m_connexion = _T("");...m_remt = FALSE;...m_retry = _T("");...m_timeout = _T("");...m_rems = FALSE;...m_rate = _T("");...m_ka = FALSE;...//}}AFX_DATA_INIT..}....COptionTab4::~COptionTab4()..{..}....void COptionTab4::DoDataExchange(CDataExchange* pDX)..{...CPropertyPage::DoDataExchange(pDX);...//{{AFX_DATA_MAP(COptionTab4)...DDX_C

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-TK7CL.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1302
    Entropy (8bit):5.479213981771094
    Encrypted:false
    SSDEEP:24:oJVHlfNTZ2AyWNNrz4cIWzeuwHGUKaAiBrNkDVJ7U8nK:oJl5pZ2UNdzqWex3HrN8Vl7nK
    MD5:7DC97D21546162A67E690A6DDDA99AFA
    SHA1:0D4392723CE3800858B5199C908A44398925F3E2
    SHA-256:D5FF01A6A0FB7C03BA7E6869FAB563E71F0F70DAC44245735D1A2F519FFD110B
    SHA-512:F0EB221B689CE60F56A8D9BAD70BD2AA666B354E3B7DC7FEF5D93AE38CF953E03B6E0161AACAA8E57872B6A8D61052874E04A7992B9D8345382DA3D5BA771CF1
    Malicious:false
    Preview:#if !defined(AFX_WIZARD2_H__1D129B84_1981_11D2_A290_60D144C12802__INCLUDED_)..#define AFX_WIZARD2_H__1D129B84_1981_11D2_A290_60D144C12802__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// wizard2.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// wizard2 dialog....class wizard2 : public CDialog..{.. // gestion timer flash.. bool wflag;.. UINT_PTR tm;....// Construction..public:...wizard2(CWnd* pParent = NULL); // standard constructor....// Dialog Data...//{{AFX_DATA(wizard2)...enum { IDD = IDD_wizard_yn };...CString.m_question;...//}}AFX_DATA......// Overrides...// ClassWizard generated virtual function overrides...//{{AFX_VIRTUAL(wizard2)...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protected:.....// Generated message map functions...//{{AFX_MSG(wizard2)...virtual BOOL OnInitDialog();...afx_msg void OnTimer(UINT_PTR

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-TUC17.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):1834
    Entropy (8bit):5.533129863793972
    Encrypted:false
    SSDEEP:24:CTTTjWlrke1ukw8SwI5nN3EZAyafnSopCYC4cIWz8uwHGUKaDiVW0HMQhtkDVJ7Q:7JkOifxmZ0fnDfCqWwx3IW0sQj8Vl78
    MD5:8D5504596DD9BD73F02F15AF875C6773
    SHA1:FC1262C1B1A74120FFCD89277794AD9AB090D519
    SHA-256:DD6AB1BE96BF9F2D8D456CAA7E64125A290BAA2E8155F8174AFB1E2EF737834D
    SHA-512:8B4C2F1F570AFC2C7D6F7CC6DF01DAA2AF98928C90CB2D929C8ED6D6877D7D383E17401B92DB6CB0FC4786AB96437678C09102B3C6D5E546B8733616553C53D6
    Malicious:false
    Preview:#if !defined(AFX_INSERTURL_H__2A8B8FE2_952E_11D3_A2B3_0000E84E7CA1__INCLUDED_)..#define AFX_INSERTURL_H__2A8B8FE2_952E_11D3_A2B3_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// InsertUrl.h : header file..//....// Attention, d.finition existante .galement dans htslib.h..// (. modifier avec celle-ci)..#define POSTTOK "?>post"..../* Externe C */..extern "C" {.. #include "htscatchurl.h"..}..extern "C" {.. #include "HTTrackInterface.h"...#include "httrack-library.h"..}....#include "CatchUrl.h"..../////////////////////////////////////////////////////////////////////////////..// CInsertUrl dialog....class CInsertUrl : public CDialog..{..// Construction..public:...CInsertUrl(CWnd* pParent = NULL); // standard constructor.. char* GetTip(int id);.. //.. CString dest_path;.. //.. CCatchUrl dial;.. T_SOC soc;.. char adr_prox[1024];.. int port_prox;....// Dialog Data...//{{AFX_DATA(CInsertUrl)...enum { IDD = IDD_InsertUrl };...CString.m_urll

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-U1QM8.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1305
    Entropy (8bit):5.504847242741956
    Encrypted:false
    SSDEEP:24:Fvkv8ESlz4a5IlEDrvAyafx0X4cIWzAuwHGUKaAishtkDPUjJ7U80v0:FMtSF5y2f0fxWqWsx3aj8PYl708
    MD5:5282D57C287A13733FFB52920B82F3C0
    SHA1:273337BCCB235C176D27E897CDF8DDA0DFB7CC9B
    SHA-256:D81DD468BEE54D8F6A1413CF93A3C08E6F4245AA82B286A60EF9C10A8EDA4556
    SHA-512:B7C47DE9065B91BE6600C03D33451B3D8F8209A7385D492C5E7729FAC82D973A8548EA2002A436B75D60B9E69310230D0EBDE2E801203E9B2AA0E5A6E4A64B38
    Malicious:false
    Preview:#if !defined(AFX_CATCHURL_H__589FEA02_D671_11D3_A2B3_0000E84E7CA1__INCLUDED_)..#define AFX_CATCHURL_H__589FEA02_D671_11D3_A2B3_0000E84E7CA1__INCLUDED_....#if _MSC_VER > 1000..#pragma once..#endif // _MSC_VER > 1000..// CatchUrl.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// CCatchUrl dialog....class CCatchUrl : public CDialog..{..// Construction..public:...CCatchUrl(CWnd* pParent = NULL); // standard constructor.. char* GetTip(int id);....// Dialog Data...//{{AFX_DATA(CCatchUrl)...enum { IDD = IDD_CatchUrl };...CString.m_info;...//}}AFX_DATA......// Overrides...// ClassWizard generated virtual function overrides...//{{AFX_VIRTUAL(CCatchUrl)...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protected:.....// Generated message map functions...//{{AFX_MSG(CCatchUrl)...afx_msg void OnClose();...virtual BOOL OnInitDialog();...//}}AFX_MSG.. afx_msg BOOL On

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-U4JMI.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):841
    Entropy (8bit):4.190499563639701
    Encrypted:false
    SSDEEP:12:zTYcgcg2NDrXMejzzjXEvunEczz34FZpzb:zacpJBPzjSmz3s3zb
    MD5:54EDFF199BC67A1AC751EC3709AC48F6
    SHA1:7CA59B576E298751DA8CFBCF58A4A4008175DE38
    SHA-256:A7E4A31A7B26639C0DFFA346B7F2B90D75F19116D9ACD0326580BFF0CCA918D1
    SHA-512:73A0CE3FE12BC29A78D616BA9ADA9452F5091D6DF434E1887D5DDB6C8B406E36E212FC607801FFF515A487789747958B83F98F305AAB5E99E103DF6F288DC234
    Malicious:false
    Preview:Microsoft Developer Studio Workspace File, Format Version 6.00..# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!....###############################################################################....Project: "libhttrack"=..\libhttrack\libhttrack.dsp - Package Owner=<4>....Package=<5>..{{{..}}}....Package=<4>..{{{..}}}....###############################################################################....Project: "webhttrack"=.\webhttrack.dsp - Package Owner=<4>....Package=<5>..{{{..}}}....Package=<4>..{{{.. Begin Project Dependency.. Project_Dep_Name libhttrack.. End Project Dependency..}}}....###############################################################################....Global:....Package=<5>..{{{..}}}....Package=<3>..{{{..}}}....###############################################################################....

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-U61IQ.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ISO-8859 text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):239
    Entropy (8bit):4.724194705795073
    Encrypted:false
    SSDEEP:6:jsRp3TMuoFfdXRm4g2te0gwzybgwNJU/f:jO3ZoxdXRm/2ewzLwNW3
    MD5:C7855286C0881844289914E81AB60ACD
    SHA1:1D10A915688BC9E651F5B4F0BAA785E0E230D160
    SHA-256:34AB2E125063B51D2A952CB4B49998D08DF055F5E2BD6AB07B40F0B8A21880BC
    SHA-512:1D3642B2F2491495672E4C4A8D1AC4330DC5A6E56DDC098B84BDB5B5604C25693AA99476A2C3741AD5CDCA70A43BA1CC070A8E3DF3CB73D4C3B675B476166B09
    Malicious:false
    Preview:// D.finition de la plate-forme utilis.e..// Sun Solaris .......... 0 .// Windows/95 ........... 1 .// Ibm 580 .............. 2..#define HTS_PLATFORM 1.#define HTS_ANALYSTE 1...// SHELL.//#define HTS_ANALYSTE 2...// Fin de la d.finition...

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-UAGT0.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1519
    Entropy (8bit):5.406485060360228
    Encrypted:false
    SSDEEP:24:S/X/6+tZp5lC/+ozzXHRefGvPlwGvPl3igvPl/cRw3l379wVyqiEltTd/S:OZp5Y/+I7+uCu9iQj3F9CyR4TI
    MD5:6DD9F5C1334CDB8D455A3AF85FF63723
    SHA1:3831AD6D7763AAC1FE5903BF31138D2E89093C13
    SHA-256:AD7C6BD400562404A6053A1CF193D02FC60E2FC09FA69EA90567E158F29127D5
    SHA-512:4531A333EBD24021FBD7B1562360D92FA8428664CF2E0F4AF0C380849400667EEF6B718B4C29FD8CEC3014E40C315925CFFA3DC8F1310EA008C60BF8976BA373
    Malicious:false
    Preview:#if !defined(AFX_CEasyDropTarget_H__5EBE1984_98CD_11D2_A2B1_0000E84E7CA1__INCLUDED_)..#define AFX_CEasyDropTarget_H__5EBE1984_98CD_11D2_A2B1_0000E84E7CA1__INCLUDED_....#include <afxole.h>....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// CEasyDropTarget.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// CEasyDropTarget document....static int ReadString(CArchive& ar, char* pString, int nMaxLen);....class CEasyDropTarget : public COleDropTarget..{..public: .. CEasyDropTarget();.. CEasyDropTarget(CWnd* wnd);.. BOOL IsRegistered();.. void SetTextCallback(UINT msg);.. //.. static char** StringToArray(CString st);.. static int ReleaseStringToArray(char** st);.... // OLE.. DROPEFFECT OnDragEnter( CWnd* pWnd, COleDataObject* pDataObject, DWORD dwKeyState, CPoint point ); .. DROPEFFECT OnDragOver( CWnd* pWnd, COleDataObject* pDataObject, DWORD dwKeyState, CPoint point ); .. DROPEFFECT OnDragScroll( CWnd* pWnd,

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-UJ3P7.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1301
    Entropy (8bit):5.47138171214136
    Encrypted:false
    SSDEEP:24:Art2lJhAyW5uK4cIWzajuwHGUKaDiO0HMvkDVJ7U8JS:F/hU1qWelx3x0sv8Vl7Y
    MD5:9D73AF75C33EE555D4A97D2F70B3D4A5
    SHA1:0361CA0293B9CFBFF1327EC651EA43B68098A82F
    SHA-256:6D4FF3DD9B57953FB6267F777628DCE6A80E27C0AAAFA78E0DE0FD44FAD9C1B3
    SHA-512:ED2194EC3D5AB19C340D052FB381CCB886946DD61CB51C1A7E54BA2453D7CDC9881C0FDCF9B13AAEEDE6F80BE0ABEE41EBE7DA45F7561E6B67EE9A83B8FF35C5
    Malicious:false
    Preview:#if !defined(AFX_BUILDOPTIONS_H__9ADE0222_D39E_11D2_A2B1_0000E84E7CA1__INCLUDED_)..#define AFX_BUILDOPTIONS_H__9ADE0222_D39E_11D2_A2B1_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// BuildOptions.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// CBuildOptions dialog....class CBuildOptions : public CDialog..{..// Construction..public:...CBuildOptions(CWnd* pParent = NULL); // standard constructor....// Dialog Data...//{{AFX_DATA(CBuildOptions)...enum { IDD = IDD_BuildOptions };...CString.m_BuildString;...//}}AFX_DATA......// Overrides...// ClassWizard generated virtual function overrides...//{{AFX_VIRTUAL(CBuildOptions)...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protected:.. void OnHelpInfo2();.....// Generated message map functions...//{{AFX_MSG(CBuildOptions)...afx_msg BOOL OnHelpInfo(HELPINFO* dummy)

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-UKUPG.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):12382
    Entropy (8bit):5.572628698414145
    Encrypted:false
    SSDEEP:384:s1zMvwjblA6pgNZcai4Xn8XZ8C7p+giiJynT:syyblA6pgNZcaiqs77p+giVnT
    MD5:06CCB839CC9ED3E6F00684A65FC7F854
    SHA1:D694627705D3FD6B3BE30BFFA79D090A23632A13
    SHA-256:A2E77373F09ADD9B3864C6DDEF813098F44F4CC083297D1126DA7D58D625571A
    SHA-512:31FBC8431ADB65A16302AC030C89863D811B5867E8CB51A1CDA65FA3606E48D67F4C741E03186249616EE6A5FCCB73945391F71A28AAAB0CE0ADC832EA1A5640
    Malicious:false
    Preview:// OptionTab10.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "OptionTab10.h"..#include "ProxyId.h"....#include <ws2tcpip.h>.#include <Wspiapi.h>.//#include <winsock2.h>....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif..../* Externe C */..extern "C" {.. #include "HTTrackInterface.h".. //#include "htsbase.h".. //#include "htslib.h"..}.... //extern char* jump_identification(char*);..../////////////////////////////////////////////////////////////////////////////..// COptionTab10 property page....IMPLEMENT_DYNCREATE(COptionTab10, CPropertyPage)....COptionTab10::COptionTab10() : CPropertyPage(COptionTab10::IDD)..{.. // Patcher titre.. if (LANG_T(-1)) { // Patcher en fran.ais.. m_psp.pszTitle=LANG(LANG_IOPT10); // titre.. m_psp.dwFlags|=PSP_USETITLE;.. }.. m_psp.dwFlags|=PSP_HASHELP;.. //...//{{AFX_DATA_INIT(COptionTab10)...m_proxy = _T("");...m_port = _T("");...m_ftpprox = FALSE;...//

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-V6IHV.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1387
    Entropy (8bit):5.535460201607986
    Encrypted:false
    SSDEEP:24:jfTifTjnlbnku0fPuxaKK4471WzBuwHGUKaPiFhtkOVJ7U8yfT0:L8Htn10fWxS4YWrx3ejJVl7IA
    MD5:F5226579128490CB149B59973ABCE592
    SHA1:9773A802994BDBFD89A839F5462B3A19A2C64CA6
    SHA-256:7C42100FF810B02EA9AB1AD3BA6CAD840217CF1178725E25FC0440BF04D6C154
    SHA-512:F55DD337150C53ACC701E4B20485FE05309A48851B88CAA2B69393B010272D09B35D5A5CD94E61D3AA75FEFCD7386621F4BC8C0F210476B009D9AE7552F63D4A
    Malicious:false
    Preview:#if !defined(AFX_OPTIONTAB1_H__E6FA3FE2_A5B5_11D3_A2B3_0000E84E7CA1__INCLUDED_)..#define AFX_OPTIONTAB1_H__E6FA3FE2_A5B5_11D3_A2B3_0000E84E7CA1__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// OptionTab1.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// COptionTab1 dialog....class COptionTab1 : public CPropertyPage..{...DECLARE_DYNCREATE(COptionTab1)....// Construction..public:...COptionTab1();...~COptionTab1();.. char* GetTip(int id);.. int modify;....// Dialog Data...//{{AFX_DATA(COptionTab1)...enum { IDD = IDD_OPTION1 };...BOOL.m_link;...BOOL.m_parseall;...BOOL.m_testall;...BOOL.m_htmlfirst;...//}}AFX_DATA......// Overrides...// ClassWizard generate virtual function overrides...//{{AFX_VIRTUAL(COptionTab1)...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protected:...// Generated message map functions...//{{AFX_MSG(COpt

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-VO910.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):2036
    Entropy (8bit):5.452720967820525
    Encrypted:false
    SSDEEP:48:W68y1Ua3OSDRoXqWvXQK5pgx34uireLPYl7c:WxyPOSa6fKMdxQl7c
    MD5:C5FF2CACF4183A74D46A1D47F7CB9FF2
    SHA1:B39F4ADABF907C8A929D208B04754833855789DF
    SHA-256:4D081311B2DA1EF2B5D686428D0631114F01B95B1DA9E1F43DD88DD4074CB168
    SHA-512:8C63692824B9595FA7C0FD51DAE0AF44D74A21F5D2C6A053787B3258DE39F357308424C143A614933DCDC0BED95F994396AC990C3FDE7DBE381A3A97B61E3155
    Malicious:false
    Preview:#if !defined(AFX_DIALOGCONTAINER_H__4F25D0C2_5DF4_4149_BD78_FCB2CD06E2DB__INCLUDED_)..#define AFX_DIALOGCONTAINER_H__4F25D0C2_5DF4_4149_BD78_FCB2CD06E2DB__INCLUDED_....#if _MSC_VER > 1000..#pragma once..#endif // _MSC_VER > 1000..// DialogContainer.h : header file..//....// Includes pour objet encapsul...#include "WizTab.h"..../////////////////////////////////////////////////////////////////////////////..// CDialogContainer form view....#ifndef __AFXEXT_H__..#include <afxext.h>..#endif....class CDialogContainer : public CFormView..{..protected:...CDialogContainer(); // protected constructor used by dynamic creation...DECLARE_DYNCREATE(CDialogContainer).... CWizTab* tab;.. CWizTab* tab2;.. BOOL scrollsize_declared;.. int view_w,view_h;....// Form Data..public:...//{{AFX_DATA(CDialogContainer)...enum { IDD = IDD_DIALOGCONTAINER_FORM };....// NOTE: the ClassWizard will add data members here...//}}AFX_DATA....// Attributes..public:....// Operations..public:....// Overrides...

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\is-VURAI.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):599
    Entropy (8bit):5.293613965134194
    Encrypted:false
    SSDEEP:12:jfmOcTA+B3/7iGfB23/7iGVJ2X0m4MoMPM8RCALwTLcnRmLcbnQY:yOmB3ziGp23ziGVIXdJJua86nQY
    MD5:65935CC5C60447C5FDFA82F1DB409F76
    SHA1:A1C0CA56225372762B5B3A2943BE7E8B97873D72
    SHA-256:B73445B0308990E2B0F73D3E867D5D84A8161CDDAECD387FB5F09A2040966F3D
    SHA-512:F2703968B51A6D49C40956045797FB54555761F42162FFCC216367778D065007BB25B06061E2E70FEE38AA672F0EED80849397EBD18C19BCDDD706A2F0C9C6F3
    Malicious:false
    Preview:// Classe de sauvegarde de cl.s (identifi.es par leur nom)..// . la mani.re de la base de registre (mais en plus basique)....#if !defined(MEMREGISTER_LIB_JHGFHIV25489654156HJRZDSCIOUJ5648654651)..#define MEMREGISTER_LIB_JHGFHIV25489654156HJRZDSCIOUJ5648654651....class MemRegister..{..private:.. CStringArray Mem_index;.. CStringArray Mem_value;.. CWordArray Mem_valueint;..public:.. void deleteAll();.. CString getString(CString name,CString defval);.. int getInt(CString name,int defval);.. bool setString(CString name,CString val);.. bool setInt(CString name,int val);..};......#endif....

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\newlang.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):23150
    Entropy (8bit):4.97504110345696
    Encrypted:false
    SSDEEP:384:ddRl8Q8g109TmNtrolb7PhlmiKDH1Ick8EaMLy8s/K+erQ7S9:nRSQ31y4olbTmSckfaMDQ7S9
    MD5:3475646B86C1B3368DA812CD6AB2355A
    SHA1:DABC982D6434AD0B30BBB1AA68246FFFF829B4FF
    SHA-256:A2F3F7A399AA94F4804E9BEA8F051E5694195A3F949F4D2CFBEAA255665C3374
    SHA-512:10D343C4E55C038015AC48C3AD488568941915B526993C40C00BD307A511B1DBF730B121E8D5B4D00B72FD8DA234D4DF45059BE9785E86495A03D447BA11ED99
    Malicious:false
    Preview:..// Win includes..#include "stdafx.h"..#include "Shell.h"..#include <comdef.h>....// Hash for lang.h..extern "C" {.. #include "HTTrackInterface.h"..#define HTS_INTERNAL_BYTECODE.. #include "coucal.h"..#undef HTS_INTERNAL_BYTECODE..};..#include "newlang.h"....// test..#ifndef _MBCS..#error "MBCS/DBCS support not found"..#endif..#include <locale.h>......int NewLangStrSz=1024;..coucal NewLangStr=NULL;..int NewLangStrKeysSz=1024;..coucal NewLangStrKeys=NULL;..UINT NewLangCP = CP_THREAD_ACP;..UINT NewLangFileCP = CP_THREAD_ACP;....typedef struct WinLangid {.. int langId;.. const char* name;..} WinLangid;....WinLangid WINDOWS_LANGID[] = {.. { 0x0436, "Afrikaans" },.. { 0x041c, "Albanian" },.. { 0x0401, "Arabic (Saudi Arabia)" },.. { 0x0801, "Arabic (Iraq)" },.. { 0x0c01, "Arabic (Egypt)" },.. { 0x1001, "Arabic (Libya)" },.. { 0x1401, "Arabic (Algeria)" },.. { 0x1801, "Arabic (Morocco)" },.. { 0x1c01, "Arabic (Tunisia)" },.. { 0x2001, "Arabic (Oman)" },.. { 0x2401, "Arabic (Ye

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\newlang.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1008
    Entropy (8bit):5.395983785063817
    Encrypted:false
    SSDEEP:24:xcTr7YBIGFrgrUOvil6V+BwxGEUoE8LApMLY:xiwIG2r6l6V+BwxVUr8L2MLY
    MD5:B90FD66616A75EFC4B311C63EFCF6E7F
    SHA1:92BD952E8A708150374EBA202A606FDE11A3209E
    SHA-256:6281510C7A8788CB4A40AD5E011744E399102A2DB72E7E8295DFBE071A5149DA
    SHA-512:14131473265FFA2FD1DFEC690721B38477F46BAB6AC447C9ECDB19E8500D7343612120432DC17193695D9EF6736050B98A1469215C03D507409E0DD60C6EA797
    Malicious:false
    Preview:..#ifndef HTS_DEFNEWLANG..#define HTS_DEFNEWLANG....void LANG_LOAD(char* limit_to);..void LANG_INIT();..int LANG_T(int);..int QLANG_T(int l);..//char* LANGSEL(char* lang0,...);..char* LANGSEL(char* name);..char* LANGINTKEY(char* name);..void LANG_DELETE();..void conv_printf(char* from,char* to);..#define LANG(A) A....BOOL SetDlgItemTextCP(HWND hDlg, int nIDDlgItem, LPCSTR lpString);..BOOL SetDlgItemTextCP(CWnd* wnd, int nIDDlgItem, LPCSTR lpString);..BOOL SetDlgItemTextUTF8(HWND hDlg, int nIDDlgItem, LPCSTR lpString);..BOOL SetDlgItemTextUTF8(CWnd* wnd, int nIDDlgItem, LPCSTR lpString);..BOOL SetWindowTextCP(HWND hWnd, LPCSTR lpString);..BOOL SetWindowTextCP(CWnd* wnd, LPCSTR lpString);..BOOL SetWindowTextUTF8(HWND hWnd, LPCSTR lpString);..BOOL SetWindowTextUTF8(CWnd* wnd, LPCSTR lpString);..BOOL ModifyMenuCP(HMENU hMnu, UINT uPosition, UINT uFlags, UINT uIDNewItem, LPCSTR lpNewItem);..BOOL ModifyMenuCP(CMenu* menu, UINT uPosition, UINT uFlags, UINT uIDNewItem, LPCSTR lpNewItem);....#e

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\readme.ipv6.htm (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (630), with CRLF line terminators
    Category:dropped
    Size (bytes):11089
    Entropy (8bit):5.072672774080955
    Encrypted:false
    SSDEEP:192:M9xEgj7ulaVsMOvEtsGthTIpJxmGxhn30T2th8IpAKwYXA41ir069cVXERfZL8gd:cVuEsMODQIToIt4+1oFOqNX
    MD5:E4041E5C367BF117DF9EFEB7CD6F48C8
    SHA1:83CFD7A6CD5EBE75111000AD329404E180C9865C
    SHA-256:FA41F1E16BB5C29D53062C927BF5A9705E88FBF90753093F684CEEFDF6A32D91
    SHA-512:7BFEA7763DE2EEAEE86EA563828AA6DABC10F35F60436C7609695A0BBA593FA724D6DC390584DF00BC9725073B4830224B93FBB636C46693308C95F7C8CFB99B
    Malicious:false
    Preview:<HTML>..<HEAD>..<TITLE>Microsoft IPv6 Technology Preview for Windows&nbsp;2000</TITLE>..</HEAD>..<BODY bgcolor="#FFFFFF">....<H1>Microsoft IPv6 Technology Preview for Windows&nbsp;2000</H1>....<font size="+1"><B>September 25, 2000</B></font>..<font size="-1">(Check..<a href="http://msdn.microsoft.com/downloads/sdks/platform/tpipv6/ReadMe.asp">here</a>..for the latest version.)</font>....<H2>Introduction to the Microsoft IPv6 Technology Preview for Windows&nbsp;2000</H2>....<P>..The Microsoft IPv6 Technology Preview for Windows&nbsp;2000 is intended for application software developers who are developing network applications using the Windows Sockets (Winsock) application programming interface...</P>....<P>..The eventual migration from Internet Protocol version 4 (IPv4), the current version used on organization intranets and the Internet, to IP version 6 (IPv6), the next generation of IP, will be a gradual one involving the upgrading of client and server computers, networking infrastruct

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\Shell.ico (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:MS Windows icon resource - 4 icons, 32x32, 48x48
    Category:dropped
    Size (bytes):8166
    Entropy (8bit):3.8949927423136286
    Encrypted:false
    SSDEEP:192:7KDJKDJMd+kp7fCKDE55555ZFFFd5555:7KDJKDyd+kBCKDE55555ZFFFd5555
    MD5:8BBEABB082C72F52611C45DD71B539EB
    SHA1:021E0173BD8FB7D1A1CE14D83F0EB7E22B9B5DDA
    SHA-256:98A539EE42CF14FF22950E62DE4EB82254C5C3B2F87690C323C6D33BD09ED8FC
    SHA-512:0725FEC578E774F33EFBA28C8FA6810D6788B15DE26E2FCBBA438AD89886C2B1A47BDF1563D4783A426DE273825536095D7E9D8CE3FDF7292A76669B8FF08FB0
    Malicious:false
    Preview:...... ..........F...00.............. ......................h...~...(... ...@..............................................................................................""".))).UUU.MMM.BBB.999..|..PP........................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............f.........3...3.3.3.f.3...3...3...33..333.33f.33..33..33..3f..3f3.3ff.3f..3f..3f..3...3.3.3.f.3...3...3...3...3.3.3.f.3..3...3...3.3.3.f.3...3...3...f...f.3.f.f.f...f...f...f3..f33.f3f.f3..f3..f3..ff..ff3.fff.ff..ff..f...f.3.f.f.f...f...f...f...f.3.f..f...f...f...f.3.f...f................3...............33...f..3.......f...f3..3f..f...f...3....3...f...................3.f.f..................3...f...................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f......3..f................3...f..................3...f...............3...f......3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..........

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\Toolbar.bmp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:PC bitmap, Windows 3.x format, 80 x 15 x 4, image size 600, cbSize 718, bits offset 118
    Category:dropped
    Size (bytes):718
    Entropy (8bit):3.054358033467095
    Encrypted:false
    SSDEEP:12:AeigBvamLPc8I9lgndEMagU1Ok+522zKvsH:tigZaS9gMiNK2iKkH
    MD5:2989CE6B34968ED6F7284CB03962DC30
    SHA1:0D748ECD3A3A1E7B0EDAFEE086D2EF60DF6D6CC4
    SHA-256:6ED61E2C525D5AFD115A8D3FAB2BCDF2899AA1B1A5E34B6BD0FF2135D900366A
    SHA-512:DA3E4C1B8E69681B7A2D32B0642719B63F40C103EEEB3B6B282376059FC7EF5A545729F84670AB46CC6708F260B0DE5269F744DBE4CEF578D318F2C59F8477D9
    Malicious:false
    Preview:BM........v...(...P...............X...................................................................................wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww.......w......wwwwp.wwwwp.....wp.....wwp3...w..pwwwwppwwww...wwwp.....wp.3333.wp3...w..........www...wwwp.....wp.33330wp3...w...ww{.w..wwwp.wwwwp.....wp..3333.p3.......wwx.w..www..wwwwp.....wp..33330p333333........pwww..wwwwp.....wp.......p3....3..wwwwpppwww..wwwwp.....wp.....wwp0wwww..p.......www...wwwp.....wp.....wwp0wwww..w.....ppww.p..wwwp.....wp.....wwp0wwww..wp......wp.....wwp.....ww..wwwp.p0wwww..wp.....wwp..p..wwp.....wwwwwwww.p0wwww..ww.....wwp.....wwp....wwwwwwpwppp0wwww..ww.....www....wwwp....wwwwwww..wp.......wwp....wwwp...ww

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\WinHTTrack.rc2 (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):402
    Entropy (8bit):3.913865789129991
    Encrypted:false
    SSDEEP:6:GvxU9mVamFVPUORQmikglagHqZPUO3JgNvXW18bk:gxU9mrzPUkQjlhHqZPUauNvXW9
    MD5:EBCCFEC131DD9E487F05F25A6CC6A557
    SHA1:DC9E2622C05FB8DF184CDB1A604B731EE8E0BEEA
    SHA-256:F40BE37FB18FDBC2AE3F0608EE521571EAF310BF33091DE3BFC378D8EB9FEB17
    SHA-512:2D2C0508303BF9FD692DF504DA429D15F09B757DC81AF50211845BE040956A3DAF12E98CD1C2310862FF11071A5C34B65BDCDC5A07868CC288CF252B626EB5D4
    Malicious:false
    Preview://..// WINHTTRACK.RC2 - resources Microsoft Visual C++ does not edit directly..//....#ifdef APSTUDIO_INVOKED...#error this file is not editable by Microsoft Visual C++..#endif //APSTUDIO_INVOKED....../////////////////////////////////////////////////////////////////////////////..// Add manually edited resources here......./////////////////////////////////////////////////////////////////////////////..

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\ico00001.ico (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:MS Windows icon resource - 1 icon, 24x70
    Category:dropped
    Size (bytes):23206
    Entropy (8bit):2.472367456779414
    Encrypted:false
    SSDEEP:96:EOtJyg4DiEnTPWKK1TWXdDjeahASlAeah9vTeahQeahZnMeahUwmPeaheeahk7j+:VKDiQ7WKK1TWZaKeY9BtXEkf+yIJB5
    MD5:F0C440A95CFE47AC25A7E6AD4F598C48
    SHA1:15C89B6ABDCE113825855C0476B9F88CF2BCD078
    SHA-256:719B68CE7116D8D83A883BF2628E6C5175E0149BF83571631E69DDC45D201C15
    SHA-512:E14135EC2B4371E63BE06816071B836466D83F05B89FE493E822B97896973342A673788DB88B4744425469D3ACFF5ADBA3DD46B7DAADABFDA9EA64A677E9A00D
    Malicious:false
    Preview:.......F.......Z......(...................hV.................................................................................""".))).UUU.MMM.BBB.999..|..PP........................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............f.........3...3.3.3.f.3...3...3...33..333.33f.33..33..33..3f..3f3.3ff.3f..3f..3f..3...3.3.3.f.3...3...3...3...3.3.3.f.3..3...3...3.3.3.f.3...3...3...f...f.3.f.f.f...f...f...f3..f33.f3f.f3..f3..f3..ff..ff3.fff.ff..ff..f...f.3.f.f.f...f...f...f...f.3.f..f...f...f...f.3.f...f................3...............33...f..3.......f...f3..3f..f...f...3....3...f...................3.f.f..................3...f...................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f......3..f................3...f..................3...f...............3...f......3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............3...f.........ff..f.f.f....ff..f....f.!...__

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\icon1.ico (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:MS Windows icon resource - 1 icon, 40x40
    Category:dropped
    Size (bytes):3006
    Entropy (8bit):2.607365862522363
    Encrypted:false
    SSDEEP:24:COtfcHi18SG7EG+WZ4WN83+/pDv6j6dtimCi0u6vSSSSSSSSSSSyYSSSSSSSSSS9:COta08t7E/gbN1pv6uQu
    MD5:070EFE8B1639E7F309D8D90F50892968
    SHA1:6B7AAFDB08FFA498CA32C6A6A09F9314BFFC7AE9
    SHA-256:632E2685473623C6E8D1FC6BF5EEBE85F9F140842A31650C0205C40FF5E4E9B7
    SHA-512:A51D9406EAA08EE9AA5CF4C87B14005F9FE42623B797F51CED6EDAF45F96A7FDD4E5B4A3A31E563D31FED34F6D4C5B1BACDA403C9A4242FFE9D5F401ACB1C888
    Malicious:false
    Preview:......((..............(...(...P...........@..................................................................................""".))).UUU.MMM.BBB.999..|..PP........................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............f.........3...3.3.3.f.3...3...3...33..333.33f.33..33..33..3f..3f3.3ff.3f..3f..3f..3...3.3.3.f.3...3...3...3...3.3.3.f.3..3...3...3.3.3.f.3...3...3...f...f.3.f.f.f...f...f...f3..f33.f3f.f3..f3..f3..ff..ff3.fff.ff..ff..f...f.3.f.f.f...f...f...f...f.3.f..f...f...f...f.3.f...f................3...............33...f..3.......f...f3..3f..f...f...3....3...f...................3.f.f..................3...f...................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f......3..f................3...f..................3...f...............3...f......3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............3...f.........ff..f.f.f....ff..f....f.!...__

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\icon2.ico (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:MS Windows icon resource - 1 icon, 40x40
    Category:dropped
    Size (bytes):3006
    Entropy (8bit):2.610759078793246
    Encrypted:false
    SSDEEP:24:COtfcHi18SG7EG+WZ4WN83+/pDv6j6dtimCidvPSSSSSSSSSSS6n3gSSSSSSSSSB:COta08t7E/gbN1pv6uxvn
    MD5:40217FDA053C04A3F5B73563710373D2
    SHA1:95D8305921E91AF116E292485897F3A928F7B158
    SHA-256:6EFC98041573DBADFEF4031DA1C9A188DC9B24E7B732BA0AC11183F4590BD6BD
    SHA-512:F8E8C9061BFCBF19CB17E37D2E5BE8E8F32573F6BF320575130D2CACF968BFDEBA03F066C8DD269703222DA76FCF4B656C6CE6DA4D2798D13A8CE6247678EEF2
    Malicious:false
    Preview:......((..............(...(...P...........@..................................................................................""".))).UUU.MMM.BBB.999..|..PP........................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............f.........3...3.3.3.f.3...3...3...33..333.33f.33..33..33..3f..3f3.3ff.3f..3f..3f..3...3.3.3.f.3...3...3...3...3.3.3.f.3..3...3...3.3.3.f.3...3...3...f...f.3.f.f.f...f...f...f3..f33.f3f.f3..f3..f3..ff..ff3.fff.ff..ff..f...f.3.f.f.f...f...f...f...f.3.f..f...f...f...f.3.f...f................3...............33...f..3.......f...f3..3f..f...f...3....3...f...................3.f.f..................3...f...................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f......3..f................3...f..................3...f...............3...f......3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............3...f.........ff..f.f.f....ff..f....f.!...__

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\icon3.ico (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:MS Windows icon resource - 1 icon, 40x40
    Category:dropped
    Size (bytes):3006
    Entropy (8bit):2.9682208303327684
    Encrypted:false
    SSDEEP:24:COtfcHi18SG7EG+WZ4WN83+/pDv6j6dtimCiV3rQ1CkVSSSSSSSSTOL4dSSSSSS/:COta08t7E/gbN1pv6uR3roCkX
    MD5:6CFFF362163EED0B7E1E4747DC3AFD83
    SHA1:68D63E636D6D2D2E8CD83959ECD1C3836A429450
    SHA-256:D00D6EFFB9A4097B62D96356E7A3C0E82FDE0C4D2C9E1BCD0380198D7026F6B3
    SHA-512:B4671F94ADBD1100628B939AD12ED909E46FF55E3005528348F17BF2514BA0E3BDB406E334111E2752EDB27CAF4CA4C67845D549AA6243731EAB086E5FB48BF9
    Malicious:false
    Preview:......((..............(...(...P...........@..................................................................................""".))).UUU.MMM.BBB.999..|..PP........................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............f.........3...3.3.3.f.3...3...3...33..333.33f.33..33..33..3f..3f3.3ff.3f..3f..3f..3...3.3.3.f.3...3...3...3...3.3.3.f.3..3...3...3.3.3.f.3...3...3...f...f.3.f.f.f...f...f...f3..f33.f3f.f3..f3..f3..ff..ff3.fff.ff..ff..f...f.3.f.f.f...f...f...f...f.3.f..f...f...f...f.3.f...f................3...............33...f..3.......f...f3..3f..f...f...3....3...f...................3.f.f..................3...f...................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f......3..f................3...f..................3...f...............3...f......3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............3...f.........ff..f.f.f....ff..f....f.!...__

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\icon4.ico (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:MS Windows icon resource - 1 icon, 40x40
    Category:dropped
    Size (bytes):3006
    Entropy (8bit):2.8907046190611463
    Encrypted:false
    SSDEEP:24:COtfcHi18SG7EG+WZ4WN83+/pDv6j6dtimCirjRUmpL38bFV/ElnZSSSSSSSSVSR:COta08t7E/gbN1pv6unjRUmR4vYY
    MD5:255F0920357A5A200F0768D6F667B5AC
    SHA1:382A47F477CF63CA99E9000CC960C7297F26E88D
    SHA-256:D7DCB505AF4DB2E7D504D19C409F21A3CA588242A33B1AF8AA134B4887EAD933
    SHA-512:B86D5366E6AFD828BEE05AE09993BE0E712BEAFC1A0B4C2F190F07B39E0833BFE84F0412F48A76390A2C213E78E1631016F89C41FB2C41D4EFE3A0D9A0F71480
    Malicious:false
    Preview:......((..............(...(...P...........@..................................................................................""".))).UUU.MMM.BBB.999..|..PP........................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............f.........3...3.3.3.f.3...3...3...33..333.33f.33..33..33..3f..3f3.3ff.3f..3f..3f..3...3.3.3.f.3...3...3...3...3.3.3.f.3..3...3...3.3.3.f.3...3...3...f...f.3.f.f.f...f...f...f3..f33.f3f.f3..f3..f3..ff..ff3.fff.ff..ff..f...f.3.f.f.f...f...f...f...f.3.f..f...f...f...f.3.f...f................3...............33...f..3.......f...f3..3f..f...f...3....3...f...................3.f.f..................3...f...................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f......3..f................3...f..................3...f...............3...f......3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............3...f.........ff..f.f.f....ff..f....f.!...__

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\icon5.ico (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:MS Windows icon resource - 1 icon, 40x40
    Category:dropped
    Size (bytes):3006
    Entropy (8bit):2.8869784929689515
    Encrypted:false
    SSDEEP:24:COtfcHi18SG7EG+WZ4WN83+/pDv6j6dtimCia1mcNShxajLSSSSSSSS80000000v:COta08t7E/gbN1pv6um1msShxMH
    MD5:92479119CB7B3B2884F52CC85084659B
    SHA1:1DB21D031441C6014E202F1266587793F9CCCCD4
    SHA-256:AF44A2B7F4256D586F69C4E19173FD40E3BB9A08322720BB3BD4FD9530D9CA3F
    SHA-512:AB9EBA127C3CCBCED9EA91F14D4754EF78B9C62655C93D5B31C3A06A2E6B072ADBDF66BCA75D32EB530FB1DDC1CC64F433D915E4B0FC6798A6AB3F8F69ADEBD2
    Malicious:false
    Preview:......((..............(...(...P...........@..................................................................................""".))).UUU.MMM.BBB.999..|..PP........................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............f.........3...3.3.3.f.3...3...3...33..333.33f.33..33..33..3f..3f3.3ff.3f..3f..3f..3...3.3.3.f.3...3...3...3...3.3.3.f.3..3...3...3.3.3.f.3...3...3...f...f.3.f.f.f...f...f...f3..f33.f3f.f3..f3..f3..ff..ff3.fff.ff..ff..f...f.3.f.f.f...f...f...f...f.3.f..f...f...f...f.3.f...f................3...............33...f..3.......f...f3..3f..f...f...3....3...f...................3.f.f..................3...f...................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f......3..f................3...f..................3...f...............3...f......3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............3...f.........ff..f.f.f....ff..f....f.!...__

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\icon6.ico (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:MS Windows icon resource - 1 icon, 40x40
    Category:dropped
    Size (bytes):3006
    Entropy (8bit):2.9645308123650773
    Encrypted:false
    SSDEEP:24:COtfcHi18SG7EG+WZ4WN83+/pDv6j6dtimCiHAgZCFY9yLkmfXa:COta08t7E/gbN1pv6uLAgEg3yXa
    MD5:7C33F017C109DB384DEC819E4E4158EC
    SHA1:FAFC465F1AC4BFF82FD4D82159531A4C8BDC83B4
    SHA-256:2C5F80EF16CCD1AF055B389C6CD4D5B8DA1A6567E16E4E0F8BCA7535CE843C0A
    SHA-512:2CAAA2EC97AD09434BBE248A299DED3930FEA05D7666AA3D1F029B682F6A2F9D87C21EE8B01C5CD7444E923FE3E0608DDF3288BFB9010CEAD73F16620745E1ED
    Malicious:false
    Preview:......((..............(...(...P...........@..................................................................................""".))).UUU.MMM.BBB.999..|..PP........................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............f.........3...3.3.3.f.3...3...3...33..333.33f.33..33..33..3f..3f3.3ff.3f..3f..3f..3...3.3.3.f.3...3...3...3...3.3.3.f.3..3...3...3.3.3.f.3...3...3...f...f.3.f.f.f...f...f...f3..f33.f3f.f3..f3..f3..ff..ff3.fff.ff..ff..f...f.3.f.f.f...f...f...f...f.3.f..f...f...f...f.3.f...f................3...............33...f..3.......f...f3..3f..f...f...3....3...f...................3.f.f..................3...f...................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f......3..f................3...f..................3...f...............3...f......3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............3...f.........ff..f.f.f....ff..f....f.!...__

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\idr_main.ico (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:MS Windows icon resource - 4 icons, 32x32, 48x48
    Category:dropped
    Size (bytes):8166
    Entropy (8bit):4.010443763015549
    Encrypted:false
    SSDEEP:192:7KDJKD94N+UpvETLKDE55555ZFFFd5555:7KDJKDaN+UmTLKDE55555ZFFFd5555
    MD5:A1AD5075A90C7806A12D76B0FFAA3CD6
    SHA1:AB1EA995F8D8189E6F77801EB0B76B5D821E8162
    SHA-256:1BB582346C84C97A6C93BF610D1D631652A6AA6097CE95E1C7B6F8C534EC1325
    SHA-512:82C59BD3E7F38C813BDDF569C060365C8D08843170114AF1DD8100AE00289629D168CCDED1598E16F8F77E017D1C352AB4A750B21D111A25D3607448FD9BB53D
    Malicious:false
    Preview:...... ..........F...00.............. ......................h...~...(... ...@..............................................................................................""".))).UUU.MMM.BBB.999..|..PP........................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............f.........3...3.3.3.f.3...3...3...33..333.33f.33..33..33..3f..3f3.3ff.3f..3f..3f..3...3.3.3.f.3...3...3...3...3.3.3.f.3..3...3...3.3.3.f.3...3...3...f...f.3.f.f.f...f...f...f3..f33.f3f.f3..f3..f3..ff..ff3.fff.ff..ff..f...f.3.f.f.f...f...f...f...f.3.f..f...f...f...f.3.f...f................3...............33...f..3.......f...f3..3f..f...f...3....3...f...................3.f.f..................3...f...................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f......3..f................3...f..................3...f...............3...f......3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..........

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\is-419O7.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:MS Windows icon resource - 1 icon, 40x40
    Category:dropped
    Size (bytes):3006
    Entropy (8bit):2.607365862522363
    Encrypted:false
    SSDEEP:24:COtfcHi18SG7EG+WZ4WN83+/pDv6j6dtimCi0u6vSSSSSSSSSSSyYSSSSSSSSSS9:COta08t7E/gbN1pv6uQu
    MD5:070EFE8B1639E7F309D8D90F50892968
    SHA1:6B7AAFDB08FFA498CA32C6A6A09F9314BFFC7AE9
    SHA-256:632E2685473623C6E8D1FC6BF5EEBE85F9F140842A31650C0205C40FF5E4E9B7
    SHA-512:A51D9406EAA08EE9AA5CF4C87B14005F9FE42623B797F51CED6EDAF45F96A7FDD4E5B4A3A31E563D31FED34F6D4C5B1BACDA403C9A4242FFE9D5F401ACB1C888
    Malicious:false
    Preview:......((..............(...(...P...........@..................................................................................""".))).UUU.MMM.BBB.999..|..PP........................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............f.........3...3.3.3.f.3...3...3...33..333.33f.33..33..33..3f..3f3.3ff.3f..3f..3f..3...3.3.3.f.3...3...3...3...3.3.3.f.3..3...3...3.3.3.f.3...3...3...f...f.3.f.f.f...f...f...f3..f33.f3f.f3..f3..f3..ff..ff3.fff.ff..ff..f...f.3.f.f.f...f...f...f...f.3.f..f...f...f...f.3.f...f................3...............33...f..3.......f...f3..3f..f...f...3....3...f...................3.f.f..................3...f...................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f......3..f................3...f..................3...f...............3...f......3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............3...f.........ff..f.f.f....ff..f....f.!...__

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\is-609N6.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:MS Windows icon resource - 4 icons, 32x32, 48x48
    Category:dropped
    Size (bytes):8166
    Entropy (8bit):3.8949927423136286
    Encrypted:false
    SSDEEP:192:7KDJKDJMd+kp7fCKDE55555ZFFFd5555:7KDJKDyd+kBCKDE55555ZFFFd5555
    MD5:8BBEABB082C72F52611C45DD71B539EB
    SHA1:021E0173BD8FB7D1A1CE14D83F0EB7E22B9B5DDA
    SHA-256:98A539EE42CF14FF22950E62DE4EB82254C5C3B2F87690C323C6D33BD09ED8FC
    SHA-512:0725FEC578E774F33EFBA28C8FA6810D6788B15DE26E2FCBBA438AD89886C2B1A47BDF1563D4783A426DE273825536095D7E9D8CE3FDF7292A76669B8FF08FB0
    Malicious:false
    Preview:...... ..........F...00.............. ......................h...~...(... ...@..............................................................................................""".))).UUU.MMM.BBB.999..|..PP........................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............f.........3...3.3.3.f.3...3...3...33..333.33f.33..33..33..3f..3f3.3ff.3f..3f..3f..3...3.3.3.f.3...3...3...3...3.3.3.f.3..3...3...3.3.3.f.3...3...3...f...f.3.f.f.f...f...f...f3..f33.f3f.f3..f3..f3..ff..ff3.fff.ff..ff..f...f.3.f.f.f...f...f...f...f.3.f..f...f...f...f.3.f...f................3...............33...f..3.......f...f3..3f..f...f...3....3...f...................3.f.f..................3...f...................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f......3..f................3...f..................3...f...............3...f......3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..........

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\is-801BH.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:MS Windows icon resource - 1 icon, 40x40
    Category:dropped
    Size (bytes):3006
    Entropy (8bit):2.9682208303327684
    Encrypted:false
    SSDEEP:24:COtfcHi18SG7EG+WZ4WN83+/pDv6j6dtimCiV3rQ1CkVSSSSSSSSTOL4dSSSSSS/:COta08t7E/gbN1pv6uR3roCkX
    MD5:6CFFF362163EED0B7E1E4747DC3AFD83
    SHA1:68D63E636D6D2D2E8CD83959ECD1C3836A429450
    SHA-256:D00D6EFFB9A4097B62D96356E7A3C0E82FDE0C4D2C9E1BCD0380198D7026F6B3
    SHA-512:B4671F94ADBD1100628B939AD12ED909E46FF55E3005528348F17BF2514BA0E3BDB406E334111E2752EDB27CAF4CA4C67845D549AA6243731EAB086E5FB48BF9
    Malicious:false
    Preview:......((..............(...(...P...........@..................................................................................""".))).UUU.MMM.BBB.999..|..PP........................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............f.........3...3.3.3.f.3...3...3...33..333.33f.33..33..33..3f..3f3.3ff.3f..3f..3f..3...3.3.3.f.3...3...3...3...3.3.3.f.3..3...3...3.3.3.f.3...3...3...f...f.3.f.f.f...f...f...f3..f33.f3f.f3..f3..f3..ff..ff3.fff.ff..ff..f...f.3.f.f.f...f...f...f...f.3.f..f...f...f...f.3.f...f................3...............33...f..3.......f...f3..3f..f...f...3....3...f...................3.f.f..................3...f...................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f......3..f................3...f..................3...f...............3...f......3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............3...f.........ff..f.f.f....ff..f....f.!...__

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\is-BKKEG.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:MS Windows icon resource - 1 icon, 24x70
    Category:dropped
    Size (bytes):23206
    Entropy (8bit):2.472367456779414
    Encrypted:false
    SSDEEP:96:EOtJyg4DiEnTPWKK1TWXdDjeahASlAeah9vTeahQeahZnMeahUwmPeaheeahk7j+:VKDiQ7WKK1TWZaKeY9BtXEkf+yIJB5
    MD5:F0C440A95CFE47AC25A7E6AD4F598C48
    SHA1:15C89B6ABDCE113825855C0476B9F88CF2BCD078
    SHA-256:719B68CE7116D8D83A883BF2628E6C5175E0149BF83571631E69DDC45D201C15
    SHA-512:E14135EC2B4371E63BE06816071B836466D83F05B89FE493E822B97896973342A673788DB88B4744425469D3ACFF5ADBA3DD46B7DAADABFDA9EA64A677E9A00D
    Malicious:false
    Preview:.......F.......Z......(...................hV.................................................................................""".))).UUU.MMM.BBB.999..|..PP........................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............f.........3...3.3.3.f.3...3...3...33..333.33f.33..33..33..3f..3f3.3ff.3f..3f..3f..3...3.3.3.f.3...3...3...3...3.3.3.f.3..3...3...3.3.3.f.3...3...3...f...f.3.f.f.f...f...f...f3..f33.f3f.f3..f3..f3..ff..ff3.fff.ff..ff..f...f.3.f.f.f...f...f...f...f.3.f..f...f...f...f.3.f...f................3...............33...f..3.......f...f3..3f..f...f...3....3...f...................3.f.f..................3...f...................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f......3..f................3...f..................3...f...............3...f......3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............3...f.........ff..f.f.f....ff..f....f.!...__

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\is-ERVA1.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:MS Windows icon resource - 1 icon, 40x40
    Category:dropped
    Size (bytes):3006
    Entropy (8bit):2.8907046190611463
    Encrypted:false
    SSDEEP:24:COtfcHi18SG7EG+WZ4WN83+/pDv6j6dtimCirjRUmpL38bFV/ElnZSSSSSSSSVSR:COta08t7E/gbN1pv6unjRUmR4vYY
    MD5:255F0920357A5A200F0768D6F667B5AC
    SHA1:382A47F477CF63CA99E9000CC960C7297F26E88D
    SHA-256:D7DCB505AF4DB2E7D504D19C409F21A3CA588242A33B1AF8AA134B4887EAD933
    SHA-512:B86D5366E6AFD828BEE05AE09993BE0E712BEAFC1A0B4C2F190F07B39E0833BFE84F0412F48A76390A2C213E78E1631016F89C41FB2C41D4EFE3A0D9A0F71480
    Malicious:false
    Preview:......((..............(...(...P...........@..................................................................................""".))).UUU.MMM.BBB.999..|..PP........................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............f.........3...3.3.3.f.3...3...3...33..333.33f.33..33..33..3f..3f3.3ff.3f..3f..3f..3...3.3.3.f.3...3...3...3...3.3.3.f.3..3...3...3.3.3.f.3...3...3...f...f.3.f.f.f...f...f...f3..f33.f3f.f3..f3..f3..ff..ff3.fff.ff..ff..f...f.3.f.f.f...f...f...f...f.3.f..f...f...f...f.3.f...f................3...............33...f..3.......f...f3..3f..f...f...3....3...f...................3.f.f..................3...f...................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f......3..f................3...f..................3...f...............3...f......3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............3...f.........ff..f.f.f....ff..f....f.!...__

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\is-HG1JB.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:MS Windows icon resource - 4 icons, 32x32, 48x48
    Category:dropped
    Size (bytes):8166
    Entropy (8bit):4.010443763015549
    Encrypted:false
    SSDEEP:192:7KDJKD94N+UpvETLKDE55555ZFFFd5555:7KDJKDaN+UmTLKDE55555ZFFFd5555
    MD5:A1AD5075A90C7806A12D76B0FFAA3CD6
    SHA1:AB1EA995F8D8189E6F77801EB0B76B5D821E8162
    SHA-256:1BB582346C84C97A6C93BF610D1D631652A6AA6097CE95E1C7B6F8C534EC1325
    SHA-512:82C59BD3E7F38C813BDDF569C060365C8D08843170114AF1DD8100AE00289629D168CCDED1598E16F8F77E017D1C352AB4A750B21D111A25D3607448FD9BB53D
    Malicious:false
    Preview:...... ..........F...00.............. ......................h...~...(... ...@..............................................................................................""".))).UUU.MMM.BBB.999..|..PP........................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............f.........3...3.3.3.f.3...3...3...33..333.33f.33..33..33..3f..3f3.3ff.3f..3f..3f..3...3.3.3.f.3...3...3...3...3.3.3.f.3..3...3...3.3.3.f.3...3...3...f...f.3.f.f.f...f...f...f3..f33.f3f.f3..f3..f3..ff..ff3.fff.ff..ff..f...f.3.f.f.f...f...f...f...f.3.f..f...f...f...f.3.f...f................3...............33...f..3.......f...f3..3f..f...f...3....3...f...................3.f.f..................3...f...................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f......3..f................3...f..................3...f...............3...f......3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..........

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\is-KBONT.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):402
    Entropy (8bit):3.913865789129991
    Encrypted:false
    SSDEEP:6:GvxU9mVamFVPUORQmikglagHqZPUO3JgNvXW18bk:gxU9mrzPUkQjlhHqZPUauNvXW9
    MD5:EBCCFEC131DD9E487F05F25A6CC6A557
    SHA1:DC9E2622C05FB8DF184CDB1A604B731EE8E0BEEA
    SHA-256:F40BE37FB18FDBC2AE3F0608EE521571EAF310BF33091DE3BFC378D8EB9FEB17
    SHA-512:2D2C0508303BF9FD692DF504DA429D15F09B757DC81AF50211845BE040956A3DAF12E98CD1C2310862FF11071A5C34B65BDCDC5A07868CC288CF252B626EB5D4
    Malicious:false
    Preview://..// WINHTTRACK.RC2 - resources Microsoft Visual C++ does not edit directly..//....#ifdef APSTUDIO_INVOKED...#error this file is not editable by Microsoft Visual C++..#endif //APSTUDIO_INVOKED....../////////////////////////////////////////////////////////////////////////////..// Add manually edited resources here......./////////////////////////////////////////////////////////////////////////////..

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\is-KTL6R.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):646
    Entropy (8bit):4.954158131479624
    Encrypted:false
    SSDEEP:12:TMHdtHWM5nogVWEFTSN4d6UENjRE6j39pO5oSN4dQF+bJER6KgVZtkk+G:2dtHW8ogXeN44UEVREqePN4y+b24Kgi6
    MD5:E7D1610D4A62FAD7C1C1AC522AEFB054
    SHA1:DBA54C7FD758F13388C4F2E1EBC3426E6AB80631
    SHA-256:DA8F6A37B9FA79E7A2481412A666D63371EBD5B13ECEB9FAE15B3F0C5D944595
    SHA-512:94CF124B9C198FC296F7C75DF7D66BCD6E8BF39E3F9F0C8A352B944F56803617FC4C0A09BD6712B862114B09F0B63C513A2E858B590D943682772F6369E8FFA2
    Malicious:false
    Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?> ..<assembly .. xmlns="urn:schemas-microsoft-com:asm.v1" .. manifestVersion="1.0">.. <assemblyIdentity .. processorArchitecture="x86" .. version="5.1.0.0".. type="win32".. name="WinHTTrack.exe"/>.. <description>WinHTTrack Website Copier</description>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity.. type="win32".. name="Microsoft.Windows.Common-Controls".. version="6.0.0.0".. publicKeyToken="6595b64144ccf1df".. language="*".. processorArchitecture="x86"/>.. </dependentAssembly>.. </dependency>..</assembly>..

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\is-LGUG2.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:MS Windows icon resource - 1 icon, 40x40
    Category:dropped
    Size (bytes):3006
    Entropy (8bit):2.610759078793246
    Encrypted:false
    SSDEEP:24:COtfcHi18SG7EG+WZ4WN83+/pDv6j6dtimCidvPSSSSSSSSSSS6n3gSSSSSSSSSB:COta08t7E/gbN1pv6uxvn
    MD5:40217FDA053C04A3F5B73563710373D2
    SHA1:95D8305921E91AF116E292485897F3A928F7B158
    SHA-256:6EFC98041573DBADFEF4031DA1C9A188DC9B24E7B732BA0AC11183F4590BD6BD
    SHA-512:F8E8C9061BFCBF19CB17E37D2E5BE8E8F32573F6BF320575130D2CACF968BFDEBA03F066C8DD269703222DA76FCF4B656C6CE6DA4D2798D13A8CE6247678EEF2
    Malicious:false
    Preview:......((..............(...(...P...........@..................................................................................""".))).UUU.MMM.BBB.999..|..PP........................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............f.........3...3.3.3.f.3...3...3...33..333.33f.33..33..33..3f..3f3.3ff.3f..3f..3f..3...3.3.3.f.3...3...3...3...3.3.3.f.3..3...3...3.3.3.f.3...3...3...f...f.3.f.f.f...f...f...f3..f33.f3f.f3..f3..f3..ff..ff3.fff.ff..ff..f...f.3.f.f.f...f...f...f...f.3.f..f...f...f...f.3.f...f................3...............33...f..3.......f...f3..3f..f...f...3....3...f...................3.f.f..................3...f...................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f......3..f................3...f..................3...f...............3...f......3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............3...f.........ff..f.f.f....ff..f....f.!...__

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\is-M0VDR.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:MS Windows icon resource - 1 icon, 40x40
    Category:dropped
    Size (bytes):3006
    Entropy (8bit):2.9645308123650773
    Encrypted:false
    SSDEEP:24:COtfcHi18SG7EG+WZ4WN83+/pDv6j6dtimCiHAgZCFY9yLkmfXa:COta08t7E/gbN1pv6uLAgEg3yXa
    MD5:7C33F017C109DB384DEC819E4E4158EC
    SHA1:FAFC465F1AC4BFF82FD4D82159531A4C8BDC83B4
    SHA-256:2C5F80EF16CCD1AF055B389C6CD4D5B8DA1A6567E16E4E0F8BCA7535CE843C0A
    SHA-512:2CAAA2EC97AD09434BBE248A299DED3930FEA05D7666AA3D1F029B682F6A2F9D87C21EE8B01C5CD7444E923FE3E0608DDF3288BFB9010CEAD73F16620745E1ED
    Malicious:false
    Preview:......((..............(...(...P...........@..................................................................................""".))).UUU.MMM.BBB.999..|..PP........................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............f.........3...3.3.3.f.3...3...3...33..333.33f.33..33..33..3f..3f3.3ff.3f..3f..3f..3...3.3.3.f.3...3...3...3...3.3.3.f.3..3...3...3.3.3.f.3...3...3...f...f.3.f.f.f...f...f...f3..f33.f3f.f3..f3..f3..ff..ff3.fff.ff..ff..f...f.3.f.f.f...f...f...f...f.3.f..f...f...f...f.3.f...f................3...............33...f..3.......f...f3..3f..f...f...3....3...f...................3.f.f..................3...f...................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f......3..f................3...f..................3...f...............3...f......3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............3...f.........ff..f.f.f....ff..f....f.!...__

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\is-MIJ53.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:PC bitmap, Windows 3.x format, 80 x 15 x 4, image size 600, cbSize 718, bits offset 118
    Category:dropped
    Size (bytes):718
    Entropy (8bit):3.054358033467095
    Encrypted:false
    SSDEEP:12:AeigBvamLPc8I9lgndEMagU1Ok+522zKvsH:tigZaS9gMiNK2iKkH
    MD5:2989CE6B34968ED6F7284CB03962DC30
    SHA1:0D748ECD3A3A1E7B0EDAFEE086D2EF60DF6D6CC4
    SHA-256:6ED61E2C525D5AFD115A8D3FAB2BCDF2899AA1B1A5E34B6BD0FF2135D900366A
    SHA-512:DA3E4C1B8E69681B7A2D32B0642719B63F40C103EEEB3B6B282376059FC7EF5A545729F84670AB46CC6708F260B0DE5269F744DBE4CEF578D318F2C59F8477D9
    Malicious:false
    Preview:BM........v...(...P...............X...................................................................................wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww.......w......wwwwp.wwwwp.....wp.....wwp3...w..pwwwwppwwww...wwwp.....wp.3333.wp3...w..........www...wwwp.....wp.33330wp3...w...ww{.w..wwwp.wwwwp.....wp..3333.p3.......wwx.w..www..wwwwp.....wp..33330p333333........pwww..wwwwp.....wp.......p3....3..wwwwpppwww..wwwwp.....wp.....wwp0wwww..p.......www...wwwp.....wp.....wwp0wwww..w.....ppww.p..wwwp.....wp.....wwp0wwww..wp......wp.....wwp.....ww..wwwp.p0wwww..wp.....wwp..p..wwp.....wwwwwwww.p0wwww..ww.....wwp.....wwp....wwwwwwpwppp0wwww..ww.....www....wwwp....wwwwwww..wp.......wwp....wwwp...ww

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\is-NJCO6.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:MS Windows cursor resource - 2 icons, 32x32, hotspot @1x2
    Category:dropped
    Size (bytes):1086
    Entropy (8bit):1.911843610493103
    Encrypted:false
    SSDEEP:6:Ul1lXWls62bnQriM8Yl0M9ltlvlEij1bnQriM8Yl0M9ltli:Ul18s627Q5BEip7Q5G
    MD5:D1C36850413E495436D3FC308F19A6C2
    SHA1:2555E90F8E42200ACDBC8B0F4019FDEBEEAF54AB
    SHA-256:BB2C8DFB59D30E0F0145A5196E93DFF9BA28E3AC8E58649CB6777DF0D945A284
    SHA-512:244512516E3D97095EDA950D47576F28E178F6454EAF1885DDB0BA3FB35C394888D585B7AC64E2A92FBD10B28E4382C79160270E56764CE341BB5F07CCE7C363
    Malicious:false
    Preview:...... ......0...&... ..........V...(... ...@.............................................................................................................................................................................>O..>O.p...p...s..'..'..'.......................?...?.......................?..........................................(... ...@.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................>O..>O.p...p...s..'..'..'........

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\is-UNBCP.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:MS Windows icon resource - 1 icon, 40x40
    Category:dropped
    Size (bytes):3006
    Entropy (8bit):2.8869784929689515
    Encrypted:false
    SSDEEP:24:COtfcHi18SG7EG+WZ4WN83+/pDv6j6dtimCia1mcNShxajLSSSSSSSS80000000v:COta08t7E/gbN1pv6um1msShxMH
    MD5:92479119CB7B3B2884F52CC85084659B
    SHA1:1DB21D031441C6014E202F1266587793F9CCCCD4
    SHA-256:AF44A2B7F4256D586F69C4E19173FD40E3BB9A08322720BB3BD4FD9530D9CA3F
    SHA-512:AB9EBA127C3CCBCED9EA91F14D4754EF78B9C62655C93D5B31C3A06A2E6B072ADBDF66BCA75D32EB530FB1DDC1CC64F433D915E4B0FC6798A6AB3F8F69ADEBD2
    Malicious:false
    Preview:......((..............(...(...P...........@..................................................................................""".))).UUU.MMM.BBB.999..|..PP........................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............f.........3...3.3.3.f.3...3...3...33..333.33f.33..33..33..3f..3f3.3ff.3f..3f..3f..3...3.3.3.f.3...3...3...3...3.3.3.f.3..3...3...3.3.3.f.3...3...3...f...f.3.f.f.f...f...f...f3..f33.f3f.f3..f3..f3..ff..ff3.fff.ff..ff..f...f.3.f.f.f...f...f...f...f.3.f..f...f...f...f.3.f...f................3...............33...f..3.......f...f3..3f..f...f...3....3...f...................3.f.f..................3...f...................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f......3..f................3...f..................3...f...............3...f......3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............3...f.........ff..f.f.f....ff..f....f.!...__

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\is-VUAG7.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:PC bitmap, Windows 3.x format, 80 x 15 x 4, image size 600, cbSize 718, bits offset 118
    Category:dropped
    Size (bytes):718
    Entropy (8bit):3.054358033467095
    Encrypted:false
    SSDEEP:12:AeigBvamLPc8I9lgndEMagU1Ok+522zKvsH:tigZaS9gMiNK2iKkH
    MD5:2989CE6B34968ED6F7284CB03962DC30
    SHA1:0D748ECD3A3A1E7B0EDAFEE086D2EF60DF6D6CC4
    SHA-256:6ED61E2C525D5AFD115A8D3FAB2BCDF2899AA1B1A5E34B6BD0FF2135D900366A
    SHA-512:DA3E4C1B8E69681B7A2D32B0642719B63F40C103EEEB3B6B282376059FC7EF5A545729F84670AB46CC6708F260B0DE5269F744DBE4CEF578D318F2C59F8477D9
    Malicious:false
    Preview:BM........v...(...P...............X...................................................................................wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww.......w......wwwwp.wwwwp.....wp.....wwp3...w..pwwwwppwwww...wwwp.....wp.3333.wp3...w..........www...wwwp.....wp.33330wp3...w...ww{.w..wwwp.wwwwp.....wp..3333.p3.......wwx.w..www..wwwwp.....wp..33330p333333........pwww..wwwwp.....wp.......p3....3..wwwwpppwww..wwwwp.....wp.....wwp0wwww..p.......www...wwwp.....wp.....wwp0wwww..w.....ppww.p..wwwp.....wp.....wwp0wwww..wp......wp.....wwp.....ww..wwwp.p0wwww..wp.....wwp..p..wwp.....wwwwwwww.p0wwww..ww.....wwp.....wwp....wwwwwwpwppp0wwww..ww.....www....wwwp....wwwwwww..wp.......wwp....wwwp...ww

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\mainfram.bmp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:PC bitmap, Windows 3.x format, 80 x 15 x 4, image size 600, cbSize 718, bits offset 118
    Category:dropped
    Size (bytes):718
    Entropy (8bit):3.054358033467095
    Encrypted:false
    SSDEEP:12:AeigBvamLPc8I9lgndEMagU1Ok+522zKvsH:tigZaS9gMiNK2iKkH
    MD5:2989CE6B34968ED6F7284CB03962DC30
    SHA1:0D748ECD3A3A1E7B0EDAFEE086D2EF60DF6D6CC4
    SHA-256:6ED61E2C525D5AFD115A8D3FAB2BCDF2899AA1B1A5E34B6BD0FF2135D900366A
    SHA-512:DA3E4C1B8E69681B7A2D32B0642719B63F40C103EEEB3B6B282376059FC7EF5A545729F84670AB46CC6708F260B0DE5269F744DBE4CEF578D318F2C59F8477D9
    Malicious:false
    Preview:BM........v...(...P...............X...................................................................................wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww.......w......wwwwp.wwwwp.....wp.....wwp3...w..pwwwwppwwww...wwwp.....wp.3333.wp3...w..........www...wwwp.....wp.33330wp3...w...ww{.w..wwwp.wwwwp.....wp..3333.p3.......wwx.w..www..wwwwp.....wp..33330p333333........pwww..wwwwp.....wp.......p3....3..wwwwpppwww..wwwwp.....wp.....wwp0wwww..p.......www...wwwp.....wp.....wwp0wwww..w.....ppww.p..wwwp.....wp.....wwp0wwww..wp......wp.....wwp.....ww..wwwp.p0wwww..wp.....wwp..p..wwp.....wwwwwwww.p0wwww..ww.....wwp.....wwp....wwwwwwpwppp0wwww..ww.....www....wwwp....wwwwwww..wp.......wwp....wwwp...ww

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\manifest.xml (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):646
    Entropy (8bit):4.954158131479624
    Encrypted:false
    SSDEEP:12:TMHdtHWM5nogVWEFTSN4d6UENjRE6j39pO5oSN4dQF+bJER6KgVZtkk+G:2dtHW8ogXeN44UEVREqePN4y+b24Kgi6
    MD5:E7D1610D4A62FAD7C1C1AC522AEFB054
    SHA1:DBA54C7FD758F13388C4F2E1EBC3426E6AB80631
    SHA-256:DA8F6A37B9FA79E7A2481412A666D63371EBD5B13ECEB9FAE15B3F0C5D944595
    SHA-512:94CF124B9C198FC296F7C75DF7D66BCD6E8BF39E3F9F0C8A352B944F56803617FC4C0A09BD6712B862114B09F0B63C513A2E858B590D943682772F6369E8FFA2
    Malicious:false
    Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?> ..<assembly .. xmlns="urn:schemas-microsoft-com:asm.v1" .. manifestVersion="1.0">.. <assemblyIdentity .. processorArchitecture="x86" .. version="5.1.0.0".. type="win32".. name="WinHTTrack.exe"/>.. <description>WinHTTrack Website Copier</description>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity.. type="win32".. name="Microsoft.Windows.Common-Controls".. version="6.0.0.0".. publicKeyToken="6595b64144ccf1df".. language="*".. processorArchitecture="x86"/>.. </dependentAssembly>.. </dependency>..</assembly>..

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\res\www.cur (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:MS Windows cursor resource - 2 icons, 32x32, hotspot @1x2
    Category:dropped
    Size (bytes):1086
    Entropy (8bit):1.911843610493103
    Encrypted:false
    SSDEEP:6:Ul1lXWls62bnQriM8Yl0M9ltlvlEij1bnQriM8Yl0M9ltli:Ul18s627Q5BEip7Q5G
    MD5:D1C36850413E495436D3FC308F19A6C2
    SHA1:2555E90F8E42200ACDBC8B0F4019FDEBEEAF54AB
    SHA-256:BB2C8DFB59D30E0F0145A5196E93DFF9BA28E3AC8E58649CB6777DF0D945A284
    SHA-512:244512516E3D97095EDA950D47576F28E178F6454EAF1885DDB0BA3FB35C394888D585B7AC64E2A92FBD10B28E4382C79160270E56764CE341BB5F07CCE7C363
    Malicious:false
    Preview:...... ......0...&... ..........V...(... ...@.............................................................................................................................................................................>O..>O.p...p...s..'..'..'.......................?...?.......................?..........................................(... ...@.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................>O..>O.p...p...s..'..'..'........

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\resource.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):26503
    Entropy (8bit):3.750747618739003
    Encrypted:false
    SSDEEP:384:iJtRpKwWuUI4ljXQB1XGzDPytEqBKYOTMZJmm3efe385m:iTRpKwWub4ljXQ+jMnmmIe3x
    MD5:DF129E9A2738A2C2FE365F21907BDFA0
    SHA1:AFC5F8F83F1180E9B7816136C7D4375533B184E3
    SHA-256:DD877B51EC53AE39880283DBD80C252CF696DCD3D98F4B402A0722567BB540F1
    SHA-512:E9EC0396F1F5B94436C3A6DA87632DB9FC50C2F6D20E21E9C718E367A88AF6DD3909EEE0D3B16CFDBAA7A27C6392DA3DD77B4BEB2F4059B06C40B9C6E05BAF6C
    Malicious:false
    Preview://{{NO_DEPENDENCIES}}..// Microsoft Visual C++ generated include file...// Used by WinHTTrack.rc..//..#define IDC_NewProject 2..#define IDlog 3..#define ID_setopt 3..#define ID_capt 3..#define IDCANCEL2 4..#define IDbrowse 4..#define IDCANCEL3 5..#define IDD_ABOUTBOX 100..#define IDD_DIALOGCONTAINER_FORM 106..#define IDR_DIALOGCONTAINER_TMPL 107..#define IDR_MAINFRAME 128..#define IDR_SHELLTYPE 129..#define IDD_DIALOG1 131..#define IDD_DIALOG2 132..#define IDD_DIALOG3 133..#define IDD_DIALOG4 134..#define IDD_DIALOG5 135..#define IDD_WIZ1 138..#define IDD_DIALOG6 141..#define IDD_WIZ2 142..#define IDD_

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\setup_license.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):1195
    Entropy (8bit):4.911086399144892
    Encrypted:false
    SSDEEP:24:yE59+EDDWkyEOkH5CTbVpTjFvW4/mFTxUQ36s:yO9PDDNygHWTjFvWJUyN
    MD5:F93E24FD6A95D2489D5DB275ADD84D2A
    SHA1:624FAC7C36C2F90AA432D75B603E0BAA79A53654
    SHA-256:D62DDB7AE57B89BA7FB237BA9AA7FEFA2C59D764BE3840BE026CD5E12FE410B6
    SHA-512:CC264A926D42B113C66DEAD4EF7831461866B1F72BE2B0DD7C85DE07E051F7577AF1F052DDD6026983D3F171C6989CD9BD69B3AD947D9064F9F346248AC569D9
    Malicious:false
    Preview:HTTrack Website Copier License Agreement:....HTTrack Website Copier, Offline Browser for Windows and Unix..Copyright (C) Xavier Roche and other contributors.....This program is free software; you can redistribute it and/or..modify it under the terms of the GNU General Public License..as published by the Free Software Foundation; either version 3..of the License, or any later version.....This program is distributed in the hope that it will be useful,..but WITHOUT ANY WARRANTY; without even the implied warranty of..MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the..GNU General Public License for more details.....You should have received a copy of the GNU General Public License..along with this program; if not, write to the Free Software..Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.......Important notes:....- We hereby ask people using this source NOT to use it in purpose of grabbing..emails addresses, or collecting any other private informations

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\splitter.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):14404
    Entropy (8bit):5.549556951592952
    Encrypted:false
    SSDEEP:384:sMNvWT5MGcbfjUjuR1p2RwAjd0txYiwaqakv:sKhXHYiw2G
    MD5:7DB14C7D96D3EB065639589860D9E114
    SHA1:199753166BB741DF13707E9853D979CF4DD664C1
    SHA-256:71830D095B6013CA4B723C697E915C5CFC862DDCE5AD87DF42C22974F2B98464
    SHA-512:D722DC1D92E31DD6727290FCF9532306E7BB53DC0175E895C834D9CEAEF14DCB15C855715B395B04C2AE92F38DF2D6E366740775DF4615F8C20BC3FA75AD9634
    Malicious:false
    Preview:// splitter.cpp : implementation file..//....#include "resource.h"..#include "stdafx.h"..#include "splitter.h"..#include "DialogContainer.h"..#include "cpp_lang.h"....#include "afxpriv.h"....// CDirTreeView..#include "DirTreeView.h"....// Pointeur sur nous..#include "WinHTTrack.h"..extern CWinHTTrackApp* this_app;....extern "C" {.. #include "HTTrackInterface.h"..};....//#include "htsbase.h"....#ifdef _DEBUG..#undef THIS_FILE..static char BASED_CODE THIS_FILE[] = __FILE__;..#endif....extern "C" {.. #include "HTTrackInterface.h"..};....static UINT indicators[] =..{...ID_SEPARATOR, // status line indicator...ID_INDICATOR_CAPS,...ID_INDICATOR_NUM,...ID_INDICATOR_SCRL,..};....// splitter frame..extern CSplitterFrame* this_CSplitterFrame;..// termine flag..extern int termine;..../* DirTreeView */..#include "DirTreeView.h"..extern CDirTreeView* this_DirTreeView;......../////////////////////////////////////////////////////////////////////////////..// CSplitterFrame....// Create a s

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\splitter.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2322
    Entropy (8bit):5.15826603064037
    Encrypted:false
    SSDEEP:48:bKHSUfJDDkhfJ7kv7fJlJaXRleuyZ2cdS5ZmN2Y/WCWpDXJm8pUyGEGI/keshzgs:uHrf5DkhfODfPWauJo4+2Y18mftO1olh
    MD5:4C5EBE5BC00F607C3AFF3D18109EF7F2
    SHA1:323CEB8A29E1BB683EA84D4BD70478ED5F62F65A
    SHA-256:A2E3D388BE6F2AAA4DDE8829CDCD86FBA9E833D6F6A9BA6800E4A593A19BC59A
    SHA-512:AE54D6B5F28A9F10A2847A9FAFFE47A3EA413D40803659CF91D6166D83E17E3F40AB87B70CEA6FFED7CB9DB6BC5436DEA94526B9459979DFAF0AF92DD916DB22
    Malicious:false
    Preview:// splitter.h : custom splitter control and frame that contains it..//..// This is a part of the Microsoft Foundation Classes C++ library...// Copyright (C) 1992-1998 Microsoft Corporation..// All rights reserved...//..// This source code is only intended as a supplement to the..// Microsoft Foundation Classes Reference and related..// electronic documentation provided with the library...// See these sources for detailed information regarding the..// Microsoft Foundation Classes product...../////////////////////////////////////////////////////////////////////////////..// CSplitterFrame frame with splitter/wiper....class CSplitterFrame : public CMDIChildWnd..{...DECLARE_DYNCREATE(CSplitterFrame)..protected:...CSplitterFrame(); // protected constructor used by dynamic creation....public:.. void SetMenuPrefs();...afx_msg void Onhide();.. BOOL SetNewName(CString name);.. BOOL SetSaved();.. BOOL SetCurrentCategory(CString name);.. CString GetCurrentCategory(void);.... // Attributes..

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\trans.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ISO-8859 text, with CRLF line terminators
    Category:dropped
    Size (bytes):12703
    Entropy (8bit):5.446120697418617
    Encrypted:false
    SSDEEP:384:pmi8c8U3wWOifYiATH62Xys4JXCpnS2p2uSmK944:cWOifYiATH62XyqG144
    MD5:74BA4EF4A94585B175C745362818F13C
    SHA1:3C245F8504A861351E73EF89D1C1923BE05E5718
    SHA-256:565D6DDA41F311EF91A094F74DA665E236E0349D64B3CF360CC1551C27229B47
    SHA-512:F8A32CF45AE0E7D877DD4F096FA8E2CB3289C9B2D780CB65FF665AC33155100AA44FD99D237C8A8BEDBD9119DC7903918CA45FCC44B4B5F1A5F80151C078DF02
    Malicious:false
    Preview:// trans.cpp : implementation file..//....#include "stdafx.h"..#include "Shell.h"..#include "trans.h"....extern "C" {.. #include "HTTrackInterface.h"..}....#ifdef _DEBUG..#define new DEBUG_NEW..#undef THIS_FILE..static char THIS_FILE[] = __FILE__;..#endif....extern char OPTIONhh[32];..extern char OPTIONmm[32];..extern char OPTIONss[32];..extern HICON httrack_icon;....// Chargement des librairies RAS..#if USE_RAS..extern CDynamicRAS* LibRas;..extern int LibRasUse;..#endif....// Helper..extern LaunchHelp* HtsHelper;....// reference sur objet..extern Ctrans* dialog2;..../* Main WizTab frame */..#include "WizTab.h"..extern CWizTab* this_CWizTab;..extern CWizTab* this_intCWizTab2;..../* Main splitter frame */..#include "DialogContainer.h"..#include "splitter.h"..extern CSplitterFrame* this_CSplitterFrame;....// prise en compte prefs..extern void compute_options() ;..../* Back to FirstInfo */..//#include "FirstInfo.h"..../* Dialog final */..#include "inprogress.h"..../* maintab */..#include

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\trans.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2034
    Entropy (8bit):5.52718198110644
    Encrypted:false
    SSDEEP:48:NzKzSKj1n05mEqWMlx3LfecFK0sp7tW0lOE8Vl7izs:ZK5pzdK4WsVl71
    MD5:8079346EEAE3ABD1434353006D82104C
    SHA1:1BA3EBC6F2109DEEC1284469F53C2DD06B71DFC5
    SHA-256:EA1F92CEA5E89534203373CA5AC294050A4282382D7EB9BC1FC4FBC24FCB6DD2
    SHA-512:0350777444543E07C390DB9D25FA1DD3A8C500572F809772409AF35EFDEBFED5D362056B51243DB90F219C602A2B0660B249A801917F63B51097092C4987CF34
    Malicious:false
    Preview:#if !defined(AFX_TRANS_H__437D7274_F613_11D1_B222_006097BCBD81__INCLUDED_)..#define AFX_TRANS_H__437D7274_F613_11D1_B222_006097BCBD81__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// trans.h : header file..//....#include "ras.h"..../////////////////////////////////////////////////////////////////////////////..// Ctrans dialog....class Ctrans : public CPropertyPage..{...DECLARE_DYNCREATE(Ctrans)..public:.. char RasString[256];.. RASDIALPARAMS dial;.. int hms;..// Construction...Ctrans(); // standard constructor...~Ctrans(); // standard constructor....// Dialog Data...//{{AFX_DATA(Ctrans)...enum { IDD = IDD_Debut };...CButton.m_ctl_rasshut;...CButton.m_ctl_rasdisc;...CStatic.m_ctlcnx;...CComboBox.m_ctlrasid;...CStatic.m_ctl_wait;...CEdit.m_ctl_ss;...CEdit.m_ctl_mm;...CEdit.m_ctl_hh;...CString.m_hh;...CString.m_mm;...CString.m_ss;...BOOL.m_wait;...int..m_rasid;...BOOL.m_rasdisc;...BOOL.m_rasshut;...//}}AFX_DATA......// Overrides...// ClassWizard gene

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\webhttrack.dsp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with very long lines (361), with CRLF line terminators
    Category:dropped
    Size (bytes):4675
    Entropy (8bit):5.486954205867068
    Encrypted:false
    SSDEEP:96:yRawfIT5irfjQNhNQEPTRE+LjUGNCNvrdTWv+SHNAbA0vBPxW2ad1c:eATUjjQF9vUHK2StAbAUhrad1c
    MD5:35135743C08319C957256CFFE0F4351F
    SHA1:309A185090DF7367EAC9E0F1E394E5540CFE708B
    SHA-256:47D89C19732CBEF46373812043F5A8508B5FBFFDB072B515093324D97B7C8E88
    SHA-512:4EDC7B3F0EB36905E4120C807C55C57642072B760533D718275123E429F624743FA3F8BFA9586B17A0DE0369A159F46AA8CB82DC9D6BC6D7C4190F80A602DFB7
    Malicious:false
    Preview:# Microsoft Developer Studio Project File - Name="webhttrack" - Package Owner=<4>..# Microsoft Developer Studio Generated Build File, Format Version 6.00..# ** DO NOT EDIT **....# TARGTYPE "Win32 (x86) Console Application" 0x0103....CFG=webhttrack - Win32 Debug..!MESSAGE This is not a valid makefile. To build this project using NMAKE,..!MESSAGE use the Export Makefile command and run..!MESSAGE ..!MESSAGE NMAKE /f "webhttrack.mak"...!MESSAGE ..!MESSAGE You can specify a configuration when running NMAKE..!MESSAGE by defining the macro CFG on the command line. For example:..!MESSAGE ..!MESSAGE NMAKE /f "webhttrack.mak" CFG="webhttrack - Win32 Debug"..!MESSAGE ..!MESSAGE Possible choices for configuration are:..!MESSAGE ..!MESSAGE "webhttrack - Win32 Release" (based on "Win32 (x86) Console Application")..!MESSAGE "webhttrack - Win32 Debug" (based on "Win32 (x86) Console Application")..!MESSAGE ....# Begin Project..# PROP AllowPerConfigDependencies 0..# PROP Scc_ProjName ""..# PROP Scc_Loca

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\webhttrack.dsw (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):841
    Entropy (8bit):4.190499563639701
    Encrypted:false
    SSDEEP:12:zTYcgcg2NDrXMejzzjXEvunEczz34FZpzb:zacpJBPzjSmz3s3zb
    MD5:54EDFF199BC67A1AC751EC3709AC48F6
    SHA1:7CA59B576E298751DA8CFBCF58A4A4008175DE38
    SHA-256:A7E4A31A7B26639C0DFFA346B7F2B90D75F19116D9ACD0326580BFF0CCA918D1
    SHA-512:73A0CE3FE12BC29A78D616BA9ADA9452F5091D6DF434E1887D5DDB6C8B406E36E212FC607801FFF515A487789747958B83F98F305AAB5E99E103DF6F288DC234
    Malicious:false
    Preview:Microsoft Developer Studio Workspace File, Format Version 6.00..# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!....###############################################################################....Project: "libhttrack"=..\libhttrack\libhttrack.dsp - Package Owner=<4>....Package=<5>..{{{..}}}....Package=<4>..{{{..}}}....###############################################################################....Project: "webhttrack"=.\webhttrack.dsp - Package Owner=<4>....Package=<5>..{{{..}}}....Package=<4>..{{{.. Begin Project Dependency.. Project_Dep_Name libhttrack.. End Project Dependency..}}}....###############################################################################....Global:....Package=<5>..{{{..}}}....Package=<3>..{{{..}}}....###############################################################################....

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\wizard.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1180
    Entropy (8bit):5.486691593330864
    Encrypted:false
    SSDEEP:24:KpFpFvlLz+1oAyWN+E2urz4cIWzW1uwHGUKaAijGkDVJ7U8Tp6:W3N94oUN+3ozqW67x3xG8Vl7N6
    MD5:CAECD7ADB30B37E2773EC7C679A7050E
    SHA1:4D658681A9661EBFFCCB878E4AB6EFD7FD5D1623
    SHA-256:810E65FD962E75D6B06934AFEC89CEF7122DAD9F1B096A122C24AF62A4C3E9D3
    SHA-512:77EA1E564A08957FDCE150B886AEB454352C4C08DCA29BD1CA4854C72B4DC4C91B226BA2810252CF9202C1F61E65770F91F7B30617907B5641FB5B1622A920F2
    Malicious:false
    Preview:#if !defined(AFX_WIZARD_H__55E76A32_F652_11D1_B223_006097BCBD81__INCLUDED_)..#define AFX_WIZARD_H__55E76A32_F652_11D1_B223_006097BCBD81__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// wizard.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// wizard dialog....class wizard : public CDialog..{..// Construction..public:...wizard(CWnd* pParent = NULL); // standard constructor....// Dialog Data...//{{AFX_DATA(wizard)...enum { IDD = IDD_wizard };...CString.m_reponse;...CString.m_question;...//}}AFX_DATA......// Overrides...// ClassWizard generated virtual function overrides...//{{AFX_VIRTUAL(wizard)...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protected:.....// Generated message map functions...//{{AFX_MSG(wizard)...virtual BOOL OnInitDialog();...//}}AFX_MSG...DECLARE_MESSAGE_MAP()..};....//{{AFX_INSERT_LOCATION}}..// Microso

    C:\Program Files\WinHTTrack\src_win\WinHTTrack\wizard2.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C++ source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1302
    Entropy (8bit):5.479213981771094
    Encrypted:false
    SSDEEP:24:oJVHlfNTZ2AyWNNrz4cIWzeuwHGUKaAiBrNkDVJ7U8nK:oJl5pZ2UNdzqWex3HrN8Vl7nK
    MD5:7DC97D21546162A67E690A6DDDA99AFA
    SHA1:0D4392723CE3800858B5199C908A44398925F3E2
    SHA-256:D5FF01A6A0FB7C03BA7E6869FAB563E71F0F70DAC44245735D1A2F519FFD110B
    SHA-512:F0EB221B689CE60F56A8D9BAD70BD2AA666B354E3B7DC7FEF5D93AE38CF953E03B6E0161AACAA8E57872B6A8D61052874E04A7992B9D8345382DA3D5BA771CF1
    Malicious:false
    Preview:#if !defined(AFX_WIZARD2_H__1D129B84_1981_11D2_A290_60D144C12802__INCLUDED_)..#define AFX_WIZARD2_H__1D129B84_1981_11D2_A290_60D144C12802__INCLUDED_....#if _MSC_VER >= 1000..#pragma once..#endif // _MSC_VER >= 1000..// wizard2.h : header file..//..../////////////////////////////////////////////////////////////////////////////..// wizard2 dialog....class wizard2 : public CDialog..{.. // gestion timer flash.. bool wflag;.. UINT_PTR tm;....// Construction..public:...wizard2(CWnd* pParent = NULL); // standard constructor....// Dialog Data...//{{AFX_DATA(wizard2)...enum { IDD = IDD_wizard_yn };...CString.m_question;...//}}AFX_DATA......// Overrides...// ClassWizard generated virtual function overrides...//{{AFX_VIRTUAL(wizard2)...protected:...virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support...//}}AFX_VIRTUAL....// Implementation..protected:.....// Generated message map functions...//{{AFX_MSG(wizard2)...virtual BOOL OnInitDialog();...afx_msg void OnTimer(UINT_PTR

    C:\Program Files\WinHTTrack\src_win\htsswf\StdAfx.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):293
    Entropy (8bit):4.679142777218118
    Encrypted:false
    SSDEEP:6:jGmyXH+5AMRNT15eA6Nj5Fm+yr5FdllZ+sMKcaGIA0RQbyyeGgLxLELpcxLglOEs:jGXXHJYx5fA5E+yr5JlZ+4cWAoQB6mpu
    MD5:24A16DDD19A84F66221C31A8DC7A9210
    SHA1:AD895C6A7AB9A94D488958E91AAC8D3BB7793430
    SHA-256:FAE60BD0F859C2BDA1A1BA244371A63C7BF4D8813D4C8A7D3DB626DB6FA7A223
    SHA-512:08932305F038B20D9EFB70B7807CF404183B08ECCB368B5E70346EAFB72BB3A1FDE315F732F317D7EC360282DEC11B2296610EB93AA252169D982A82797E78BC
    Malicious:false
    Preview:// stdafx.cpp : source file that includes just the standard includes..//.htsswf.pch will be the pre-compiled header..//.stdafx.obj will contain the pre-compiled type information....#include "stdafx.h"....// TODO: reference any additional headers you need in STDAFX.H..// and not in this file..

    C:\Program Files\WinHTTrack\src_win\htsswf\StdAfx.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):802
    Entropy (8bit):5.43312679594103
    Encrypted:false
    SSDEEP:24:FnCpbTAuTIdTAuTIIjd7oicMqpcBPUjJ7U8xTAuTII:8pbvIdvIqlcMqyBPYl7xvII
    MD5:B4AC1E6B4BCD0C35BF5A88B38A13D2A9
    SHA1:9C542F868E2CC0107838FB43E845F00EC6401B94
    SHA-256:C38F4AF76CC1076913686D6CC3EA99AD3FD1F0DDE60D9C30DADD795F7D7EC1AA
    SHA-512:59A4643DACE9EB6E5CABF28CA0702AFF9CC00923A378A30B37D638A8AA821F5193642D20DC3402026D5C750E6024597BB0FACEAF2444BC6EA9842DDF39C91294
    Malicious:false
    Preview:// stdafx.h : include file for standard system include files,..// or project specific include files that are used frequently, but..// are changed infrequently..//....#if !defined(AFX_STDAFX_H__2EC43ACA_1829_4334_B81F_533F6FD7C7AC__INCLUDED_)..#define AFX_STDAFX_H__2EC43ACA_1829_4334_B81F_533F6FD7C7AC__INCLUDED_....#if _MSC_VER > 1000..#pragma once..#endif // _MSC_VER > 1000......// Insert your headers here..#define WIN32_LEAN_AND_MEAN..// Exclude rarely-used stuff from Windows headers....#include <windows.h>....// TODO: reference additional headers your program requires here....//{{AFX_INSERT_LOCATION}}..// Microsoft Visual C++ will insert additional declarations immediately before the previous line.....#endif // !defined(AFX_STDAFX_H__2EC43ACA_1829_4334_B81F_533F6FD7C7AC__INCLUDED_)..

    C:\Program Files\WinHTTrack\src_win\htsswf\htsswf.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):449
    Entropy (8bit):4.991293789715475
    Encrypted:false
    SSDEEP:12:jDbfWmmQAoQClAI0/bGzkoJTFlzWxSRW6aF6aW++SR7MFeoK8:SQ7pldaKj1jzWxMO3WHMGeoK8
    MD5:AFA43CED53A9B6B878E24E24CF89BA58
    SHA1:55565700919A5EA97E07634C3149496C6EB85E6B
    SHA-256:7EC4E8400CDD6CCDD9251B57225CC4BEAE0999C1E3B2F2878932F258ABECD9B0
    SHA-512:FD266D9A105D7DE565942F9E8B0076A5D9642D5462C9F0C92FCA1D48C4971207E9F5E31C7A067ACBFC31DC6A4BD5E5405F0934EF8C07D1D950D246648D788EA9
    Malicious:false
    Preview:// htsswf.cpp : Defines the entry point for the DLL application...//....#include "stdafx.h"..#include "htsswf.h"....BOOL APIENTRY DllMain( HANDLE hModule, .. DWORD ul_reason_for_call, .. LPVOID lpReserved....... )..{.. switch (ul_reason_for_call)...{....case DLL_PROCESS_ATTACH:....case DLL_THREAD_ATTACH:....case DLL_THREAD_DETACH:....case DLL_PROCESS_DETACH:.....break;.. }.. return TRUE;..}..

    C:\Program Files\WinHTTrack\src_win\htsswf\htsswf.dsp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):4530
    Entropy (8bit):5.511913064783769
    Encrypted:false
    SSDEEP:96:y3acQ9iV5+XvQQNhNQUClTGTFQGNCNvb679TPTV6NGbG0heF6eTe2exWj+1c:sQ8V5+XovOOWVL+GbGIeF6eTe2eI+1c
    MD5:F659356CC564B175C0BF84CA3D30240B
    SHA1:A8D5D5897D2C93FC04AFADB7878761F53097BE83
    SHA-256:625200516B14B27D93CE6D244135CEDB6B0519A9403A1174F4611646B064AD2F
    SHA-512:645AB273288FFB38772842B4E404109C590958F32EDE78C6C8036F9F9CB33E9AAB966EE4E946D8C33E48D2C0987AF30E6B0459403BEB687AE318B54FD649FC55
    Malicious:false
    Preview:# Microsoft Developer Studio Project File - Name="htsswf" - Package Owner=<4>..# Microsoft Developer Studio Generated Build File, Format Version 6.00..# ** DO NOT EDIT **....# TARGTYPE "Win32 (x86) Dynamic-Link Library" 0x0102....CFG=htsswf - Win32 Debug..!MESSAGE This is not a valid makefile. To build this project using NMAKE,..!MESSAGE use the Export Makefile command and run..!MESSAGE ..!MESSAGE NMAKE /f "htsswf.mak"...!MESSAGE ..!MESSAGE You can specify a configuration when running NMAKE..!MESSAGE by defining the macro CFG on the command line. For example:..!MESSAGE ..!MESSAGE NMAKE /f "htsswf.mak" CFG="htsswf - Win32 Debug"..!MESSAGE ..!MESSAGE Possible choices for configuration are:..!MESSAGE ..!MESSAGE "htsswf - Win32 Release" (based on "Win32 (x86) Dynamic-Link Library")..!MESSAGE "htsswf - Win32 Debug" (based on "Win32 (x86) Dynamic-Link Library")..!MESSAGE ....# Begin Project..# PROP AllowPerConfigDependencies 0..# PROP Scc_ProjName ""..# PROP Scc_LocalPath ""..CPP=cl.exe..MTL

    C:\Program Files\WinHTTrack\src_win\htsswf\htsswf.dsw (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):535
    Entropy (8bit):3.9021288180550675
    Encrypted:false
    SSDEEP:6:zd22IPtDQHVCeJqN2NdumGsr81oxwycqVZrWpYrZp4xkmrWpYrlCp4n:zTYcgcg2NDrTwEzzYpzb
    MD5:41B64C4D7F11B50217D69B4890B21E3C
    SHA1:36D8F080B546C5CDF29A814172CA02C655A1139B
    SHA-256:65A983261F324F1C36371E24788A93FE040BE712B71DD39B4399B40D3F5CE87A
    SHA-512:3514001240CCB2254C3E2ED077EA65DF6D5ECDC366EA01A47E01F449D07631F5B77F5339CAE9B67216D7968DE1917AF383BA961BFA4A05BC9AC3B16C96400AB1
    Malicious:false
    Preview:Microsoft Developer Studio Workspace File, Format Version 6.00..# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!....###############################################################################....Project: "htsswf"=.\htsswf.dsp - Package Owner=<4>....Package=<5>..{{{..}}}....Package=<4>..{{{..}}}....###############################################################################....Global:....Package=<5>..{{{..}}}....Package=<3>..{{{..}}}....###############################################################################....

    C:\Program Files\WinHTTrack\src_win\htsswf\htsswf.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):830
    Entropy (8bit):4.999191214371604
    Encrypted:false
    SSDEEP:24:rwCaxHbeDGywvVwOvkTA7DNzxywCkIenv7Rd:wxHbeqywhkTA/Nzx9d
    MD5:ED986EE706C09734482BE73DAABCEEF1
    SHA1:A512A15E1BCC6120BCB7AE9E9F839D3319020C28
    SHA-256:15CCF3073F2641EABC6AB3F659CB2AADA8539C493181DBF5095A29D86FB3E878
    SHA-512:C801D611374A539E21D5039E99EA3A477C56ED49EA68CDBDFBD54F1111D0EA9277A0F9B5648D1B1E9DAD1BA3A581A665169DD307C972506B22B2AD4DC89576C9
    Malicious:false
    Preview:..// The following ifdef block is the standard way of creating macros which make exporting ..// from a DLL simpler. All files within this DLL are compiled with the HTSSWF_EXPORTS..// symbol defined on the command line. this symbol should not be defined on any project..// that uses this DLL. This way any other project whose source files include this file see ..// HTSSWF_API functions as being imported from a DLL, wheras this DLL sees symbols..// defined with this macro as being exported...#ifdef HTSSWF_EXPORTS..#define HTSSWF_API __declspec(dllexport)..#else..#define HTSSWF_API __declspec(dllimport)..#endif....extern "C" {.. #include "htsmodules.h".. #include "swf/swf2html_interface.h"..};..extern "C" HTSSWF_API int hts_detect_swf(htsmoduleStruct* str);..extern "C" HTSSWF_API int hts_parse_swf(htsmoduleStruct* str);..

    C:\Program Files\WinHTTrack\src_win\htsswf\htsswf.vcproj (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):8185
    Entropy (8bit):5.268737742965206
    Encrypted:false
    SSDEEP:192:j2KP9tj7Kwwzy4TU9YuDqL0IC40nCg0ICG0ICx0ICm:TltkU7E0IC40nCg0ICG0ICx0ICm
    MD5:89EAE4FFC92EC9B02A0DEA7611FC1073
    SHA1:73806F75A226B36851E3A84864F5DCB014D359BF
    SHA-256:DF69D6B911561183518E7B1E65CDBDF31CF46E8D781BE0E706CAE367AAEC254C
    SHA-512:BDDD51A7326C2E7C560E9F2505630791D626544EAFB6D02AA2F467E0C2DC64F767510C7C5BB8ADCD7647BD3698ADCDB3D4073E844A3263D17F9FF0E38668A566
    Malicious:false
    Preview:<?xml version="1.0" encoding="Windows-1252"?>..<VisualStudioProject...ProjectType="Visual C++"...Version="7.10"...Name="htsswf"...ProjectGUID="{A8989022-60C3-4B84-8768-8967DC4DE06E}"...SccProjectName=""...SccLocalPath="">...<Platforms>....<Platform.....Name="Win32"/>...</Platforms>...<Configurations>....<Configuration.....Name="Debug|Win32".....OutputDirectory=".\Debug".....IntermediateDirectory=".\Debug".....ConfigurationType="2".....UseOfMFC="0".....ATLMinimizesCRunTimeLibraryUsage="FALSE".....CharacterSet="0">.....<Tool......Name="VCCLCompilerTool"......Optimization="0"......AdditionalIncludeDirectories="C:\Dev\zlib\include,C:\Dev"......PreprocessorDefinitions="WIN32;_DEBUG;_WINDOWS;_USRDLL;HTSSWF_EXPORTS"......BasicRuntimeChecks="3"......RuntimeLibrary="1"......BufferSecurityCheck="TRUE"......PrecompiledHeaderFile=".\Debug/htsswf.pch"......AssemblerOutput="2"......AssemblerListingLocation=".\Debug/"......ObjectFile=".\Debug/"......ProgramDataBaseFileName=".\Debug/"......WarningLeve

    C:\Program Files\WinHTTrack\src_win\htsswf\is-2IRAK.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):293
    Entropy (8bit):4.679142777218118
    Encrypted:false
    SSDEEP:6:jGmyXH+5AMRNT15eA6Nj5Fm+yr5FdllZ+sMKcaGIA0RQbyyeGgLxLELpcxLglOEs:jGXXHJYx5fA5E+yr5JlZ+4cWAoQB6mpu
    MD5:24A16DDD19A84F66221C31A8DC7A9210
    SHA1:AD895C6A7AB9A94D488958E91AAC8D3BB7793430
    SHA-256:FAE60BD0F859C2BDA1A1BA244371A63C7BF4D8813D4C8A7D3DB626DB6FA7A223
    SHA-512:08932305F038B20D9EFB70B7807CF404183B08ECCB368B5E70346EAFB72BB3A1FDE315F732F317D7EC360282DEC11B2296610EB93AA252169D982A82797E78BC
    Malicious:false
    Preview:// stdafx.cpp : source file that includes just the standard includes..//.htsswf.pch will be the pre-compiled header..//.stdafx.obj will contain the pre-compiled type information....#include "stdafx.h"....// TODO: reference any additional headers you need in STDAFX.H..// and not in this file..

    C:\Program Files\WinHTTrack\src_win\htsswf\is-45FQ6.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):8185
    Entropy (8bit):5.268737742965206
    Encrypted:false
    SSDEEP:192:j2KP9tj7Kwwzy4TU9YuDqL0IC40nCg0ICG0ICx0ICm:TltkU7E0IC40nCg0ICG0ICx0ICm
    MD5:89EAE4FFC92EC9B02A0DEA7611FC1073
    SHA1:73806F75A226B36851E3A84864F5DCB014D359BF
    SHA-256:DF69D6B911561183518E7B1E65CDBDF31CF46E8D781BE0E706CAE367AAEC254C
    SHA-512:BDDD51A7326C2E7C560E9F2505630791D626544EAFB6D02AA2F467E0C2DC64F767510C7C5BB8ADCD7647BD3698ADCDB3D4073E844A3263D17F9FF0E38668A566
    Malicious:false
    Preview:<?xml version="1.0" encoding="Windows-1252"?>..<VisualStudioProject...ProjectType="Visual C++"...Version="7.10"...Name="htsswf"...ProjectGUID="{A8989022-60C3-4B84-8768-8967DC4DE06E}"...SccProjectName=""...SccLocalPath="">...<Platforms>....<Platform.....Name="Win32"/>...</Platforms>...<Configurations>....<Configuration.....Name="Debug|Win32".....OutputDirectory=".\Debug".....IntermediateDirectory=".\Debug".....ConfigurationType="2".....UseOfMFC="0".....ATLMinimizesCRunTimeLibraryUsage="FALSE".....CharacterSet="0">.....<Tool......Name="VCCLCompilerTool"......Optimization="0"......AdditionalIncludeDirectories="C:\Dev\zlib\include,C:\Dev"......PreprocessorDefinitions="WIN32;_DEBUG;_WINDOWS;_USRDLL;HTSSWF_EXPORTS"......BasicRuntimeChecks="3"......RuntimeLibrary="1"......BufferSecurityCheck="TRUE"......PrecompiledHeaderFile=".\Debug/htsswf.pch"......AssemblerOutput="2"......AssemblerListingLocation=".\Debug/"......ObjectFile=".\Debug/"......ProgramDataBaseFileName=".\Debug/"......WarningLeve

    C:\Program Files\WinHTTrack\src_win\htsswf\is-5C44E.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):4530
    Entropy (8bit):5.511913064783769
    Encrypted:false
    SSDEEP:96:y3acQ9iV5+XvQQNhNQUClTGTFQGNCNvb679TPTV6NGbG0heF6eTe2exWj+1c:sQ8V5+XovOOWVL+GbGIeF6eTe2eI+1c
    MD5:F659356CC564B175C0BF84CA3D30240B
    SHA1:A8D5D5897D2C93FC04AFADB7878761F53097BE83
    SHA-256:625200516B14B27D93CE6D244135CEDB6B0519A9403A1174F4611646B064AD2F
    SHA-512:645AB273288FFB38772842B4E404109C590958F32EDE78C6C8036F9F9CB33E9AAB966EE4E946D8C33E48D2C0987AF30E6B0459403BEB687AE318B54FD649FC55
    Malicious:false
    Preview:# Microsoft Developer Studio Project File - Name="htsswf" - Package Owner=<4>..# Microsoft Developer Studio Generated Build File, Format Version 6.00..# ** DO NOT EDIT **....# TARGTYPE "Win32 (x86) Dynamic-Link Library" 0x0102....CFG=htsswf - Win32 Debug..!MESSAGE This is not a valid makefile. To build this project using NMAKE,..!MESSAGE use the Export Makefile command and run..!MESSAGE ..!MESSAGE NMAKE /f "htsswf.mak"...!MESSAGE ..!MESSAGE You can specify a configuration when running NMAKE..!MESSAGE by defining the macro CFG on the command line. For example:..!MESSAGE ..!MESSAGE NMAKE /f "htsswf.mak" CFG="htsswf - Win32 Debug"..!MESSAGE ..!MESSAGE Possible choices for configuration are:..!MESSAGE ..!MESSAGE "htsswf - Win32 Release" (based on "Win32 (x86) Dynamic-Link Library")..!MESSAGE "htsswf - Win32 Debug" (based on "Win32 (x86) Dynamic-Link Library")..!MESSAGE ....# Begin Project..# PROP AllowPerConfigDependencies 0..# PROP Scc_ProjName ""..# PROP Scc_LocalPath ""..CPP=cl.exe..MTL

    C:\Program Files\WinHTTrack\src_win\htsswf\is-71T5B.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):535
    Entropy (8bit):3.9021288180550675
    Encrypted:false
    SSDEEP:6:zd22IPtDQHVCeJqN2NdumGsr81oxwycqVZrWpYrZp4xkmrWpYrlCp4n:zTYcgcg2NDrTwEzzYpzb
    MD5:41B64C4D7F11B50217D69B4890B21E3C
    SHA1:36D8F080B546C5CDF29A814172CA02C655A1139B
    SHA-256:65A983261F324F1C36371E24788A93FE040BE712B71DD39B4399B40D3F5CE87A
    SHA-512:3514001240CCB2254C3E2ED077EA65DF6D5ECDC366EA01A47E01F449D07631F5B77F5339CAE9B67216D7968DE1917AF383BA961BFA4A05BC9AC3B16C96400AB1
    Malicious:false
    Preview:Microsoft Developer Studio Workspace File, Format Version 6.00..# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!....###############################################################################....Project: "htsswf"=.\htsswf.dsp - Package Owner=<4>....Package=<5>..{{{..}}}....Package=<4>..{{{..}}}....###############################################################################....Global:....Package=<5>..{{{..}}}....Package=<3>..{{{..}}}....###############################################################################....

    C:\Program Files\WinHTTrack\src_win\htsswf\is-9K6KS.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):1195
    Entropy (8bit):4.911086399144892
    Encrypted:false
    SSDEEP:24:yE59+EDDWkyEOkH5CTbVpTjFvW4/mFTxUQ36s:yO9PDDNygHWTjFvWJUyN
    MD5:F93E24FD6A95D2489D5DB275ADD84D2A
    SHA1:624FAC7C36C2F90AA432D75B603E0BAA79A53654
    SHA-256:D62DDB7AE57B89BA7FB237BA9AA7FEFA2C59D764BE3840BE026CD5E12FE410B6
    SHA-512:CC264A926D42B113C66DEAD4EF7831461866B1F72BE2B0DD7C85DE07E051F7577AF1F052DDD6026983D3F171C6989CD9BD69B3AD947D9064F9F346248AC569D9
    Malicious:false
    Preview:HTTrack Website Copier License Agreement:....HTTrack Website Copier, Offline Browser for Windows and Unix..Copyright (C) Xavier Roche and other contributors.....This program is free software; you can redistribute it and/or..modify it under the terms of the GNU General Public License..as published by the Free Software Foundation; either version 3..of the License, or any later version.....This program is distributed in the hope that it will be useful,..but WITHOUT ANY WARRANTY; without even the implied warranty of..MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the..GNU General Public License for more details.....You should have received a copy of the GNU General Public License..along with this program; if not, write to the Free Software..Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.......Important notes:....- We hereby ask people using this source NOT to use it in purpose of grabbing..emails addresses, or collecting any other private informations

    C:\Program Files\WinHTTrack\src_win\htsswf\is-ADN8G.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):802
    Entropy (8bit):5.43312679594103
    Encrypted:false
    SSDEEP:24:FnCpbTAuTIdTAuTIIjd7oicMqpcBPUjJ7U8xTAuTII:8pbvIdvIqlcMqyBPYl7xvII
    MD5:B4AC1E6B4BCD0C35BF5A88B38A13D2A9
    SHA1:9C542F868E2CC0107838FB43E845F00EC6401B94
    SHA-256:C38F4AF76CC1076913686D6CC3EA99AD3FD1F0DDE60D9C30DADD795F7D7EC1AA
    SHA-512:59A4643DACE9EB6E5CABF28CA0702AFF9CC00923A378A30B37D638A8AA821F5193642D20DC3402026D5C750E6024597BB0FACEAF2444BC6EA9842DDF39C91294
    Malicious:false
    Preview:// stdafx.h : include file for standard system include files,..// or project specific include files that are used frequently, but..// are changed infrequently..//....#if !defined(AFX_STDAFX_H__2EC43ACA_1829_4334_B81F_533F6FD7C7AC__INCLUDED_)..#define AFX_STDAFX_H__2EC43ACA_1829_4334_B81F_533F6FD7C7AC__INCLUDED_....#if _MSC_VER > 1000..#pragma once..#endif // _MSC_VER > 1000......// Insert your headers here..#define WIN32_LEAN_AND_MEAN..// Exclude rarely-used stuff from Windows headers....#include <windows.h>....// TODO: reference additional headers your program requires here....//{{AFX_INSERT_LOCATION}}..// Microsoft Visual C++ will insert additional declarations immediately before the previous line.....#endif // !defined(AFX_STDAFX_H__2EC43ACA_1829_4334_B81F_533F6FD7C7AC__INCLUDED_)..

    C:\Program Files\WinHTTrack\src_win\htsswf\is-CR8F3.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):830
    Entropy (8bit):4.999191214371604
    Encrypted:false
    SSDEEP:24:rwCaxHbeDGywvVwOvkTA7DNzxywCkIenv7Rd:wxHbeqywhkTA/Nzx9d
    MD5:ED986EE706C09734482BE73DAABCEEF1
    SHA1:A512A15E1BCC6120BCB7AE9E9F839D3319020C28
    SHA-256:15CCF3073F2641EABC6AB3F659CB2AADA8539C493181DBF5095A29D86FB3E878
    SHA-512:C801D611374A539E21D5039E99EA3A477C56ED49EA68CDBDFBD54F1111D0EA9277A0F9B5648D1B1E9DAD1BA3A581A665169DD307C972506B22B2AD4DC89576C9
    Malicious:false
    Preview:..// The following ifdef block is the standard way of creating macros which make exporting ..// from a DLL simpler. All files within this DLL are compiled with the HTSSWF_EXPORTS..// symbol defined on the command line. this symbol should not be defined on any project..// that uses this DLL. This way any other project whose source files include this file see ..// HTSSWF_API functions as being imported from a DLL, wheras this DLL sees symbols..// defined with this macro as being exported...#ifdef HTSSWF_EXPORTS..#define HTSSWF_API __declspec(dllexport)..#else..#define HTSSWF_API __declspec(dllimport)..#endif....extern "C" {.. #include "htsmodules.h".. #include "swf/swf2html_interface.h"..};..extern "C" HTSSWF_API int hts_detect_swf(htsmoduleStruct* str);..extern "C" HTSSWF_API int hts_parse_swf(htsmoduleStruct* str);..

    C:\Program Files\WinHTTrack\src_win\htsswf\is-T8DEM.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):449
    Entropy (8bit):4.991293789715475
    Encrypted:false
    SSDEEP:12:jDbfWmmQAoQClAI0/bGzkoJTFlzWxSRW6aF6aW++SR7MFeoK8:SQ7pldaKj1jzWxMO3WHMGeoK8
    MD5:AFA43CED53A9B6B878E24E24CF89BA58
    SHA1:55565700919A5EA97E07634C3149496C6EB85E6B
    SHA-256:7EC4E8400CDD6CCDD9251B57225CC4BEAE0999C1E3B2F2878932F258ABECD9B0
    SHA-512:FD266D9A105D7DE565942F9E8B0076A5D9642D5462C9F0C92FCA1D48C4971207E9F5E31C7A067ACBFC31DC6A4BD5E5405F0934EF8C07D1D950D246648D788EA9
    Malicious:false
    Preview:// htsswf.cpp : Defines the entry point for the DLL application...//....#include "stdafx.h"..#include "htsswf.h"....BOOL APIENTRY DllMain( HANDLE hModule, .. DWORD ul_reason_for_call, .. LPVOID lpReserved....... )..{.. switch (ul_reason_for_call)...{....case DLL_PROCESS_ATTACH:....case DLL_THREAD_ATTACH:....case DLL_THREAD_DETACH:....case DLL_PROCESS_DETACH:.....break;.. }.. return TRUE;..}..

    C:\Program Files\WinHTTrack\src_win\htsswf\setup_license.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):1195
    Entropy (8bit):4.911086399144892
    Encrypted:false
    SSDEEP:24:yE59+EDDWkyEOkH5CTbVpTjFvW4/mFTxUQ36s:yO9PDDNygHWTjFvWJUyN
    MD5:F93E24FD6A95D2489D5DB275ADD84D2A
    SHA1:624FAC7C36C2F90AA432D75B603E0BAA79A53654
    SHA-256:D62DDB7AE57B89BA7FB237BA9AA7FEFA2C59D764BE3840BE026CD5E12FE410B6
    SHA-512:CC264A926D42B113C66DEAD4EF7831461866B1F72BE2B0DD7C85DE07E051F7577AF1F052DDD6026983D3F171C6989CD9BD69B3AD947D9064F9F346248AC569D9
    Malicious:false
    Preview:HTTrack Website Copier License Agreement:....HTTrack Website Copier, Offline Browser for Windows and Unix..Copyright (C) Xavier Roche and other contributors.....This program is free software; you can redistribute it and/or..modify it under the terms of the GNU General Public License..as published by the Free Software Foundation; either version 3..of the License, or any later version.....This program is distributed in the hope that it will be useful,..but WITHOUT ANY WARRANTY; without even the implied warranty of..MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the..GNU General Public License for more details.....You should have received a copy of the GNU General Public License..along with this program; if not, write to the Free Software..Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.......Important notes:....- We hereby ask people using this source NOT to use it in purpose of grabbing..emails addresses, or collecting any other private informations

    C:\Program Files\WinHTTrack\src_win\htsswf\swf\is-2LHK6.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2000
    Entropy (8bit):4.725499148769603
    Encrypted:false
    SSDEEP:48:QG6XYTKXKTTawm7kM/w1zsMab0h2F6gPi8h3a:fkXKCr7WxsJ0h2Fq
    MD5:6ECB149315FB6093FA74812ADAD9F653
    SHA1:58D0440E1A5B3DF96547AA086DC331BFAF988EB9
    SHA-256:DCE0F7CC300454B104C895D838DBE47CC29B1760D5EF14114D3C7BE52004424C
    SHA-512:1F78A53AD71081BA51CF216D2FF84A07EC4FCFC1B16803FBB1FBCA15DB7CCC70EBE1EDAE30CC913EAA803361F85739770987755ADCED45E5A8B82821E4A08D9C
    Malicious:false
    Preview:SWF Flash format (Macromedia)....Okay, the stupid license (http://www.macromedia.com/software/flash/download/search_engine/license2.html) ..of the Macromedia Flash SDK contains the following statements:...."(..)..Pursuant to the terms and conditions of this License, you are granted a nonexclusive license to use, ..modify and create derivative works ("Derivative Works") of the sample code included in the SDK for ..the sole purpose of developing Products that extract text and link information from a SWF file, ..and to distribute compiled version of such Derivative Works in object code format solely as incorporated ..in the object code format of such Products (the "Bundled Products"). ....By using the licenses above, you agree to the following restrictions: ..You will not make or distribute copies of the SDK, or electronically transfer the SDK outside your company. ..(..)"....Therefore, I can't redistribute the three stupid sources that allow to extract links inside flash files...This i

    C:\Program Files\WinHTTrack\src_win\htsswf\swf\swf2html.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):2000
    Entropy (8bit):4.725499148769603
    Encrypted:false
    SSDEEP:48:QG6XYTKXKTTawm7kM/w1zsMab0h2F6gPi8h3a:fkXKCr7WxsJ0h2Fq
    MD5:6ECB149315FB6093FA74812ADAD9F653
    SHA1:58D0440E1A5B3DF96547AA086DC331BFAF988EB9
    SHA-256:DCE0F7CC300454B104C895D838DBE47CC29B1760D5EF14114D3C7BE52004424C
    SHA-512:1F78A53AD71081BA51CF216D2FF84A07EC4FCFC1B16803FBB1FBCA15DB7CCC70EBE1EDAE30CC913EAA803361F85739770987755ADCED45E5A8B82821E4A08D9C
    Malicious:false
    Preview:SWF Flash format (Macromedia)....Okay, the stupid license (http://www.macromedia.com/software/flash/download/search_engine/license2.html) ..of the Macromedia Flash SDK contains the following statements:...."(..)..Pursuant to the terms and conditions of this License, you are granted a nonexclusive license to use, ..modify and create derivative works ("Derivative Works") of the sample code included in the SDK for ..the sole purpose of developing Products that extract text and link information from a SWF file, ..and to distribute compiled version of such Derivative Works in object code format solely as incorporated ..in the object code format of such Products (the "Bundled Products"). ....By using the licenses above, you agree to the following restrictions: ..You will not make or distribute copies of the SDK, or electronically transfer the SDK outside your company. ..(..)"....Therefore, I can't redistribute the three stupid sources that allow to extract links inside flash files...This i

    C:\Program Files\WinHTTrack\src_win\is-QCULD.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1258
    Entropy (8bit):4.9369443739801495
    Encrypted:false
    SSDEEP:24:aUHJgXEDL4STdOKittQ5Q0GcSRE55F+EDDWkyEOkH5CTbVpTl:amCXEDLzwBQ5LuELFPDDNygHWTl
    MD5:2BEE1D97A7AE1646405686DC24E49D84
    SHA1:1E78D6C5D94F554EA9A04BA9545EC31F5FD30670
    SHA-256:409B44496CC858EAB7C0376541A7E78635725EC3B63EE9FB248CC0CA0E4AE1B3
    SHA-512:86AEFD138C44BD10E9A98D67C832A51A8CF076522A3A89F7E613263C1F6E667A95009E23136D6D804E4FD690B83E727F66DE2EF36D9B1D4F08635DC2314CC9D3
    Malicious:false
    Preview:Hello,....Here are the sources of the shell interface of WinHTTrack Website Copier III, for Visual C++ 2008....The shell interface code was started at the very begining of HTTrack, and is very, *VERY* ditry, not documented, and therefore not easy to (re)use.....These sources can be useful if you want to understand how to make another version, or a version for another OS.....Use this code at your own risks!!......Have fun,..Xavier Roche (Author)....---....WinHTTrack Website Copier, Offline Browser for Windows and Unix..Copyright (C) Xavier Roche and other contributors....This program is free software; you can redistribute it and/or..modify it under the terms of the GNU General Public License..as published by the Free Software Foundation; either version 3..of the License, or any later version.....This program is distributed in the hope that it will be useful,..but WITHOUT ANY WARRANTY; without even the implied warranty of..MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the..GN

    C:\Program Files\WinHTTrack\src_win\is-VRF36.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):1195
    Entropy (8bit):4.911086399144892
    Encrypted:false
    SSDEEP:24:yE59+EDDWkyEOkH5CTbVpTjFvW4/mFTxUQ36s:yO9PDDNygHWTjFvWJUyN
    MD5:F93E24FD6A95D2489D5DB275ADD84D2A
    SHA1:624FAC7C36C2F90AA432D75B603E0BAA79A53654
    SHA-256:D62DDB7AE57B89BA7FB237BA9AA7FEFA2C59D764BE3840BE026CD5E12FE410B6
    SHA-512:CC264A926D42B113C66DEAD4EF7831461866B1F72BE2B0DD7C85DE07E051F7577AF1F052DDD6026983D3F171C6989CD9BD69B3AD947D9064F9F346248AC569D9
    Malicious:false
    Preview:HTTrack Website Copier License Agreement:....HTTrack Website Copier, Offline Browser for Windows and Unix..Copyright (C) Xavier Roche and other contributors.....This program is free software; you can redistribute it and/or..modify it under the terms of the GNU General Public License..as published by the Free Software Foundation; either version 3..of the License, or any later version.....This program is distributed in the hope that it will be useful,..but WITHOUT ANY WARRANTY; without even the implied warranty of..MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the..GNU General Public License for more details.....You should have received a copy of the GNU General Public License..along with this program; if not, write to the Free Software..Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.......Important notes:....- We hereby ask people using this source NOT to use it in purpose of grabbing..emails addresses, or collecting any other private informations

    C:\Program Files\WinHTTrack\src_win\libhttrack\StdAfx.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):297
    Entropy (8bit):4.689131637267515
    Encrypted:false
    SSDEEP:6:jGmyXH+5AMRNT15eA6JA/Fm+yr5FdllZ+sMKcaGIA0RQbyyeGgLxLELpcxLglOEs:jGXXHJYx5fhE+yr5JlZ+4cWAoQB6mpcV
    MD5:2AE7082BB2B6FCB9184E52A257BB92E2
    SHA1:F2CC246B3ED7D8DC8CCA55B4E884A10E9626C7CA
    SHA-256:F2F93EA986240B26498FA1731CFB89174F3FF649D93BE3770151794CD4BF72D5
    SHA-512:DED6099319F0E92A83512C830A3B984E16CA283E35FC3D81E943C581B6D61FCFC430327D794317AC36B5849B41871BBF6F90CDDB5B12354E66CCA984DB5DC3D2
    Malicious:false
    Preview:// stdafx.cpp : source file that includes just the standard includes..//.libhttrack.pch will be the pre-compiled header..//.stdafx.obj will contain the pre-compiled type information....#include "stdafx.h"....// TODO: reference any additional headers you need in STDAFX.H..// and not in this file..

    C:\Program Files\WinHTTrack\src_win\libhttrack\StdAfx.h (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):802
    Entropy (8bit):5.401644627468446
    Encrypted:false
    SSDEEP:24:FnCpbG6/G6Sjd7oicMqpcBPUjJ7U8xG6K:8pbG6/G68lcMqyBPYl7xG6K
    MD5:A8BC470A12C936F9C8E828F3F32D1E24
    SHA1:554F581ABECF5DEBE7B820D95A3C4A5490FC239C
    SHA-256:11B03D74D593A9818FC79D0783608735E28A24B3D85A2A5FE5F687013AE36403
    SHA-512:FD104B5E6574531C6AE7FFE0A40F660171673084BBAEA9FFBAD2ADC8443B675D94370D1F2153CE9ADCCA278A88965F7D900F6D75DD0706688B9FC35CE0C6DFE8
    Malicious:false
    Preview:// stdafx.h : include file for standard system include files,..// or project specific include files that are used frequently, but..// are changed infrequently..//....#if !defined(AFX_STDAFX_H__7AACFAAB_F538_4DFF_A8FC_17EF82E463C2__INCLUDED_)..#define AFX_STDAFX_H__7AACFAAB_F538_4DFF_A8FC_17EF82E463C2__INCLUDED_....#if _MSC_VER > 1000..#pragma once..#endif // _MSC_VER > 1000......// Insert your headers here..#define WIN32_LEAN_AND_MEAN..// Exclude rarely-used stuff from Windows headers....#include <windows.h>....// TODO: reference additional headers your program requires here....//{{AFX_INSERT_LOCATION}}..// Microsoft Visual C++ will insert additional declarations immediately before the previous line.....#endif // !defined(AFX_STDAFX_H__7AACFAAB_F538_4DFF_A8FC_17EF82E463C2__INCLUDED_)..

    C:\Program Files\WinHTTrack\src_win\libhttrack\gpl.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):35821
    Entropy (8bit):4.622128610438848
    Encrypted:false
    SSDEEP:768:A7Y+tNdSz3ZlqXOWoInuzx3Y8N3WiYD0v:AVtNIq1uzZY1C
    MD5:3C34AFDC3ADF82D2448F12715A255122
    SHA1:7713A1753CE88F2C7E6B054ECC8E4C786DF76300
    SHA-256:0B383D5A63DA644F628D99C33976EA6487ED89AAA59F0B3257992DEAC1171E6B
    SHA-512:4937848B94F5B50EA16C51F9E98FDCD3953ACA63D63CA3BB05D8A62C107E382B71C496838D130AE504A52032398630B957ACAEA6C48032081A6366D27CBA5EA9
    Malicious:false
    Preview: GNU GENERAL PUBLIC LICENSE.. Version 3, 29 June 2007.... Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>.. Everyone is permitted to copy and distribute verbatim copies.. of this license document, but changing it is not allowed..... Preamble.... The GNU General Public License is a free, copyleft license for..software and other kinds of works..... The licenses for most software and other practical works are designed..to take away your freedom to share and change the works. By contrast,..the GNU General Public License is intended to guarantee your freedom to..share and change all versions of a program--to make sure it remains free..software for all its users. We, the Free Software Foundation, use the..GNU General Public License for most of our software; it applies also to..any other work released this way by its authors. You can apply it to..your programs, too..... When we speak of free software

    C:\Program Files\WinHTTrack\src_win\libhttrack\is-160GN.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):54197
    Entropy (8bit):5.169205554685027
    Encrypted:false
    SSDEEP:384:FmiW/SMqWZBE9WiTOcWaNwkyRkyik9w1R1iCn/w1R1iCnUw1R1iCnew1R1iCnYw/:wikqD92c4d
    MD5:8B9586F6E938EFC236C5C50B75D88221
    SHA1:4645DC547E3F7E12F96615316C55C1B014396EC5
    SHA-256:D40045866318D657524E15B56EEF75C6207341839EDE66E45BA51AECC5C8057B
    SHA-512:381EAFCC629819257640D9C4CA3756F313CAB159B40C24583C86ECD9CB2DB43A2610073C0F9F1DB337B6F792D3CFE6A16695813B9C26474E1E8EB345C2018A34
    Malicious:false
    Preview:<?xml version="1.0" encoding="Windows-1252"?>..<VisualStudioProject...ProjectType="Visual C++"...Version="9,00"...Name="libhttrack"...ProjectGUID="{E76AD871-54C1-45E8-A657-6117ADEFFB46}"...RootNamespace="libhttrack"...TargetFrameworkVersion="131072"...>...<Platforms>....<Platform.....Name="Win32"..../>....<Platform.....Name="x64"..../>...</Platforms>...<ToolFiles>...</ToolFiles>...<Configurations>....<Configuration.....Name="Release|Win32".....OutputDirectory="C:\temp\Releaselib".....IntermediateDirectory="C:\temp\Releaselib".....ConfigurationType="2".....InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops".....UseOfMFC="0".....ATLMinimizesCRunTimeLibraryUsage="false".....CharacterSet="2".....>.....<Tool......Name="VCPreBuildEventTool"...../>.....<Tool......Name="VCCustomBuildTool"...../>.....<Tool......Name="VCXMLDataGeneratorTool"...../>.....<Tool......Name="VCWebServiceProxyGeneratorTool"...../>.....<Tool......Name="VCMIDLTool"......PreprocessorDefiniti

    C:\Program Files\WinHTTrack\src_win\libhttrack\is-6GPUO.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:current ar archive
    Category:dropped
    Size (bytes):35226
    Entropy (8bit):5.022786949491424
    Encrypted:false
    SSDEEP:768:odxnkjQTHYUUTRV8rcnlf/k+QeB601lWHHr/GFNf:+xkjQTHbUUrcjj7Nf
    MD5:CBF0AB6E4E52D7D30D0AA3FF4D49528C
    SHA1:8FA8F6A22DF7942BAF67E14AF7E4CB181F71747E
    SHA-256:F58EE94960A3085175D2F39B82902046663F1B6973D6E828501AECE94724E4D0
    SHA-512:516876D584F2FD79E6F52C62A1CB9F455A3AF5AABE682338F211468B175D0ADD617F57E4D7768258B39F01313C9E83C57AAA5CBBCB681054938EAD52FC833FFA
    Malicious:false
    Preview:!<arch>./ 1495270362 0 7687 `....N..<...>...@...LX..LX..M8..M8..N...N...G...G...Kl..Kl..J...J...Q...Q...J...J...Of..Of..Hf..Hf..TL..TL..Sd..Sd..U>..U>..Rj..Rj..S...S...O...O...N...N...M...M...I...I...J...J...R...R...P...P...L...L...P>..P>..Q...Q...Q...Q...K...K...T...T...I>..I>..V...V...G...G...V(..V(..G...G...U...U...N...N...H...H...D...D...Ed..Ed..D...D...FH..FH..[v..[v..[...[...\...\...]...]...W...W............n...n.._6.._6..`...`..._..._...kd..kd..k...k...j...j...bT..bT..t...t...r2..r2..i...i...^Z..^Z..r...r...F...F...m...m...m...m...Al..| ..| ...V...V...................X...X..........xH..xH..s...s...gt..gt..v...v...v...v...l@..l@..t`..t`..........uH..uH..g...g...v$..v$..nV..nV..qV..qV..f...f...s...s...u...u...wj..wj..q...q...n...n...w...w....D...D...<...<...........&...&..........\D..\D..A...A............................J...J..........Y...Y....,...,..X\..X\..X...X...........s~..s~..a...a...ad..ad..E...E...m...m...l...l...g...g...f2..f2..~...~.

    C:\Program Files\WinHTTrack\src_win\libhttrack\is-78EUQ.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):802
    Entropy (8bit):5.401644627468446
    Encrypted:false
    SSDEEP:24:FnCpbG6/G6Sjd7oicMqpcBPUjJ7U8xG6K:8pbG6/G68lcMqyBPYl7xG6K
    MD5:A8BC470A12C936F9C8E828F3F32D1E24
    SHA1:554F581ABECF5DEBE7B820D95A3C4A5490FC239C
    SHA-256:11B03D74D593A9818FC79D0783608735E28A24B3D85A2A5FE5F687013AE36403
    SHA-512:FD104B5E6574531C6AE7FFE0A40F660171673084BBAEA9FFBAD2ADC8443B675D94370D1F2153CE9ADCCA278A88965F7D900F6D75DD0706688B9FC35CE0C6DFE8
    Malicious:false
    Preview:// stdafx.h : include file for standard system include files,..// or project specific include files that are used frequently, but..// are changed infrequently..//....#if !defined(AFX_STDAFX_H__7AACFAAB_F538_4DFF_A8FC_17EF82E463C2__INCLUDED_)..#define AFX_STDAFX_H__7AACFAAB_F538_4DFF_A8FC_17EF82E463C2__INCLUDED_....#if _MSC_VER > 1000..#pragma once..#endif // _MSC_VER > 1000......// Insert your headers here..#define WIN32_LEAN_AND_MEAN..// Exclude rarely-used stuff from Windows headers....#include <windows.h>....// TODO: reference additional headers your program requires here....//{{AFX_INSERT_LOCATION}}..// Microsoft Visual C++ will insert additional declarations immediately before the previous line.....#endif // !defined(AFX_STDAFX_H__7AACFAAB_F538_4DFF_A8FC_17EF82E463C2__INCLUDED_)..

    C:\Program Files\WinHTTrack\src_win\libhttrack\is-9FO9D.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):543
    Entropy (8bit):3.92621294133388
    Encrypted:false
    SSDEEP:6:zd22IPtDQHVCeJqN2NdumGsr81o1MHUtcqVZrWpYrZp4xkmrWpYrlCp4n:zTYcgcg2NDrXM0FzzYpzb
    MD5:89184D6B353740CFB5F85AB5A451F24E
    SHA1:8198D39A2B25A1EC68FD132552ABDD31B179D603
    SHA-256:D17D91659420C5AB2C23D1FEAEDD9E16AC5DF0E228F51D54A98B7A68DFA827B2
    SHA-512:7BC8FDB1A01E2A4F9CCAC5343AEE7577DA81951FBED93CAC971FEA27FB39AB6209F0175A877C2F1C3AE15900D337C1EC288907EF19C19DCD9DB43611B13F4C36
    Malicious:false
    Preview:Microsoft Developer Studio Workspace File, Format Version 6.00..# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!....###############################################################################....Project: "libhttrack"=.\libhttrack.dsp - Package Owner=<4>....Package=<5>..{{{..}}}....Package=<4>..{{{..}}}....###############################################################################....Global:....Package=<5>..{{{..}}}....Package=<3>..{{{..}}}....###############################################################################....

    C:\Program Files\WinHTTrack\src_win\libhttrack\is-B33QE.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):297
    Entropy (8bit):4.689131637267515
    Encrypted:false
    SSDEEP:6:jGmyXH+5AMRNT15eA6JA/Fm+yr5FdllZ+sMKcaGIA0RQbyyeGgLxLELpcxLglOEs:jGXXHJYx5fhE+yr5JlZ+4cWAoQB6mpcV
    MD5:2AE7082BB2B6FCB9184E52A257BB92E2
    SHA1:F2CC246B3ED7D8DC8CCA55B4E884A10E9626C7CA
    SHA-256:F2F93EA986240B26498FA1731CFB89174F3FF649D93BE3770151794CD4BF72D5
    SHA-512:DED6099319F0E92A83512C830A3B984E16CA283E35FC3D81E943C581B6D61FCFC430327D794317AC36B5849B41871BBF6F90CDDB5B12354E66CCA984DB5DC3D2
    Malicious:false
    Preview:// stdafx.cpp : source file that includes just the standard includes..//.libhttrack.pch will be the pre-compiled header..//.stdafx.obj will contain the pre-compiled type information....#include "stdafx.h"....// TODO: reference any additional headers you need in STDAFX.H..// and not in this file..

    C:\Program Files\WinHTTrack\src_win\libhttrack\is-BHNUF.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):35821
    Entropy (8bit):4.622128610438848
    Encrypted:false
    SSDEEP:768:A7Y+tNdSz3ZlqXOWoInuzx3Y8N3WiYD0v:AVtNIq1uzZY1C
    MD5:3C34AFDC3ADF82D2448F12715A255122
    SHA1:7713A1753CE88F2C7E6B054ECC8E4C786DF76300
    SHA-256:0B383D5A63DA644F628D99C33976EA6487ED89AAA59F0B3257992DEAC1171E6B
    SHA-512:4937848B94F5B50EA16C51F9E98FDCD3953ACA63D63CA3BB05D8A62C107E382B71C496838D130AE504A52032398630B957ACAEA6C48032081A6366D27CBA5EA9
    Malicious:false
    Preview: GNU GENERAL PUBLIC LICENSE.. Version 3, 29 June 2007.... Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>.. Everyone is permitted to copy and distribute verbatim copies.. of this license document, but changing it is not allowed..... Preamble.... The GNU General Public License is a free, copyleft license for..software and other kinds of works..... The licenses for most software and other practical works are designed..to take away your freedom to share and change the works. By contrast,..the GNU General Public License is intended to guarantee your freedom to..share and change all versions of a program--to make sure it remains free..software for all its users. We, the Free Software Foundation, use the..GNU General Public License for most of our software; it applies also to..any other work released this way by its authors. You can apply it to..your programs, too..... When we speak of free software

    C:\Program Files\WinHTTrack\src_win\libhttrack\is-FF0EQ.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):1195
    Entropy (8bit):4.911086399144892
    Encrypted:false
    SSDEEP:24:yE59+EDDWkyEOkH5CTbVpTjFvW4/mFTxUQ36s:yO9PDDNygHWTjFvWJUyN
    MD5:F93E24FD6A95D2489D5DB275ADD84D2A
    SHA1:624FAC7C36C2F90AA432D75B603E0BAA79A53654
    SHA-256:D62DDB7AE57B89BA7FB237BA9AA7FEFA2C59D764BE3840BE026CD5E12FE410B6
    SHA-512:CC264A926D42B113C66DEAD4EF7831461866B1F72BE2B0DD7C85DE07E051F7577AF1F052DDD6026983D3F171C6989CD9BD69B3AD947D9064F9F346248AC569D9
    Malicious:false
    Preview:HTTrack Website Copier License Agreement:....HTTrack Website Copier, Offline Browser for Windows and Unix..Copyright (C) Xavier Roche and other contributors.....This program is free software; you can redistribute it and/or..modify it under the terms of the GNU General Public License..as published by the Free Software Foundation; either version 3..of the License, or any later version.....This program is distributed in the hope that it will be useful,..but WITHOUT ANY WARRANTY; without even the implied warranty of..MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the..GNU General Public License for more details.....You should have received a copy of the GNU General Public License..along with this program; if not, write to the Free Software..Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.......Important notes:....- We hereby ask people using this source NOT to use it in purpose of grabbing..emails addresses, or collecting any other private informations

    C:\Program Files\WinHTTrack\src_win\libhttrack\is-NDM89.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):269
    Entropy (8bit):4.666661557641663
    Encrypted:false
    SSDEEP:6:jkffWDKwrJ3OA0RQby/CabGNhk6+KRnT2NoHFFQx:jkffWmmQAoQw/bGzkoJTFyx
    MD5:293BF34A3AA9A70179C0BF83DA3EFC37
    SHA1:254EF6DAE8F1D8DA8B961E183ACB7FA3A46FB086
    SHA-256:C90760F961A775895DADF66239C4FCD8DC63A2B993A4B328E2821858E442C86E
    SHA-512:02B1F3940512DE33DB1E72B67A397FFD87C9C5B9053A6236B30C9970489003424BE9EC0C01C8944AA05EC10AD98DAEC2A6EFA7CB566769F18B1158E8D44D0A9A
    Malicious:false
    Preview:// libhttrack.cpp : Defines the entry point for the DLL application...//....#include "stdafx.h"....BOOL APIENTRY DllMain( HANDLE hModule, .. DWORD ul_reason_for_call, .. LPVOID lpReserved....... )..{.. return TRUE;..}....

    C:\Program Files\WinHTTrack\src_win\libhttrack\is-OTC1J.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):9369
    Entropy (8bit):5.332855082239021
    Encrypted:false
    SSDEEP:192:HX0HX55O2gLIw/b/bBiTw2d7szQpiTwmCJhqUKBx6B7oy57ocv8W9X04Pje15gDB:HX0HJ5O2gLImLboTw2d7szQpiTwmCJhx
    MD5:40E67AF0B965E426E4E68F9410264870
    SHA1:5D464583BBD592C419C45373F688D19BF741C497
    SHA-256:A24EA1DC78B9508B4CC4FE0DAFB2925A6A52C5AA232E501D19E1193450932A22
    SHA-512:F78B3310478D3A6F19897BAB9FB00EC424F9FD4DD15060F3672C8907D300659726CE38FA5FD65D502F8326D3819B8BAFEE116CAC537507D3F3CCE686A864C0F3
    Malicious:false
    Preview:# Microsoft Developer Studio Project File - Name="libhttrack" - Package Owner=<4>..# Microsoft Developer Studio Generated Build File, Format Version 6.00..# ** DO NOT EDIT **....# TARGTYPE "Win32 (x86) Dynamic-Link Library" 0x0102....CFG=libhttrack - Win32 Debug..!MESSAGE This is not a valid makefile. To build this project using NMAKE,..!MESSAGE use the Export Makefile command and run..!MESSAGE ..!MESSAGE NMAKE /f "libhttrack.mak"...!MESSAGE ..!MESSAGE You can specify a configuration when running NMAKE..!MESSAGE by defining the macro CFG on the command line. For example:..!MESSAGE ..!MESSAGE NMAKE /f "libhttrack.mak" CFG="libhttrack - Win32 Debug"..!MESSAGE ..!MESSAGE Possible choices for configuration are:..!MESSAGE ..!MESSAGE "libhttrack - Win32 Release" (based on "Win32 (x86) Dynamic-Link Library")..!MESSAGE "libhttrack - Win32 Debug" (based on "Win32 (x86) Dynamic-Link Library")..!MESSAGE ....# Begin Project..# PROP AllowPerConfigDependencies 0..# PROP Scc_ProjName ""..# PROP Scc_L

    C:\Program Files\WinHTTrack\src_win\libhttrack\libhttrack.cpp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:C source, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):269
    Entropy (8bit):4.666661557641663
    Encrypted:false
    SSDEEP:6:jkffWDKwrJ3OA0RQby/CabGNhk6+KRnT2NoHFFQx:jkffWmmQAoQw/bGzkoJTFyx
    MD5:293BF34A3AA9A70179C0BF83DA3EFC37
    SHA1:254EF6DAE8F1D8DA8B961E183ACB7FA3A46FB086
    SHA-256:C90760F961A775895DADF66239C4FCD8DC63A2B993A4B328E2821858E442C86E
    SHA-512:02B1F3940512DE33DB1E72B67A397FFD87C9C5B9053A6236B30C9970489003424BE9EC0C01C8944AA05EC10AD98DAEC2A6EFA7CB566769F18B1158E8D44D0A9A
    Malicious:false
    Preview:// libhttrack.cpp : Defines the entry point for the DLL application...//....#include "stdafx.h"....BOOL APIENTRY DllMain( HANDLE hModule, .. DWORD ul_reason_for_call, .. LPVOID lpReserved....... )..{.. return TRUE;..}....

    C:\Program Files\WinHTTrack\src_win\libhttrack\libhttrack.dsp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):9369
    Entropy (8bit):5.332855082239021
    Encrypted:false
    SSDEEP:192:HX0HX55O2gLIw/b/bBiTw2d7szQpiTwmCJhqUKBx6B7oy57ocv8W9X04Pje15gDB:HX0HJ5O2gLImLboTw2d7szQpiTwmCJhx
    MD5:40E67AF0B965E426E4E68F9410264870
    SHA1:5D464583BBD592C419C45373F688D19BF741C497
    SHA-256:A24EA1DC78B9508B4CC4FE0DAFB2925A6A52C5AA232E501D19E1193450932A22
    SHA-512:F78B3310478D3A6F19897BAB9FB00EC424F9FD4DD15060F3672C8907D300659726CE38FA5FD65D502F8326D3819B8BAFEE116CAC537507D3F3CCE686A864C0F3
    Malicious:false
    Preview:# Microsoft Developer Studio Project File - Name="libhttrack" - Package Owner=<4>..# Microsoft Developer Studio Generated Build File, Format Version 6.00..# ** DO NOT EDIT **....# TARGTYPE "Win32 (x86) Dynamic-Link Library" 0x0102....CFG=libhttrack - Win32 Debug..!MESSAGE This is not a valid makefile. To build this project using NMAKE,..!MESSAGE use the Export Makefile command and run..!MESSAGE ..!MESSAGE NMAKE /f "libhttrack.mak"...!MESSAGE ..!MESSAGE You can specify a configuration when running NMAKE..!MESSAGE by defining the macro CFG on the command line. For example:..!MESSAGE ..!MESSAGE NMAKE /f "libhttrack.mak" CFG="libhttrack - Win32 Debug"..!MESSAGE ..!MESSAGE Possible choices for configuration are:..!MESSAGE ..!MESSAGE "libhttrack - Win32 Release" (based on "Win32 (x86) Dynamic-Link Library")..!MESSAGE "libhttrack - Win32 Debug" (based on "Win32 (x86) Dynamic-Link Library")..!MESSAGE ....# Begin Project..# PROP AllowPerConfigDependencies 0..# PROP Scc_ProjName ""..# PROP Scc_L

    C:\Program Files\WinHTTrack\src_win\libhttrack\libhttrack.dsw (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):543
    Entropy (8bit):3.92621294133388
    Encrypted:false
    SSDEEP:6:zd22IPtDQHVCeJqN2NdumGsr81o1MHUtcqVZrWpYrZp4xkmrWpYrlCp4n:zTYcgcg2NDrXM0FzzYpzb
    MD5:89184D6B353740CFB5F85AB5A451F24E
    SHA1:8198D39A2B25A1EC68FD132552ABDD31B179D603
    SHA-256:D17D91659420C5AB2C23D1FEAEDD9E16AC5DF0E228F51D54A98B7A68DFA827B2
    SHA-512:7BC8FDB1A01E2A4F9CCAC5343AEE7577DA81951FBED93CAC971FEA27FB39AB6209F0175A877C2F1C3AE15900D337C1EC288907EF19C19DCD9DB43611B13F4C36
    Malicious:false
    Preview:Microsoft Developer Studio Workspace File, Format Version 6.00..# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!....###############################################################################....Project: "libhttrack"=.\libhttrack.dsp - Package Owner=<4>....Package=<5>..{{{..}}}....Package=<4>..{{{..}}}....###############################################################################....Global:....Package=<5>..{{{..}}}....Package=<3>..{{{..}}}....###############################################################################....

    C:\Program Files\WinHTTrack\src_win\libhttrack\libhttrack.lib (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:current ar archive
    Category:dropped
    Size (bytes):35226
    Entropy (8bit):5.022786949491424
    Encrypted:false
    SSDEEP:768:odxnkjQTHYUUTRV8rcnlf/k+QeB601lWHHr/GFNf:+xkjQTHbUUrcjj7Nf
    MD5:CBF0AB6E4E52D7D30D0AA3FF4D49528C
    SHA1:8FA8F6A22DF7942BAF67E14AF7E4CB181F71747E
    SHA-256:F58EE94960A3085175D2F39B82902046663F1B6973D6E828501AECE94724E4D0
    SHA-512:516876D584F2FD79E6F52C62A1CB9F455A3AF5AABE682338F211468B175D0ADD617F57E4D7768258B39F01313C9E83C57AAA5CBBCB681054938EAD52FC833FFA
    Malicious:false
    Preview:!<arch>./ 1495270362 0 7687 `....N..<...>...@...LX..LX..M8..M8..N...N...G...G...Kl..Kl..J...J...Q...Q...J...J...Of..Of..Hf..Hf..TL..TL..Sd..Sd..U>..U>..Rj..Rj..S...S...O...O...N...N...M...M...I...I...J...J...R...R...P...P...L...L...P>..P>..Q...Q...Q...Q...K...K...T...T...I>..I>..V...V...G...G...V(..V(..G...G...U...U...N...N...H...H...D...D...Ed..Ed..D...D...FH..FH..[v..[v..[...[...\...\...]...]...W...W............n...n.._6.._6..`...`..._..._...kd..kd..k...k...j...j...bT..bT..t...t...r2..r2..i...i...^Z..^Z..r...r...F...F...m...m...m...m...Al..| ..| ...V...V...................X...X..........xH..xH..s...s...gt..gt..v...v...v...v...l@..l@..t`..t`..........uH..uH..g...g...v$..v$..nV..nV..qV..qV..f...f...s...s...u...u...wj..wj..q...q...n...n...w...w....D...D...<...<...........&...&..........\D..\D..A...A............................J...J..........Y...Y....,...,..X\..X\..X...X...........s~..s~..a...a...ad..ad..E...E...m...m...l...l...g...g...f2..f2..~...~.

    C:\Program Files\WinHTTrack\src_win\libhttrack\libhttrack.vcproj (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):54197
    Entropy (8bit):5.169205554685027
    Encrypted:false
    SSDEEP:384:FmiW/SMqWZBE9WiTOcWaNwkyRkyik9w1R1iCn/w1R1iCnUw1R1iCnew1R1iCnYw/:wikqD92c4d
    MD5:8B9586F6E938EFC236C5C50B75D88221
    SHA1:4645DC547E3F7E12F96615316C55C1B014396EC5
    SHA-256:D40045866318D657524E15B56EEF75C6207341839EDE66E45BA51AECC5C8057B
    SHA-512:381EAFCC629819257640D9C4CA3756F313CAB159B40C24583C86ECD9CB2DB43A2610073C0F9F1DB337B6F792D3CFE6A16695813B9C26474E1E8EB345C2018A34
    Malicious:false
    Preview:<?xml version="1.0" encoding="Windows-1252"?>..<VisualStudioProject...ProjectType="Visual C++"...Version="9,00"...Name="libhttrack"...ProjectGUID="{E76AD871-54C1-45E8-A657-6117ADEFFB46}"...RootNamespace="libhttrack"...TargetFrameworkVersion="131072"...>...<Platforms>....<Platform.....Name="Win32"..../>....<Platform.....Name="x64"..../>...</Platforms>...<ToolFiles>...</ToolFiles>...<Configurations>....<Configuration.....Name="Release|Win32".....OutputDirectory="C:\temp\Releaselib".....IntermediateDirectory="C:\temp\Releaselib".....ConfigurationType="2".....InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops".....UseOfMFC="0".....ATLMinimizesCRunTimeLibraryUsage="false".....CharacterSet="2".....>.....<Tool......Name="VCPreBuildEventTool"...../>.....<Tool......Name="VCCustomBuildTool"...../>.....<Tool......Name="VCXMLDataGeneratorTool"...../>.....<Tool......Name="VCWebServiceProxyGeneratorTool"...../>.....<Tool......Name="VCMIDLTool"......PreprocessorDefiniti

    C:\Program Files\WinHTTrack\src_win\libhttrack\setup_license.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):1195
    Entropy (8bit):4.911086399144892
    Encrypted:false
    SSDEEP:24:yE59+EDDWkyEOkH5CTbVpTjFvW4/mFTxUQ36s:yO9PDDNygHWTjFvWJUyN
    MD5:F93E24FD6A95D2489D5DB275ADD84D2A
    SHA1:624FAC7C36C2F90AA432D75B603E0BAA79A53654
    SHA-256:D62DDB7AE57B89BA7FB237BA9AA7FEFA2C59D764BE3840BE026CD5E12FE410B6
    SHA-512:CC264A926D42B113C66DEAD4EF7831461866B1F72BE2B0DD7C85DE07E051F7577AF1F052DDD6026983D3F171C6989CD9BD69B3AD947D9064F9F346248AC569D9
    Malicious:false
    Preview:HTTrack Website Copier License Agreement:....HTTrack Website Copier, Offline Browser for Windows and Unix..Copyright (C) Xavier Roche and other contributors.....This program is free software; you can redistribute it and/or..modify it under the terms of the GNU General Public License..as published by the Free Software Foundation; either version 3..of the License, or any later version.....This program is distributed in the hope that it will be useful,..but WITHOUT ANY WARRANTY; without even the implied warranty of..MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the..GNU General Public License for more details.....You should have received a copy of the GNU General Public License..along with this program; if not, write to the Free Software..Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.......Important notes:....- We hereby ask people using this source NOT to use it in purpose of grabbing..emails addresses, or collecting any other private informations

    C:\Program Files\WinHTTrack\src_win\setup_license.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):1195
    Entropy (8bit):4.911086399144892
    Encrypted:false
    SSDEEP:24:yE59+EDDWkyEOkH5CTbVpTjFvW4/mFTxUQ36s:yO9PDDNygHWTjFvWJUyN
    MD5:F93E24FD6A95D2489D5DB275ADD84D2A
    SHA1:624FAC7C36C2F90AA432D75B603E0BAA79A53654
    SHA-256:D62DDB7AE57B89BA7FB237BA9AA7FEFA2C59D764BE3840BE026CD5E12FE410B6
    SHA-512:CC264A926D42B113C66DEAD4EF7831461866B1F72BE2B0DD7C85DE07E051F7577AF1F052DDD6026983D3F171C6989CD9BD69B3AD947D9064F9F346248AC569D9
    Malicious:false
    Preview:HTTrack Website Copier License Agreement:....HTTrack Website Copier, Offline Browser for Windows and Unix..Copyright (C) Xavier Roche and other contributors.....This program is free software; you can redistribute it and/or..modify it under the terms of the GNU General Public License..as published by the Free Software Foundation; either version 3..of the License, or any later version.....This program is distributed in the hope that it will be useful,..but WITHOUT ANY WARRANTY; without even the implied warranty of..MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the..GNU General Public License for more details.....You should have received a copy of the GNU General Public License..along with this program; if not, write to the Free Software..Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.......Important notes:....- We hereby ask people using this source NOT to use it in purpose of grabbing..emails addresses, or collecting any other private informations

    C:\Program Files\WinHTTrack\src_win\warning.txt (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):1258
    Entropy (8bit):4.9369443739801495
    Encrypted:false
    SSDEEP:24:aUHJgXEDL4STdOKittQ5Q0GcSRE55F+EDDWkyEOkH5CTbVpTl:amCXEDLzwBQ5LuELFPDDNygHWTl
    MD5:2BEE1D97A7AE1646405686DC24E49D84
    SHA1:1E78D6C5D94F554EA9A04BA9545EC31F5FD30670
    SHA-256:409B44496CC858EAB7C0376541A7E78635725EC3B63EE9FB248CC0CA0E4AE1B3
    SHA-512:86AEFD138C44BD10E9A98D67C832A51A8CF076522A3A89F7E613263C1F6E667A95009E23136D6D804E4FD690B83E727F66DE2EF36D9B1D4F08635DC2314CC9D3
    Malicious:false
    Preview:Hello,....Here are the sources of the shell interface of WinHTTrack Website Copier III, for Visual C++ 2008....The shell interface code was started at the very begining of HTTrack, and is very, *VERY* ditry, not documented, and therefore not easy to (re)use.....These sources can be useful if you want to understand how to make another version, or a version for another OS.....Use this code at your own risks!!......Have fun,..Xavier Roche (Author)....---....WinHTTrack Website Copier, Offline Browser for Windows and Unix..Copyright (C) Xavier Roche and other contributors....This program is free software; you can redistribute it and/or..modify it under the terms of the GNU General Public License..as published by the Free Software Foundation; either version 3..of the License, or any later version.....This program is distributed in the hope that it will be useful,..but WITHOUT ANY WARRANTY; without even the implied warranty of..MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the..GN

    C:\Program Files\WinHTTrack\ssleay32.dll (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
    Category:dropped
    Size (bytes):357376
    Entropy (8bit):6.107476818924725
    Encrypted:false
    SSDEEP:6144:dEn/jiRtgk9NHoj2Q6yr6lIBLsy0IfMFPL+Ehy7OtdbDC7VMsNORJjd542Ki6hS5:dE/jiRtgk9NHoaQ6yr6uBLsy0IfMFT+E
    MD5:A96DB1B339924E6DF3FA369615DA2DE2
    SHA1:4CBDC505B5B248A8C20BE4B317029C32E28487A9
    SHA-256:7CA267B4E6CCEDFF8DD3730033C14A7237DECB7AAC721ABD3F286E41F38FC983
    SHA-512:752AAA9A8F9A1503534910C8D0C4E1BFDF79F054FF34932752A4A7DA848F1A84FFAC58F1ADA3E637EC1F0F89225D25801A27DE991BD9C7246556AE822EB65938
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 0%
    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........aB9..,j..,j..,j.x.j..,j.x.j..,j.x.j..,j..-j..,j.x.j..,j.x.j..,j.x.j..,j.x.j..,jRich..,j................PE..d...G.>T.........." ................D..............................................._Z..............................................@/..p$......P............`..H'..............D...p...................................................H............................text............................... ..`.rdata..............................@..@.data........`.......>..............@....pdata..H'...`...(...4..............@..@.rsrc................\..............@..@.reloc..<............d..............@..B........................................................................................................................................................................................................................................................................

    C:\Program Files\WinHTTrack\templates\index-body.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):115
    Entropy (8bit):4.288628311663439
    Encrypted:false
    SSDEEP:3:Lxusss7nvFLZeb5dv+ssaFtPzHuNsNN0T0SN/srx+n:Lxusswn3mv+NaFtjQ+OT0E0U
    MD5:FD57C643217A582A0523F7C61A2C03CD
    SHA1:39D7BB15BED24017F7FDE996CA2F01537086A7D5
    SHA-256:6303A2AE05C4B4E61505BA1AA1E6F2D9C04E43EFD443060B0D1622A884EF3B5E
    SHA-512:ACCBC42340ACDDCCDD1ABDE9886280D49BBC3CBF5AB3AD5648CD2A00682974F753ECB9AA3A051B928C9A60B04A0EFF78379C8545E2612BC72D8CDF4AAF56BBB9
    Malicious:false
    Preview:..<TR>.....<TD BACKGROUND="fade.gif">......&middot;.......<A HREF="%s">........%s.......</A>.......</TD>....</TR>..

    C:\Program Files\WinHTTrack\templates\index-footer.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):609
    Entropy (8bit):5.189451377972159
    Encrypted:false
    SSDEEP:12:4fnktb/rspEKoCco4ya4woK0tl+iMqLb73pnJhkL09sGa:Cnktb/rstoNqXlptwiMqLb73pnJxst
    MD5:C013D3AA0378D6BE21A777D21901C2EF
    SHA1:BD9F532D8FB078309A558337C679A0F9D5F617B5
    SHA-256:D07AB2C303EFED3545F79B6DB3F1037080E7E0518C02C9098489A2F07C9162A4
    SHA-512:14E5FAFFAE5C752DC2C4AE2006EBBC3B934532FB4A7161DD9B6FA0A712B1D1B0545758C9BD2DEE8DE8AF476C16D447B4422206BE2E64996F45822F3C77EFEC38
    Malicious:false
    Preview:.</TABLE>...<BR>...<BR>...<BR>.. .<H6 ALIGN="RIGHT">...<I>Mirror and index made by HTTrack Website Copier [XR&amp;CO'2008]</I>...</H6>...%s... Thanks for using HTTrack Website Copier! -->...%s.... ==================== Start epilogue ==================== -->....</td>....</tr>....</table>...</td>...</tr>...</table>..</td>..</tr>..</table>....<table width="76%%" border="0" align="center" valign="bottom" cellspacing="0" cellpadding="0">...<tr>...<td id="footer"><small>&copy; 2008 Xavier Roche & other contributors - Web Design: Leto Kauler.</small></td>...</tr>..</table>....</body>....</html>......

    C:\Program Files\WinHTTrack\templates\index-header.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603), with CRLF line terminators
    Category:dropped
    Size (bytes):4231
    Entropy (8bit):5.223364022108319
    Encrypted:false
    SSDEEP:96:FLRopoU/UvyGmAHq+JdGn+6H+dvJcWX++kVjyzobCBIUB3nEn/9bSP:hy5/uHq2sDXeECtFEFbSP
    MD5:EC22F7F0DC3325FC135F74A4C3869D6F
    SHA1:DB1B3082DC20378C0B93D0EAA1635C0B6740B900
    SHA-256:4D7EEAC20C9EE19793237C9308D1C08DAEFBCAF622AD7D3E35430D2B64CE20C9
    SHA-512:00D9EB2B2BE99FFCA2C6776544A2BEE4C83010F9AE2CA0A834A5FB63491F97AFDF62E677F16489E5D316331315578F6B623495435DB9FCABF2ABB2BE3177F22F
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">....<head>...<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />...<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />...<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\templates\is-67ID0.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):33
    Entropy (8bit):3.2250274521673097
    Encrypted:false
    SSDEEP:3:Lrm3N0lo04qGv:LrAN0l/wv
    MD5:D3500CBEEE5BF92809353AC9446F2111
    SHA1:80100377688B84EA88A26EC586C8D467F577D2C9
    SHA-256:3E1D5373C6350D24FB43ABABAD65EB33E341BECDDDDE61EB22BFF6767C856D4C
    SHA-512:B596325D58E835B7D8EB09B7BE2CD9ABEFD721E0D927771D0C79611AEDEE45ED09BDEA9D418F27F3CE66992C991D6BCEB5D337804963106E9414BA32C4B51B34
    Malicious:false
    Preview:..<TH>....<BR/>.....%s....</TH>..

    C:\Program Files\WinHTTrack\templates\is-680JA.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603), with CRLF line terminators
    Category:dropped
    Size (bytes):4231
    Entropy (8bit):5.223364022108319
    Encrypted:false
    SSDEEP:96:FLRopoU/UvyGmAHq+JdGn+6H+dvJcWX++kVjyzobCBIUB3nEn/9bSP:hy5/uHq2sDXeECtFEFbSP
    MD5:EC22F7F0DC3325FC135F74A4C3869D6F
    SHA1:DB1B3082DC20378C0B93D0EAA1635C0B6740B900
    SHA-256:4D7EEAC20C9EE19793237C9308D1C08DAEFBCAF622AD7D3E35430D2B64CE20C9
    SHA-512:00D9EB2B2BE99FFCA2C6776544A2BEE4C83010F9AE2CA0A834A5FB63491F97AFDF62E677F16489E5D316331315578F6B623495435DB9FCABF2ABB2BE3177F22F
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">....<head>...<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />...<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />...<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\templates\is-8OOGN.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):124
    Entropy (8bit):4.569436541578217
    Encrypted:false
    SSDEEP:3:Lxuss/LFLZebOUMqPzKp5QbAb2nbfx+n:LxussLBUR4OamfU
    MD5:BDB673BD686B9471A8573AD7037B47DB
    SHA1:10CA479BB5308FE168EDE6C8FD040F4129AF8950
    SHA-256:0C4D086B93F96652C9D9A507F3BCD7EE5A76F6F7AC861CD3916E482715975562
    SHA-512:D876154AAF13176184C30683F0824B08262D6DDFB617CEFCD9D3CAF74D709C3C625671CFE4A377A90C63F2E63D7154D5127E2CE2DC728A3BD5F5E8AD7F3FD22B
    Malicious:false
    Preview:..<TR>.... <TD BACKGROUND="fade.gif">.. &middot; <A HREF="%s/index.html">%s</A>.. .. </TD>....</TR>..

    C:\Program Files\WinHTTrack\templates\is-DA78M.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):592
    Entropy (8bit):5.159536332928235
    Encrypted:false
    SSDEEP:12:4fnKbC/dsp2oCcoU4woK0tl+iMqLb73pnJhkL09sGa:CnKbyswoNUlptwiMqLb73pnJxst
    MD5:E0221915493BF6F4F3D8869E0ADD3CE5
    SHA1:CC148721ABB0BFC9060524C8B4E4B632F49AF1B2
    SHA-256:3EEE0E39AF5B6C9CACD06C20929D7061F3618D396F965C90FCF4583AE31D3015
    SHA-512:DE20D4E54B720AE4D3FB4409D166A5E8FCE8EC49DE774854CF46C45338763849F19704E511A8BA1C937BFD238A4337786890CD4A48594B960DE2405505330F09
    Malicious:false
    Preview:.</TABLE>...<BR>...<H6 ALIGN="RIGHT">.. <I>Mirror and index made by HTTrack Website Copier [XR&CO'2008]</I>...</H6>...%s... Thanks for using HTTrack Website Copier! -->.... ==================== Start epilogue ==================== -->....</td>....</tr>....</table>...</td>...</tr>...</table>..</td>..</tr>..</table>....<table width="76%%" border="0" align="center" valign="bottom" cellspacing="0" cellpadding="0">...<tr>...<td id="footer"><small>&copy; 2008 Xavier Roche & other contributors - Web Design: Leto Kauler.</small></td>...</tr>..</table>....</body>....</html>......

    C:\Program Files\WinHTTrack\templates\is-MBG29.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):609
    Entropy (8bit):5.189451377972159
    Encrypted:false
    SSDEEP:12:4fnktb/rspEKoCco4ya4woK0tl+iMqLb73pnJhkL09sGa:Cnktb/rstoNqXlptwiMqLb73pnJxst
    MD5:C013D3AA0378D6BE21A777D21901C2EF
    SHA1:BD9F532D8FB078309A558337C679A0F9D5F617B5
    SHA-256:D07AB2C303EFED3545F79B6DB3F1037080E7E0518C02C9098489A2F07C9162A4
    SHA-512:14E5FAFFAE5C752DC2C4AE2006EBBC3B934532FB4A7161DD9B6FA0A712B1D1B0545758C9BD2DEE8DE8AF476C16D447B4422206BE2E64996F45822F3C77EFEC38
    Malicious:false
    Preview:.</TABLE>...<BR>...<BR>...<BR>.. .<H6 ALIGN="RIGHT">...<I>Mirror and index made by HTTrack Website Copier [XR&amp;CO'2008]</I>...</H6>...%s... Thanks for using HTTrack Website Copier! -->...%s.... ==================== Start epilogue ==================== -->....</td>....</tr>....</table>...</td>...</tr>...</table>..</td>..</tr>..</table>....<table width="76%%" border="0" align="center" valign="bottom" cellspacing="0" cellpadding="0">...<tr>...<td id="footer"><small>&copy; 2008 Xavier Roche & other contributors - Web Design: Leto Kauler.</small></td>...</tr>..</table>....</body>....</html>......

    C:\Program Files\WinHTTrack\templates\is-O714A.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):115
    Entropy (8bit):4.288628311663439
    Encrypted:false
    SSDEEP:3:Lxusss7nvFLZeb5dv+ssaFtPzHuNsNN0T0SN/srx+n:Lxusswn3mv+NaFtjQ+OT0E0U
    MD5:FD57C643217A582A0523F7C61A2C03CD
    SHA1:39D7BB15BED24017F7FDE996CA2F01537086A7D5
    SHA-256:6303A2AE05C4B4E61505BA1AA1E6F2D9C04E43EFD443060B0D1622A884EF3B5E
    SHA-512:ACCBC42340ACDDCCDD1ABDE9886280D49BBC3CBF5AB3AD5648CD2A00682974F753ECB9AA3A051B928C9A60B04A0EFF78379C8545E2612BC72D8CDF4AAF56BBB9
    Malicious:false
    Preview:..<TR>.....<TD BACKGROUND="fade.gif">......&middot;.......<A HREF="%s">........%s.......</A>.......</TD>....</TR>..

    C:\Program Files\WinHTTrack\templates\is-P8OQC.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603), with CRLF line terminators
    Category:dropped
    Size (bytes):4142
    Entropy (8bit):5.159447306556116
    Encrypted:false
    SSDEEP:96:FLRopoU/UvyGmBq+JdGn+6H+dvJcWX++kVjyzob5BIUB3nEn/wxO:hy5/Xq2sDXeE5tFE44
    MD5:65B81489D5DA139AC0B7C5F712825F99
    SHA1:2ED16B48BFAE963355E899181E5446EA1CFCC050
    SHA-256:7AF44A764576AA0E7BC2823B70A304A119268579D103B443DAC66B3D75E2B902
    SHA-512:1D16275BD24E4C65CEBB2F11A3FC5CE67C90357BFFE1B3C7E8C74ACDD9570C88AA7F859671E085C8CED395FEDFD804CA3A2C10FCC095A400F97BA0CACAF463EE
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">....<head>...<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />...<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />...<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\templates\topindex-body.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):124
    Entropy (8bit):4.569436541578217
    Encrypted:false
    SSDEEP:3:Lxuss/LFLZebOUMqPzKp5QbAb2nbfx+n:LxussLBUR4OamfU
    MD5:BDB673BD686B9471A8573AD7037B47DB
    SHA1:10CA479BB5308FE168EDE6C8FD040F4129AF8950
    SHA-256:0C4D086B93F96652C9D9A507F3BCD7EE5A76F6F7AC861CD3916E482715975562
    SHA-512:D876154AAF13176184C30683F0824B08262D6DDFB617CEFCD9D3CAF74D709C3C625671CFE4A377A90C63F2E63D7154D5127E2CE2DC728A3BD5F5E8AD7F3FD22B
    Malicious:false
    Preview:..<TR>.... <TD BACKGROUND="fade.gif">.. &middot; <A HREF="%s/index.html">%s</A>.. .. </TD>....</TR>..

    C:\Program Files\WinHTTrack\templates\topindex-bodycat.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):33
    Entropy (8bit):3.2250274521673097
    Encrypted:false
    SSDEEP:3:Lrm3N0lo04qGv:LrAN0l/wv
    MD5:D3500CBEEE5BF92809353AC9446F2111
    SHA1:80100377688B84EA88A26EC586C8D467F577D2C9
    SHA-256:3E1D5373C6350D24FB43ABABAD65EB33E341BECDDDDE61EB22BFF6767C856D4C
    SHA-512:B596325D58E835B7D8EB09B7BE2CD9ABEFD721E0D927771D0C79611AEDEE45ED09BDEA9D418F27F3CE66992C991D6BCEB5D337804963106E9414BA32C4B51B34
    Malicious:false
    Preview:..<TH>....<BR/>.....%s....</TH>..

    C:\Program Files\WinHTTrack\templates\topindex-footer.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):592
    Entropy (8bit):5.159536332928235
    Encrypted:false
    SSDEEP:12:4fnKbC/dsp2oCcoU4woK0tl+iMqLb73pnJhkL09sGa:CnKbyswoNUlptwiMqLb73pnJxst
    MD5:E0221915493BF6F4F3D8869E0ADD3CE5
    SHA1:CC148721ABB0BFC9060524C8B4E4B632F49AF1B2
    SHA-256:3EEE0E39AF5B6C9CACD06C20929D7061F3618D396F965C90FCF4583AE31D3015
    SHA-512:DE20D4E54B720AE4D3FB4409D166A5E8FCE8EC49DE774854CF46C45338763849F19704E511A8BA1C937BFD238A4337786890CD4A48594B960DE2405505330F09
    Malicious:false
    Preview:.</TABLE>...<BR>...<H6 ALIGN="RIGHT">.. <I>Mirror and index made by HTTrack Website Copier [XR&CO'2008]</I>...</H6>...%s... Thanks for using HTTrack Website Copier! -->.... ==================== Start epilogue ==================== -->....</td>....</tr>....</table>...</td>...</tr>...</table>..</td>..</tr>..</table>....<table width="76%%" border="0" align="center" valign="bottom" cellspacing="0" cellpadding="0">...<tr>...<td id="footer"><small>&copy; 2008 Xavier Roche & other contributors - Web Design: Leto Kauler.</small></td>...</tr>..</table>....</body>....</html>......

    C:\Program Files\WinHTTrack\templates\topindex-header.html (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:HTML document, ASCII text, with very long lines (603), with CRLF line terminators
    Category:dropped
    Size (bytes):4142
    Entropy (8bit):5.159447306556116
    Encrypted:false
    SSDEEP:96:FLRopoU/UvyGmBq+JdGn+6H+dvJcWX++kVjyzob5BIUB3nEn/wxO:hy5/Xq2sDXeE5tFE44
    MD5:65B81489D5DA139AC0B7C5F712825F99
    SHA1:2ED16B48BFAE963355E899181E5446EA1CFCC050
    SHA-256:7AF44A764576AA0E7BC2823B70A304A119268579D103B443DAC66B3D75E2B902
    SHA-512:1D16275BD24E4C65CEBB2F11A3FC5CE67C90357BFFE1B3C7E8C74ACDD9570C88AA7F859671E085C8CED395FEDFD804CA3A2C10FCC095A400F97BA0CACAF463EE
    Malicious:false
    Preview:<html xmlns="http://www.w3.org/1999/xhtml" lang="en">....<head>...<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />...<meta name="description" content="HTTrack is an easy-to-use website mirror utility. It allows you to download a World Wide website from the Internet to a local directory,building recursively all structures, getting html, images, and other files from the server to your computer. Links are rebuiltrelatively so that you can freely browse to the local site (works with any browser). You can mirror several sites together so that you can jump from one toanother. You can, also, update an existing mirror site, or resume an interrupted download. The robot is fully configurable, with an integrated help" />...<meta name="keywords" content="httrack, HTTRACK, HTTrack, winhttrack, WINHTTRACK, WinHTTrack, offline browser, web mirror utility, aspirateur web, surf offline, web capture, www mirror utility, browse offline, local site builder, website mirroring, aspirat

    C:\Program Files\WinHTTrack\unins000.dat

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:InnoSetup Log 64-bit WinHTTrack Website Copier, version 0x30, 41919 bytes, 347688\user, "C:\Program Files\WinHTTrack"
    Category:dropped
    Size (bytes):41919
    Entropy (8bit):4.974187564955729
    Encrypted:false
    SSDEEP:384:AYzOb+kK8ARj6qdc/qoMx+yJcbL8nw13mnq41qfZg0lrz+r98Ihv8NzunWyPeGA1:mAy3mnq41qfZg0lrz+r98Ihvy
    MD5:B39C1F8B3F81321400F020F7F09DEBA7
    SHA1:F7886B98EE0E4DFDC0B466468674EC394CC1446A
    SHA-256:7C0591102E6D077A368411988708D1747D65412A7A4FF12DD94A5C8776515222
    SHA-512:2B88D27289C273096DB433AB333F517C4F208D0284BA8CC7E6AEBB46CB498AFD86F4589A6374DEBBB5D775D63509CEB9294A030CA71EAD104595AE948AC7EAAA
    Malicious:false
    Preview:Inno Setup Uninstall Log (b) 64-bit.............................WinHTTrack Website Copier.......................................................................................................WinHTTrack Website Copier.......................................................................................................0...h.......%................................................................................................................o2-........r.PL......;....347688.user.C:\Program Files\WinHTTrack...........3...... .......... .................................C:\Program Files\WinHTTrack?C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinHTTrack.WinHTTrack.default.............WinHTTrack_RUN..."........C:\Program Files\WinHTTrack..."..."... C:\Program Files\WinHTTrack\html.......1...+C:\Program Files\WinHTTrack\html\abuse.html...........2...,C:\Program Files\WinHTTrack\html\addurl.html...........1...+C:\Program Files\WinHTTrack\html\cache.html...........2...,C:\Program Files

    C:\Program Files\WinHTTrack\unins000.exe (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
    Category:dropped
    Size (bytes):718008
    Entropy (8bit):6.534479221871629
    Encrypted:false
    SSDEEP:12288:NQszP8NRMXpc/rPx37/zHBA66pE+4p1YR71CERdH6rN9by7HaOMeImx9M8:NQQP8YXpc/rPx37/zHBA6plp+51CErzt
    MD5:BE92B50BF16F68E185DF0AD85936EE03
    SHA1:11FD2A8CB8744540DD5257F7A9F22AA2C7BB4DE3
    SHA-256:8114CFC2B266A56C9A98911A5EFA603E967838227B519F35E573182E49470B16
    SHA-512:C24F552DE5136BB9F8836B26D9690534B6EE23A1D9CFC4099C1A9681A57358221613D00B595F05A7B278C42B1EFA747259700B35D7E056DEE38E45905F2FBE55
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 2%
    Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................T...................@.................................1 ...........@...............................%...........................0............................... ......................................................CODE....,........................... ..`DATA................................@...BSS......................................idata...%.......&..................@....tls.....................................rdata....... ......................@..P.reloc..(....0......................@..P.rsrc...............................@..P.....................Z..............@..P........................................................................................................................................

    C:\Program Files\WinHTTrack\unins000.msg

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:InnoSetup messages, version 5.5.3, 221 messages (ASCII), &About Setup...
    Category:dropped
    Size (bytes):11397
    Entropy (8bit):4.691973131855328
    Encrypted:false
    SSDEEP:192:4yuyHdp7pdoksdrKUURqCZYcI71gWb/I+XIWCMVtQs:vFz7p85KaCZYcI71Tb/rIWCMVtN
    MD5:B0610572F47DD7165EF515858C48C164
    SHA1:07F192C9AB4166647F5FBB8108F6D3D803EF20B1
    SHA-256:221D3BEFB04828CC2BA4D167DD2CC87B2680A58C5E7069210A17D0C37EC182BB
    SHA-512:BBBD6A1D722A9833CE4AD2E7803AAB5AB9F2515F23CA1116DD3BC6ABA805F1575DF5767EE00E2191FED871F1977C4D373DE6AD2D446751316C771557D35E98A5
    Malicious:false
    Preview:Inno Setup Messages (5.5.3).........................................X,......G.a&About Setup....%1 version %2..%3....%1 home page:..%4..About Setup.You must be logged in as an administrator when installing this program..The following applications are using files that need to be updated by Setup. It is recommended that you allow Setup to automatically close these applications..The following applications are using files that need to be updated by Setup. It is recommended that you allow Setup to automatically close these applications. After the installation has completed, Setup will attempt to restart the applications..Folder names cannot include any of the following characters:....%1.The folder name cannot include any of the following characters:....%1..Select a folder in the list below, then click OK..Browse For Folder.< &Back.&Browse....Cancel.&Finish.&Install.&Make New Folder.&Next >.&No.N&o to All.OK.B&rowse....&Yes.Yes to &All.Setup cannot continue. Please click Cancel to exit..Setu

    C:\Program Files\WinHTTrack\webhttrack.exe (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:PE32+ executable (console) x86-64, for MS Windows
    Category:dropped
    Size (bytes):94280
    Entropy (8bit):6.324698229368409
    Encrypted:false
    SSDEEP:1536:1J/NVuxg/PRjTPVhfOJMyITuPM6Vj6+Cos7YQ00xSRcaYr2xOYtZhW8+aELDRo5v:1ll9hmW5oCPSoSuW/XyW
    MD5:B3A7851BAB37169B83735B19BFD6EB3D
    SHA1:23A7D5ADD5C148473F478ABA3A77875D150C41F8
    SHA-256:6E976D98F868F5178F098242134EB96A2BCE4142AAD8F1B4D822F4589BE96B85
    SHA-512:13F96F7EE83822748D087578876E20DCDC3591EAC5DFAFD46DB99F8835F5BA2DEE708934AA8E188D3871817BF3A5E6C98F1DF67ED37D46AE7FDA1E3FFE27428B
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 0%
    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y..k*..k*..k*...*..k*...*..k*...*..k*...*..k*...*..k*..j*&.k*...*..k*...*..k*...*..k*Rich..k*........................PE..d..... Y..........#..........^......$..........@.....................................................................................V..(...`K..d............p..8....X..H...............................................................`............................text...A........................... ..`.rdata...J.......L..................@..@.data...H....`.......F..............@....pdata..8....p.......H..............@..@.rsrc................T..............@..@................................................................................................................................................................................................................................................................................................

    C:\Program Files\WinHTTrack\webhttrack.exp (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:Intel 80386 COFF object file, not stripped, 2 sections, symbol offset=0xc18, 78 symbols, created Sat May 20 08:50:02 2017, 1st section name ".edata"
    Category:dropped
    Size (bytes):5189
    Entropy (8bit):4.233136455639894
    Encrypted:false
    SSDEEP:96:aAxgGKnaDAn9KAsmLb4fyMOdMxuYIeaQz8G4yFjrddjWNGesBuIv6fdQBHMqB4Ax:aAmGKnaEYyMOmBdaDLXI1
    MD5:F8EE798B1D36AB6C3068BFC7CB14F372
    SHA1:27D60F1E0D94D3F21C5074AE4E72D51A3E686515
    SHA-256:3DBA02F0A6BD8DAAB43CFE509EA558DFDD3CF3B3992B78552C5B3F2DE6EB5AD9
    SHA-512:90FED658A8C969E83B35B967F37FC810882B9D9F8BC23E6760AAC7E82D37FC228B8432893F9B4FC15E50EF7190D7FFA7143393A406A314857CBEBCD5D25FB095
    Malicious:false
    Preview:L...:. Y....N........edata..........(...d...........L...@..@.debug$S............................@..B....:. Y............$...$............................................................................................................................................................................................................................................................................................................................................................................... .!.".#.webhttrack.exe.coucal_add.coucal_add_pvoid.coucal_calc_hashes.coucal_created.coucal_dec.coucal_delete.coucal_enum_new.coucal_enum_next.coucal_exists.coucal_fetch_value.coucal_fetch_value_hashes.coucal_get_intptr.coucal_get_name.coucal_get_pvoid.coucal_hash_data.coucal_hash_size.coucal_hash_string.coucal_inc.coucal_memory_size.coucal_new.coucal_nitems.coucal_read.coucal_read_pvoid.coucal_read_value.coucal_readptr.coucal_remove.coucal_set_assert_handler.coucal_set_global_assert_handler.coucal_set_

    C:\Program Files\WinHTTrack\webhttrack.lib (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:current ar archive
    Category:dropped
    Size (bytes):9438
    Entropy (8bit):5.0017954547659516
    Encrypted:false
    SSDEEP:192:z8vONEEaHCWNinv9XIXWql/y4qL7EjYrg:z82NT8TUv94mqlqLXEjL
    MD5:3998D1D6AF700578E715A82EDFCC3505
    SHA1:9D8FD625D321580A75403F4D5A559FBA146BE3CC
    SHA-256:ADA7F81CA950B23DD9929F71651A0154D06064AEE06D4A015F6025DC77BC1F36
    SHA-512:890464B0A99A01C4A4896A3A47A0AAD709456882E9519553A152F7B6D6D28FF90825D1A8A1390519BA84AC8266D1CB1312A7581B923A0FA9DAF5521FA3599879
    Malicious:false
    Preview:!<arch>./ 1495270202 0 1974 `....K.......,...f...........................................................<...<...$...$.........."..."...!(..!(..#...#... ,.. ,..!...!....................^...^...Z...Z.......... ... ....j...j...z...z...................N...N.........."..."...........$j..$j..........#...#....*...*..#...#....D...D........__IMPORT_DESCRIPTOR_webhttrack.__NULL_IMPORT_DESCRIPTOR..webhttrack_NULL_THUNK_DATA.__imp__coucal_get_name._coucal_get_name.__imp__coucal_hash_data._coucal_hash_data.__imp__coucal_hash_string._coucal_hash_string.__imp__coucal_calc_hashes._coucal_calc_hashes.__imp__coucal_fetch_value_hashes._coucal_fetch_value_hashes.__imp__coucal_fetch_value._coucal_fetch_value.__imp__coucal_read_value._coucal_read_value.__imp__coucal_exists._coucal_exists.__imp__coucal_new._coucal_new.__imp__coucal_created._coucal_created.__imp__coucal_value_is_malloc._coucal_value_is_malloc.__imp__coucal_set_name._coucal_set_name.__imp__coucal_value_se

    C:\Program Files\WinHTTrack\zlib1.dll (copy)

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
    Category:dropped
    Size (bytes):154112
    Entropy (8bit):5.796445452784198
    Encrypted:false
    SSDEEP:3072:w5ske1vfuO+n11R1k4RwGluix00aQXxVPtp3HBgfatznPcTBfbK27:wSke1nuO+n11R1k4RwGThVPcmnPcTBDr
    MD5:2BD6884CCB700BE46F755C8673456A71
    SHA1:7CCB15712F69034D3B5BF131C901C9C8A6AD7A30
    SHA-256:9A03096691E21118EF74D0CDEB77A6149EBDD00003490CC01BAF0E1E0871400F
    SHA-512:00E91FECB29794D5D931D975BADBEF03369DFFDE82771D601FB4747D9C1259C6EEACC8BB8DA762B10C6CFE59978DA455C660C03533C0DEEF72D48212F8F000E8
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 0%
    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........|K.r/K.r/K.r/B../I.r/.../N.r/B../J.r/B../B.r/B../I.r/lv./H.r/K.s/q.r/B../_.r/B../J.r/U../J.r/B../J.r/RichK.r/................PE..d..... Y.........." .........n......|.....................................................@..........................................M.......G..<............p..................P....................................................................................text............................... ..`.rdata...Y.......Z..................@..@.data........`.......F..............@....pdata.......p.......H..............@..@.rsrc................T..............@..@.reloc..8............X..............@..B................................................................................................................................................................................................................................................

    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinHTTrack\Documentation.lnk

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Archive, ctime=Wed Jul 3 15:51:33 2024, mtime=Wed Jul 3 15:51:33 2024, atime=Fri Nov 1 20:50:50 2002, length=190, window=hide
    Category:dropped
    Size (bytes):943
    Entropy (8bit):4.52814586872709
    Encrypted:false
    SSDEEP:24:8B73dARkZBmGKrHvA7XEtrdeekdeW7Bm:8VdGkZBJw4TEtrdeekdeu
    MD5:1823B178AA2BAC50535B1DCBEF3D971C
    SHA1:55C07BF9E5461BC5A11E0D7390A8F7D6047E7101
    SHA-256:B808E4A42DE3B5E9F1D938FCCC3C0AEB8E32126C1E1703CD5226967B3714A32A
    SHA-512:5345872E476CD383D13B4617DA8211F97BAA15B863314DA54DF1923609021E80FCB9B07394CE2E161A997F05D94FE9E866EA4945B00B3B7C82C07B27E5815796
    Malicious:false
    Preview:L..................F.... ....H.Bi....H.Bi........................................P.O. .:i.....+00.../C:\.....................1......Xp...PROGRA~1..t......O.I.Xr.....B...............J.....H...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....^.1......Xr...WINHTT~1..F.......Xp..Xr.....Y.......................).W.i.n.H.T.T.r.a.c.k.....n.2.....a-Y. .HTTRAC~1.HTM..R.......Xq..Xq......H........................h.t.t.r.a.c.k.-.d.o.c...h.t.m.l.......[...............-.......Z.............lx.....C:\Program Files\WinHTTrack\httrack-doc.html....V.i.e.w. .d.o.c.u.m.e.n.t.a.t.i.o.n.;.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.H.T.T.r.a.c.k.\.h.t.t.r.a.c.k.-.d.o.c...h.t.m.l...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.H.T.T.r.a.c.k.`.......X.......347688...........hT..CrF.f4... .l.T..b...,.......hT..CrF.f4... .l.T..b...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinHTTrack\WinHTTrack Website Copier.lnk

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Archive, ctime=Wed Jul 3 15:51:33 2024, mtime=Wed Jul 3 15:51:34 2024, atime=Sat May 20 13:55:32 2017, length=683592, window=hide
    Category:dropped
    Size (bytes):961
    Entropy (8bit):4.5314135696372215
    Encrypted:false
    SSDEEP:24:8VldARkZBl6JdAs2XEBXEpsdeOcdeWbLGLEBm:8TdGkZBl6JWswEhEpsdeOcdeIcm
    MD5:5CC6D925FC38770E7A8116A547F9EDF4
    SHA1:376BAE53EF871100467C71C992EBBCD6E0D134C3
    SHA-256:C1D4D1D062C9ADA218C30450BD6FBB845B4F347208375A303E0B5D0DD228829F
    SHA-512:7821C5C7CDE57800A90971CC5936F9507D9CF400FF5D0D54A5FA551E0344990B08CE1B741069260867E6A3EC0AF8B8422AD7FBD238C6F089ACD07F62CA64AA71
    Malicious:false
    Preview:L..................F.... ....W.Bi...t..Bi...... y...Hn...........................P.O. .:i.....+00.../C:\.....................1.....DW.V..PROGRA~1..t......O.IDWQ`....B...............J.....i...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....^.1......Xr...WINHTT~1..F.......Xp..Xr.....Y.......................).W.i.n.H.T.T.r.a.c.k.....j.2.Hn...J.v .WINHTT~1.EXE..N.......Xq..Xr......H........................W.i.n.H.T.T.r.a.c.k...e.x.e.......Y...............-.......X.............lx.....C:\Program Files\WinHTTrack\WinHTTrack.exe.. .L.a.u.n.c.h. .W.i.n.H.T.T.r.a.c.k. .W.e.b.s.i.t.e. .C.o.p.i.e.r.9.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.H.T.T.r.a.c.k.\.W.i.n.H.T.T.r.a.c.k...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.H.T.T.r.a.c.k.`.......X.......347688...........hT..CrF.f4... ...T..b...,.......hT..CrF.f4... ...T..b...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinHTTrack\copying.lnk

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Archive, ctime=Thu Sep 8 02:07:23 2022, mtime=Wed Jul 3 15:51:34 2024, atime=Thu Sep 8 02:07:23 2022, length=201216, window=hide
    Category:dropped
    Size (bytes):952
    Entropy (8bit):4.647534801038209
    Encrypted:false
    SSDEEP:24:8JuE+DsBqtCAn+BdeSde902bI7LmLMqyFm:8wXs4thGdeSde90EG8VyF
    MD5:5BA99165CD3EBF997E32257908FECAEA
    SHA1:C1523EC0F39FB1679441FA5ADDBBC68076F11CC5
    SHA-256:09777941632EAFF1DFB8BA5F297247DF6E8D238556295F19A62AA523D8134148
    SHA-512:7B74ACC6AFA999FDAC50195DBD207897EC6AE6CEC83B2BCBC69888CE3D400735A0BCDBD69B8DFD20CEC0A7FFB5716E22989D8F2334D5E8917E0C5A92CED11C98
    Malicious:false
    Preview:L..................F.... .......0....dCi...z...0................................P.O. .:i.....+00.../C:\...................V.1.....DWP`..Windows.@......OwH.X`.....3.....................{Y..W.i.n.d.o.w.s.....b.2.....(U.. .notepad.exe.H......(U...Xr.....)...........p...........[.n.o.t.e.p.a.d...e.x.e.......E...............-.......D.............lx.....C:\Windows\notepad.exe....C.O.P.Y.I.N.G.%.....\.....\.....\.....\.....\.....\.W.i.n.d.o.w.s.\.n.o.t.e.p.a.d...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.H.T.T.r.a.c.k.#.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.H.T.T.r.a.c.k.\.c.o.p.y.i.n.g.........$..................C..B..g..(.#....`.......X.......347688...........hT..CrF.f4... .p.T..b...,.......hT..CrF.f4... .p.T..b...,..................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.2.........9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinHTTrack\greetings.txt.lnk

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Archive, ctime=Thu Sep 8 02:07:23 2022, mtime=Wed Jul 3 15:51:34 2024, atime=Thu Sep 8 02:07:23 2022, length=201216, window=hide
    Category:dropped
    Size (bytes):976
    Entropy (8bit):4.601046176671073
    Encrypted:false
    SSDEEP:24:8HE+DsBqtCAbnCRN+Bdekxdexb2bI7LmLMqyFm:8HXs4thbC6dekxdetEG8VyF
    MD5:D8F333BE7264F66A901C660D912393CD
    SHA1:26E9653B2F86BCE398493ABC2673FC7AB42E8D58
    SHA-256:D4ED63FADFA144FFBD4044119DAF5179891996F0A75409774219D5AC9C1D908E
    SHA-512:DE898A36C0524CE8FE9A37267CDCE236D563D3596FF7BB48DCDD1F7477F5ABD5C88749D4DFC2262128AAB1355F5E147A40FF70ADB38B5660EF17EFADA51D74F2
    Malicious:false
    Preview:L..................F.... .......0...ZfiCi...z...0................................P.O. .:i.....+00.../C:\...................V.1.....DWP`..Windows.@......OwH.X`.....3.....................{Y..W.i.n.d.o.w.s.....b.2.....(U.. .notepad.exe.H......(U...Xr.....)...........p...........[.n.o.t.e.p.a.d...e.x.e.......E...............-.......D.............lx.....C:\Windows\notepad.exe....g.r.e.e.t.i.n.g.s...t.x.t.%.....\.....\.....\.....\.....\.....\.W.i.n.d.o.w.s.\.n.o.t.e.p.a.d...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.H.T.T.r.a.c.k.).C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.H.T.T.r.a.c.k.\.g.r.e.e.t.i.n.g.s...t.x.t.........$..................C..B..g..(.#....`.......X.......347688...........hT..CrF.f4... .p.T..b...,.......hT..CrF.f4... .p.T..b...,..................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.2.........9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinHTTrack\history.txt.lnk

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Archive, ctime=Thu Sep 8 02:07:23 2022, mtime=Wed Jul 3 15:51:34 2024, atime=Thu Sep 8 02:07:23 2022, length=201216, window=hide
    Category:dropped
    Size (bytes):968
    Entropy (8bit):4.614396554786452
    Encrypted:false
    SSDEEP:24:8EE+DsBqtCAFFURN+BdeC7deN2bI7LmLMqyFm:8EXs4thk6deC7deNEG8VyF
    MD5:0A28C410E15CCE7C8EFBA2E7E1B4A493
    SHA1:C96F5587B86353378544DB99C535CFD4DACE5069
    SHA-256:F2A31437C6160744CD4B28C6BE70288B09DB0345C1419F948184850B09DA774B
    SHA-512:0BCEF2B5352F22345DE85D3DE289A8E68DDD9672435E0CEB7B0598EFB34BCCF1AFFEAEE61429254E20A2401014F1A1D59B543F24B27C1AF794E61AE138F67663
    Malicious:false
    Preview:L..................F.... .......0...=.gCi...z...0................................P.O. .:i.....+00.../C:\...................V.1.....DWP`..Windows.@......OwH.X`.....3.....................{Y..W.i.n.d.o.w.s.....b.2.....(U.. .notepad.exe.H......(U...Xr.....)...........p...........[.n.o.t.e.p.a.d...e.x.e.......E...............-.......D.............lx.....C:\Windows\notepad.exe....h.i.s.t.o.r.y...t.x.t.%.....\.....\.....\.....\.....\.....\.W.i.n.d.o.w.s.\.n.o.t.e.p.a.d...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.H.T.T.r.a.c.k.'.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.H.T.T.r.a.c.k.\.h.i.s.t.o.r.y...t.x.t.........$..................C..B..g..(.#....`.......X.......347688...........hT..CrF.f4... .p.T..b...,.......hT..CrF.f4... .p.T..b...,..................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.2.........9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinHTTrack\license.txt.lnk

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Archive, ctime=Thu Sep 8 02:07:23 2022, mtime=Wed Jul 3 15:51:34 2024, atime=Thu Sep 8 02:07:23 2022, length=201216, window=hide
    Category:dropped
    Size (bytes):968
    Entropy (8bit):4.608199986363598
    Encrypted:false
    SSDEEP:24:8HE+DsBqtCAFdRN+BdeC7de8P2bI7LmLMqyFm:8HXs4thX6deC7de8PEG8VyF
    MD5:F86ADCD65A48C06E781DE5A1660A3216
    SHA1:6810B2A12AFB552B1853341B7391BB7DA1F529F9
    SHA-256:48C73279FCA84C26A38D15F4920F5A62341B9551016E94127796C862330CB409
    SHA-512:548EB95CC818BD06805172E7983B9ADDD9036CDA03335A44BC1E39E73BC39766805DC93C065DEEA1152823108EE597E5148FBFD98B1925BA4FB0967BC34EA99B
    Malicious:false
    Preview:L..................F.... .......0...ZfiCi...z...0................................P.O. .:i.....+00.../C:\...................V.1.....DWP`..Windows.@......OwH.X`.....3.....................{Y..W.i.n.d.o.w.s.....b.2.....(U.. .notepad.exe.H......(U...Xr.....)...........p...........[.n.o.t.e.p.a.d...e.x.e.......E...............-.......D.............lx.....C:\Windows\notepad.exe....l.i.c.e.n.s.e...t.x.t.%.....\.....\.....\.....\.....\.....\.W.i.n.d.o.w.s.\.n.o.t.e.p.a.d...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.H.T.T.r.a.c.k.'.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.H.T.T.r.a.c.k.\.l.i.c.e.n.s.e...t.x.t.........$..................C..B..g..(.#....`.......X.......347688...........hT..CrF.f4... .p.T..b...,.......hT..CrF.f4... .p.T..b...,..................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.2.........9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinHTTrack\readme.lnk

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Archive, ctime=Thu Sep 8 02:07:23 2022, mtime=Wed Oct 4 11:00:16 2023, atime=Thu Sep 8 02:07:23 2022, length=201216, window=hide
    Category:dropped
    Size (bytes):948
    Entropy (8bit):4.645499815235041
    Encrypted:false
    SSDEEP:24:8dE+DsB69CAXh+Bdebdeuut2bI7LmLMqyFm:8dXsM9hAdebdeuutEG8VyF
    MD5:037FDCB5F2BC45ECF5C1D2404631916F
    SHA1:2378589951794340A69DE983D224E04ADBBC6DD4
    SHA-256:45E3761FAC66A1B9A31DE0AD981F8EFA3D6F02BE90E64564843855A045382EF3
    SHA-512:97D2FD80A5D88A661826159BFD06EE29C1C0B43B9CABAFC5BD4ACD4AAAFE556F628E2F5A5397B0955A18BCF9F9796265B2D616754A7B3E0E0A362E707AE3287D
    Malicious:false
    Preview:L..................F.... .......0......V....z...0................................P.O. .:i.....+00.../C:\...................V.1.....DWP`..Windows.@......OwH.X`.....3.....................{Y..W.i.n.d.o.w.s.....b.2.....(U.. .notepad.exe.H......(U..(U......).......................[.n.o.t.e.p.a.d...e.x.e.......E...............-.......D.............lx.....C:\Windows\notepad.exe....R.E.A.D.M.E.%.....\.....\.....\.....\.....\.....\.W.i.n.d.o.w.s.\.n.o.t.e.p.a.d...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.H.T.T.r.a.c.k.".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.H.T.T.r.a.c.k.\.r.e.a.d.m.e.........$..................C..B..g..(.#....`.......X.......347688...........hT..CrF.f4... .p.T..b...,.......hT..CrF.f4... .p.T..b...,..................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.2.........9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

    C:\Users\user\AppData\Local\Temp\is-79SP6.tmp\_isetup\_setup64.tmp

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:PE32+ executable (console) x86-64, for MS Windows
    Category:dropped
    Size (bytes):6144
    Entropy (8bit):4.363359036723334
    Encrypted:false
    SSDEEP:48:SvrzfWvPcXegCPUo1vlZQrAxoONfHFZONfH3d1xCWMBFNL2piSS4k+bkg6j0KHc:+fkcXegaJ/ZAYNzcld1xaX12pTSKvkc
    MD5:526426126AE5D326D0A24706C77D8C5C
    SHA1:68BAEC323767C122F74A269D3AA6D49EB26903DB
    SHA-256:B20A8D88C550981137ED831F2015F5F11517AEB649C29642D9D61DEA5EBC37D1
    SHA-512:A2D824FB08BF0B2B2CC0B5E4AF8B13D5BC752EA0D195C6D40FD72AEC05360A3569EADE1749BDAC81CFB075112D0D3CD030D40F629DAF7ABCC243F9D8DCA8BFBE
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 0%
    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`..............................................................<!.......P.......@..0.................................................................... ...............................text............................... ..`.rdata..|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc........P......................@..@................................................................................................................................................................................................................................................................................................................................

    C:\Users\user\AppData\Local\Temp\is-79SP6.tmp\_isetup\_shfoldr.dll

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
    Category:dropped
    Size (bytes):23312
    Entropy (8bit):4.596242908851566
    Encrypted:false
    SSDEEP:384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
    MD5:92DC6EF532FBB4A5C3201469A5B5EB63
    SHA1:3E89FF837147C16B4E41C30D6C796374E0B8E62C
    SHA-256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
    SHA-512:9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 0%
    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

    C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp

    Download File
    Process:C:\Users\user\Desktop\httrack_x64-3.49.2.exe
    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
    Category:dropped
    Size (bytes):718008
    Entropy (8bit):6.534479221871629
    Encrypted:false
    SSDEEP:12288:NQszP8NRMXpc/rPx37/zHBA66pE+4p1YR71CERdH6rN9by7HaOMeImx9M8:NQQP8YXpc/rPx37/zHBA6plp+51CErzt
    MD5:BE92B50BF16F68E185DF0AD85936EE03
    SHA1:11FD2A8CB8744540DD5257F7A9F22AA2C7BB4DE3
    SHA-256:8114CFC2B266A56C9A98911A5EFA603E967838227B519F35E573182E49470B16
    SHA-512:C24F552DE5136BB9F8836B26D9690534B6EE23A1D9CFC4099C1A9681A57358221613D00B595F05A7B278C42B1EFA747259700B35D7E056DEE38E45905F2FBE55
    Malicious:false
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 2%
    Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................T...................@.................................1 ...........@...............................%...........................0............................... ......................................................CODE....,........................... ..`DATA................................@...BSS......................................idata...%.......&..................@....tls.....................................rdata....... ......................@..P.reloc..(....0......................@..P.rsrc...............................@..P.....................Z..............@..P........................................................................................................................................

    C:\Users\user\Desktop\HTTrack Website Copier.lnk

    Download File
    Process:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Jul 3 15:51:33 2024, mtime=Wed Jul 3 15:51:34 2024, atime=Sat May 20 13:55:32 2017, length=683592, window=hide
    Category:dropped
    Size (bytes):877
    Entropy (8bit):4.57441393216498
    Encrypted:false
    SSDEEP:24:8mDFvc3dARkZBl6JdAs2XEBXEYdeOcdeWbLGLEBm:8mJEdGkZBl6JWswEhEYdeOcdeIcm
    MD5:CDB4C23A4409572A80B5B58B5D76310F
    SHA1:51257435EDEA4800276304C9656B5D2440CDDE75
    SHA-256:7827B9A8E639B95C11C9C141152AA5C6F67CD690062A99B55209E1E1A3DBC014
    SHA-512:6E9EF5990D6CC16AB5627F74A3414629466ABFC4318FDD512E9A0955538E7A5EF27C22DB75E3A3DB8B7BB5E7DF9F161D3BCCCFD68315F98BC3B3D5A1E672101F
    Malicious:false
    Preview:L..................F.... ....W.Bi....T7Ci...... y...Hn...........................P.O. .:i.....+00.../C:\.....................1......Xp...PROGRA~1..t......O.I.Xr.....B...............J.....H...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....^.1......Xr...WINHTT~1..F.......Xp..Xr.....Y.......................).W.i.n.H.T.T.r.a.c.k.....j.2.Hn...J.v .WINHTT~1.EXE..N.......Xq..Xr......H........................W.i.n.H.T.T.r.a.c.k...e.x.e.......Y...............-.......X.............lx.....C:\Program Files\WinHTTrack\WinHTTrack.exe..0.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.H.T.T.r.a.c.k.\.W.i.n.H.T.T.r.a.c.k...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.H.T.T.r.a.c.k.`.......X.......347688...........hT..CrF.f4... ...T..b...,.......hT..CrF.f4... ...T..b...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

    Static File Info

    General

    File type:PE32 executable (GUI) Intel 80386, for MS Windows
    Entropy (8bit):7.9976282311469635
    TrID:
    • Win32 Executable (generic) a (10002005/4) 98.73%
    • Inno Setup installer (109748/4) 1.08%
    • Windows Screen Saver (13104/52) 0.13%
    • Win16/32 Executable Delphi generic (2074/23) 0.02%
    • Generic Win/DOS Executable (2004/3) 0.02%
    File name:httrack_x64-3.49.2.exe
    File size:4'513'224 bytes
    MD5:2e1d04910dfaa3170b66b94b9d44d56a
    SHA1:019b8b956910529218e92f2a92b14cd159e82095
    SHA256:ce12f0e0cd3a3807463c8c538808d613798b11d961a94eabf0ba9d67851106f3
    SHA512:ebf16f8d687b4dd409cf8d5ef912623161a0b2023c345d319b93ded02e5d2e5acc4cd8d8b9615a2d2b60493591a4faa5559e9f24bc994b46413d0a10dc85931d
    SSDEEP:98304:70YG38ZLNIgYD36wDnXpDrmAIjd7p/sFFbOoFc/0kBtLCO3u4Sn46xoVuJ78J+zK:8WAAb0r5mQd5dx8
    TLSH:662633E1FA5685F2E5D10F340F961DB531AAA5A1DCAC241F7BCCCE9F0D4B2C88E112A5
    File Content Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

    File Icon

    Icon Hash:7979390139797979

    Static PE Info

    General

    Entrypoint:0x40a5f8
    Entrypoint Section:CODE
    Digitally signed:true
    Imagebase:0x400000
    Subsystem:windows gui
    Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
    DLL Characteristics:TERMINAL_SERVER_AWARE
    Time Stamp:0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
    TLS Callbacks:
    CLR (.Net) Version:
    OS Version Major:1
    OS Version Minor:0
    File Version Major:1
    File Version Minor:0
    Subsystem Version Major:1
    Subsystem Version Minor:0
    Import Hash:884310b1928934402ea6fec1dbd3cf5e

    Authenticode Signature

    Signature Valid:true
    Signature Issuer:CN=Certum Code Signing CA SHA2, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL
    Signature Validation Error:The operation completed successfully
    Error Number:0
    Not Before, Not After
    • 09/09/2016 01:00:00 09/09/2017 01:00:00
    Subject Chain
    • E=roche@httrack.com, CN="Open Source Developer, Xavier Roche", O=Open Source Developer, C=FR
    Version:3
    Thumbprint MD5:66D560943930381C865335D1FDB66BD1
    Thumbprint SHA-1:044F3F9DA0A78219CC676249BB0B3F264402E519
    Thumbprint SHA-256:AE7C672412DD2634CA98FD08793C880150F847C726F00EF14CDB5DBB8372AEA3
    Serial:0304E53E0F9B762F0EEB0F5F7E3B549D

    Entrypoint Preview

    Instruction
    push ebp
    mov ebp, esp
    add esp, FFFFFFC4h
    push ebx
    push esi
    push edi
    xor eax, eax
    mov dword ptr [ebp-10h], eax
    mov dword ptr [ebp-24h], eax
    call 00007F5FACB6B763h
    call 00007F5FACB6C96Ah
    call 00007F5FACB6CBF9h
    call 00007F5FACB6CC9Ch
    call 00007F5FACB6EC3Bh
    call 00007F5FACB715A6h
    call 00007F5FACB7170Dh
    xor eax, eax
    push ebp
    push 0040ACC9h
    push dword ptr fs:[eax]
    mov dword ptr fs:[eax], esp
    xor edx, edx
    push ebp
    push 0040AC92h
    push dword ptr fs:[edx]
    mov dword ptr fs:[edx], esp
    mov eax, dword ptr [0040C014h]
    call 00007F5FACB721BBh
    call 00007F5FACB71DA6h
    cmp byte ptr [0040B234h], 00000000h
    je 00007F5FACB72C9Eh
    call 00007F5FACB722B8h
    xor eax, eax
    call 00007F5FACB6C459h
    lea edx, dword ptr [ebp-10h]
    xor eax, eax
    call 00007F5FACB6F24Bh
    mov edx, dword ptr [ebp-10h]
    mov eax, 0040CE28h
    call 00007F5FACB6B7FAh
    push 00000002h
    push 00000000h
    push 00000001h
    mov ecx, dword ptr [0040CE28h]
    mov dl, 01h
    mov eax, 0040738Ch
    call 00007F5FACB6FADAh
    mov dword ptr [0040CE2Ch], eax
    xor edx, edx
    push ebp
    push 0040AC4Ah
    push dword ptr fs:[edx]
    mov dword ptr fs:[edx], esp
    call 00007F5FACB72216h
    mov dword ptr [0040CE34h], eax
    mov eax, dword ptr [0040CE34h]
    cmp dword ptr [eax+0Ch], 00000000h

    Data Directories

    NameVirtual AddressVirtual Size Is in Section
    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
    IMAGE_DIRECTORY_ENTRY_IMPORT0xd0000x950.idata
    IMAGE_DIRECTORY_ENTRY_RESOURCE0x110000x38d8.rsrc
    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
    IMAGE_DIRECTORY_ENTRY_SECURITY0x44c5100x18b8
    IMAGE_DIRECTORY_ENTRY_BASERELOC0x100000x0.reloc
    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
    IMAGE_DIRECTORY_ENTRY_TLS0xf0000x18.rdata
    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
    IMAGE_DIRECTORY_ENTRY_IAT0x00x0
    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

    Sections

    NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
    CODE0x10000x9d300x9e00c3bd95c4b1a8e5199981e0d9b45fd18cFalse0.6052709651898734data6.631765876950794IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
    DATA0xb0000x2500x4001ee71d84f1c77af85f1f5c278f880572False0.306640625data2.751820662285145IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
    BSS0xc0000xe8c0x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
    .idata0xd0000x9500xa00bb5485bf968b970e5ea81292af2acdbaFalse0.414453125data4.430733069799036IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
    .tls0xe0000x80x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
    .rdata0xf0000x180x2009ba824905bf9c7922b6fc87a38b74366False0.052734375data0.2044881574398449IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
    .reloc0x100000x8c40x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
    .rsrc0x110000x38d80x3a0025dbb156aa255a15f7c1bbdd0c3a52abFalse0.26320043103448276data4.644718194501147IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

    Resources

    NameRVASizeTypeLanguageCountryZLIB Complexity
    RT_ICON0x113540x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1152EnglishUnited States0.2815884476534296
    RT_ICON0x11bfc0xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2688EnglishUnited States0.3640724946695096
    RT_ICON0x12aa40x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 640EnglishUnited States0.11424731182795698
    RT_ICON0x12d8c0x568Device independent bitmap graphic, 16 x 32 x 8, image size 320EnglishUnited States0.44147398843930635
    RT_STRING0x132f40x2f2data0.35543766578249336
    RT_STRING0x135e80x30cdata0.3871794871794872
    RT_STRING0x138f40x2cedata0.42618384401114207
    RT_STRING0x13bc40x68data0.75
    RT_STRING0x13c2c0xb4data0.6277777777777778
    RT_STRING0x13ce00xaedata0.5344827586206896
    RT_RCDATA0x13d900x2cdata1.2045454545454546
    RT_GROUP_ICON0x13dbc0x3edataEnglishUnited States0.8064516129032258
    RT_VERSION0x13dfc0x4f4dataEnglishUnited States0.2823343848580442
    RT_MANIFEST0x142f00x5e8XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.4252645502645503

    Imports

    DLLImport
    kernel32.dllDeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, WideCharToMultiByte, TlsSetValue, TlsGetValue, MultiByteToWideChar, GetModuleHandleA, GetLastError, GetCommandLineA, WriteFile, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetSystemTime, GetFileType, ExitProcess, CreateFileA, CloseHandle
    user32.dllMessageBoxA
    oleaut32.dllVariantChangeTypeEx, VariantCopyInd, VariantClear, SysStringLen, SysAllocStringLen
    advapi32.dllRegQueryValueExA, RegOpenKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA
    kernel32.dllWriteFile, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, Sleep, SizeofResource, SetLastError, SetFilePointer, SetErrorMode, SetEndOfFile, RemoveDirectoryA, ReadFile, LockResource, LoadResource, LoadLibraryA, IsDBCSLeadByte, GetWindowsDirectoryA, GetVersionExA, GetUserDefaultLangID, GetSystemInfo, GetSystemDefaultLCID, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeProcess, GetEnvironmentVariableA, GetCurrentProcess, GetCommandLineA, GetACP, InterlockedExchange, FormatMessageA, FindResourceA, DeleteFileA, CreateProcessA, CreateFileA, CreateDirectoryA, CloseHandle
    user32.dllTranslateMessage, SetWindowLongA, PeekMessageA, MsgWaitForMultipleObjects, MessageBoxA, LoadStringA, ExitWindowsEx, DispatchMessageA, DestroyWindow, CreateWindowExA, CallWindowProcA, CharPrevA
    comctl32.dllInitCommonControls
    advapi32.dllAdjustTokenPrivileges

    Possible Origin

    Language of compilation systemCountry where language is spokenMap
    EnglishUnited States

    Network Behavior

    ⊘No network behavior found

    Statistics

    CPU Usage

    Click to jump to process

    Memory Usage

    Click to jump to process

    High Level Behavior Distribution

    Click to dive into process behavior distribution

    Behavior

    Click to jump to process

    System Behavior

    General

    Target ID:0
    Start time:12:51:02
    Start date:03/07/2024
    Path:C:\Users\user\Desktop\httrack_x64-3.49.2.exe
    Wow64 process (32bit):true
    Commandline:"C:\Users\user\Desktop\httrack_x64-3.49.2.exe"
    Imagebase:0x400000
    File size:4'513'224 bytes
    MD5 hash:2E1D04910DFAA3170B66B94B9D44D56A
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Reputation:low
    Has exited:true

    General

    Target ID:1
    Start time:12:51:02
    Start date:03/07/2024
    Path:C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp
    Wow64 process (32bit):true
    Commandline:"C:\Users\user\AppData\Local\Temp\is-HM2BO.tmp\httrack_x64-3.49.2.tmp" /SL5="$20412,4225024,60416,C:\Users\user\Desktop\httrack_x64-3.49.2.exe"
    Imagebase:0x400000
    File size:718'008 bytes
    MD5 hash:BE92B50BF16F68E185DF0AD85936EE03
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Antivirus matches:
    • Detection: 2%, ReversingLabs
    Reputation:low
    Has exited:true

    General

    Target ID:6
    Start time:12:51:35
    Start date:03/07/2024
    Path:C:\Program Files\WinHTTrack\WinHTTrack.exe
    Wow64 process (32bit):false
    Commandline:"C:\Program Files\WinHTTrack\WinHTTrack.exe"
    Imagebase:0x140000000
    File size:683'592 bytes
    MD5 hash:1222165410734DB4A128E0B6F37EB89C
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Reputation:low
    Has exited:false

    General

    Target ID:7
    Start time:12:51:36
    Start date:03/07/2024
    Path:C:\Windows\System32\notepad.exe
    Wow64 process (32bit):false
    Commandline:"C:\Windows\notepad.exe" C:\Program Files\WinHTTrack\history.txt
    Imagebase:0x7ff7c9fc0000
    File size:201'216 bytes
    MD5 hash:27F71B12CB585541885A31BE22F61C83
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Reputation:moderate
    Has exited:false

    Disassembly

    Reset < >

      Execution Graph

      Execution Coverage:23.2%
      Dynamic/Decrypted Code Coverage:0%
      Signature Coverage:2.4%
      Total number of Nodes:1471
      Total number of Limit Nodes:21
      execution_graph 5306 407548 5307 407554 CloseHandle 5306->5307 5308 40755d 5306->5308 5307->5308 6694 402b48 RaiseException 5309 407749 5310 4076dc WriteFile 5309->5310 5315 407724 5309->5315 5311 4076e8 5310->5311 5312 4076ef 5310->5312 5313 40748c 35 API calls 5311->5313 5314 407700 5312->5314 5316 4073ec 34 API calls 5312->5316 5313->5312 5315->5309 5317 4077e0 5315->5317 5316->5314 5318 4078db InterlockedExchange 5317->5318 5320 407890 5317->5320 5319 4078e7 5318->5319 6695 40294a 6696 402952 6695->6696 6697 402967 6696->6697 6698 403554 4 API calls 6696->6698 6698->6696 6699 403f4a 6700 403f53 6699->6700 6701 403f5c 6699->6701 6702 403f07 4 API calls 6700->6702 6702->6701 5332 40ac4f 5333 40abc1 5332->5333 5336 40abed 5333->5336 5344 4094d8 5333->5344 5335 40ac06 5337 40ac1a 5335->5337 5338 40ac0f DestroyWindow 5335->5338 5336->5335 5339 40ac00 RemoveDirectoryA 5336->5339 5340 40ac42 5337->5340 5352 40357c 5337->5352 5338->5337 5339->5335 5342 40ac38 5343 4025ac 4 API calls 5342->5343 5343->5340 5345 409532 5344->5345 5349 4094eb 5344->5349 5345->5336 5346 4094f3 Sleep 5346->5349 5347 409503 Sleep 5347->5349 5349->5345 5349->5346 5349->5347 5350 40951a GetLastError 5349->5350 5365 408fbc 5349->5365 5350->5345 5351 409524 GetLastError 5350->5351 5351->5345 5351->5349 5355 403591 5352->5355 5361 4035a0 5352->5361 5353 4035b1 5356 403198 4 API calls 5353->5356 5354 4035b8 5357 4031b8 4 API calls 5354->5357 5358 4035d0 5355->5358 5359 40359b 5355->5359 5360 4035b6 5355->5360 5356->5360 5357->5360 5358->5360 5363 40357c 4 API calls 5358->5363 5359->5361 5362 4035ec 5359->5362 5360->5342 5361->5353 5361->5354 5362->5360 5382 403554 5362->5382 5363->5358 5373 408f70 5365->5373 5367 408fd2 5368 408fd6 5367->5368 5369 408ff2 DeleteFileA GetLastError 5367->5369 5368->5349 5370 409010 5369->5370 5379 408fac 5370->5379 5374 408f7a 5373->5374 5375 408f7e 5373->5375 5374->5367 5376 408fa0 SetLastError 5375->5376 5377 408f87 Wow64DisableWow64FsRedirection 5375->5377 5378 408f9b 5376->5378 5377->5378 5378->5367 5380 408fb1 Wow64RevertWow64FsRedirection 5379->5380 5381 408fbb 5379->5381 5380->5381 5381->5349 5383 403566 5382->5383 5385 403578 5383->5385 5386 403604 5383->5386 5385->5362 5387 40357c 5386->5387 5392 40359b 5387->5392 5393 4035d0 5387->5393 5394 4035a0 5387->5394 5398 4035b6 5387->5398 5388 4035b1 5390 403198 4 API calls 5388->5390 5389 4035b8 5391 4031b8 4 API calls 5389->5391 5390->5398 5391->5398 5392->5394 5395 4035ec 5392->5395 5396 40357c 4 API calls 5393->5396 5393->5398 5394->5388 5394->5389 5397 403554 4 API calls 5395->5397 5395->5398 5396->5393 5397->5395 5398->5383 6243 403a52 6244 403a74 6243->6244 6245 403a5a WriteFile 6243->6245 6245->6244 6246 403a78 GetLastError 6245->6246 6246->6244 6247 402654 6248 403154 4 API calls 6247->6248 6249 402614 6248->6249 6250 402632 6249->6250 6251 403154 4 API calls 6249->6251 6250->6250 6251->6250 6252 40ac56 6253 40ac5d 6252->6253 6255 40ac88 6252->6255 6262 409448 6253->6262 6257 403198 4 API calls 6255->6257 6256 40ac62 6256->6255 6259 40ac80 MessageBoxA 6256->6259 6258 40acc0 6257->6258 6260 403198 4 API calls 6258->6260 6259->6255 6261 40acc8 6260->6261 6263 409454 GetCurrentProcess OpenProcessToken 6262->6263 6264 4094af ExitWindowsEx 6262->6264 6265 409466 6263->6265 6266 40946a LookupPrivilegeValueA AdjustTokenPrivileges GetLastError 6263->6266 6264->6265 6265->6256 6266->6264 6266->6265 6711 40995e 6713 409960 6711->6713 6712 409982 6713->6712 6714 40999e CallWindowProcA 6713->6714 6714->6712 6715 409960 6716 409982 6715->6716 6718 40996f 6715->6718 6717 40999e CallWindowProcA 6717->6716 6718->6716 6718->6717 6719 405160 6720 405173 6719->6720 6721 404e58 33 API calls 6720->6721 6722 405187 6721->6722 6267 402e64 6268 402e69 6267->6268 6269 402e7a RtlUnwind 6268->6269 6270 402e5e 6268->6270 6271 402e9d 6269->6271 5321 40766c SetFilePointer 5322 4076a3 5321->5322 5323 407693 GetLastError 5321->5323 5323->5322 5324 40769c 5323->5324 5325 40748c 35 API calls 5324->5325 5325->5322 6284 40667c IsDBCSLeadByte 6285 406694 6284->6285 6735 403f7d 6736 403fa2 6735->6736 6739 403f84 6735->6739 6738 403e8e 4 API calls 6736->6738 6736->6739 6737 403f8c 6738->6739 6739->6737 6740 402674 4 API calls 6739->6740 6741 403fca 6740->6741 4979 403d02 4985 403d12 4979->4985 4980 403ddf ExitProcess 4981 403db8 4995 403cc8 4981->4995 4983 403dea 4985->4980 4985->4981 4985->4983 4985->4985 4989 403da4 4985->4989 4990 403d8f MessageBoxA 4985->4990 4986 403cc8 4 API calls 4987 403dcc 4986->4987 4999 4019dc 4987->4999 5011 403fe4 4989->5011 4990->4981 4991 403dd1 4991->4980 4991->4983 4996 403cd6 4995->4996 4998 403ceb 4996->4998 5015 402674 4996->5015 4998->4986 5000 401abb 4999->5000 5001 4019ed 4999->5001 5000->4991 5002 401a04 RtlEnterCriticalSection 5001->5002 5003 401a0e LocalFree 5001->5003 5002->5003 5004 401a41 5003->5004 5005 401a2f VirtualFree 5004->5005 5006 401a49 5004->5006 5005->5004 5007 401a70 LocalFree 5006->5007 5008 401a87 5006->5008 5007->5007 5007->5008 5009 401aa9 RtlDeleteCriticalSection 5008->5009 5010 401a9f RtlLeaveCriticalSection 5008->5010 5009->4991 5010->5009 5012 403fe8 5011->5012 5031 403f07 5012->5031 5014 404006 5018 403154 5015->5018 5017 40267a 5017->4998 5019 403164 5018->5019 5020 40318c TlsGetValue 5018->5020 5019->5017 5021 403196 5020->5021 5022 40316f 5020->5022 5021->5017 5026 40310c 5022->5026 5024 403174 TlsGetValue 5025 403184 5024->5025 5025->5017 5027 403120 LocalAlloc 5026->5027 5028 403116 5026->5028 5029 40313e TlsSetValue 5027->5029 5030 403132 5027->5030 5028->5027 5029->5030 5030->5024 5034 403f09 5031->5034 5033 403f3c 5033->5014 5035 403154 4 API calls 5034->5035 5037 403e9c 5034->5037 5040 403f3d 5034->5040 5054 403e9c 5034->5054 5035->5034 5036 403ef2 5039 402674 4 API calls 5036->5039 5037->5033 5037->5036 5042 403ea9 5037->5042 5045 403e8e 5037->5045 5044 403ecf 5039->5044 5040->5014 5043 402674 4 API calls 5042->5043 5042->5044 5043->5044 5044->5014 5046 403e4c 5045->5046 5047 403e62 5046->5047 5048 403e7b 5046->5048 5050 403e67 5046->5050 5049 403cc8 4 API calls 5047->5049 5051 402674 4 API calls 5048->5051 5049->5050 5052 403e78 5050->5052 5053 402674 4 API calls 5050->5053 5051->5052 5052->5036 5052->5042 5053->5052 5055 403ed7 5054->5055 5061 403ea9 5054->5061 5056 403ef2 5055->5056 5058 403e8e 4 API calls 5055->5058 5059 402674 4 API calls 5056->5059 5057 403ecf 5057->5034 5060 403ee6 5058->5060 5059->5057 5060->5056 5060->5061 5061->5057 5062 402674 4 API calls 5061->5062 5062->5057 6290 404206 6291 4041cc 6290->6291 6294 40420a 6290->6294 6292 404282 6293 403154 4 API calls 6295 404323 6293->6295 6294->6292 6294->6293 6296 402c08 6297 402c82 6296->6297 6300 402c19 6296->6300 6298 402c56 RtlUnwind 6299 403154 4 API calls 6298->6299 6299->6297 6300->6297 6300->6298 6303 402b28 6300->6303 6304 402b31 RaiseException 6303->6304 6305 402b47 6303->6305 6304->6305 6305->6298 6306 408c10 6307 408c17 6306->6307 6308 403198 4 API calls 6307->6308 6316 408cb1 6308->6316 6309 408cdc 6310 4031b8 4 API calls 6309->6310 6311 408d69 6310->6311 6312 408cc8 6314 4032fc 18 API calls 6312->6314 6313 403278 18 API calls 6313->6316 6314->6309 6315 4032fc 18 API calls 6315->6316 6316->6309 6316->6312 6316->6313 6316->6315 6321 40a814 6322 40a839 6321->6322 6323 40993c 29 API calls 6322->6323 6326 40a83e 6323->6326 6324 40a891 6355 4026c4 GetSystemTime 6324->6355 6326->6324 6329 408dd8 18 API calls 6326->6329 6327 40a896 6328 409330 46 API calls 6327->6328 6330 40a89e 6328->6330 6331 40a86d 6329->6331 6332 4031e8 18 API calls 6330->6332 6335 40a875 MessageBoxA 6331->6335 6333 40a8ab 6332->6333 6334 406928 19 API calls 6333->6334 6336 40a8b8 6334->6336 6335->6324 6337 40a882 6335->6337 6338 4066c0 19 API calls 6336->6338 6339 405864 19 API calls 6337->6339 6340 40a8c8 6338->6340 6339->6324 6341 406638 19 API calls 6340->6341 6342 40a8d9 6341->6342 6343 403340 18 API calls 6342->6343 6344 40a8e7 6343->6344 6345 4031e8 18 API calls 6344->6345 6346 40a8f7 6345->6346 6347 4074e0 37 API calls 6346->6347 6348 40a936 6347->6348 6349 402594 18 API calls 6348->6349 6350 40a956 6349->6350 6351 407a28 19 API calls 6350->6351 6352 40a998 6351->6352 6353 407cb8 35 API calls 6352->6353 6354 40a9bf 6353->6354 6355->6327 5989 407017 5990 407008 SetErrorMode 5989->5990 6356 403018 6357 403070 6356->6357 6358 403025 6356->6358 6359 40302a RtlUnwind 6358->6359 6360 40304e 6359->6360 6362 402f78 6360->6362 6363 402be8 6360->6363 6364 402bf1 RaiseException 6363->6364 6365 402c04 6363->6365 6364->6365 6365->6357 6370 40901e 6371 409010 6370->6371 6372 408fac Wow64RevertWow64FsRedirection 6371->6372 6373 409018 6372->6373 6374 409020 SetLastError 6375 409029 6374->6375 6390 403a28 ReadFile 6391 403a46 6390->6391 6392 403a49 GetLastError 6390->6392 5326 40762c ReadFile 5327 407663 5326->5327 5328 40764c 5326->5328 5329 407652 GetLastError 5328->5329 5330 40765c 5328->5330 5329->5327 5329->5330 5331 40748c 35 API calls 5330->5331 5331->5327 6752 40712e 6753 407118 6752->6753 6754 403198 4 API calls 6753->6754 6755 407120 6754->6755 6756 403198 4 API calls 6755->6756 6757 407128 6756->6757 5399 40a82f 5436 409ae8 5399->5436 5401 40a834 5402 40a839 5401->5402 5526 402f24 5401->5526 5443 40993c 5402->5443 5405 40a891 5448 4026c4 GetSystemTime 5405->5448 5407 40a83e 5407->5405 5531 408dd8 5407->5531 5408 40a896 5449 409330 5408->5449 5412 40a86d 5416 40a875 MessageBoxA 5412->5416 5413 4031e8 18 API calls 5414 40a8ab 5413->5414 5467 406928 5414->5467 5416->5405 5418 40a882 5416->5418 5534 405864 5418->5534 5423 40a8d9 5494 403340 5423->5494 5425 40a8e7 5426 4031e8 18 API calls 5425->5426 5427 40a8f7 5426->5427 5509 4074e0 5427->5509 5430 402594 18 API calls 5431 40a956 5430->5431 5516 407a28 5431->5516 5433 40a998 5538 407cb8 5433->5538 5435 40a9bf 5437 409af1 5436->5437 5438 409b09 5436->5438 5439 405890 18 API calls 5437->5439 5440 405890 18 API calls 5438->5440 5441 409b03 5439->5441 5442 409b1a 5440->5442 5441->5401 5442->5401 5544 40953c 5443->5544 5448->5408 5458 409350 5449->5458 5452 409375 CreateDirectoryA 5453 4093ed 5452->5453 5454 40937f GetLastError 5452->5454 5455 40322c 4 API calls 5453->5455 5454->5458 5456 4093f7 5455->5456 5459 4031b8 4 API calls 5456->5459 5457 408dd8 18 API calls 5457->5458 5458->5452 5458->5457 5463 407284 19 API calls 5458->5463 5466 405890 18 API calls 5458->5466 5664 406cf4 5458->5664 5687 409224 5458->5687 5706 404c94 5458->5706 5709 408da8 5458->5709 5461 409411 5459->5461 5462 4031b8 4 API calls 5461->5462 5464 40941e 5462->5464 5463->5458 5464->5413 5466->5458 5818 406820 5467->5818 5470 403454 18 API calls 5471 40694a 5470->5471 5472 4066c0 5471->5472 5823 4068e4 5472->5823 5475 4066f0 5477 403340 18 API calls 5475->5477 5476 4066fe 5478 403454 18 API calls 5476->5478 5480 4066fc 5477->5480 5479 406711 5478->5479 5481 403340 18 API calls 5479->5481 5482 403198 4 API calls 5480->5482 5481->5480 5483 406733 5482->5483 5484 406638 5483->5484 5485 406642 5484->5485 5486 406665 5484->5486 5829 406950 5485->5829 5488 40322c 4 API calls 5486->5488 5490 40666e 5488->5490 5489 406649 5489->5486 5491 406654 5489->5491 5490->5423 5492 403340 18 API calls 5491->5492 5493 406662 5492->5493 5493->5423 5495 403344 5494->5495 5498 4033a5 5494->5498 5496 4031e8 5495->5496 5497 40334c 5495->5497 5501 403254 18 API calls 5496->5501 5504 4031fc 5496->5504 5497->5498 5500 40335b 5497->5500 5502 4031e8 18 API calls 5497->5502 5499 403228 5499->5425 5503 403254 18 API calls 5500->5503 5501->5504 5502->5500 5506 403375 5503->5506 5504->5499 5505 4025ac 4 API calls 5504->5505 5505->5499 5507 4031e8 18 API calls 5506->5507 5508 4033a1 5507->5508 5508->5425 5510 4074ea 5509->5510 5835 407576 5510->5835 5838 407578 5510->5838 5511 407516 5512 40752a 5511->5512 5513 40748c 35 API calls 5511->5513 5512->5430 5513->5512 5517 407a35 5516->5517 5518 405890 18 API calls 5517->5518 5519 407a89 5517->5519 5518->5519 5520 407918 InterlockedExchange 5519->5520 5521 407a9b 5520->5521 5522 405890 18 API calls 5521->5522 5523 407ab1 5521->5523 5522->5523 5524 405890 18 API calls 5523->5524 5525 407af4 5523->5525 5524->5525 5525->5433 5527 403154 4 API calls 5526->5527 5528 402f29 5527->5528 5841 402bcc 5528->5841 5530 402f51 5530->5530 5532 408da8 18 API calls 5531->5532 5533 408df4 5532->5533 5533->5412 5535 405869 5534->5535 5536 405940 19 API calls 5535->5536 5537 40587b 5536->5537 5537->5537 5539 407cd3 5538->5539 5541 407cc8 5538->5541 5844 407c5c 5539->5844 5541->5435 5543 405890 18 API calls 5543->5541 5551 40955b 5544->5551 5545 409590 5547 40959d GetUserDefaultLangID 5545->5547 5552 409592 5545->5552 5546 409594 5562 407024 GetModuleHandleA GetProcAddress 5546->5562 5547->5552 5550 40956f 5556 4098cc 5550->5556 5551->5545 5551->5546 5551->5550 5552->5550 5553 4095cb GetACP 5552->5553 5554 4095ef 5552->5554 5553->5550 5553->5552 5554->5550 5555 409615 GetACP 5554->5555 5555->5550 5555->5554 5557 40990e 5556->5557 5558 4098d4 5556->5558 5557->5407 5558->5557 5559 403420 18 API calls 5558->5559 5560 409908 5559->5560 5641 408e80 5560->5641 5563 407067 5562->5563 5564 40705e 5562->5564 5565 407070 5563->5565 5566 4070a8 5563->5566 5573 403198 4 API calls 5564->5573 5583 406f68 5565->5583 5567 406f68 RegOpenKeyExA 5566->5567 5571 4070c1 5567->5571 5569 407089 5570 4070de 5569->5570 5586 406f5c 5569->5586 5589 40322c 5570->5589 5571->5570 5574 406f5c 20 API calls 5571->5574 5577 407120 5573->5577 5578 4070d5 RegCloseKey 5574->5578 5580 403198 4 API calls 5577->5580 5578->5570 5582 407128 5580->5582 5582->5552 5584 406f73 5583->5584 5585 406f79 RegOpenKeyExA 5583->5585 5584->5585 5585->5569 5607 406e10 5586->5607 5591 403230 5589->5591 5590 403252 5593 4032fc 5590->5593 5591->5590 5592 4025ac 4 API calls 5591->5592 5592->5590 5594 403300 5593->5594 5595 40333f 5593->5595 5596 4031e8 5594->5596 5597 40330a 5594->5597 5595->5564 5603 403254 18 API calls 5596->5603 5604 4031fc 5596->5604 5598 403334 5597->5598 5599 40331d 5597->5599 5600 4034f0 18 API calls 5598->5600 5602 4034f0 18 API calls 5599->5602 5606 403322 5600->5606 5601 403228 5601->5564 5602->5606 5603->5604 5604->5601 5605 4025ac 4 API calls 5604->5605 5605->5601 5606->5564 5608 406e36 RegQueryValueExA 5607->5608 5609 406e59 5608->5609 5614 406e7b 5608->5614 5610 406e73 5609->5610 5609->5614 5615 403278 18 API calls 5609->5615 5624 403420 5609->5624 5612 403198 4 API calls 5610->5612 5611 403198 4 API calls 5613 406f47 RegCloseKey 5611->5613 5612->5614 5613->5570 5614->5611 5615->5609 5617 406eb0 RegQueryValueExA 5617->5608 5618 406ecc 5617->5618 5618->5614 5628 4034f0 5618->5628 5621 406f20 5622 4031e8 18 API calls 5621->5622 5622->5614 5623 403420 18 API calls 5623->5621 5625 403426 5624->5625 5627 403437 5624->5627 5626 403254 18 API calls 5625->5626 5625->5627 5626->5627 5627->5617 5629 4034fd 5628->5629 5636 40352d 5628->5636 5631 403526 5629->5631 5634 403509 5629->5634 5630 403198 4 API calls 5633 403517 5630->5633 5632 403254 18 API calls 5631->5632 5632->5636 5633->5621 5633->5623 5637 4025c4 5634->5637 5636->5630 5639 4025ca 5637->5639 5638 4025dc 5638->5633 5638->5638 5639->5638 5640 403154 4 API calls 5639->5640 5640->5638 5642 408e8e 5641->5642 5644 408ea6 5642->5644 5654 408e18 5642->5654 5645 408e18 18 API calls 5644->5645 5646 408eca 5644->5646 5645->5646 5657 407918 5646->5657 5649 408e18 18 API calls 5651 408ef8 5649->5651 5650 408e18 18 API calls 5650->5651 5651->5650 5652 403278 18 API calls 5651->5652 5653 408f27 5651->5653 5652->5651 5653->5557 5655 405890 18 API calls 5654->5655 5656 408e29 5655->5656 5656->5644 5660 4078c4 5657->5660 5661 4078d6 5660->5661 5662 4078e7 5660->5662 5663 4078db InterlockedExchange 5661->5663 5662->5649 5662->5651 5663->5662 5713 406a58 5664->5713 5668 406a58 19 API calls 5670 406d36 5668->5670 5669 406d26 5669->5668 5671 406d72 5669->5671 5672 406d42 5670->5672 5674 406a34 21 API calls 5670->5674 5721 406888 5671->5721 5672->5671 5675 406d67 5672->5675 5678 406a58 19 API calls 5672->5678 5674->5672 5675->5671 5733 406cc8 GetWindowsDirectoryA 5675->5733 5680 406d5b 5678->5680 5679 406638 19 API calls 5681 406d87 5679->5681 5680->5675 5682 406a34 21 API calls 5680->5682 5683 40322c 4 API calls 5681->5683 5682->5675 5684 406d91 5683->5684 5685 4031b8 4 API calls 5684->5685 5686 406dab 5685->5686 5686->5458 5688 409244 5687->5688 5689 406638 19 API calls 5688->5689 5690 40925d 5689->5690 5691 40322c 4 API calls 5690->5691 5698 409268 5691->5698 5693 406978 20 API calls 5693->5698 5694 408dd8 18 API calls 5694->5698 5696 405890 18 API calls 5696->5698 5698->5693 5698->5694 5698->5696 5699 4092e4 5698->5699 5775 4091b0 5698->5775 5783 4033b4 5698->5783 5789 409034 5698->5789 5700 40322c 4 API calls 5699->5700 5701 4092ef 5700->5701 5702 4031b8 4 API calls 5701->5702 5703 409309 5702->5703 5704 403198 4 API calls 5703->5704 5705 409311 5704->5705 5705->5458 5707 4051a8 33 API calls 5706->5707 5708 404cb2 5707->5708 5708->5458 5710 408dc8 5709->5710 5808 408c80 5710->5808 5714 4034f0 18 API calls 5713->5714 5716 406a6b 5714->5716 5715 406a82 GetEnvironmentVariableA 5715->5716 5717 406a8e 5715->5717 5716->5715 5720 406a95 5716->5720 5735 406dec 5716->5735 5718 403198 4 API calls 5717->5718 5718->5720 5720->5669 5730 406a34 5720->5730 5739 403414 5721->5739 5724 4068b7 5725 4068ce 5724->5725 5726 4068bf 5724->5726 5727 40322c 4 API calls 5725->5727 5728 403278 18 API calls 5726->5728 5729 4068cc 5727->5729 5728->5729 5729->5679 5741 4069dc 5730->5741 5734 406ce9 5733->5734 5734->5671 5736 406dfa 5735->5736 5737 4034f0 18 API calls 5736->5737 5738 406e08 5737->5738 5738->5716 5740 403418 GetFullPathNameA 5739->5740 5740->5724 5740->5725 5748 406978 5741->5748 5743 4069fe 5744 406a06 GetFileAttributesA 5743->5744 5745 406a1b 5744->5745 5746 403198 4 API calls 5745->5746 5747 406a23 5746->5747 5747->5669 5758 406744 5748->5758 5750 4069b0 5753 4069c6 5750->5753 5754 4069bb 5750->5754 5752 406989 5752->5750 5765 406970 CharPrevA 5752->5765 5766 403454 5753->5766 5755 40322c 4 API calls 5754->5755 5757 4069c4 5755->5757 5757->5743 5762 406755 5758->5762 5759 4067b9 5760 406680 IsDBCSLeadByte 5759->5760 5761 4067b4 5759->5761 5760->5761 5761->5752 5762->5759 5764 406773 5762->5764 5764->5761 5773 406680 IsDBCSLeadByte 5764->5773 5765->5752 5767 403486 5766->5767 5768 403459 5766->5768 5769 403198 4 API calls 5767->5769 5768->5767 5771 40346d 5768->5771 5770 40347c 5769->5770 5770->5757 5772 403278 18 API calls 5771->5772 5772->5770 5774 406694 5773->5774 5774->5764 5776 403198 4 API calls 5775->5776 5778 4091d1 5776->5778 5780 4091fe 5778->5780 5798 4032a8 5778->5798 5801 403494 5778->5801 5781 403198 4 API calls 5780->5781 5782 409213 5781->5782 5782->5698 5784 4033bc 5783->5784 5785 403254 18 API calls 5784->5785 5786 4033cf 5785->5786 5787 4031e8 18 API calls 5786->5787 5788 4033f7 5787->5788 5790 408f70 2 API calls 5789->5790 5791 40904a 5790->5791 5792 40904e 5791->5792 5805 406a48 5791->5805 5792->5698 5795 409081 5796 408fac Wow64RevertWow64FsRedirection 5795->5796 5797 409089 5796->5797 5797->5698 5799 403278 18 API calls 5798->5799 5800 4032b5 5799->5800 5800->5778 5802 403498 5801->5802 5804 4034c3 5801->5804 5803 4034f0 18 API calls 5802->5803 5803->5804 5804->5778 5806 4069dc 21 API calls 5805->5806 5807 406a52 GetLastError 5806->5807 5807->5795 5809 403198 4 API calls 5808->5809 5811 408cb1 5808->5811 5809->5811 5810 4031b8 4 API calls 5812 408d69 5810->5812 5813 408cc8 5811->5813 5814 403278 18 API calls 5811->5814 5816 408cdc 5811->5816 5817 4032fc 18 API calls 5811->5817 5812->5458 5815 4032fc 18 API calls 5813->5815 5814->5811 5815->5816 5816->5810 5817->5811 5819 406744 IsDBCSLeadByte 5818->5819 5821 406835 5819->5821 5820 40687f 5820->5470 5821->5820 5822 406680 IsDBCSLeadByte 5821->5822 5822->5821 5824 4068f3 5823->5824 5825 406820 IsDBCSLeadByte 5824->5825 5827 4068fe 5825->5827 5826 4066ea 5826->5475 5826->5476 5827->5826 5828 406680 IsDBCSLeadByte 5827->5828 5828->5827 5830 406957 5829->5830 5831 40695b 5829->5831 5830->5489 5834 406970 CharPrevA 5831->5834 5833 40696c 5833->5489 5834->5833 5836 407578 5835->5836 5837 4075b7 CreateFileA 5836->5837 5837->5511 5839 403414 5838->5839 5840 4075b7 CreateFileA 5839->5840 5840->5511 5842 402bd5 RaiseException 5841->5842 5843 402be6 5841->5843 5842->5843 5843->5530 5845 407c70 5844->5845 5846 407caf 5844->5846 5845->5846 5848 407bac 5845->5848 5846->5541 5846->5543 5849 407bb7 5848->5849 5853 407bc8 5848->5853 5851 405890 18 API calls 5849->5851 5851->5853 5860 4074a0 5853->5860 5854 4074a0 34 API calls 5855 407bfd 5854->5855 5856 407918 InterlockedExchange 5855->5856 5857 407c12 5856->5857 5858 407c28 5857->5858 5859 405890 18 API calls 5857->5859 5858->5845 5859->5858 5861 4074b4 5860->5861 5862 4074c4 5861->5862 5863 4073ec 34 API calls 5861->5863 5862->5854 5863->5862 6758 408f30 6761 408dfc 6758->6761 6762 408e05 6761->6762 6763 403198 4 API calls 6762->6763 6764 408e13 6762->6764 6763->6762 6765 403932 6766 403924 6765->6766 6767 40374c VariantClear 6766->6767 6768 40392c 6767->6768 5063 4075c4 SetFilePointer 5064 4075f7 5063->5064 5065 4075e7 GetLastError 5063->5065 5065->5064 5066 4075f0 5065->5066 5068 40748c GetLastError 5066->5068 5071 4073ec 5068->5071 5080 407284 FormatMessageA 5071->5080 5074 407434 5087 405890 5074->5087 5077 407443 5091 403198 5077->5091 5081 4072aa 5080->5081 5095 403278 5081->5095 5084 405194 5174 4051a8 5084->5174 5088 405897 5087->5088 5089 4031e8 18 API calls 5088->5089 5090 4058af 5089->5090 5090->5077 5092 4031b7 5091->5092 5093 40319e 5091->5093 5092->5064 5093->5092 5302 4025ac 5093->5302 5100 403254 5095->5100 5097 403288 5098 403198 4 API calls 5097->5098 5099 4032a0 5098->5099 5099->5074 5099->5084 5101 403274 5100->5101 5102 403258 5100->5102 5101->5097 5105 402594 5102->5105 5104 403261 5104->5097 5106 402598 5105->5106 5108 4025a2 5105->5108 5111 401fd4 5106->5111 5107 40259e 5107->5108 5109 403154 4 API calls 5107->5109 5108->5104 5108->5108 5109->5108 5112 401fe8 5111->5112 5113 401fed 5111->5113 5122 401918 RtlInitializeCriticalSection 5112->5122 5115 402012 RtlEnterCriticalSection 5113->5115 5116 40201c 5113->5116 5121 401ff1 5113->5121 5115->5116 5116->5121 5129 401ee0 5116->5129 5119 402147 5119->5107 5120 40213d RtlLeaveCriticalSection 5120->5119 5121->5107 5123 40193c RtlEnterCriticalSection 5122->5123 5124 401946 5122->5124 5123->5124 5125 401964 LocalAlloc 5124->5125 5126 40197e 5125->5126 5127 4019c3 RtlLeaveCriticalSection 5126->5127 5128 4019cd 5126->5128 5127->5128 5128->5113 5132 401ef0 5129->5132 5130 401f1c 5134 401f40 5130->5134 5140 401d00 5130->5140 5132->5130 5132->5134 5135 401e58 5132->5135 5134->5119 5134->5120 5144 4016d8 5135->5144 5138 401e75 5138->5132 5141 401d4e 5140->5141 5142 401d1e 5140->5142 5141->5142 5161 401c68 5141->5161 5142->5134 5147 4016f4 5144->5147 5145 401430 LocalAlloc VirtualAlloc VirtualFree 5145->5147 5146 4016fe 5148 4015c4 VirtualAlloc 5146->5148 5147->5145 5147->5146 5149 40175b 5147->5149 5150 40132c LocalAlloc 5147->5150 5151 40174f 5147->5151 5152 40170a 5148->5152 5149->5138 5154 401dcc 5149->5154 5150->5147 5153 40150c VirtualFree 5151->5153 5152->5149 5153->5149 5155 401d80 9 API calls 5154->5155 5156 401de0 5155->5156 5157 40132c LocalAlloc 5156->5157 5158 401df0 5157->5158 5159 401b44 9 API calls 5158->5159 5160 401df8 5158->5160 5159->5160 5160->5138 5162 401c7a 5161->5162 5163 401c9d 5162->5163 5164 401caf 5162->5164 5165 40188c LocalAlloc VirtualFree VirtualFree 5163->5165 5166 40188c LocalAlloc VirtualFree VirtualFree 5164->5166 5167 401cad 5165->5167 5166->5167 5168 401b44 9 API calls 5167->5168 5173 401cc5 5167->5173 5169 401cd4 5168->5169 5170 401cee 5169->5170 5171 401b98 9 API calls 5169->5171 5172 4013a0 LocalAlloc 5170->5172 5171->5170 5172->5173 5173->5142 5175 4051c5 5174->5175 5182 404e58 5175->5182 5178 4051f1 5180 403278 18 API calls 5178->5180 5181 4051a3 5180->5181 5181->5074 5185 404e73 5182->5185 5183 404e85 5183->5178 5187 404be4 5183->5187 5185->5183 5190 404f7a 5185->5190 5197 404e4c 5185->5197 5294 405940 5187->5294 5189 404bf5 5189->5178 5191 404f8b 5190->5191 5195 404fd9 5190->5195 5194 40505f 5191->5194 5191->5195 5193 404ff7 5193->5185 5194->5193 5204 404e38 5194->5204 5195->5193 5200 404df4 5195->5200 5198 403198 4 API calls 5197->5198 5199 404e56 5198->5199 5199->5185 5201 404e02 5200->5201 5207 404bfc 5201->5207 5203 404e30 5203->5195 5233 4039a4 5204->5233 5210 4059b0 5207->5210 5209 404c15 5209->5203 5211 4059be 5210->5211 5220 404cdc LoadStringA 5211->5220 5214 405194 33 API calls 5215 4059f6 5214->5215 5223 4031e8 5215->5223 5221 403278 18 API calls 5220->5221 5222 404d09 5221->5222 5222->5214 5224 4031ec 5223->5224 5227 4031fc 5223->5227 5226 403254 18 API calls 5224->5226 5224->5227 5225 403228 5229 4031b8 5225->5229 5226->5227 5227->5225 5228 4025ac LocalAlloc TlsSetValue TlsGetValue TlsGetValue 5227->5228 5228->5225 5231 4031be 5229->5231 5230 4031e3 5230->5209 5231->5230 5232 4025ac LocalAlloc TlsSetValue TlsGetValue TlsGetValue 5231->5232 5232->5231 5234 4039ab 5233->5234 5239 4038b4 5234->5239 5236 4039cb 5237 403198 4 API calls 5236->5237 5238 4039d2 5237->5238 5238->5193 5240 4038d5 5239->5240 5241 4038c8 5239->5241 5243 403934 5240->5243 5244 4038db 5240->5244 5267 403780 5241->5267 5245 403993 5243->5245 5246 40393b 5243->5246 5247 4038e1 5244->5247 5248 4038ee 5244->5248 5249 4037f4 3 API calls 5245->5249 5250 403941 5246->5250 5251 40394b 5246->5251 5274 403894 5247->5274 5253 403894 6 API calls 5248->5253 5256 4038d0 5249->5256 5289 403864 5250->5289 5255 4037f4 3 API calls 5251->5255 5257 4038fc 5253->5257 5258 40395d 5255->5258 5256->5236 5279 4037f4 5257->5279 5261 403864 23 API calls 5258->5261 5260 403917 5285 40374c 5260->5285 5262 403976 5261->5262 5265 40374c VariantClear 5262->5265 5264 40392c 5264->5236 5266 40398b 5265->5266 5266->5236 5268 4037f0 5267->5268 5270 403744 5267->5270 5268->5256 5269 403793 VariantClear 5269->5270 5270->5267 5270->5269 5271 4037ab 5270->5271 5272 403198 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 5270->5272 5273 4037dc VariantCopyInd 5270->5273 5271->5256 5272->5270 5273->5268 5273->5270 5275 4036b8 MultiByteToWideChar SysAllocStringLen MultiByteToWideChar SysAllocStringLen MultiByteToWideChar 5274->5275 5276 4038a0 5275->5276 5277 40374c VariantClear 5276->5277 5278 4038a9 5277->5278 5278->5256 5280 403845 VariantChangeTypeEx 5279->5280 5281 40380a VariantChangeTypeEx 5279->5281 5284 403832 5280->5284 5282 403826 5281->5282 5283 40374c VariantClear 5282->5283 5283->5284 5284->5260 5286 403759 5285->5286 5287 403766 5285->5287 5286->5287 5288 403779 VariantClear 5286->5288 5287->5264 5288->5264 5290 40369c 22 API calls 5289->5290 5291 40387b 5290->5291 5292 40374c VariantClear 5291->5292 5293 403882 5292->5293 5293->5256 5295 40594c 5294->5295 5296 404cdc 19 API calls 5295->5296 5297 405972 5296->5297 5298 4031e8 18 API calls 5297->5298 5299 40597d 5298->5299 5300 403198 4 API calls 5299->5300 5301 405992 5300->5301 5301->5189 5303 4025b0 5302->5303 5304 4025ba 5302->5304 5303->5304 5305 403154 4 API calls 5303->5305 5304->5092 5304->5304 5305->5304 6401 4076c8 WriteFile 6402 4076e8 6401->6402 6403 4076ef 6401->6403 6404 40748c 35 API calls 6402->6404 6405 407700 6403->6405 6406 4073ec 34 API calls 6403->6406 6404->6403 6406->6405 6407 402ccc 6410 402cfe 6407->6410 6411 402cdd 6407->6411 6408 402d88 RtlUnwind 6409 403154 4 API calls 6408->6409 6409->6410 6411->6408 6411->6410 6412 402b28 RaiseException 6411->6412 6413 402d7f 6412->6413 6413->6408 6777 403fcd 6778 403f07 4 API calls 6777->6778 6779 403fd6 6778->6779 6780 403e9c 4 API calls 6779->6780 6781 403fe2 6780->6781 6420 4024d0 6421 4024e4 6420->6421 6422 4024e9 6420->6422 6425 401918 4 API calls 6421->6425 6423 402518 6422->6423 6424 40250e RtlEnterCriticalSection 6422->6424 6427 4024ed 6422->6427 6435 402300 6423->6435 6424->6423 6425->6422 6428 402525 6431 402581 6428->6431 6432 402577 RtlLeaveCriticalSection 6428->6432 6430 401fd4 14 API calls 6433 402531 6430->6433 6432->6431 6433->6428 6445 40215c 6433->6445 6436 402314 6435->6436 6438 4023b8 6436->6438 6440 402335 6436->6440 6437 402344 6437->6428 6437->6430 6438->6437 6443 402455 6438->6443 6462 401d80 6438->6462 6466 401e84 6438->6466 6440->6437 6459 401b74 6440->6459 6443->6437 6444 401d00 9 API calls 6443->6444 6444->6437 6446 40217a 6445->6446 6447 402175 6445->6447 6449 4021ab RtlEnterCriticalSection 6446->6449 6450 40217e 6446->6450 6457 4021b5 6446->6457 6448 401918 4 API calls 6447->6448 6448->6446 6449->6457 6450->6428 6451 4021c1 6453 4022e3 RtlLeaveCriticalSection 6451->6453 6454 4022ed 6451->6454 6452 402244 6452->6450 6455 401d80 7 API calls 6452->6455 6453->6454 6454->6428 6455->6450 6456 402270 6456->6451 6458 401d00 7 API calls 6456->6458 6457->6451 6457->6452 6457->6456 6458->6451 6460 40215c 9 API calls 6459->6460 6461 401b95 6460->6461 6461->6437 6463 401d89 6462->6463 6465 401d92 6462->6465 6464 401b74 9 API calls 6463->6464 6463->6465 6464->6465 6465->6438 6471 401768 6466->6471 6468 401e99 6469 401ea6 6468->6469 6470 401dcc 9 API calls 6468->6470 6469->6438 6470->6469 6472 401787 6471->6472 6473 40183b 6472->6473 6474 401494 LocalAlloc VirtualAlloc VirtualAlloc VirtualFree 6472->6474 6476 40132c LocalAlloc 6472->6476 6477 401821 6472->6477 6479 4017d6 6472->6479 6480 4017e7 6473->6480 6486 4015c4 6473->6486 6474->6472 6476->6472 6478 40150c VirtualFree 6477->6478 6478->6480 6482 40150c 6479->6482 6480->6468 6485 40153b 6482->6485 6483 401594 6483->6480 6484 401568 VirtualFree 6484->6485 6485->6483 6485->6484 6488 40160a 6486->6488 6487 40163a 6487->6480 6488->6487 6489 401626 VirtualAlloc 6488->6489 6489->6487 6489->6488 6490 4028d2 6491 4028da 6490->6491 6492 403554 4 API calls 6491->6492 6493 4028ef 6491->6493 6492->6491 6494 4025ac 4 API calls 6493->6494 6495 4028f4 6494->6495 6782 4019d3 6783 4019ba 6782->6783 6784 4019c3 RtlLeaveCriticalSection 6783->6784 6785 4019cd 6783->6785 6784->6785 5943 407fd4 5944 407fe6 5943->5944 5946 407fed 5943->5946 5954 407f10 5944->5954 5948 408017 5946->5948 5950 408015 5946->5950 5953 408021 5946->5953 5947 40804e 5965 407d7c 5948->5965 5949 407d7c 33 API calls 5949->5947 5968 407e2c 5950->5968 5953->5947 5953->5949 5955 407f25 5954->5955 5956 407d7c 33 API calls 5955->5956 5957 407f34 5955->5957 5956->5957 5958 407f6e 5957->5958 5959 407d7c 33 API calls 5957->5959 5960 407f82 5958->5960 5961 407d7c 33 API calls 5958->5961 5959->5958 5964 407fae 5960->5964 5975 407eb8 5960->5975 5961->5960 5964->5946 5978 4058c4 5965->5978 5967 407d9e 5967->5953 5969 405194 33 API calls 5968->5969 5970 407e57 5969->5970 5986 407de4 5970->5986 5972 407e5f 5973 403198 4 API calls 5972->5973 5974 407e74 5973->5974 5974->5953 5976 407ec7 VirtualFree 5975->5976 5977 407ed9 VirtualAlloc 5975->5977 5976->5977 5977->5964 5980 4058d0 5978->5980 5979 405194 33 API calls 5981 4058fd 5979->5981 5980->5979 5982 4031e8 18 API calls 5981->5982 5983 405908 5982->5983 5984 403198 4 API calls 5983->5984 5985 40591d 5984->5985 5985->5967 5987 4058c4 33 API calls 5986->5987 5988 407e06 5987->5988 5988->5972 6496 405ad4 6497 405adc 6496->6497 6499 405ae4 6496->6499 6498 405aeb 6497->6498 6500 405ae2 6497->6500 6501 405940 19 API calls 6498->6501 6503 405a4c 6500->6503 6501->6499 6504 405a54 6503->6504 6505 405a6e 6504->6505 6506 403154 4 API calls 6504->6506 6507 405a73 6505->6507 6508 405a8a 6505->6508 6506->6504 6510 405940 19 API calls 6507->6510 6509 403154 4 API calls 6508->6509 6512 405a8f 6509->6512 6511 405a86 6510->6511 6514 403154 4 API calls 6511->6514 6513 4059b0 33 API calls 6512->6513 6513->6511 6515 405ab8 6514->6515 6516 403154 4 API calls 6515->6516 6517 405ac6 6516->6517 6517->6499 6224 40a9de 6225 40aa03 6224->6225 6226 407918 InterlockedExchange 6225->6226 6227 40aa2d 6226->6227 6228 409ae8 18 API calls 6227->6228 6229 40aa3d 6227->6229 6228->6229 6234 4076ac SetEndOfFile 6229->6234 6231 40aa59 6232 4025ac 4 API calls 6231->6232 6233 40aa90 6232->6233 6235 4076c3 6234->6235 6236 4076bc 6234->6236 6235->6231 6237 40748c 35 API calls 6236->6237 6237->6235 6789 402be9 RaiseException 6790 402c04 6789->6790 6528 402af2 6529 402afe 6528->6529 6532 402ed0 6529->6532 6533 403154 4 API calls 6532->6533 6535 402ee0 6533->6535 6534 402b03 6535->6534 6537 402b0c 6535->6537 6538 402b25 6537->6538 6539 402b15 RaiseException 6537->6539 6538->6534 6539->6538 5991 40a5f8 6034 4030dc 5991->6034 5993 40a60e 6037 4042e8 5993->6037 5995 40a613 6040 40457c GetModuleHandleA GetProcAddress 5995->6040 5999 40a61d 6048 4065c8 5999->6048 6001 40a622 6057 4090a4 GetModuleHandleA GetProcAddress GetModuleHandleA GetProcAddress 6001->6057 6011 40a665 6079 406c2c 6011->6079 6012 4031e8 18 API calls 6013 40a683 6012->6013 6014 4074e0 37 API calls 6013->6014 6015 40a69b 6014->6015 6093 409c34 FindResourceA 6015->6093 6018 409ae8 18 API calls 6020 40a710 6018->6020 6019 407918 InterlockedExchange 6022 40a6d2 6019->6022 6021 4074a0 34 API calls 6020->6021 6024 40a736 6021->6024 6022->6018 6022->6020 6023 40a751 6026 407a28 19 API calls 6023->6026 6024->6023 6025 409ae8 18 API calls 6024->6025 6025->6023 6027 40a776 6026->6027 6106 408b08 6027->6106 6031 40a7bc 6032 408b08 35 API calls 6031->6032 6033 40a7f5 6031->6033 6032->6031 6132 403094 6034->6132 6036 4030e1 GetModuleHandleA GetCommandLineA 6036->5993 6038 403154 4 API calls 6037->6038 6039 404323 6037->6039 6038->6039 6039->5995 6041 404598 6040->6041 6042 40459f GetProcAddress 6040->6042 6041->6042 6043 4045b5 GetProcAddress 6042->6043 6044 4045ae 6042->6044 6045 4045c4 SetProcessDEPPolicy 6043->6045 6046 4045c8 6043->6046 6044->6043 6045->6046 6047 404624 6F571CD0 6046->6047 6047->5999 6133 405ca8 6048->6133 6058 4090f7 6057->6058 6213 406fa0 SetErrorMode 6058->6213 6061 407284 19 API calls 6062 409127 6061->6062 6063 403198 4 API calls 6062->6063 6064 40913c 6063->6064 6065 409b78 GetSystemInfo VirtualQuery 6064->6065 6066 409c2c 6065->6066 6069 409ba2 6065->6069 6071 409768 6066->6071 6067 409c0d VirtualQuery 6067->6066 6067->6069 6068 409bcc VirtualProtect 6068->6069 6069->6066 6069->6067 6069->6068 6070 409bfb VirtualProtect 6069->6070 6070->6067 6217 406bd0 GetCommandLineA 6071->6217 6073 409785 6074 409850 6073->6074 6075 406c2c 20 API calls 6073->6075 6078 403454 18 API calls 6073->6078 6076 4031b8 4 API calls 6074->6076 6075->6073 6077 40986a 6076->6077 6077->6011 6122 409c88 6077->6122 6078->6073 6080 406c53 GetModuleFileNameA 6079->6080 6081 406c77 GetCommandLineA 6079->6081 6082 403278 18 API calls 6080->6082 6089 406c7c 6081->6089 6083 406c75 6082->6083 6087 406ca4 6083->6087 6084 406c81 6085 403198 4 API calls 6084->6085 6088 406c89 6085->6088 6086 406af0 18 API calls 6086->6089 6090 403198 4 API calls 6087->6090 6091 40322c 4 API calls 6088->6091 6089->6084 6089->6086 6089->6088 6092 406cb9 6090->6092 6091->6087 6092->6012 6094 409c49 6093->6094 6095 409c4e SizeofResource 6093->6095 6096 409ae8 18 API calls 6094->6096 6097 409c60 LoadResource 6095->6097 6098 409c5b 6095->6098 6096->6095 6100 409c73 LockResource 6097->6100 6101 409c6e 6097->6101 6099 409ae8 18 API calls 6098->6099 6099->6097 6103 409c84 6100->6103 6104 409c7f 6100->6104 6102 409ae8 18 API calls 6101->6102 6102->6100 6103->6019 6103->6022 6105 409ae8 18 API calls 6104->6105 6105->6103 6118 408b39 6106->6118 6120 408b82 6106->6120 6107 408bcd 6109 407cb8 35 API calls 6107->6109 6108 407cb8 35 API calls 6108->6118 6110 408be4 6109->6110 6113 4031b8 4 API calls 6110->6113 6111 4034f0 18 API calls 6111->6118 6112 4034f0 18 API calls 6112->6120 6115 408bfe 6113->6115 6114 4031e8 18 API calls 6114->6118 6129 404c20 6115->6129 6116 403420 18 API calls 6116->6118 6117 4031e8 18 API calls 6117->6120 6118->6108 6118->6111 6118->6114 6118->6116 6118->6120 6119 403420 18 API calls 6119->6120 6120->6107 6120->6112 6120->6117 6120->6119 6121 407cb8 35 API calls 6120->6121 6121->6120 6123 40322c 4 API calls 6122->6123 6124 409cab 6123->6124 6125 409cba MessageBoxA 6124->6125 6126 409ccf 6125->6126 6127 403198 4 API calls 6126->6127 6128 409cd7 6127->6128 6128->6011 6130 402594 18 API calls 6129->6130 6131 404c2b 6130->6131 6131->6031 6132->6036 6134 405940 19 API calls 6133->6134 6135 405cb9 6134->6135 6136 405280 GetSystemDefaultLCID 6135->6136 6139 4052b6 6136->6139 6137 4031e8 18 API calls 6137->6139 6138 404cdc 19 API calls 6138->6139 6139->6137 6139->6138 6140 40520c 19 API calls 6139->6140 6141 405318 6139->6141 6140->6139 6142 404cdc 19 API calls 6141->6142 6143 40520c 19 API calls 6141->6143 6144 4031e8 18 API calls 6141->6144 6145 40539b 6141->6145 6142->6141 6143->6141 6144->6141 6146 4031b8 4 API calls 6145->6146 6147 4053b5 6146->6147 6148 4053c4 GetSystemDefaultLCID 6147->6148 6205 40520c GetLocaleInfoA 6148->6205 6151 4031e8 18 API calls 6152 405404 6151->6152 6153 40520c 19 API calls 6152->6153 6154 405419 6153->6154 6155 40520c 19 API calls 6154->6155 6156 40543d 6155->6156 6211 405258 GetLocaleInfoA 6156->6211 6159 405258 GetLocaleInfoA 6160 40546d 6159->6160 6161 40520c 19 API calls 6160->6161 6162 405487 6161->6162 6163 405258 GetLocaleInfoA 6162->6163 6164 4054a4 6163->6164 6165 40520c 19 API calls 6164->6165 6166 4054be 6165->6166 6167 4031e8 18 API calls 6166->6167 6168 4054cb 6167->6168 6169 40520c 19 API calls 6168->6169 6170 4054e0 6169->6170 6171 4031e8 18 API calls 6170->6171 6172 4054ed 6171->6172 6173 405258 GetLocaleInfoA 6172->6173 6174 4054fb 6173->6174 6175 40520c 19 API calls 6174->6175 6176 405515 6175->6176 6177 4031e8 18 API calls 6176->6177 6178 405522 6177->6178 6179 40520c 19 API calls 6178->6179 6180 405537 6179->6180 6181 4031e8 18 API calls 6180->6181 6182 405544 6181->6182 6183 40520c 19 API calls 6182->6183 6184 405559 6183->6184 6185 405576 6184->6185 6186 405567 6184->6186 6188 40322c 4 API calls 6185->6188 6187 40322c 4 API calls 6186->6187 6189 405574 6187->6189 6188->6189 6190 40520c 19 API calls 6189->6190 6191 405598 6190->6191 6192 4055b5 6191->6192 6193 4055a6 6191->6193 6194 403198 4 API calls 6192->6194 6195 40322c 4 API calls 6193->6195 6196 4055b3 6194->6196 6195->6196 6197 4033b4 18 API calls 6196->6197 6198 4055d7 6197->6198 6199 4033b4 18 API calls 6198->6199 6200 4055f1 6199->6200 6201 4031b8 4 API calls 6200->6201 6202 40560b 6201->6202 6203 405cf4 GetVersionExA 6202->6203 6204 405d0b 6203->6204 6204->6001 6206 405233 6205->6206 6207 405245 6205->6207 6208 403278 18 API calls 6206->6208 6209 40322c 4 API calls 6207->6209 6210 405243 6208->6210 6209->6210 6210->6151 6212 405274 6211->6212 6212->6159 6214 403414 6213->6214 6215 406fd8 LoadLibraryA 6214->6215 6216 406fee 6215->6216 6216->6061 6218 406af0 18 API calls 6217->6218 6219 406bf3 6218->6219 6220 406c05 6219->6220 6221 406af0 18 API calls 6219->6221 6222 403198 4 API calls 6220->6222 6221->6219 6223 406c1a 6222->6223 6223->6073 6791 402dfa 6792 402e26 6791->6792 6793 402e0d 6791->6793 6795 402ba4 6793->6795 6796 402bc9 6795->6796 6797 402bad 6795->6797 6796->6792 6798 402bb5 RaiseException 6797->6798 6798->6796 6799 4075fa GetFileSize 6800 407626 6799->6800 6801 407616 GetLastError 6799->6801 6801->6800 6802 40761f 6801->6802 6803 40748c 35 API calls 6802->6803 6803->6800 6804 406ffb 6805 407008 SetErrorMode 6804->6805 6544 403a80 CloseHandle 6545 403a90 6544->6545 6546 403a91 GetLastError 6544->6546 6547 404283 6548 4042c3 6547->6548 6549 403154 4 API calls 6548->6549 6550 404323 6549->6550 6806 404185 6807 4041ff 6806->6807 6808 4041cc 6807->6808 6809 403154 4 API calls 6807->6809 6810 404323 6809->6810 6551 403e87 6552 403e4c 6551->6552 6553 403e62 6552->6553 6554 403e7b 6552->6554 6557 403e67 6552->6557 6555 403cc8 4 API calls 6553->6555 6556 402674 4 API calls 6554->6556 6555->6557 6558 403e78 6556->6558 6557->6558 6559 402674 4 API calls 6557->6559 6559->6558 6568 407e90 6569 407eb8 VirtualFree 6568->6569 6570 407e9d 6569->6570 6582 40ac97 6591 4096fc 6582->6591 6585 402f24 5 API calls 6586 40aca1 6585->6586 6587 403198 4 API calls 6586->6587 6588 40acc0 6587->6588 6589 403198 4 API calls 6588->6589 6590 40acc8 6589->6590 6600 4056ac 6591->6600 6593 409717 6594 409745 6593->6594 6606 40720c 6593->6606 6597 403198 4 API calls 6594->6597 6596 409735 6599 40973d MessageBoxA 6596->6599 6598 40975a 6597->6598 6598->6585 6598->6586 6599->6594 6601 403154 4 API calls 6600->6601 6602 4056b1 6601->6602 6603 4056c9 6602->6603 6604 403154 4 API calls 6602->6604 6603->6593 6605 4056bf 6604->6605 6605->6593 6607 4056ac 4 API calls 6606->6607 6608 40721b 6607->6608 6609 407221 6608->6609 6610 40722f 6608->6610 6611 40322c 4 API calls 6609->6611 6613 40724b 6610->6613 6614 40723f 6610->6614 6612 40722d 6611->6612 6612->6596 6624 4032b8 6613->6624 6617 4071d0 6614->6617 6618 40322c 4 API calls 6617->6618 6619 4071df 6618->6619 6620 4071fc 6619->6620 6621 406950 CharPrevA 6619->6621 6620->6612 6622 4071eb 6621->6622 6622->6620 6623 4032fc 18 API calls 6622->6623 6623->6620 6625 403278 18 API calls 6624->6625 6626 4032c2 6625->6626 6626->6612 6627 403a97 6628 403aac 6627->6628 6629 403bbc GetStdHandle 6628->6629 6630 403b0e CreateFileA 6628->6630 6638 403ab2 6628->6638 6631 403c17 GetLastError 6629->6631 6644 403bba 6629->6644 6630->6631 6632 403b2c 6630->6632 6631->6638 6634 403b3b GetFileSize 6632->6634 6632->6644 6634->6631 6635 403b4e SetFilePointer 6634->6635 6635->6631 6640 403b6a ReadFile 6635->6640 6636 403be7 GetFileType 6637 403c02 CloseHandle 6636->6637 6636->6638 6637->6638 6640->6631 6641 403b8c 6640->6641 6642 403b9f SetFilePointer 6641->6642 6641->6644 6642->6631 6643 403bb0 SetEndOfFile 6642->6643 6643->6631 6643->6644 6644->6636 6644->6638 6649 40aaa2 6650 40aad2 6649->6650 6651 40aadc CreateWindowExA SetWindowLongA 6650->6651 6652 405194 33 API calls 6651->6652 6653 40ab5f 6652->6653 6654 4032fc 18 API calls 6653->6654 6655 40ab6d 6654->6655 6656 4032fc 18 API calls 6655->6656 6657 40ab7a 6656->6657 6658 406b7c 19 API calls 6657->6658 6659 40ab86 6658->6659 6660 4032fc 18 API calls 6659->6660 6661 40ab8f 6660->6661 6662 4099ec 43 API calls 6661->6662 6663 40aba1 6662->6663 6664 4098cc 19 API calls 6663->6664 6665 40abb4 6663->6665 6664->6665 6666 40abed 6665->6666 6667 4094d8 9 API calls 6665->6667 6668 40ac06 6666->6668 6671 40ac00 RemoveDirectoryA 6666->6671 6667->6666 6669 40ac1a 6668->6669 6670 40ac0f DestroyWindow 6668->6670 6672 40ac42 6669->6672 6673 40357c 4 API calls 6669->6673 6670->6669 6671->6668 6674 40ac38 6673->6674 6675 4025ac 4 API calls 6674->6675 6675->6672 6823 405ba2 6825 405ba4 6823->6825 6824 405be0 6828 405940 19 API calls 6824->6828 6825->6824 6826 405bf7 6825->6826 6827 405bda 6825->6827 6832 404cdc 19 API calls 6826->6832 6827->6824 6829 405c4c 6827->6829 6830 405bf3 6828->6830 6831 4059b0 33 API calls 6829->6831 6833 403198 4 API calls 6830->6833 6831->6830 6834 405c20 6832->6834 6835 405c86 6833->6835 6836 4059b0 33 API calls 6834->6836 6836->6830 6837 408da4 6838 408dc8 6837->6838 6839 408c80 18 API calls 6838->6839 6840 408dd1 6839->6840 6676 402caa 6677 403154 4 API calls 6676->6677 6678 402caf 6677->6678 6855 4011aa 6856 4011ac GetStdHandle 6855->6856 6679 4028ac 6680 402594 18 API calls 6679->6680 6681 4028b6 6680->6681 5864 40aab4 5865 40aab8 SetLastError 5864->5865 5895 409648 GetLastError 5865->5895 5868 40aad2 5870 40aadc CreateWindowExA SetWindowLongA 5868->5870 5869 402f24 5 API calls 5869->5868 5871 405194 33 API calls 5870->5871 5872 40ab5f 5871->5872 5873 4032fc 18 API calls 5872->5873 5874 40ab6d 5873->5874 5875 4032fc 18 API calls 5874->5875 5876 40ab7a 5875->5876 5908 406b7c GetCommandLineA 5876->5908 5879 4032fc 18 API calls 5880 40ab8f 5879->5880 5913 4099ec 5880->5913 5883 4098cc 19 API calls 5884 40abb4 5883->5884 5885 40abed 5884->5885 5886 4094d8 9 API calls 5884->5886 5887 40ac06 5885->5887 5890 40ac00 RemoveDirectoryA 5885->5890 5886->5885 5888 40ac1a 5887->5888 5889 40ac0f DestroyWindow 5887->5889 5891 40ac42 5888->5891 5892 40357c 4 API calls 5888->5892 5889->5888 5890->5887 5893 40ac38 5892->5893 5894 4025ac 4 API calls 5893->5894 5894->5891 5896 404c94 33 API calls 5895->5896 5897 40968f 5896->5897 5898 407284 19 API calls 5897->5898 5899 40969f 5898->5899 5900 408da8 18 API calls 5899->5900 5901 4096b4 5900->5901 5902 405890 18 API calls 5901->5902 5903 4096c3 5902->5903 5904 4031b8 4 API calls 5903->5904 5905 4096e2 5904->5905 5906 403198 4 API calls 5905->5906 5907 4096ea 5906->5907 5907->5868 5907->5869 5929 406af0 5908->5929 5910 406ba1 5911 403198 4 API calls 5910->5911 5912 406bbf 5911->5912 5912->5879 5914 4033b4 18 API calls 5913->5914 5915 409a27 5914->5915 5916 409a59 CreateProcessA 5915->5916 5917 409a65 5916->5917 5918 409a6c CloseHandle 5916->5918 5919 409648 35 API calls 5917->5919 5920 409a75 5918->5920 5919->5918 5939 4099c0 5920->5939 5923 409a91 5924 4099c0 3 API calls 5923->5924 5925 409a96 GetExitCodeProcess CloseHandle 5924->5925 5926 409ab6 5925->5926 5927 403198 4 API calls 5926->5927 5928 409abe 5927->5928 5928->5883 5928->5884 5930 406b1c 5929->5930 5931 403278 18 API calls 5930->5931 5932 406b29 5931->5932 5933 403420 18 API calls 5932->5933 5934 406b31 5933->5934 5935 4031e8 18 API calls 5934->5935 5936 406b49 5935->5936 5937 403198 4 API calls 5936->5937 5938 406b6b 5937->5938 5938->5910 5940 4099d4 PeekMessageA 5939->5940 5941 4099e6 MsgWaitForMultipleObjects 5940->5941 5942 4099c8 TranslateMessage DispatchMessageA 5940->5942 5941->5920 5941->5923 5942->5940 6682 401ab9 6683 401a96 6682->6683 6684 401aa9 RtlDeleteCriticalSection 6683->6684 6685 401a9f RtlLeaveCriticalSection 6683->6685 6685->6684

      Executed Functions

      Function 00409B78 Relevance: 7.6, APIs: 5, Instructions: 78memoryCOMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 135 409b78-409b9c GetSystemInfo VirtualQuery 136 409ba2 135->136 137 409c2c-409c33 135->137 138 409c21-409c26 136->138 138->137 139 409ba4-409bab 138->139 140 409c0d-409c1f VirtualQuery 139->140 141 409bad-409bb1 139->141 140->137 140->138 141->140 142 409bb3-409bbb 141->142 143 409bcc-409bdd VirtualProtect 142->143 144 409bbd-409bc0 142->144 146 409be1-409be3 143->146 147 409bdf 143->147 144->143 145 409bc2-409bc5 144->145 145->143 148 409bc7-409bca 145->148 149 409bf2-409bf5 146->149 147->146 148->143 148->146 150 409be5-409bee call 409b70 149->150 151 409bf7-409bf9 149->151 150->149 151->140 153 409bfb-409c08 VirtualProtect 151->153 153->140
      APIs
      • GetSystemInfo.KERNEL32(?), ref: 00409B8A
      • VirtualQuery.KERNEL32(00400000,?,0000001C,?), ref: 00409B95
      • VirtualProtect.KERNEL32(?,?,00000040,?,00400000,?,0000001C,?), ref: 00409BD6
      • VirtualProtect.KERNEL32(?,?,?,?,?,?,00000040,?,00400000,?,0000001C,?), ref: 00409C08
      • VirtualQuery.KERNEL32(?,?,0000001C,00400000,?,0000001C,?), ref: 00409C18
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Virtual$ProtectQuery$InfoSystem
      • String ID:
      • API String ID: 2441996862-0
      • Opcode ID: 69cc1b0b9b744b29044eea84e4744ba7a66f7205e02ae19cc0529fdcfa929845
      • Instruction ID: 4a1d84bb43d4a47cf168f169447d483ed62c711ee8ccb48f5bfbfd053dbeaed9
      • Opcode Fuzzy Hash: 69cc1b0b9b744b29044eea84e4744ba7a66f7205e02ae19cc0529fdcfa929845
      • Instruction Fuzzy Hash: D421A1B16043006BDA309AA99C85E57B7E8AF45360F144C2BFA99E72C3D239FC40C669
      Function 0040520C Relevance: 1.5, APIs: 1, Instructions: 29COMMON
      Download Yara Rule
      APIs
      • GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: InfoLocale
      • String ID:
      • API String ID: 2299586839-0
      • Opcode ID: 08facca5f8c818d7ae0117448837c5e97f15c9e55cb3aedc2694e0bc5091a832
      • Instruction ID: 1248db9972fbf410c55bf070b604c98f5d62b90992f8f49b6b6440a9954d2c50
      • Opcode Fuzzy Hash: 08facca5f8c818d7ae0117448837c5e97f15c9e55cb3aedc2694e0bc5091a832
      • Instruction Fuzzy Hash: E2E0927170021427D710A9A99C86AEB725CEB58310F0002BFB904E73C6EDB49E804AED
      Function 0040457C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 27libraryloaderCOMMON
      Download Yara Rule

      Control-flow Graph

      APIs
      • GetModuleHandleA.KERNEL32(kernel32.dll,?,0040A618), ref: 00404582
      • GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040458F
      • GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 004045A5
      • GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 004045BB
      • SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,0040A618), ref: 004045C6
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressProc$HandleModulePolicyProcess
      • String ID: SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$kernel32.dll
      • API String ID: 3256987805-3653653586
      • Opcode ID: 5152b1c660b0fef0348360efae9d442e0d6811f491f57bfacbbc157bf84edc67
      • Instruction ID: 1f393095ee8ecda9e1e01b6ca7d440447e938bbc9796bcd5dbe8d266940e5f64
      • Opcode Fuzzy Hash: 5152b1c660b0fef0348360efae9d442e0d6811f491f57bfacbbc157bf84edc67
      • Instruction Fuzzy Hash: 5FE02DD03813013AEA5032F20D83B2B20884AD0B49B2414377F25B61C3EDBDDA40587E
      Function 0040AAB4 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 109COMMON
      Download Yara Rule

      Control-flow Graph

      APIs
      • SetLastError.KERNEL32 ref: 0040AAC1
        • Part of subcall function 00409648: GetLastError.KERNEL32(00000000,004096EB,?,0040B244,?,02111D24), ref: 0040966C
      • CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040AAFE
      • SetWindowLongA.USER32(00020412,000000FC,00409960), ref: 0040AB15
      • RemoveDirectoryA.KERNEL32(00000000,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC01
      • DestroyWindow.USER32(00020412,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC15
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Window$ErrorLast$CreateDestroyDirectoryLongRemove
      • String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
      • API String ID: 3757039580-3001827809
      • Opcode ID: 7bc9c0c8e9dfd2478b94306391eafe1fb51b7566d8199cdbb2b2653dcbc3d95c
      • Instruction ID: 81987b3bab642c92fe87a7372e0454594c4b8fe140ce311e0f93b1eeebf6ab37
      • Opcode Fuzzy Hash: 7bc9c0c8e9dfd2478b94306391eafe1fb51b7566d8199cdbb2b2653dcbc3d95c
      • Instruction Fuzzy Hash: 25412E70604204DBDB10EBA9EE89B9E37A5EB44304F10467FF510B72E2D7B89855CB9D
      Function 004090A4 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46libraryloaderCOMMON
      Download Yara Rule

      Control-flow Graph

      APIs
      • GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,0040913D,?,?,?,?,00000000,?,0040A62C), ref: 004090C4
      • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004090CA
      • GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,0040913D,?,?,?,?,00000000,?,0040A62C), ref: 004090DE
      • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004090E4
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressHandleModuleProc
      • String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
      • API String ID: 1646373207-2130885113
      • Opcode ID: 0414f1d66f28dc470df4633e5994336701384173b3f6f66b470f3ad827f759f7
      • Instruction ID: 214dda5481ef482ebe311b1329301f35405b1013d97e3062c17ffb2c8286d57d
      • Opcode Fuzzy Hash: 0414f1d66f28dc470df4633e5994336701384173b3f6f66b470f3ad827f759f7
      • Instruction Fuzzy Hash: 21017C70748342AEFB00BB76DD4AB163A68E785704F60457BF640BA2D3DABD4C04D66E
      Function 0040AAA2 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 105COMMON
      Download Yara Rule

      Control-flow Graph

      APIs
      • CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040AAFE
      • SetWindowLongA.USER32(00020412,000000FC,00409960), ref: 0040AB15
        • Part of subcall function 00406B7C: GetCommandLineA.KERNEL32(00000000,00406BC0,?,?,?,?,00000000,?,0040AB86,?), ref: 00406B94
        • Part of subcall function 004099EC: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,02111D24,00409AD8,00000000,00409ABF), ref: 00409A5C
        • Part of subcall function 004099EC: CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,02111D24,00409AD8,00000000), ref: 00409A70
        • Part of subcall function 004099EC: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409A89
        • Part of subcall function 004099EC: GetExitCodeProcess.KERNEL32(?,0040B244), ref: 00409A9B
        • Part of subcall function 004099EC: CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,02111D24,00409AD8), ref: 00409AA4
      • RemoveDirectoryA.KERNEL32(00000000,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC01
      • DestroyWindow.USER32(00020412,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC15
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Window$CloseCreateHandleProcess$CodeCommandDestroyDirectoryExitLineLongMultipleObjectsRemoveWait
      • String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
      • API String ID: 3586484885-3001827809
      • Opcode ID: c367800830601d7b7bb1e4b9cc729c69669d466ec6c890b8506752b9ad64910a
      • Instruction ID: d3376fcde1141b4290a3dca450fc2844fa47922897975e075ebf06e3b6db64eb
      • Opcode Fuzzy Hash: c367800830601d7b7bb1e4b9cc729c69669d466ec6c890b8506752b9ad64910a
      • Instruction Fuzzy Hash: 77411A71604204DFD714EBA9EE85B5A37B5EB48304F20427BF500BB2E1D7B8A855CB9D
      Function 004099EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77processCOMMON
      Download Yara Rule

      Control-flow Graph

      APIs
      • CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,02111D24,00409AD8,00000000,00409ABF), ref: 00409A5C
      • CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,02111D24,00409AD8,00000000), ref: 00409A70
      • MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409A89
      • GetExitCodeProcess.KERNEL32(?,0040B244), ref: 00409A9B
      • CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,02111D24,00409AD8), ref: 00409AA4
        • Part of subcall function 00409648: GetLastError.KERNEL32(00000000,004096EB,?,0040B244,?,02111D24), ref: 0040966C
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CloseHandleProcess$CodeCreateErrorExitLastMultipleObjectsWait
      • String ID: D
      • API String ID: 3356880605-2746444292
      • Opcode ID: aadf6f075de5bdb3c28d757ddccd10dd30f6bbfdbbad62eb54c24073370c977f
      • Instruction ID: b58d0f6e2b8975977e6c7b71aada5392bea55c03070ce9fad3dcef5aa6d4018a
      • Opcode Fuzzy Hash: aadf6f075de5bdb3c28d757ddccd10dd30f6bbfdbbad62eb54c24073370c977f
      • Instruction Fuzzy Hash: EE1142B16402486EDB00EBE6CC42F9EB7ACEF49714F50013BB604F72C6DA785D048A69
      Function 004019DC Relevance: 9.1, APIs: 6, Instructions: 59COMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 116 4019dc-4019e7 117 401abb-401abd 116->117 118 4019ed-401a02 116->118 119 401a04-401a09 RtlEnterCriticalSection 118->119 120 401a0e-401a2d LocalFree 118->120 119->120 121 401a41-401a47 120->121 122 401a49-401a6e call 4012dc * 3 121->122 123 401a2f-401a3f VirtualFree 121->123 130 401a70-401a85 LocalFree 122->130 131 401a87-401a9d 122->131 123->121 130->130 130->131 133 401aa9-401ab3 RtlDeleteCriticalSection 131->133 134 401a9f-401aa4 RtlLeaveCriticalSection 131->134 134->133
      APIs
      • RtlEnterCriticalSection.KERNEL32(0040C41C,00000000,00401AB4), ref: 00401A09
      • LocalFree.KERNEL32(00000000,00000000,00401AB4), ref: 00401A1B
      • VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00401AB4), ref: 00401A3A
      • LocalFree.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00401AB4), ref: 00401A79
      • RtlLeaveCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AA4
      • RtlDeleteCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AAE
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
      • String ID:
      • API String ID: 3782394904-0
      • Opcode ID: 2760f6fc436d2282df077fa3fe2c561b0ff429e9c23b98cc44d100e589fe962f
      • Instruction ID: 5447b05044442752c1d56c7733342563ab4b4f61826a3093f511f794066d9233
      • Opcode Fuzzy Hash: 2760f6fc436d2282df077fa3fe2c561b0ff429e9c23b98cc44d100e589fe962f
      • Instruction Fuzzy Hash: 91116330341280DAD711ABA59EE2F623668B785748F44437EF444B62F2C67C9840CA9D
      Function 00403D02 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72windowCOMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 155 403d02-403d10 156 403d12-403d19 155->156 157 403d29-403d30 155->157 158 403ddf-403de5 ExitProcess 156->158 159 403d1f 156->159 160 403d32-403d3c 157->160 161 403d3e-403d45 157->161 159->157 164 403d21-403d23 159->164 160->157 162 403d47-403d51 161->162 163 403db8-403dcc call 403cc8 * 2 call 4019dc 161->163 166 403d56-403d62 162->166 180 403dd1-403dd8 163->180 164->157 168 403dea-403e19 call 4030b4 164->168 166->166 169 403d64-403d6e 166->169 172 403d73-403d84 169->172 172->172 176 403d86-403d8d 172->176 178 403da4-403db3 call 403fe4 call 403f67 176->178 179 403d8f-403da2 MessageBoxA 176->179 178->163 179->163 180->168 182 403dda call 4030b4 180->182 182->158
      APIs
      • MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00403D9D
      • ExitProcess.KERNEL32 ref: 00403DE5
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ExitMessageProcess
      • String ID: Error$Runtime error at 00000000
      • API String ID: 1220098344-2970929446
      • Opcode ID: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
      • Instruction ID: db3008c0e6bc5d60e05df0545d3e9f81ce91e923819fa2a9fb93000da4b6b716
      • Opcode Fuzzy Hash: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
      • Instruction Fuzzy Hash: B521F830A04341CAE714EFA59AD17153E98AB49349F04837BD500B73E3C77C8A45C76E
      Function 00401918 Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 186 401918-40193a RtlInitializeCriticalSection 187 401946-40197c call 4012dc * 3 LocalAlloc 186->187 188 40193c-401941 RtlEnterCriticalSection 186->188 195 4019ad-4019c1 187->195 196 40197e 187->196 188->187 199 4019c3-4019c8 RtlLeaveCriticalSection 195->199 200 4019cd 195->200 198 401983-401995 196->198 198->198 201 401997-4019a6 198->201 199->200 201->195
      APIs
      • RtlInitializeCriticalSection.KERNEL32(0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
      • RtlEnterCriticalSection.KERNEL32(0040C41C,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
      • LocalAlloc.KERNEL32(00000000,00000FF8,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
      • RtlLeaveCriticalSection.KERNEL32(0040C41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CriticalSection$AllocEnterInitializeLeaveLocal
      • String ID:
      • API String ID: 730355536-0
      • Opcode ID: 38709c719971e1168baf9cdc3c67f999ad3db3ab521e9349fb3b390a12b3c6f3
      • Instruction ID: 093a8b970c40f4dda7bd37408b901a2e20e4e29fb74a5496b56404d4d89a3717
      • Opcode Fuzzy Hash: 38709c719971e1168baf9cdc3c67f999ad3db3ab521e9349fb3b390a12b3c6f3
      • Instruction Fuzzy Hash: CC0161B0684240DEE715ABA999E6B353AA4E786744F10427FF080F62F2C67C4450CB9D
      Function 0040A814 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 117windowCOMMON
      Download Yara Rule

      Control-flow Graph

      APIs
      • MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 0040A878
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Message
      • String ID: .tmp$y@
      • API String ID: 2030045667-2396523267
      • Opcode ID: 55a53fbd7ad7285035f8ab2cde1915fb146aa3dc543cd9b52406218d685c1c98
      • Instruction ID: 5e9257013af3d55ef2b6e359c41f87f67318ae2a4e6dbf07461b5d8c6de74657
      • Opcode Fuzzy Hash: 55a53fbd7ad7285035f8ab2cde1915fb146aa3dc543cd9b52406218d685c1c98
      • Instruction Fuzzy Hash: 3B41C030704200CFD311EF25DED1A1A77A5EB49304B214A3AF804B73E1CAB9AC11CBAD
      Function 0040A82F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113windowCOMMON
      Download Yara Rule

      Control-flow Graph

      APIs
      • MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 0040A878
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Message
      • String ID: .tmp$y@
      • API String ID: 2030045667-2396523267
      • Opcode ID: 4e131503fe38447772e4e2294cf5373b7e2007f9fac8d76d0a71823c743fc64d
      • Instruction ID: 95bba075cf9db07042691c1556ef0613dbe482a65a3614fff4d0ead14828e6f7
      • Opcode Fuzzy Hash: 4e131503fe38447772e4e2294cf5373b7e2007f9fac8d76d0a71823c743fc64d
      • Instruction Fuzzy Hash: E341BE30700200DFC711EF65DED2A1A77A5EB49304B104A3AF804B73E2CAB9AC01CBAD
      Function 00409330 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON
      Download Yara Rule

      Control-flow Graph

      APIs
      • CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,0040941F,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409376
      • GetLastError.KERNEL32(00000000,00000000,?,00000000,0040941F,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040937F
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CreateDirectoryErrorLast
      • String ID: .tmp
      • API String ID: 1375471231-2986845003
      • Opcode ID: 1c7982c9535877cc809d76a2290e1ec991a7408e90ad789d49a53b04ffd62ed2
      • Instruction ID: b240cf9bc22f775501a2d99da134be40bb2f76fb21a7d6e050461713caae6e8b
      • Opcode Fuzzy Hash: 1c7982c9535877cc809d76a2290e1ec991a7408e90ad789d49a53b04ffd62ed2
      • Instruction Fuzzy Hash: 9E216774A00208ABDB05EFA1C8429DFB7B8EF88304F50457BE901B73C2DA3C9E058A65
      Function 004094D8 Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 327 4094d8-4094e9 328 409532-409537 327->328 329 4094eb-4094ec 327->329 330 4094ee-4094f1 329->330 331 4094f3-4094fc Sleep 330->331 332 4094fe-409501 330->332 333 40950c-409511 call 408fbc 331->333 332->333 334 409503-409507 Sleep 332->334 336 409516-409518 333->336 334->333 336->328 337 40951a-409522 GetLastError 336->337 337->328 338 409524-40952c GetLastError 337->338 338->328 339 40952e-409530 338->339 339->328 339->330
      APIs
      • Sleep.KERNEL32(?,?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 004094F7
      • Sleep.KERNEL32(?,?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 00409507
      • GetLastError.KERNEL32(?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 0040951A
      • GetLastError.KERNEL32(?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 00409524
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ErrorLastSleep
      • String ID:
      • API String ID: 1458359878-0
      • Opcode ID: 97bb3b87fdda019371420e794be163fcf62410a15a23215566f33b90e6dc6563
      • Instruction ID: cd4a420f7ace5638a97e0bdb8a1e9fccbb234b9240edd4770f97938e6011a3cc
      • Opcode Fuzzy Hash: 97bb3b87fdda019371420e794be163fcf62410a15a23215566f33b90e6dc6563
      • Instruction Fuzzy Hash: 16F0967360451477CA35A5AF9D81A5F634DDAD1354B10813BE945F3283C538DD0142A9
      Function 00407749 Relevance: 3.3, APIs: 2, Instructions: 284fileCOMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 405 407749-40774a 406 4076dc-4076e6 WriteFile 405->406 407 40774c-40776f 405->407 408 4076e8-4076ea call 40748c 406->408 409 4076ef-4076f2 406->409 410 407770-407785 407->410 408->409 414 407700-407704 409->414 415 4076f4-4076fb call 4073ec 409->415 411 407787 410->411 412 4077f9 410->412 416 40778a-40778f 411->416 417 4077fd-407802 411->417 418 40783b-40783d 412->418 419 4077fb 412->419 415->414 422 407803-407819 416->422 425 407791-407792 416->425 417->422 423 407841-407843 418->423 419->417 424 40785b-40785c 422->424 433 40781b 422->433 423->424 426 4078d6-4078eb call 407890 InterlockedExchange 424->426 427 40785e-40788c 424->427 428 407724-407741 425->428 429 407794-4077b4 425->429 450 407912-407917 426->450 451 4078ed-407910 426->451 443 407820-407823 427->443 444 407890-407893 427->444 432 4077b5 428->432 435 407743 428->435 429->432 437 4077b6-4077b7 432->437 438 4077f7-4077f8 432->438 439 40781e-40781f 433->439 441 407746-407747 435->441 442 4077b9 435->442 437->442 438->412 439->443 441->405 445 4077bb-4077cd 441->445 442->445 447 407824 443->447 448 407898 443->448 444->448 445->423 449 4077cf-4077d4 445->449 452 407825 447->452 453 40789a 447->453 448->453 449->418 457 4077d6-4077de 449->457 451->450 451->451 455 407896-407897 452->455 456 407826-40782d 452->456 458 40789f 453->458 455->448 459 4078a1 456->459 460 40782f 456->460 457->410 468 4077e0 457->468 458->459 465 4078a3 459->465 466 4078ac 459->466 462 407832-407833 460->462 463 4078a5-4078aa 460->463 462->418 462->439 467 4078ae-4078af 463->467 465->463 466->467 467->458 469 4078b1-4078bd 467->469 468->438 469->448 470 4078bf-4078c0 469->470
      APIs
      • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004076DF
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: FileWrite
      • String ID:
      • API String ID: 3934441357-0
      • Opcode ID: 43d3196ec1ce5242573e8f450cfa6a0a1bc6604aabb0088ea34051851cbbaa4a
      • Instruction ID: 20d0a63744b7af467993d3e8aec565234b7be2d060ba20bf9fd199bb98bd5a4e
      • Opcode Fuzzy Hash: 43d3196ec1ce5242573e8f450cfa6a0a1bc6604aabb0088ea34051851cbbaa4a
      • Instruction Fuzzy Hash: 8251D12294D2910FC7126B7849685A53FE0FE5331132E92FBC5C1AB1A3D27CA847D35B
      Function 00401FD4 Relevance: 3.1, APIs: 2, Instructions: 122COMMON
      Download Yara Rule
      APIs
      • RtlEnterCriticalSection.KERNEL32(0040C41C,00000000,00402148), ref: 00402017
        • Part of subcall function 00401918: RtlInitializeCriticalSection.KERNEL32(0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
        • Part of subcall function 00401918: RtlEnterCriticalSection.KERNEL32(0040C41C,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
        • Part of subcall function 00401918: LocalAlloc.KERNEL32(00000000,00000FF8,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
        • Part of subcall function 00401918: RtlLeaveCriticalSection.KERNEL32(0040C41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CriticalSection$Enter$AllocInitializeLeaveLocal
      • String ID:
      • API String ID: 296031713-0
      • Opcode ID: e41243de7c80276a36dcdd2c2c0e451bb1a6f3055e5ddec7aea90b49354f7273
      • Instruction ID: b272be6629c35a549fc4f1c5a19e6e0df2414f51bb24a7fd7fb800939d1160d0
      • Opcode Fuzzy Hash: e41243de7c80276a36dcdd2c2c0e451bb1a6f3055e5ddec7aea90b49354f7273
      • Instruction Fuzzy Hash: D4419CB2A40711DFDB108F69DEC562A77A0FB58314B25837AD984B73E1D378A842CB48
      Function 00408FBC Relevance: 3.0, APIs: 2, Instructions: 42fileCOMMON
      Download Yara Rule
      APIs
      • DeleteFileA.KERNEL32(00000000,00000000,00409019,?,0000000D,00000000), ref: 00408FF3
      • GetLastError.KERNEL32(00000000,00000000,00409019,?,0000000D,00000000), ref: 00408FFB
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: DeleteErrorFileLast
      • String ID:
      • API String ID: 2018770650-0
      • Opcode ID: 51b14d3c2f7fde5c1a6bb776c84878c326085b2b0be15ffc15f9635c9f9f5f18
      • Instruction ID: 1f0403e6899a51d1d5356f81b6020870d4ad1054c4e625117792cee712869c3b
      • Opcode Fuzzy Hash: 51b14d3c2f7fde5c1a6bb776c84878c326085b2b0be15ffc15f9635c9f9f5f18
      • Instruction Fuzzy Hash: 16F0C871A04704ABCB01DF759D4159DB3E8DB8831475045BBF814F3682EA385E108599
      Function 0040AC4F Relevance: 3.0, APIs: 2, Instructions: 33COMMON
      Download Yara Rule
      APIs
      • RemoveDirectoryA.KERNEL32(00000000,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC01
      • DestroyWindow.USER32(00020412,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC15
        • Part of subcall function 004094D8: Sleep.KERNEL32(?,?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 004094F7
        • Part of subcall function 004094D8: GetLastError.KERNEL32(?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 0040951A
        • Part of subcall function 004094D8: GetLastError.KERNEL32(?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 00409524
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ErrorLast$DestroyDirectoryRemoveSleepWindow
      • String ID:
      • API String ID: 2192421792-0
      • Opcode ID: 2c973cdf999bbb1192929a8364406a109d64bb88cfdea17aa602a860d5632052
      • Instruction ID: be585450a05658aa0cbbe96fcd01bcdb7ec8c3c433658d061b63fb0e61c88a9e
      • Opcode Fuzzy Hash: 2c973cdf999bbb1192929a8364406a109d64bb88cfdea17aa602a860d5632052
      • Instruction Fuzzy Hash: 24F03170244200DBD724EB69EEC9B1632A5A784305F10423BF500B72F1C7FC98A1CB9D
      Function 00406FA0 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON
      Download Yara Rule
      APIs
      • SetErrorMode.KERNEL32(00008000), ref: 00406FAA
      • LoadLibraryA.KERNEL32(00000000,00000000,00406FF4,?,00000000,00407012,?,00008000), ref: 00406FD9
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ErrorLibraryLoadMode
      • String ID:
      • API String ID: 2987862817-0
      • Opcode ID: 9b48b29771c4fc6652b627c4d055133170331230f079557c80f3f4e2880abe46
      • Instruction ID: 292e1fc4e19851716b0ab93d2d43454b233f1d25ff8a05a0d03104374ea2dcbc
      • Opcode Fuzzy Hash: 9b48b29771c4fc6652b627c4d055133170331230f079557c80f3f4e2880abe46
      • Instruction Fuzzy Hash: D6F08270A14704BEDB129FB68C5282ABBECEB4DB0475349BAF914A26D2E53C5C209568
      Function 0040766C Relevance: 3.0, APIs: 2, Instructions: 30COMMON
      Download Yara Rule
      APIs
      • SetFilePointer.KERNEL32(?,?,?,00000000), ref: 0040768B
      • GetLastError.KERNEL32(?,?,?,00000000), ref: 00407693
        • Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,021003AC,?,0040A69B,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 0040748F
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ErrorLast$FilePointer
      • String ID:
      • API String ID: 1156039329-0
      • Opcode ID: cf8b3d77442686d6cce32677ffa2556d95a4d660bd32a6059a32509021572d83
      • Instruction ID: 64daf3b7b2b4cd691f255a674f922558070816022eb0a012369b73df1192a31e
      • Opcode Fuzzy Hash: cf8b3d77442686d6cce32677ffa2556d95a4d660bd32a6059a32509021572d83
      • Instruction Fuzzy Hash: B2E092766081016FD600D55EC881B9B37DCDFC5364F104536B654EB2D1D679EC108776
      Function 0040762C Relevance: 3.0, APIs: 2, Instructions: 30fileCOMMON
      Download Yara Rule
      APIs
      • ReadFile.KERNEL32(?,?,?,?,00000000), ref: 00407643
      • GetLastError.KERNEL32(?,?,?,?,00000000), ref: 00407652
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ErrorFileLastRead
      • String ID:
      • API String ID: 1948546556-0
      • Opcode ID: 1b4aea639ae4b78e93b9ef79541d7064bf1f98a27d237b51b731e51654b8bdcb
      • Instruction ID: e2f452503b48da12a69c10a9d1416f2aa512a4714c212e67fea7d8588799396e
      • Opcode Fuzzy Hash: 1b4aea639ae4b78e93b9ef79541d7064bf1f98a27d237b51b731e51654b8bdcb
      • Instruction Fuzzy Hash: 69E012A1A081106ADB24A66E9CC5F6B6BDCCBC5724F14457BF504DB382D678DC0487BB
      Function 004075C4 Relevance: 3.0, APIs: 2, Instructions: 24COMMON
      Download Yara Rule
      APIs
      • SetFilePointer.KERNEL32(?,00000000,?,00000001), ref: 004075DB
      • GetLastError.KERNEL32(?,00000000,?,00000001), ref: 004075E7
        • Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,021003AC,?,0040A69B,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 0040748F
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ErrorLast$FilePointer
      • String ID:
      • API String ID: 1156039329-0
      • Opcode ID: 7730a1f6a5d1c383143cef2e1ec1cb69b5af0836910a757b2920ce96cbe13b7f
      • Instruction ID: 74cf86129294d2faf5969c20f66175129728110ffa3c668ef2bae8a95e28f18b
      • Opcode Fuzzy Hash: 7730a1f6a5d1c383143cef2e1ec1cb69b5af0836910a757b2920ce96cbe13b7f
      • Instruction Fuzzy Hash: C4E04FB1600210AFDB10EEB98D81B9676D89F48364F0485B6EA14DF2C6D274DC00C766
      Function 00401430 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON
      Download Yara Rule
      APIs
      • VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00401739), ref: 0040145F
      • VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00401739), ref: 00401486
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Virtual$AllocFree
      • String ID:
      • API String ID: 2087232378-0
      • Opcode ID: efc6f27fa4c1f0416fcf42a0cb9c981ca4ea103f0f96f52908972bf4ed8d2b74
      • Instruction ID: 29306f1da17679ce7d7d3cecb65679b0075e6f6f2ddca0a826851c871ac90975
      • Opcode Fuzzy Hash: efc6f27fa4c1f0416fcf42a0cb9c981ca4ea103f0f96f52908972bf4ed8d2b74
      • Instruction Fuzzy Hash: 57F02772B0032057DB206A6A0CC1B636AC59F85B90F1541BBFA4CFF3F9D2B98C0042A9
      Function 00405280 Relevance: 1.6, APIs: 1, Instructions: 99COMMON
      Download Yara Rule
      APIs
      • GetSystemDefaultLCID.KERNEL32(00000000,004053B6), ref: 0040529F
        • Part of subcall function 00404CDC: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00404CF9
        • Part of subcall function 0040520C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: DefaultInfoLoadLocaleStringSystem
      • String ID:
      • API String ID: 1658689577-0
      • Opcode ID: ef449c44a2a61a26d18614e24c7ade2666283ce56a0d8fcdc2eeed56ad2c4646
      • Instruction ID: b95c725f163960c8622ba1b0af82130980b93a97e76f79286a035b518bc8de08
      • Opcode Fuzzy Hash: ef449c44a2a61a26d18614e24c7ade2666283ce56a0d8fcdc2eeed56ad2c4646
      • Instruction Fuzzy Hash: 90314F75E01509ABCB00DF95C8C19EEB379FF84304F158577E815BB286E739AE068B98
      Function 00407576 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON
      Download Yara Rule
      APIs
      • CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 004075B8
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CreateFile
      • String ID:
      • API String ID: 823142352-0
      • Opcode ID: c8aa5b1e1f382d9b7ab40d46c96f796d669d4b8c7333918930cf1677525ebce7
      • Instruction ID: d860c9bcffbd3325f9178b4d72e9b59b5a3ff3896166b15a891a1a6cde46a7a7
      • Opcode Fuzzy Hash: c8aa5b1e1f382d9b7ab40d46c96f796d669d4b8c7333918930cf1677525ebce7
      • Instruction Fuzzy Hash: 6EE06D713442082EE3409AEC6C51FA277DCD309354F008032B988DB342D5719D108BE8
      Function 00407578 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON
      Download Yara Rule
      APIs
      • CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 004075B8
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CreateFile
      • String ID:
      • API String ID: 823142352-0
      • Opcode ID: 3bd7282c13d8f152a8301508d2aa72b6e2817799d08f3caede8a9fdcd0036c45
      • Instruction ID: d44512077142226ebef1615cfdb59f208ea4aebd3ed4d24446e2b73eb7949d4a
      • Opcode Fuzzy Hash: 3bd7282c13d8f152a8301508d2aa72b6e2817799d08f3caede8a9fdcd0036c45
      • Instruction Fuzzy Hash: A7E06D713442082ED2409AEC6C51F92779C9309354F008022B988DB342D5719D108BE8
      Function 004069DC Relevance: 1.5, APIs: 1, Instructions: 29COMMON
      Download Yara Rule
      APIs
      • GetFileAttributesA.KERNEL32(00000000,00000000,00406A24,?,?,?,?,00000000,?,00406A39,00406D67,00000000,00406DAC,?,?,?), ref: 00406A07
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AttributesFile
      • String ID:
      • API String ID: 3188754299-0
      • Opcode ID: 2f6b808c0a98facf9b4219f47e50352985dbcf5de86cc118cb6830f30f21a29b
      • Instruction ID: ccd219c895c276d3a4f2ed408fb3af00451e62210c6f1137e8185e88dac79a2a
      • Opcode Fuzzy Hash: 2f6b808c0a98facf9b4219f47e50352985dbcf5de86cc118cb6830f30f21a29b
      • Instruction Fuzzy Hash: A0E0ED30300304BBD301FBA6CC42E4ABBECDB8A708BA28476B400B2682D6786E108428
      Function 004076C8 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON
      Download Yara Rule
      APIs
      • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004076DF
        • Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,021003AC,?,0040A69B,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 0040748F
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ErrorFileLastWrite
      • String ID:
      • API String ID: 442123175-0
      • Opcode ID: 8d2af3ab7a63a8387ab01b8eb17bee2761ee08039256abb6018552f25082062b
      • Instruction ID: d11fc940c1eb4d9ab9bd5ee1403c634941755763b259216c6d34bff68e3e8731
      • Opcode Fuzzy Hash: 8d2af3ab7a63a8387ab01b8eb17bee2761ee08039256abb6018552f25082062b
      • Instruction Fuzzy Hash: 6DE0ED766081106BD710A65AD880EAB67DCDFC5764F00407BF904DB291D574AC049676
      Function 00407284 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON
      Download Yara Rule
      APIs
      • FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00409127,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 004072A3
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: FormatMessage
      • String ID:
      • API String ID: 1306739567-0
      • Opcode ID: 7ef42d69529baecca532a801bf1eab389dc79dba057db81877db687b261eaad4
      • Instruction ID: 7b38442d06f496379890204edef453c821f476d6c52b93f329ea0e63e965d40b
      • Opcode Fuzzy Hash: 7ef42d69529baecca532a801bf1eab389dc79dba057db81877db687b261eaad4
      • Instruction Fuzzy Hash: 17E0D8A0B8830136F22414544C87B77220E47C0700F10807E7700ED3C6D6BEA906815F
      Function 004076AC Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON
      Download Yara Rule
      APIs
      • SetEndOfFile.KERNEL32(?,02124000,0040AA59,00000000), ref: 004076B3
        • Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,021003AC,?,0040A69B,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 0040748F
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ErrorFileLast
      • String ID:
      • API String ID: 734332943-0
      • Opcode ID: 3c9e02bda174eefd6a6752df40b73b0cbe28e66d981a9881f8e50d89b6fd2d40
      • Instruction ID: f788b2e916ece263959a2b362e6cc5638f15ca068e5e6b6e193a7bb405067b9b
      • Opcode Fuzzy Hash: 3c9e02bda174eefd6a6752df40b73b0cbe28e66d981a9881f8e50d89b6fd2d40
      • Instruction Fuzzy Hash: BEC04CA1A1410047CB40A6BE89C1A1666D85A4821530485B6B908DB297D679E8004666
      Function 00406FFB Relevance: 1.5, APIs: 1, Instructions: 10COMMON
      Download Yara Rule
      APIs
      • SetErrorMode.KERNEL32(?,00407019), ref: 0040700C
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ErrorMode
      • String ID:
      • API String ID: 2340568224-0
      • Opcode ID: 070e151ae7371931e812c23e1680e2574253ea8634671ff6451d3f815f7c1847
      • Instruction ID: c47f2f618e2971e07f5b1abb1c43dc6c143ad8b034d1ddbdae76011a93498253
      • Opcode Fuzzy Hash: 070e151ae7371931e812c23e1680e2574253ea8634671ff6451d3f815f7c1847
      • Instruction Fuzzy Hash: 54B09B76A1C2415DE705DAD5745153863D4D7C47143A14977F104D35C0D53DA4144519
      Function 00407017 Relevance: 1.5, APIs: 1, Instructions: 5COMMON
      Download Yara Rule
      APIs
      • SetErrorMode.KERNEL32(?,00407019), ref: 0040700C
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ErrorMode
      • String ID:
      • API String ID: 2340568224-0
      • Opcode ID: 258b7047379ce46b8540a294da6ad57472ce1849ceeb23a1b4b516eeda09cad2
      • Instruction ID: a55afa0689d716a84ca499c05243e055e04a08b2ab071a0afeb25d409e08decd
      • Opcode Fuzzy Hash: 258b7047379ce46b8540a294da6ad57472ce1849ceeb23a1b4b516eeda09cad2
      • Instruction Fuzzy Hash: FFA022A8C08000B2CE00E2E08080A3C23283A88308BC08BA2320CB20C0C03CE008020B
      Function 00406970 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
      Download Yara Rule
      APIs
      • CharPrevA.USER32(?,?,0040696C,?,00406649,?,?,00406D87,00000000,00406DAC,?,?,?,?,00000000,00000000), ref: 00406972
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CharPrev
      • String ID:
      • API String ID: 122130370-0
      • Opcode ID: 4f55c7aa95ee0cc6def6f8b84b07f7a00b4eea213dcaa2411b48aa5a82a0c27b
      • Instruction ID: 57bb655d476c0b104ac503b4dc16dcc9cc7d9309af7e6782790f501f1b0aeff9
      • Opcode Fuzzy Hash: 4f55c7aa95ee0cc6def6f8b84b07f7a00b4eea213dcaa2411b48aa5a82a0c27b
      • Instruction Fuzzy Hash:
      Function 00407F10 Relevance: 1.3, APIs: 1, Instructions: 62memoryCOMMON
      Download Yara Rule
      APIs
      • VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00407FA0
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 636722d4ca057b68616df378e1b8a5bd7f337355b9f7c137ab23b8dc1cafdb71
      • Instruction ID: 1e7236936b067224bcb0a7c190bcfb18a105a15b1652d3161176e1d0ad605fa4
      • Opcode Fuzzy Hash: 636722d4ca057b68616df378e1b8a5bd7f337355b9f7c137ab23b8dc1cafdb71
      • Instruction Fuzzy Hash: 43116371A042059BDB00EF19C881B5B7794AF44359F05807AF958AB2C6DB38E800CBAA
      Function 00401658 Relevance: 1.3, APIs: 1, Instructions: 48COMMON
      Download Yara Rule
      APIs
      • VirtualFree.KERNEL32(00000000,00000000,00004000,?,0000000C,?,-00000008,00003FFB,004018BF), ref: 004016B2
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: FreeVirtual
      • String ID:
      • API String ID: 1263568516-0
      • Opcode ID: a2f32dd8ef58eb042d1926e7c5d87192c2fb778a874e681f692e1318d4ea2181
      • Instruction ID: 63c8255cdd02620dd55efc6405714c3c0a63becca9b218cdeda95617091702f1
      • Opcode Fuzzy Hash: a2f32dd8ef58eb042d1926e7c5d87192c2fb778a874e681f692e1318d4ea2181
      • Instruction Fuzzy Hash: 3601A7726442148BC310AF28DDC093A77D5EB85364F1A4A7ED985B73A1D23B6C0587A8
      Function 00407548 Relevance: 1.3, APIs: 1, Instructions: 20COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CloseHandle
      • String ID:
      • API String ID: 2962429428-0
      • Opcode ID: fc6098dcd6b1504a072b68d3feaaa537492281b052079d944a979dec092e75e7
      • Instruction ID: e7ddd8f09f86228f97b62737e097d00c20d119481f2284b048c56b7aa048eabb
      • Opcode Fuzzy Hash: fc6098dcd6b1504a072b68d3feaaa537492281b052079d944a979dec092e75e7
      • Instruction Fuzzy Hash: 41D05E82B00A6017D615F2BE4D8869692D85F89685B08843AF654E77D1D67CEC00838D
      Function 00407EB8 Relevance: 1.3, APIs: 1, Instructions: 15COMMON
      Download Yara Rule
      APIs
      • VirtualFree.KERNEL32(?,00000000,00008000,?,00407E9D), ref: 00407ECF
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: FreeVirtual
      • String ID:
      • API String ID: 1263568516-0
      • Opcode ID: c7bedad96efb848ea9f674ed311898bb29a23f2a16fc3a9de009753beeeb9dd9
      • Instruction ID: 622015b425f940adf6dc1d0f89e873b9c6d17cfe6f0c2733970da1323f12c917
      • Opcode Fuzzy Hash: c7bedad96efb848ea9f674ed311898bb29a23f2a16fc3a9de009753beeeb9dd9
      • Instruction Fuzzy Hash: 3ED0E9B17553055BDB90EEB98CC1B0237D8BB48610F5044B66904EB296E674E8009654

      Non-executed Functions

      Function 00409448 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON
      Download Yara Rule
      APIs
      • GetCurrentProcess.KERNEL32(00000028), ref: 00409457
      • OpenProcessToken.ADVAPI32(00000000,00000028), ref: 0040945D
      • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 00409476
      • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000,00000000,SeShutdownPrivilege), ref: 0040949D
      • GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000,00000000,SeShutdownPrivilege), ref: 004094A2
      • ExitWindowsEx.USER32(00000002,00000000), ref: 004094B3
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
      • String ID: SeShutdownPrivilege
      • API String ID: 107509674-3733053543
      • Opcode ID: 5d5c4cc2167cea31fe6e778ad900630fb502c4628614430f67a63468396a48bc
      • Instruction ID: 55e16e97e4c30333ef6e9d7cb44a764448f3c494fd9ead6bbbdf5d5bb2f9c1eb
      • Opcode Fuzzy Hash: 5d5c4cc2167cea31fe6e778ad900630fb502c4628614430f67a63468396a48bc
      • Instruction Fuzzy Hash: 61F012B069830179E610AAB18D07F6762885BC4B18F50493ABB15FA1C3D7BDD809466F
      Function 00409C34 Relevance: 6.0, APIs: 4, Instructions: 31COMMON
      Download Yara Rule
      APIs
      • FindResourceA.KERNEL32(00000000,00002B67,0000000A), ref: 00409C3E
      • SizeofResource.KERNEL32(00000000,00000000,?,0040A6B3,00000000,0040AC4A,?,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 00409C51
      • LoadResource.KERNEL32(00000000,00000000,00000000,00000000,?,0040A6B3,00000000,0040AC4A,?,00000001,00000000,00000002,00000000,0040AC92,?,00000000), ref: 00409C63
      • LockResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,0040A6B3,00000000,0040AC4A,?,00000001,00000000,00000002,00000000,0040AC92), ref: 00409C74
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Resource$FindLoadLockSizeof
      • String ID:
      • API String ID: 3473537107-0
      • Opcode ID: 66472a43d98f2116202d14454299061058d21427157a3f4f4112e001326967e1
      • Instruction ID: 5c2a5118689e511edc0a9dde7e1b9e77d0383d271af581b44440e1e73e890ea9
      • Opcode Fuzzy Hash: 66472a43d98f2116202d14454299061058d21427157a3f4f4112e001326967e1
      • Instruction Fuzzy Hash: B0E07E80B8874726FA6576FB08C7B6B008C4BA570EF00003BB700792C3DDBC8C04462E
      Function 00405258 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
      Download Yara Rule
      APIs
      • GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040545A,?,?,?,00000000,0040560C), ref: 0040526B
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: InfoLocale
      • String ID:
      • API String ID: 2299586839-0
      • Opcode ID: b79b605a6dbd2dbd76dc5df923bc970e8acc9169766131cf64cabc826e101d13
      • Instruction ID: 1db3d1c1bb6fab5f91442dea8a08a829cd161d84d3a7e1f0c2fe21aaaafd944f
      • Opcode Fuzzy Hash: b79b605a6dbd2dbd76dc5df923bc970e8acc9169766131cf64cabc826e101d13
      • Instruction Fuzzy Hash: 9ED02EA230E2006AE210808B2C84EBB4A9CCEC53A0F00007FF648C3242D2208C029B76
      Function 004026C4 Relevance: 1.5, APIs: 1, Instructions: 20timeCOMMON
      Download Yara Rule
      APIs
      • GetSystemTime.KERNEL32(?), ref: 004026CE
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: SystemTime
      • String ID:
      • API String ID: 2656138-0
      • Opcode ID: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
      • Instruction ID: 69442b1fa125f02c17f5f00667ba5619268a94e84ed87230136e9e38920861ba
      • Opcode Fuzzy Hash: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
      • Instruction Fuzzy Hash: 14E04F21E0010A82C704ABA5CD435EDF7AEAB95600B044272A418E92E0F631C251C748
      Function 00405CF4 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
      Download Yara Rule
      APIs
      • GetVersionExA.KERNEL32(?,004065F0,00000000,004065FE,?,?,?,?,?,0040A622), ref: 00405D02
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Version
      • String ID:
      • API String ID: 1889659487-0
      • Opcode ID: 804cda8d473c4c61bcc63f12479ba9190822d5c554409fc9a119c77cb0a2aa37
      • Instruction ID: 4c33b40dd65743d8d98a5ffd827b1eb297e5dd4f71424004bfe2d5ab9b26ea54
      • Opcode Fuzzy Hash: 804cda8d473c4c61bcc63f12479ba9190822d5c554409fc9a119c77cb0a2aa37
      • Instruction Fuzzy Hash: 00C0126040070186D7109B31DC02B1672D4AB44310F4405396DA4963C2E73C80018A6E
      Function 0040840C Relevance: .5, Instructions: 545COMMON
      Download Yara Rule
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 4d767100099eb102bdc21c19fdb755dbde7929e86d9821f584b3da527505dd0e
      • Instruction ID: 7dc6dc86846b3232beed044054ddb30c9891ac2fec336679fba6e94018ae2b4c
      • Opcode Fuzzy Hash: 4d767100099eb102bdc21c19fdb755dbde7929e86d9821f584b3da527505dd0e
      • Instruction Fuzzy Hash: C032D775E00219DFCB14CF99CA80AADB7B2BF88314F24816AD855B7385DB34AE42CF55
      Function 00407024 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86registrylibraryloaderCOMMON
      Download Yara Rule
      APIs
      • GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,00407129,?,00000000,00409918), ref: 0040704D
      • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00407053
      • RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,00407129,?,00000000,00409918), ref: 004070A1
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressCloseHandleModuleProc
      • String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
      • API String ID: 4190037839-2401316094
      • Opcode ID: 84283e8ecd5f01446eeee6c4ca3ac4597d6d061694d9d4138b3ca6e7d0b19e25
      • Instruction ID: c068e7fb85b52830e378cef5638f1cf195f9e270113e5aa630163df598a56aa7
      • Opcode Fuzzy Hash: 84283e8ecd5f01446eeee6c4ca3ac4597d6d061694d9d4138b3ca6e7d0b19e25
      • Instruction Fuzzy Hash: 72214170E04209ABDB10EAB5CC55A9E77A9EB48304F60847BA510FB3C1D7BCAE01875E
      Function 00403A97 Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON
      Download Yara Rule
      APIs
      • CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B1E
      • GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B42
      • SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B5E
      • ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00403B7F
      • SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00403BA8
      • SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00403BB2
      • GetStdHandle.KERNEL32(000000F5), ref: 00403BD2
      • GetFileType.KERNEL32(?,000000F5), ref: 00403BE9
      • CloseHandle.KERNEL32(?,?,000000F5), ref: 00403C04
      • GetLastError.KERNEL32(000000F5), ref: 00403C1E
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
      • String ID:
      • API String ID: 1694776339-0
      • Opcode ID: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
      • Instruction ID: 6684f6b4d1923fa93cc5777a7ebe0ca766b8c5f16b1f456132d2f0a6dbb27d3d
      • Opcode Fuzzy Hash: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
      • Instruction Fuzzy Hash: 444194302042009EF7305F258805B237DEDEB4571AF208A3FA1D6BA6E1E77DAE419B5D
      Function 004053C4 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON
      Download Yara Rule
      APIs
      • GetSystemDefaultLCID.KERNEL32(00000000,0040560C,?,?,?,?,00000000,00000000,00000000,?,004065EB,00000000,004065FE), ref: 004053DE
        • Part of subcall function 0040520C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A
        • Part of subcall function 00405258: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040545A,?,?,?,00000000,0040560C), ref: 0040526B
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: InfoLocale$DefaultSystem
      • String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
      • API String ID: 1044490935-665933166
      • Opcode ID: 2becd82198b95216644133442ecc563e5ef80f5327bc31795fb041598c227e39
      • Instruction ID: cc137df54ae1fcbb63b87987e69a719e9c27c4b31815d0debc5c9b1d2781c89a
      • Opcode Fuzzy Hash: 2becd82198b95216644133442ecc563e5ef80f5327bc31795fb041598c227e39
      • Instruction Fuzzy Hash: F8515374B00548ABDB00EBA59891A5F7769DB88304F50D5BBB515BB3C6CA3DCA058F1C
      Function 004036B8 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON
      Download Yara Rule
      APIs
      • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 004036F2
      • SysAllocStringLen.OLEAUT32(?,00000000), ref: 004036FD
      • MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403710
      • SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 0040371A
      • MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403729
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ByteCharMultiWide$AllocString
      • String ID:
      • API String ID: 262959230-0
      • Opcode ID: 759139aa8138bb4f1b890a81a570935fc2f09484a8ccbcda4eb7e9d11bc9ffe5
      • Instruction ID: 1285967c487f36a4f1f77a8b8e1f1fe351824cacfdb80e5859a13ebcd08b75b2
      • Opcode Fuzzy Hash: 759139aa8138bb4f1b890a81a570935fc2f09484a8ccbcda4eb7e9d11bc9ffe5
      • Instruction Fuzzy Hash: 17F068A13442543AF56075A75C43FAB198CCB45BAEF10457FF704FA2C2D8B89D0492BD
      Function 00406E10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113registryCOMMON
      Download Yara Rule
      APIs
      • RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,00406F48,?,00000000,00409918,00000000), ref: 00406E4C
      • RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,70000000,?,?,00000000,00000000,00000000,?,00000000,00406F48,?,00000000), ref: 00406EBC
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: QueryValue
      • String ID: )q@
      • API String ID: 3660427363-2284170586
      • Opcode ID: 32d2d681139902fa63b50b1e86c1c6042aee641263ad409bd5d16b68eaa8278f
      • Instruction ID: 22a93fbabe645b78fd14ced98f65bd4bcb22fe3fd6f8222f7fa8e6a3c98f8dfc
      • Opcode Fuzzy Hash: 32d2d681139902fa63b50b1e86c1c6042aee641263ad409bd5d16b68eaa8278f
      • Instruction Fuzzy Hash: E6415E31D0021AAFDB21DF95C881BAFB7B8EB04704F56447AE901F7280D738AF108B99
      Function 00409C88 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30windowCOMMON
      Download Yara Rule
      APIs
      • MessageBoxA.USER32(00000000,00000000,Setup,00000010), ref: 00409CBD
      Strings
      • Setup, xrefs: 00409CAD
      • The Setup program accepts optional command line parameters./HELP, /?Shows this information./SP-Disables the This will install... Do you wish to continue? prompt at the beginning of Setup./SILENT, /VERYSILENTInstructs Setup to be silent or very si, xrefs: 00409CA1
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Message
      • String ID: Setup$The Setup program accepts optional command line parameters./HELP, /?Shows this information./SP-Disables the This will install... Do you wish to continue? prompt at the beginning of Setup./SILENT, /VERYSILENTInstructs Setup to be silent or very si
      • API String ID: 2030045667-3271211647
      • Opcode ID: bc66b1cf8cea732a030952d466b76090b354ad7a58696f118c0a4b0261ee3717
      • Instruction ID: b8b600ed6bdfe48e96a015bdf4867c85bc36f5512d0f27a60c0f94c744360238
      • Opcode Fuzzy Hash: bc66b1cf8cea732a030952d466b76090b354ad7a58696f118c0a4b0261ee3717
      • Instruction Fuzzy Hash: 8EE0E5302482087EE311EA528C13F6A7BACE789B04F600477F900B15C3D6786E00A068
      Function 004030DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9COMMON
      Download Yara Rule
      APIs
      • GetModuleHandleA.KERNEL32(00000000,0040A60E), ref: 004030E3
      • GetCommandLineA.KERNEL32(00000000,0040A60E), ref: 004030EE
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.2008454658.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.2008419834.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2008487795.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
      • Associated: 00000000.00000002.2009393386.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CommandHandleLineModule
      • String ID: U1hd.@
      • API String ID: 2123368496-2904493091
      • Opcode ID: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
      • Instruction ID: 0f926add87520dc699e98d27074396f9fab16295c11a520b4b5863bd90c7cb52
      • Opcode Fuzzy Hash: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
      • Instruction Fuzzy Hash: 03C01274541300CAD328AFF69E8A304B990A385349F40823FA608BA2F1CA7C4201EBDD

      Execution Graph

      Execution Coverage:14%
      Dynamic/Decrypted Code Coverage:0%
      Signature Coverage:7.3%
      Total number of Nodes:2000
      Total number of Limit Nodes:56
      execution_graph 52287 4990e8 52345 403344 52287->52345 52289 4990f6 52348 4056a0 52289->52348 52291 4990fb 52351 40631c GetModuleHandleA GetProcAddress 52291->52351 52295 499105 52359 40994c 52295->52359 52299 49910f 52372 412928 52299->52372 52301 499119 52377 419040 GetVersion 52301->52377 52657 4032fc 52345->52657 52347 403349 GetModuleHandleA GetCommandLineA 52347->52289 52350 4056db 52348->52350 52658 4033bc LocalAlloc TlsSetValue TlsGetValue TlsGetValue 52348->52658 52350->52291 52352 406338 52351->52352 52353 40633f GetProcAddress 52351->52353 52352->52353 52354 406355 GetProcAddress 52353->52354 52355 40634e 52353->52355 52356 406364 SetProcessDEPPolicy 52354->52356 52357 406368 52354->52357 52355->52354 52356->52357 52358 4063c4 6F571CD0 52357->52358 52358->52295 52659 409024 52359->52659 52364 408720 21 API calls 52365 40996f 52364->52365 52674 409070 GetVersionExA 52365->52674 52368 410764 52369 41076e 52368->52369 52370 4107ad GetCurrentThreadId 52369->52370 52371 4107c8 52370->52371 52371->52299 52676 40ad0c 52372->52676 52376 412954 52376->52301 52688 41de24 8 API calls 52377->52688 52379 419059 52690 418f38 GetCurrentProcessId 52379->52690 52657->52347 52658->52350 52660 408cbc 19 API calls 52659->52660 52661 409035 52660->52661 52662 4085dc GetSystemDefaultLCID 52661->52662 52664 408612 52662->52664 52663 406dec 19 API calls 52663->52664 52664->52663 52665 408568 19 API calls 52664->52665 52666 403450 18 API calls 52664->52666 52668 408674 52664->52668 52665->52664 52666->52664 52667 406dec 19 API calls 52667->52668 52668->52667 52669 408568 19 API calls 52668->52669 52670 403450 18 API calls 52668->52670 52671 4086f7 52668->52671 52669->52668 52670->52668 52672 403420 4 API calls 52671->52672 52673 408711 52672->52673 52673->52364 52675 409087 52674->52675 52675->52368 52678 40ad13 52676->52678 52677 40ad32 52680 41100c 52677->52680 52678->52677 52687 40ac44 33 API calls 52678->52687 52681 41102e 52680->52681 52682 406dec 19 API calls 52681->52682 52683 403450 18 API calls 52681->52683 52684 41104d 52681->52684 52682->52681 52683->52681 52685 403400 4 API calls 52684->52685 52686 411062 52685->52686 52686->52376 52687->52678 52689 41de9e 52688->52689 52689->52379 52706 4078c0 52690->52706 52693 4078c0 33 API calls 52694 418f99 GlobalAddAtomA 52693->52694 52695 418fb1 52694->52695 52707 4078d3 52706->52707 52708 4075b8 33 API calls 52707->52708 52709 4078e7 GlobalAddAtomA GetCurrentThreadId 52708->52709 52709->52693 49958 416b42 49959 416bea 49958->49959 49960 416b5a 49958->49960 49977 41531c 18 API calls 49959->49977 49962 416b74 SendMessageA 49960->49962 49963 416b68 49960->49963 49964 416bc8 49962->49964 49965 416b72 CallWindowProcA 49963->49965 49966 416b8e 49963->49966 49965->49964 49974 41a058 GetSysColor 49966->49974 49969 416b99 SetTextColor 49970 416bae 49969->49970 49975 41a058 GetSysColor 49970->49975 49972 416bb3 SetBkColor 49976 41a6e0 GetSysColor CreateBrushIndirect 49972->49976 49974->49969 49975->49972 49976->49964 49977->49964 54337 47d124 54339 47d12f 54337->54339 54338 452908 5 API calls 54338->54339 54339->54338 54340 47d145 GetLastError 54339->54340 54341 47d170 54339->54341 54340->54341 54342 47d14f GetLastError 54340->54342 54342->54341 54343 47d159 GetTickCount 54342->54343 54343->54341 54344 47d167 Sleep 54343->54344 54344->54339 49978 416644 49979 416651 49978->49979 49980 4166ab 49978->49980 49985 416550 CreateWindowExA 49979->49985 49981 416658 SetPropA SetPropA 49981->49980 49982 41668b 49981->49982 49983 41669e SetWindowPos 49982->49983 49983->49980 49985->49981 54345 4222e4 54346 4222f3 54345->54346 54351 421274 54346->54351 54349 422313 54352 4212e3 54351->54352 54356 421283 54351->54356 54355 4212f4 54352->54355 54376 4124d0 GetMenuItemCount GetMenuStringA GetMenuState 54352->54376 54354 421322 54358 421395 54354->54358 54366 42133d 54354->54366 54355->54354 54357 4213ba 54355->54357 54356->54352 54375 408d2c 33 API calls 54356->54375 54361 4213ce SetMenu 54357->54361 54373 421393 54357->54373 54364 4213a9 54358->54364 54358->54373 54359 4213e6 54379 4211bc 24 API calls 54359->54379 54361->54373 54363 4213ed 54363->54349 54374 4221e8 10 API calls 54363->54374 54367 4213b2 SetMenu 54364->54367 54368 421360 GetMenu 54366->54368 54366->54373 54367->54373 54369 421383 54368->54369 54370 42136a 54368->54370 54377 4124d0 GetMenuItemCount GetMenuStringA GetMenuState 54369->54377 54372 42137d SetMenu 54370->54372 54372->54369 54373->54359 54378 421e2c 25 API calls 54373->54378 54374->54349 54375->54356 54376->54355 54377->54373 54378->54359 54379->54363 54380 404d2a 54381 404d3a 54380->54381 54382 404e07 ExitProcess 54381->54382 54383 404de0 54381->54383 54386 404e12 54381->54386 54390 404db7 MessageBoxA 54381->54390 54391 404dcc 54381->54391 54396 404cf0 54383->54396 54387 404cf0 4 API calls 54388 404df4 54387->54388 54400 401a90 54388->54400 54390->54383 54412 40500c LocalAlloc TlsSetValue TlsGetValue TlsGetValue 54391->54412 54392 404df9 54392->54382 54392->54386 54397 404cfe 54396->54397 54399 404d13 54397->54399 54413 402728 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 54397->54413 54399->54387 54401 401aa1 54400->54401 54402 401b6f 54400->54402 54403 401ac2 LocalFree 54401->54403 54404 401ab8 RtlEnterCriticalSection 54401->54404 54402->54392 54405 401af5 54403->54405 54404->54403 54406 401ae3 VirtualFree 54405->54406 54407 401afd 54405->54407 54406->54405 54408 401b24 LocalFree 54407->54408 54409 401b3b 54407->54409 54408->54408 54408->54409 54410 401b53 RtlLeaveCriticalSection 54409->54410 54411 401b5d RtlDeleteCriticalSection 54409->54411 54410->54411 54411->54392 54413->54399 54414 44b4a8 54415 44b4b6 54414->54415 54417 44b4d5 54414->54417 54416 44b38c 25 API calls 54415->54416 54415->54417 54416->54417 49986 492004 49987 49203e 49986->49987 49988 49204a 49987->49988 49989 492040 49987->49989 49991 492059 49988->49991 49992 492082 49988->49992 50183 409098 MessageBeep 49989->50183 50184 446ff8 32 API calls 49991->50184 49999 4920ba 49992->49999 50000 492091 49992->50000 49996 492066 50185 406bb0 49996->50185 50007 4920c9 49999->50007 50008 4920f2 49999->50008 50193 446ff8 32 API calls 50000->50193 50005 49209e 50194 406c00 18 API calls 50005->50194 50196 446ff8 32 API calls 50007->50196 50013 49211a 50008->50013 50014 492101 50008->50014 50009 4920a9 50195 44734c 19 API calls 50009->50195 50012 4920d6 50197 406c34 18 API calls 50012->50197 50021 492129 50013->50021 50022 49214e 50013->50022 50199 407280 19 API calls 50014->50199 50017 4920e1 50198 44734c 19 API calls 50017->50198 50018 492109 50200 44734c 19 API calls 50018->50200 50201 446ff8 32 API calls 50021->50201 50025 49215d 50022->50025 50026 492186 50022->50026 50024 492136 50202 4072a8 50024->50202 50206 446ff8 32 API calls 50025->50206 50033 4921be 50026->50033 50034 492195 50026->50034 50029 49213e 50205 4470d0 19 API calls 50029->50205 50030 49216a 50207 42c804 50030->50207 50040 49220a 50033->50040 50041 4921cd 50033->50041 50217 446ff8 32 API calls 50034->50217 50038 4921a2 50218 4071f8 22 API calls 50038->50218 50046 492219 50040->50046 50047 492242 50040->50047 50220 446ff8 32 API calls 50041->50220 50042 4921ad 50219 44734c 19 API calls 50042->50219 50045 4921dc 50221 446ff8 32 API calls 50045->50221 50224 446ff8 32 API calls 50046->50224 50054 49227a 50047->50054 50055 492251 50047->50055 50050 4921ed 50222 491d08 22 API calls 50050->50222 50051 492226 50225 42c8a4 50051->50225 50063 492289 50054->50063 50064 4922b2 50054->50064 50231 446ff8 32 API calls 50055->50231 50056 4921f9 50223 44734c 19 API calls 50056->50223 50061 49225e 50232 42c8cc 50061->50232 50241 446ff8 32 API calls 50063->50241 50069 4922ea 50064->50069 50070 4922c1 50064->50070 50068 492296 50242 42c8fc 19 API calls 50068->50242 50077 4922f9 50069->50077 50078 492322 50069->50078 50244 446ff8 32 API calls 50070->50244 50073 4922a1 50243 44734c 19 API calls 50073->50243 50074 4922ce 50245 42c92c 50074->50245 50251 446ff8 32 API calls 50077->50251 50083 49236e 50078->50083 50084 492331 50078->50084 50082 492306 50252 42c954 50082->50252 50090 49237d 50083->50090 50091 4923c0 50083->50091 50258 446ff8 32 API calls 50084->50258 50089 492340 50259 446ff8 32 API calls 50089->50259 50262 446ff8 32 API calls 50090->50262 50099 4923cf 50091->50099 50100 492433 50091->50100 50094 492351 50260 42c4f8 19 API calls 50094->50260 50095 492390 50263 446ff8 32 API calls 50095->50263 50098 49235d 50261 44734c 19 API calls 50098->50261 50173 446ff8 32 API calls 50099->50173 50108 492472 50100->50108 50109 492442 50100->50109 50101 4923a1 50264 491f00 26 API calls 50101->50264 50105 4923dc 50174 42c608 21 API calls 50105->50174 50107 4923af 50265 44734c 19 API calls 50107->50265 50118 4924b1 50108->50118 50119 492481 50108->50119 50268 446ff8 32 API calls 50109->50268 50111 4923ea 50114 4923ee 50111->50114 50115 492423 50111->50115 50113 49244f 50269 452908 50113->50269 50175 446ff8 32 API calls 50114->50175 50267 4470d0 19 API calls 50115->50267 50127 4924f0 50118->50127 50128 4924c0 50118->50128 50276 446ff8 32 API calls 50119->50276 50122 4923fd 50176 452c80 50122->50176 50126 49248e 50277 452770 50126->50277 50137 492538 50127->50137 50138 4924ff 50127->50138 50285 446ff8 32 API calls 50128->50285 50129 49240d 50266 4470d0 19 API calls 50129->50266 50133 49249b 50284 4470d0 19 API calls 50133->50284 50134 4924cd 50286 452e10 50134->50286 50144 492580 50137->50144 50145 492547 50137->50145 50293 446ff8 32 API calls 50138->50293 50142 49250e 50294 446ff8 32 API calls 50142->50294 50149 492593 50144->50149 50156 492649 50144->50156 50296 446ff8 32 API calls 50145->50296 50146 49251f 50295 447278 19 API calls 50146->50295 50148 492556 50297 446ff8 32 API calls 50148->50297 50299 446ff8 32 API calls 50149->50299 50153 492567 50298 447278 19 API calls 50153->50298 50154 492045 50311 403420 50154->50311 50155 4925c0 50300 446ff8 32 API calls 50155->50300 50156->50154 50305 446f9c 32 API calls 50156->50305 50159 4925d7 50301 407ddc 21 API calls 50159->50301 50161 492662 50306 42e8c8 FormatMessageA 50161->50306 50166 4925f9 50302 446ff8 32 API calls 50166->50302 50168 49260d 50303 408508 18 API calls 50168->50303 50170 492618 50304 44734c 19 API calls 50170->50304 50172 492624 50173->50105 50174->50111 50175->50122 50319 452724 50176->50319 50178 452c9d 50178->50129 50179 452c99 50179->50178 50180 452cc1 MoveFileA GetLastError 50179->50180 50325 452760 50180->50325 50183->50154 50184->49996 50186 406bbf 50185->50186 50187 406be1 50186->50187 50188 406bd8 50186->50188 50328 403778 50187->50328 50189 403400 4 API calls 50188->50189 50190 406bdf 50189->50190 50192 44734c 19 API calls 50190->50192 50192->50154 50193->50005 50194->50009 50195->50154 50196->50012 50197->50017 50198->50154 50199->50018 50200->50154 50201->50024 50433 403738 50202->50433 50205->50154 50206->50030 50208 403738 50207->50208 50209 42c827 GetFullPathNameA 50208->50209 50210 42c833 50209->50210 50211 42c84a 50209->50211 50210->50211 50212 42c83b 50210->50212 50435 403494 50211->50435 50214 4034e0 18 API calls 50212->50214 50215 42c848 50214->50215 50216 44734c 19 API calls 50215->50216 50216->50154 50217->50038 50218->50042 50219->50154 50220->50045 50221->50050 50222->50056 50223->50154 50224->50051 50444 42c79c 50225->50444 50228 403778 18 API calls 50229 42c8c5 50228->50229 50230 44734c 19 API calls 50229->50230 50230->50154 50231->50061 50459 42c674 50232->50459 50235 42c8e0 50237 403400 4 API calls 50235->50237 50236 42c8e9 50238 403778 18 API calls 50236->50238 50239 42c8e7 50237->50239 50238->50239 50240 44734c 19 API calls 50239->50240 50240->50154 50241->50068 50242->50073 50243->50154 50244->50074 50246 42c79c IsDBCSLeadByte 50245->50246 50247 42c93c 50246->50247 50248 403778 18 API calls 50247->50248 50249 42c94e 50248->50249 50250 44734c 19 API calls 50249->50250 50250->50154 50251->50082 50253 42c79c IsDBCSLeadByte 50252->50253 50254 42c964 50253->50254 50255 403778 18 API calls 50254->50255 50256 42c975 50255->50256 50257 44734c 19 API calls 50256->50257 50257->50154 50258->50089 50259->50094 50260->50098 50261->50154 50262->50095 50263->50101 50264->50107 50265->50154 50266->50154 50267->50154 50268->50113 50270 452724 2 API calls 50269->50270 50271 45291e 50270->50271 50272 45293e DeleteFileA GetLastError 50271->50272 50274 452922 50271->50274 50273 452760 Wow64RevertWow64FsRedirection 50272->50273 50273->50274 50275 4470d0 19 API calls 50274->50275 50275->50154 50276->50126 50278 452724 2 API calls 50277->50278 50279 452786 50278->50279 50280 45278a 50279->50280 50281 4527a8 CreateDirectoryA GetLastError 50279->50281 50280->50133 50282 452760 Wow64RevertWow64FsRedirection 50281->50282 50283 4527ce 50282->50283 50283->50133 50284->50154 50285->50134 50287 452724 2 API calls 50286->50287 50288 452e26 50287->50288 50289 452e2a 50288->50289 50290 452e46 RemoveDirectoryA GetLastError 50288->50290 50292 4470d0 19 API calls 50289->50292 50291 452760 Wow64RevertWow64FsRedirection 50290->50291 50291->50289 50292->50154 50293->50142 50294->50146 50295->50154 50296->50148 50297->50153 50298->50154 50299->50155 50300->50159 50301->50166 50302->50168 50303->50170 50304->50172 50305->50161 50307 42e8ee 50306->50307 50308 4034e0 18 API calls 50307->50308 50309 42e90b 50308->50309 50310 44734c 19 API calls 50309->50310 50310->50154 50312 403426 50311->50312 50313 40344b 50312->50313 50314 402660 4 API calls 50312->50314 50315 403400 50313->50315 50314->50312 50316 40341f 50315->50316 50317 403406 50315->50317 50317->50316 50318 402660 4 API calls 50317->50318 50318->50316 50320 452732 50319->50320 50321 45272e 50319->50321 50322 452754 SetLastError 50320->50322 50323 45273b Wow64DisableWow64FsRedirection 50320->50323 50321->50179 50324 45274f 50322->50324 50323->50324 50324->50179 50326 452765 Wow64RevertWow64FsRedirection 50325->50326 50327 45276f 50325->50327 50326->50327 50327->50129 50329 4037aa 50328->50329 50332 40377d 50328->50332 50330 403400 4 API calls 50329->50330 50331 4037a0 50330->50331 50331->50190 50332->50329 50333 403791 50332->50333 50335 4034e0 50333->50335 50340 4034bc 50335->50340 50337 4034f0 50338 403400 4 API calls 50337->50338 50339 403508 50338->50339 50339->50331 50341 4034c0 50340->50341 50342 4034dc 50340->50342 50345 402648 50341->50345 50342->50337 50344 4034c9 50344->50337 50346 40264c 50345->50346 50348 402656 50345->50348 50351 402088 50346->50351 50347 402652 50347->50348 50362 4033bc LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50347->50362 50348->50344 50348->50348 50352 40209c 50351->50352 50353 4020a1 50351->50353 50363 4019cc RtlInitializeCriticalSection 50352->50363 50355 4020c6 RtlEnterCriticalSection 50353->50355 50356 4020d0 50353->50356 50359 4020a5 50353->50359 50355->50356 50356->50359 50370 401f94 50356->50370 50359->50347 50360 4021f1 RtlLeaveCriticalSection 50361 4021fb 50360->50361 50361->50347 50362->50348 50364 4019f0 RtlEnterCriticalSection 50363->50364 50365 4019fa 50363->50365 50364->50365 50366 401a18 LocalAlloc 50365->50366 50367 401a32 50366->50367 50368 401a81 50367->50368 50369 401a77 RtlLeaveCriticalSection 50367->50369 50368->50353 50369->50368 50373 401fa4 50370->50373 50371 401fd0 50375 401ff4 50371->50375 50381 401db4 50371->50381 50373->50371 50373->50375 50376 401f0c 50373->50376 50375->50360 50375->50361 50385 40178c 50376->50385 50379 401f29 50379->50373 50382 401e02 50381->50382 50383 401dd2 50381->50383 50382->50383 50407 401d1c 50382->50407 50383->50375 50386 4017a8 50385->50386 50387 4017b2 50386->50387 50390 40180f 50386->50390 50393 401803 50386->50393 50396 4014e4 50386->50396 50405 4013e0 LocalAlloc 50386->50405 50404 401678 VirtualAlloc 50387->50404 50390->50379 50395 401e80 9 API calls 50390->50395 50391 4017be 50391->50390 50406 4015c0 VirtualFree 50393->50406 50395->50379 50397 4014f3 VirtualAlloc 50396->50397 50399 401520 50397->50399 50400 401543 50397->50400 50401 401398 LocalAlloc 50399->50401 50400->50386 50402 40152c 50401->50402 50402->50400 50403 401530 VirtualFree 50402->50403 50403->50400 50404->50391 50405->50386 50406->50390 50408 401d2e 50407->50408 50409 401d51 50408->50409 50410 401d63 50408->50410 50420 401940 50409->50420 50412 401940 3 API calls 50410->50412 50413 401d61 50412->50413 50414 401d79 50413->50414 50430 401bf8 9 API calls 50413->50430 50414->50383 50416 401d88 50417 401da2 50416->50417 50431 401c4c 9 API calls 50416->50431 50432 401454 LocalAlloc 50417->50432 50421 401966 50420->50421 50429 4019bf 50420->50429 50422 40170c VirtualFree 50421->50422 50423 401973 50422->50423 50424 4013e0 LocalAlloc 50423->50424 50425 401983 50424->50425 50426 40199a 50425->50426 50427 4015c0 VirtualFree 50425->50427 50428 401454 LocalAlloc 50426->50428 50426->50429 50427->50426 50428->50429 50429->50413 50430->50416 50431->50417 50432->50414 50434 40373c SetCurrentDirectoryA 50433->50434 50434->50029 50436 403498 50435->50436 50437 4034ba 50436->50437 50439 402660 50436->50439 50437->50215 50440 402664 50439->50440 50441 40266e 50439->50441 50440->50441 50443 4033bc LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50440->50443 50441->50437 50441->50441 50443->50441 50449 42c67c 50444->50449 50446 42c7fb 50446->50228 50448 42c7b1 50448->50446 50456 42c444 IsDBCSLeadByte 50448->50456 50451 42c68d 50449->50451 50452 42c6f1 50451->50452 50455 42c6ab 50451->50455 50453 42c6ec 50452->50453 50458 42c444 IsDBCSLeadByte 50452->50458 50453->50448 50455->50453 50457 42c444 IsDBCSLeadByte 50455->50457 50456->50448 50457->50455 50458->50453 50460 42c67c IsDBCSLeadByte 50459->50460 50461 42c67b 50460->50461 50461->50235 50461->50236 54418 4165ec DestroyWindow 54419 42e3ef SetErrorMode 50462 423c0c 50467 423c42 50462->50467 50465 423cec 50468 423cf3 50465->50468 50469 423d27 50465->50469 50466 423c8d 50470 423c93 50466->50470 50471 423d50 50466->50471 50481 423c63 50467->50481 50556 423b68 50467->50556 50472 423cf9 50468->50472 50515 423fb1 50468->50515 50475 423d32 50469->50475 50476 42409a IsIconic 50469->50476 50473 423cc5 50470->50473 50474 423c98 50470->50474 50477 423d62 50471->50477 50478 423d6b 50471->50478 50479 423f13 SendMessageA 50472->50479 50480 423d07 50472->50480 50473->50481 50505 423cde 50473->50505 50506 423e3f 50473->50506 50483 423df6 50474->50483 50484 423c9e 50474->50484 50485 4240d6 50475->50485 50486 423d3b 50475->50486 50476->50481 50482 4240ae GetFocus 50476->50482 50487 423d78 50477->50487 50488 423d69 50477->50488 50579 424194 11 API calls 50478->50579 50479->50481 50480->50481 50507 423cc0 50480->50507 50536 423f56 50480->50536 50482->50481 50493 4240bf 50482->50493 50592 423b84 NtdllDefWindowProc_A 50483->50592 50494 423ca7 50484->50494 50495 423e1e PostMessageA 50484->50495 50612 424850 WinHelpA PostMessageA 50485->50612 50491 4240ed 50486->50491 50486->50507 50580 4241dc IsIconic 50487->50580 50588 423b84 NtdllDefWindowProc_A 50488->50588 50503 4240f6 50491->50503 50504 42410b 50491->50504 50610 41eff4 GetCurrentThreadId EnumThreadWindows 50493->50610 50500 423cb0 50494->50500 50501 423ea5 50494->50501 50560 423b84 NtdllDefWindowProc_A 50495->50560 50510 423cb9 50500->50510 50511 423dce IsIconic 50500->50511 50512 423eae 50501->50512 50513 423edf 50501->50513 50502 4240eb 50502->50481 50613 4244d4 50503->50613 50619 42452c LocalAlloc TlsSetValue TlsGetValue TlsGetValue SendMessageA 50504->50619 50505->50507 50516 423e0b 50505->50516 50561 423b84 NtdllDefWindowProc_A 50506->50561 50507->50481 50578 423b84 NtdllDefWindowProc_A 50507->50578 50510->50507 50525 423d91 50510->50525 50518 423dea 50511->50518 50519 423dde 50511->50519 50526 423b14 5 API calls 50512->50526 50575 423b84 NtdllDefWindowProc_A 50513->50575 50515->50481 50527 423fd7 IsWindowEnabled 50515->50527 50593 424178 50516->50593 50591 423b84 NtdllDefWindowProc_A 50518->50591 50590 423bc0 29 API calls 50519->50590 50523 423e45 50531 423e83 50523->50531 50532 423e61 50523->50532 50524 4240ce SetFocus 50524->50481 50525->50481 50589 422c4c ShowWindow PostMessageA PostQuitMessage 50525->50589 50533 423eb6 50526->50533 50527->50481 50534 423fe5 50527->50534 50530 423ee5 50535 423efd 50530->50535 50576 41eea4 GetCurrentThreadId EnumThreadWindows 50530->50576 50568 423a84 50531->50568 50562 423b14 50532->50562 50540 423ec8 50533->50540 50598 41ef58 50533->50598 50548 423fec IsWindowVisible 50534->50548 50543 423a84 6 API calls 50535->50543 50536->50481 50544 423f78 IsWindowEnabled 50536->50544 50604 423b84 NtdllDefWindowProc_A 50540->50604 50543->50481 50544->50481 50549 423f86 50544->50549 50548->50481 50550 423ffa GetFocus 50548->50550 50605 412310 21 API calls 50549->50605 50606 4181e0 50550->50606 50553 42400f SetFocus 50608 415240 50553->50608 50557 423b72 50556->50557 50558 423b7d 50556->50558 50557->50558 50620 408720 GetSystemDefaultLCID 50557->50620 50558->50465 50558->50466 50560->50481 50561->50523 50563 423b62 PostMessageA 50562->50563 50565 423b23 50562->50565 50563->50481 50564 423b5a 50695 40b1d8 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 50564->50695 50565->50563 50565->50564 50567 423b4e SetWindowPos 50565->50567 50567->50564 50567->50565 50569 423b0d PostMessageA 50568->50569 50570 423a94 50568->50570 50569->50481 50570->50569 50571 423a9a EnumWindows 50570->50571 50571->50569 50572 423ab6 GetWindow GetWindowLongA 50571->50572 50696 423a1c GetWindow 50571->50696 50573 423ad5 50572->50573 50573->50569 50574 423b01 SetWindowPos 50573->50574 50574->50569 50574->50573 50575->50530 50577 41ef29 50576->50577 50577->50535 50578->50481 50579->50481 50581 424223 50580->50581 50582 4241ed SetActiveWindow 50580->50582 50581->50481 50699 42364c 50582->50699 50585 423b14 5 API calls 50586 42420a 50585->50586 50586->50581 50587 42421d SetFocus 50586->50587 50587->50581 50588->50481 50589->50481 50590->50481 50591->50481 50592->50481 50711 41db30 50593->50711 50596 424190 50596->50481 50597 424184 LoadIconA 50597->50596 50599 41ef60 IsWindow 50598->50599 50600 41ef8c 50598->50600 50601 41ef7a 50599->50601 50602 41ef6f EnableWindow 50599->50602 50600->50540 50601->50599 50601->50600 50603 402660 4 API calls 50601->50603 50602->50601 50603->50601 50604->50481 50605->50481 50607 4181ea 50606->50607 50607->50553 50609 41525b SetFocus 50608->50609 50609->50481 50611 41f022 50610->50611 50611->50481 50611->50524 50612->50502 50614 4244e0 50613->50614 50616 4244fa 50613->50616 50615 4244e7 SendMessageA 50614->50615 50618 42450f 50614->50618 50615->50618 50617 402648 18 API calls 50616->50617 50617->50618 50618->50481 50619->50502 50675 408568 GetLocaleInfoA 50620->50675 50625 408568 19 API calls 50626 408775 50625->50626 50627 408568 19 API calls 50626->50627 50628 408799 50627->50628 50687 4085b4 GetLocaleInfoA 50628->50687 50631 4085b4 GetLocaleInfoA 50632 4087c9 50631->50632 50633 408568 19 API calls 50632->50633 50634 4087e3 50633->50634 50635 4085b4 GetLocaleInfoA 50634->50635 50636 408800 50635->50636 50637 408568 19 API calls 50636->50637 50638 40881a 50637->50638 50639 403450 18 API calls 50638->50639 50640 408827 50639->50640 50641 408568 19 API calls 50640->50641 50642 40883c 50641->50642 50643 403450 18 API calls 50642->50643 50644 408849 50643->50644 50645 4085b4 GetLocaleInfoA 50644->50645 50646 408857 50645->50646 50647 408568 19 API calls 50646->50647 50648 408871 50647->50648 50649 403450 18 API calls 50648->50649 50650 40887e 50649->50650 50651 408568 19 API calls 50650->50651 50652 408893 50651->50652 50653 403450 18 API calls 50652->50653 50654 4088a0 50653->50654 50655 408568 19 API calls 50654->50655 50656 4088b5 50655->50656 50657 4088d2 50656->50657 50658 4088c3 50656->50658 50660 403494 4 API calls 50657->50660 50659 403494 4 API calls 50658->50659 50661 4088d0 50659->50661 50660->50661 50662 408568 19 API calls 50661->50662 50663 4088f4 50662->50663 50664 408911 50663->50664 50665 408902 50663->50665 50667 403400 4 API calls 50664->50667 50666 403494 4 API calls 50665->50666 50668 40890f 50666->50668 50667->50668 50689 403634 50668->50689 50676 4085a1 50675->50676 50677 40858f 50675->50677 50679 403494 4 API calls 50676->50679 50678 4034e0 18 API calls 50677->50678 50680 40859f 50678->50680 50679->50680 50681 403450 50680->50681 50682 403454 50681->50682 50685 403464 50681->50685 50684 4034bc 18 API calls 50682->50684 50682->50685 50683 403490 50683->50625 50684->50685 50685->50683 50686 402660 4 API calls 50685->50686 50686->50683 50688 4085d0 50687->50688 50688->50631 50690 40363c 50689->50690 50691 4034bc 18 API calls 50690->50691 50692 40364f 50691->50692 50695->50563 50697 423a3d GetWindowLongA 50696->50697 50698 423a49 50696->50698 50697->50698 50707 4235f8 SystemParametersInfoA 50699->50707 50702 423665 ShowWindow 50704 423670 50702->50704 50705 423677 50702->50705 50710 423628 SystemParametersInfoA 50704->50710 50705->50585 50708 423616 50707->50708 50708->50702 50709 423628 SystemParametersInfoA 50708->50709 50709->50702 50710->50705 50714 41db54 50711->50714 50715 41db3a 50714->50715 50716 41db61 50714->50716 50715->50596 50715->50597 50716->50715 50723 40ca80 19 API calls 50716->50723 50718 41db7e 50718->50715 50719 41db98 50718->50719 50720 41db8b 50718->50720 50724 41bd8c 25 API calls 50719->50724 50725 41b388 19 API calls 50720->50725 50723->50718 50724->50715 50725->50715 54420 46bb68 54421 46c005 54420->54421 54422 46bb9c 54420->54422 54423 403400 4 API calls 54421->54423 54424 46bbd8 54422->54424 54427 46bc34 54422->54427 54428 46bc12 54422->54428 54429 46bc23 54422->54429 54430 46bbf0 54422->54430 54431 46bc01 54422->54431 54426 46c044 54423->54426 54424->54421 54425 468c90 33 API calls 54424->54425 54440 46bc70 54425->54440 54433 403400 4 API calls 54426->54433 54720 46baf8 59 API calls 54427->54720 54475 46b728 54428->54475 54719 46b8e8 82 API calls 54429->54719 54717 46b478 61 API calls 54430->54717 54718 46b5e0 56 API calls 54431->54718 54439 46c04c 54433->54439 54438 46bbf6 54438->54421 54438->54424 54440->54421 54453 46bcb3 54440->54453 54721 4952e0 32 API calls 54440->54721 54442 468bcc 33 API calls 54442->54453 54446 42cbc0 20 API calls 54446->54453 54447 403450 18 API calls 54447->54453 54448 46af84 37 API calls 54448->54453 54451 414ae8 18 API calls 54451->54453 54452 46af84 37 API calls 54452->54421 54453->54421 54453->54442 54453->54446 54453->54447 54453->54448 54453->54451 54454 46be2f 54453->54454 54472 46bef7 54453->54472 54510 483968 54453->54510 54535 46acf0 54453->54535 54645 483460 54453->54645 54722 46b234 33 API calls 54453->54722 54542 469f38 54454->54542 54456 46be95 54457 403450 18 API calls 54456->54457 54458 46bea5 54457->54458 54459 46bf01 54458->54459 54460 46beb1 54458->54460 54463 46af84 37 API calls 54459->54463 54465 46bfc3 54459->54465 54461 457f1c 38 API calls 54460->54461 54462 46bed0 54461->54462 54464 457f1c 38 API calls 54462->54464 54466 46bf1b 54463->54466 54464->54472 54467 46bf44 SetActiveWindow 54466->54467 54468 46bf5c 54466->54468 54467->54468 54603 46a2e0 54468->54603 54470 46bf86 54471 46bfa6 54470->54471 54470->54472 54473 46ae00 35 API calls 54471->54473 54472->54452 54474 46bfbb 54473->54474 54723 46c47c 54475->54723 54478 46b8aa 54479 403420 4 API calls 54478->54479 54481 46b8c4 54479->54481 54480 414ae8 18 API calls 54482 46b776 54480->54482 54483 403400 4 API calls 54481->54483 54484 46b896 54482->54484 54726 455f84 54482->54726 54486 46b8cc 54483->54486 54484->54478 54485 403450 18 API calls 54484->54485 54485->54478 54488 403400 4 API calls 54486->54488 54489 46b8d4 54488->54489 54489->54424 54490 42cd48 21 API calls 54492 46b832 54490->54492 54491 46b859 54491->54478 54491->54484 54496 42cd48 21 API calls 54491->54496 54492->54491 54497 451458 18 API calls 54492->54497 54493 46b794 54494 46b7f9 54493->54494 54495 466600 33 API calls 54493->54495 54494->54478 54494->54490 54494->54491 54498 46b7c3 54495->54498 54499 46b86f 54496->54499 54500 46b849 54497->54500 54501 466600 33 API calls 54498->54501 54499->54484 54504 451458 18 API calls 54499->54504 54736 47f3ac 56 API calls 54500->54736 54503 46b7d4 54501->54503 54505 451428 18 API calls 54503->54505 54506 46b886 54504->54506 54507 46b7e9 54505->54507 54737 47f3ac 56 API calls 54506->54737 54735 47f3ac 56 API calls 54507->54735 54511 4181e0 54510->54511 54512 48399f GetForegroundWindow 54511->54512 54513 4839aa SetActiveWindow 54512->54513 54514 4839b8 54512->54514 54513->54514 54517 4839d9 54514->54517 54877 483864 54514->54877 54516 4839d4 KiUserCallbackDispatcher 54516->54517 54518 483a05 54517->54518 54520 483a9a 54517->54520 54521 483a64 54517->54521 54519 483adc 54518->54519 54522 457d10 38 API calls 54518->54522 54888 482890 54519->54888 54526 466800 34 API calls 54520->54526 54525 466800 34 API calls 54521->54525 54522->54519 54527 483a88 54525->54527 54528 483a98 54526->54528 54530 403634 18 API calls 54527->54530 54887 47f3ac 56 API calls 54528->54887 54530->54528 54532 483b18 54533 403420 4 API calls 54532->54533 54534 46bdf1 KiUserCallbackDispatcher 54533->54534 54534->54453 54536 46ad01 54535->54536 54537 46acfc 54535->54537 55232 469a9c 60 API calls 54536->55232 54538 46acff 54537->54538 55147 46a75c 54537->55147 54538->54453 54541 46ad09 54541->54453 54543 403400 4 API calls 54542->54543 54544 469f66 54543->54544 55248 47e0dc 54544->55248 54546 469fc9 54547 469fe6 54546->54547 54548 469fcd 54546->54548 54549 469fd7 54547->54549 55255 4951d0 18 API calls 54547->55255 54550 466800 34 API calls 54548->54550 54553 46a105 54549->54553 54554 46a170 54549->54554 54602 46a27a 54549->54602 54550->54549 54552 46a002 54552->54549 54556 46a00a 54552->54556 54557 403494 4 API calls 54553->54557 54558 403494 4 API calls 54554->54558 54555 403420 4 API calls 54559 46a2a4 54555->54559 54560 46af84 37 API calls 54556->54560 54561 46a112 54557->54561 54562 46a17d 54558->54562 54559->54456 54571 46a017 54560->54571 54563 40357c 18 API calls 54561->54563 54564 40357c 18 API calls 54562->54564 54566 46a11f 54563->54566 54565 46a18a 54564->54565 54568 40357c 18 API calls 54565->54568 54567 40357c 18 API calls 54566->54567 54569 46a12c 54567->54569 54570 46a197 54568->54570 54572 40357c 18 API calls 54569->54572 54573 40357c 18 API calls 54570->54573 54576 46a040 SetActiveWindow 54571->54576 54577 46a058 54571->54577 54574 46a139 54572->54574 54575 46a1a4 54573->54575 54578 466800 34 API calls 54574->54578 54579 40357c 18 API calls 54575->54579 54576->54577 54582 42f560 28 API calls 54577->54582 54580 46a147 54578->54580 54581 46a1b2 54579->54581 54583 40357c 18 API calls 54580->54583 54584 414b18 18 API calls 54581->54584 54585 46a06e 54582->54585 54586 46a150 54583->54586 54587 46a16e 54584->54587 55256 49547c 32 API calls 54585->55256 54589 40357c 18 API calls 54586->54589 54590 466b38 25 API calls 54587->54590 54592 46a15d 54589->54592 54596 46a1d4 54590->54596 54591 46a0a9 54594 46ae00 35 API calls 54591->54594 54593 414b18 18 API calls 54592->54593 54593->54587 54595 46a0db 54594->54595 54595->54456 54597 414b18 18 API calls 54596->54597 54596->54602 54598 46a237 54597->54598 55257 496090 MulDiv 54598->55257 54600 46a254 54601 414b18 18 API calls 54600->54601 54601->54602 54602->54555 54604 46a30c 54603->54604 54605 46a347 54604->54605 55301 47e3e4 54604->55301 54610 46a4bc 54605->54610 54626 46a35b 54605->54626 54607 46a4e3 54612 414b18 18 API calls 54607->54612 54608 403400 4 API calls 54615 46a661 54608->54615 54609 402648 18 API calls 54609->54626 54610->54607 54611 46a4f9 54610->54611 54644 46a63c 54610->54644 54618 414b18 18 API calls 54611->54618 54617 46a4f7 54612->54617 54613 46a4b4 54613->54470 54614 46a499 54614->54613 54620 402660 4 API calls 54614->54620 54615->54470 54616 402660 4 API calls 54616->54626 55317 496090 MulDiv 54617->55317 54618->54617 54619 46a465 54621 457f1c 38 API calls 54619->54621 54620->54613 54621->54614 54624 46a51a 54628 466b38 25 API calls 54624->54628 54625 457f1c 38 API calls 54627 46a3ce 54625->54627 54626->54609 54626->54616 54626->54627 54627->54614 54627->54619 54627->54625 54630 40357c 18 API calls 54627->54630 55316 403ba4 21 API calls 54627->55316 54629 46a54e 54628->54629 55318 466b40 KiUserCallbackDispatcher 54629->55318 54630->54627 54632 46a561 54633 466b38 25 API calls 54632->54633 54634 46a572 54633->54634 54635 414b18 18 API calls 54634->54635 54636 46a5a5 54635->54636 55319 496090 MulDiv 54636->55319 54638 46a5c2 54639 414b18 18 API calls 54638->54639 54640 46a5f9 54639->54640 55320 496090 MulDiv 54640->55320 54642 46a616 54643 414b18 18 API calls 54642->54643 54643->54644 54644->54608 54646 46c47c 62 API calls 54645->54646 54648 4834a3 54646->54648 54647 4834ac 54650 414ae8 18 API calls 54647->54650 54648->54647 55560 408be0 19 API calls 54648->55560 54651 4834bc 54650->54651 54652 403450 18 API calls 54651->54652 54653 4834c9 54652->54653 55348 46c7d4 54653->55348 54656 4834d9 54657 414ae8 18 API calls 54656->54657 54659 4834e9 54657->54659 54660 403450 18 API calls 54659->54660 54661 4834f6 54660->54661 54662 469884 SendMessageA 54661->54662 54663 48350f 54662->54663 54664 483560 54663->54664 55562 47a1f4 37 API calls 54663->55562 54665 4241dc 11 API calls 54664->54665 54667 48356a 54665->54667 54668 48357b SetActiveWindow 54667->54668 54669 483590 54667->54669 54668->54669 54670 482890 32 API calls 54669->54670 54671 4835a3 54670->54671 55377 475f64 54671->55377 54717->54438 54718->54424 54719->54424 54720->54424 54721->54453 54722->54453 54738 46c514 54723->54738 54727 42cbc0 20 API calls 54726->54727 54732 455fb2 54727->54732 54728 455fca 54730 403420 4 API calls 54728->54730 54731 456016 54730->54731 54731->54493 54732->54728 54733 42c8a4 19 API calls 54732->54733 54734 403494 4 API calls 54732->54734 54852 455e0c GetModuleHandleA GetProcAddress 54732->54852 54733->54732 54734->54732 54735->54494 54736->54491 54737->54484 54739 414ae8 18 API calls 54738->54739 54740 46c548 54739->54740 54799 466898 54740->54799 54743 414b18 18 API calls 54744 46c55a 54743->54744 54745 46c569 54744->54745 54747 46c582 54744->54747 54828 47f3ac 56 API calls 54745->54828 54750 46c5c9 54747->54750 54751 46c5b0 54747->54751 54748 403420 4 API calls 54749 46b75a 54748->54749 54749->54478 54749->54480 54752 46c62e 54750->54752 54765 46c5cd 54750->54765 54829 47f3ac 56 API calls 54751->54829 54831 42cb4c CharNextA 54752->54831 54755 46c63d 54756 46c641 54755->54756 54759 46c65a 54755->54759 54832 47f3ac 56 API calls 54756->54832 54758 46c615 54830 47f3ac 56 API calls 54758->54830 54760 46c67e 54759->54760 54808 466a08 54759->54808 54833 47f3ac 56 API calls 54760->54833 54765->54758 54765->54759 54768 46c697 54769 403778 18 API calls 54768->54769 54770 46c6ad 54769->54770 54816 42c99c 54770->54816 54773 46c6be 54834 466a94 18 API calls 54773->54834 54774 46c6ef 54776 42c8cc 19 API calls 54774->54776 54778 46c6fa 54776->54778 54777 46c6d1 54779 451458 18 API calls 54777->54779 54780 42c3fc 19 API calls 54778->54780 54781 46c6de 54779->54781 54782 46c705 54780->54782 54835 47f3ac 56 API calls 54781->54835 54784 42cbc0 20 API calls 54782->54784 54786 46c710 54784->54786 54785 46c57d 54785->54748 54820 46c4a8 54786->54820 54788 46c718 54789 42cd48 21 API calls 54788->54789 54790 46c720 54789->54790 54791 46c724 54790->54791 54792 46c73a 54790->54792 54836 47f3ac 56 API calls 54791->54836 54792->54785 54794 46c744 54792->54794 54795 46c74c GetDriveTypeA 54794->54795 54795->54785 54796 46c757 54795->54796 54837 47f3ac 56 API calls 54796->54837 54798 46c76b 54798->54785 54804 4668b2 54799->54804 54801 42cbc0 20 API calls 54801->54804 54802 403450 18 API calls 54802->54804 54803 406bb0 18 API calls 54803->54804 54804->54801 54804->54802 54804->54803 54805 4668fb 54804->54805 54838 42caac 54804->54838 54806 403420 4 API calls 54805->54806 54807 466915 54806->54807 54807->54743 54809 466a12 54808->54809 54810 466a25 54809->54810 54849 42cb3c CharNextA 54809->54849 54810->54760 54812 466a38 54810->54812 54814 466a42 54812->54814 54813 466a6f 54813->54760 54813->54768 54814->54813 54850 42cb3c CharNextA 54814->54850 54817 42c9f5 54816->54817 54818 42c9b2 54816->54818 54817->54773 54817->54774 54818->54817 54851 42cb3c CharNextA 54818->54851 54821 46c50d 54820->54821 54822 46c4bb 54820->54822 54821->54788 54822->54821 54823 41eea4 2 API calls 54822->54823 54824 46c4cb 54823->54824 54825 46c4e5 SHPathPrepareForWriteA 54824->54825 54826 41ef58 6 API calls 54825->54826 54827 46c505 54826->54827 54827->54788 54828->54785 54829->54785 54830->54785 54831->54755 54832->54785 54833->54785 54834->54777 54835->54785 54836->54785 54837->54798 54839 403494 4 API calls 54838->54839 54840 42cabc 54839->54840 54841 403744 18 API calls 54840->54841 54845 42caf2 54840->54845 54847 42c444 IsDBCSLeadByte 54840->54847 54841->54840 54843 42cb36 54843->54804 54845->54843 54846 4037b8 18 API calls 54845->54846 54848 42c444 IsDBCSLeadByte 54845->54848 54846->54845 54847->54840 54848->54845 54849->54809 54850->54814 54851->54818 54853 452724 2 API calls 54852->54853 54854 455e54 54853->54854 54855 455e61 54854->54855 54856 455e58 54854->54856 54857 455ea5 54855->54857 54858 455e73 54855->54858 54860 403420 4 API calls 54856->54860 54861 42c804 19 API calls 54857->54861 54859 42c804 19 API calls 54858->54859 54862 455e84 54859->54862 54863 455f4a 54860->54863 54864 455ebf 54861->54864 54865 42c3fc 19 API calls 54862->54865 54863->54732 54866 42c8cc 19 API calls 54864->54866 54867 455e8f 54865->54867 54868 455eca 54866->54868 54870 455e97 GetDiskFreeSpaceExA 54867->54870 54869 42c3fc 19 API calls 54868->54869 54871 455ed5 54869->54871 54872 455f13 54870->54872 54873 455edd GetDiskFreeSpaceA 54871->54873 54874 452760 Wow64RevertWow64FsRedirection 54872->54874 54873->54872 54876 455ef2 54873->54876 54875 455f28 54874->54875 54875->54732 54876->54872 54884 48389a 54877->54884 54878 483937 54879 483942 54878->54879 55006 48382c GetTickCount 54878->55006 54879->54516 54884->54878 54893 42f560 54884->54893 54909 47e594 54884->54909 54913 479638 54884->54913 54916 482b3c 54884->54916 55013 47967c 33 API calls 54884->55013 54887->54518 54889 4828e1 54888->54889 54890 4828b3 54888->54890 54892 482048 PostMessageA 54889->54892 55146 49522c 32 API calls 54890->55146 54892->54532 54894 42f56c 54893->54894 54895 42f58f GetActiveWindow GetFocus 54894->54895 54896 41eea4 2 API calls 54895->54896 54897 42f5a6 54896->54897 54898 42f5c3 54897->54898 54899 42f5b3 RegisterClassA 54897->54899 54900 42f652 SetFocus 54898->54900 54901 42f5d1 CreateWindowExA 54898->54901 54899->54898 54902 403400 4 API calls 54900->54902 54901->54900 54903 42f604 54901->54903 54904 42f66e 54902->54904 55014 42427c 54903->55014 54904->54884 54906 42f62c 54907 42f634 CreateWindowExA 54906->54907 54907->54900 54908 42f64a ShowWindow 54907->54908 54908->54900 54910 47e63b 54909->54910 54911 47e5a8 54909->54911 54910->54884 54911->54910 55020 457470 29 API calls 54911->55020 55021 479594 54913->55021 54917 457d10 38 API calls 54916->54917 54918 482b81 54917->54918 54919 482b98 54918->54919 54920 482b8c 54918->54920 54922 457d10 38 API calls 54919->54922 54921 457d10 38 API calls 54920->54921 54923 482b96 54921->54923 54922->54923 54924 482ba8 54923->54924 54925 482bb4 54923->54925 54926 457d10 38 API calls 54924->54926 54927 457d10 38 API calls 54925->54927 54928 482bb2 54926->54928 54927->54928 54929 47c648 57 API calls 54928->54929 54930 482bc8 54929->54930 54931 403494 4 API calls 54930->54931 54932 482bd5 54931->54932 54933 40357c 18 API calls 54932->54933 54934 482be0 54933->54934 54935 457d10 38 API calls 54934->54935 54936 482be8 54935->54936 54937 47c648 57 API calls 54936->54937 54938 482bf3 54937->54938 54939 482c19 54938->54939 54940 403494 4 API calls 54938->54940 54942 482c3e 54939->54942 54943 482d51 54939->54943 54941 482c06 54940->54941 54944 40357c 18 API calls 54941->54944 55029 482ac8 54942->55029 54946 482d67 54943->54946 54949 42cd5c 21 API calls 54943->54949 54947 482c11 54944->54947 54950 47c648 57 API calls 54946->54950 54951 457d10 38 API calls 54947->54951 54953 482d5f 54949->54953 54954 482d76 54950->54954 54951->54939 54952 482c61 54956 47c648 57 API calls 54952->54956 54953->54946 54957 482e25 54953->54957 54958 47c648 57 API calls 54954->54958 54961 482c70 54956->54961 54959 457d10 38 API calls 54957->54959 54962 482d96 54958->54962 55005 482d3d 54959->55005 55033 478180 54961->55033 55068 4782a8 50 API calls 54962->55068 54964 482d42 54967 457d10 38 API calls 54964->54967 54966 482da3 54971 451458 18 API calls 54966->54971 54966->55005 54967->55005 54969 403420 4 API calls 54972 482e69 54969->54972 54976 482db8 54971->54976 54977 403420 4 API calls 54972->54977 54980 40357c 18 API calls 54976->54980 54981 482e76 54977->54981 54984 482dc5 54980->54984 54985 403420 4 API calls 54981->54985 55069 406d68 33 API calls 54984->55069 54988 482e83 54985->54988 54988->54884 54990 482de0 54992 42e8c8 19 API calls 54990->54992 54994 482df1 54992->54994 54996 451428 18 API calls 54994->54996 54998 482e06 54996->54998 55000 40357c 18 API calls 54998->55000 55002 482e0f 55000->55002 55070 408c0c 18 API calls 55002->55070 55005->54969 55008 483844 55006->55008 55009 483861 55008->55009 55010 483836 GetTickCount 55008->55010 55012 482884 12 API calls 55008->55012 55141 42ec74 MsgWaitForMultipleObjects 55008->55141 55142 4837f8 GetForegroundWindow 55008->55142 55009->54879 55010->55008 55010->55009 55012->55008 55013->54884 55015 4242ae 55014->55015 55016 42428e GetWindowTextA 55014->55016 55018 403494 4 API calls 55015->55018 55017 4034e0 18 API calls 55016->55017 55019 4242ac 55017->55019 55018->55019 55019->54906 55020->54910 55022 4795a0 55021->55022 55023 4795c8 55021->55023 55024 4795c1 55022->55024 55027 453344 18 API calls 55022->55027 55023->54884 55028 479454 33 API calls 55024->55028 55027->55024 55028->55023 55031 482ad4 55029->55031 55030 482aef 55030->54952 55059 452da0 55030->55059 55031->55030 55071 453344 18 API calls 55031->55071 55034 4781a7 55033->55034 55035 4781b0 55033->55035 55034->55035 55036 4781d7 55034->55036 55072 455010 55035->55072 55114 477e9c 19 API calls 55036->55114 55041 478200 55115 477eb0 19 API calls 55041->55115 55044 47820a 55116 477eb0 19 API calls 55044->55116 55046 478214 55117 477eb0 19 API calls 55046->55117 55048 47821f 55118 477e9c 19 API calls 55048->55118 55050 47822c 55119 477e9c 19 API calls 55050->55119 55052 478237 55120 407280 19 API calls 55052->55120 55054 47823f 55060 452724 2 API calls 55059->55060 55061 452db6 55060->55061 55062 452dba 55061->55062 55063 42cd24 GetFileAttributesA 55061->55063 55062->54952 55062->54964 55064 452dd5 GetLastError 55063->55064 55065 452760 Wow64RevertWow64FsRedirection 55064->55065 55065->55062 55068->54966 55069->54990 55070->55005 55071->55030 55073 455036 55072->55073 55074 455061 55073->55074 55075 455052 55073->55075 55077 403634 18 API calls 55074->55077 55076 403494 4 API calls 55075->55076 55082 45505c 55076->55082 55078 455079 55077->55078 55079 455093 55078->55079 55080 403634 18 API calls 55078->55080 55139 42c8fc 19 API calls 55079->55139 55080->55079 55083 42d8c4 GetSystemDirectoryA 55082->55083 55085 45517c 55082->55085 55083->55085 55084 45509d 55087 4550b8 55084->55087 55140 42c8fc 19 API calls 55084->55140 55123 4527e8 55085->55123 55089 4550d2 55087->55089 55090 455109 55087->55090 55110 455107 55087->55110 55092 42d8c4 GetSystemDirectoryA 55089->55092 55093 42d898 GetWindowsDirectoryA 55090->55093 55091 4551ae 55094 4551c3 CloseHandle 55091->55094 55095 4551ba GetLastError 55091->55095 55096 4550df 55092->55096 55097 455116 55093->55097 55130 454f7c 55094->55130 55099 4551db 55095->55099 55101 42c3fc 19 API calls 55096->55101 55098 42c3fc 19 API calls 55097->55098 55102 455121 55098->55102 55104 403420 4 API calls 55099->55104 55105 4550ea 55101->55105 55106 403634 18 API calls 55102->55106 55103 42c8a4 19 API calls 55103->55082 55107 4551f5 55104->55107 55108 403634 18 API calls 55105->55108 55106->55110 55108->55110 55110->55082 55110->55103 55114->55041 55115->55044 55116->55046 55117->55048 55118->55050 55119->55052 55120->55054 55124 452724 2 API calls 55123->55124 55125 452801 55124->55125 55126 452805 55125->55126 55127 45280c CreateProcessA GetLastError 55125->55127 55126->55091 55128 452760 Wow64RevertWow64FsRedirection 55127->55128 55129 452861 55128->55129 55129->55091 55131 454fb4 55130->55131 55132 454fa0 WaitForInputIdle 55130->55132 55133 454fd4 GetExitCodeProcess 55131->55133 55137 454fbb MsgWaitForMultipleObjects 55131->55137 55132->55131 55137->55131 55139->55084 55140->55087 55141->55008 55143 48380b GetWindowThreadProcessId 55142->55143 55144 483824 55142->55144 55143->55144 55145 483819 GetCurrentProcessId 55143->55145 55144->55008 55145->55144 55146->54889 55149 46a7a3 55147->55149 55148 46ac1b 55151 46ac36 55148->55151 55152 46ac67 55148->55152 55149->55148 55150 46a85e 55149->55150 55154 403494 4 API calls 55149->55154 55153 46a87f 55150->55153 55158 46a8c0 55150->55158 55155 403494 4 API calls 55151->55155 55156 403494 4 API calls 55152->55156 55159 403494 4 API calls 55153->55159 55160 46a7e2 55154->55160 55161 46ac44 55155->55161 55157 46ac75 55156->55157 55245 469178 26 API calls 55157->55245 55166 403400 4 API calls 55158->55166 55163 46a88d 55159->55163 55164 414ae8 18 API calls 55160->55164 55244 469178 26 API calls 55161->55244 55168 414ae8 18 API calls 55163->55168 55169 46a803 55164->55169 55167 46a8be 55166->55167 55190 46a9a4 55167->55190 55233 469884 55167->55233 55172 46a8ae 55168->55172 55173 403634 18 API calls 55169->55173 55170 46ac52 55171 403400 4 API calls 55170->55171 55175 46ac98 55171->55175 55177 403634 18 API calls 55172->55177 55178 46a813 55173->55178 55181 403400 4 API calls 55175->55181 55176 46aa2c 55179 403400 4 API calls 55176->55179 55177->55167 55182 414ae8 18 API calls 55178->55182 55183 46aa2a 55179->55183 55180 46a8e0 55184 46a8e6 55180->55184 55185 46a91e 55180->55185 55186 46aca0 55181->55186 55187 46a827 55182->55187 55239 469cc0 57 API calls 55183->55239 55188 403494 4 API calls 55184->55188 55191 403400 4 API calls 55185->55191 55189 403420 4 API calls 55186->55189 55187->55150 55192 414ae8 18 API calls 55187->55192 55193 46a8f4 55188->55193 55194 46acad 55189->55194 55190->55176 55195 46a9eb 55190->55195 55196 46a91c 55191->55196 55197 46a84e 55192->55197 55199 47c648 57 API calls 55193->55199 55194->54538 55200 403494 4 API calls 55195->55200 55205 469b78 57 API calls 55196->55205 55201 403634 18 API calls 55197->55201 55203 46a90c 55199->55203 55204 46a9f9 55200->55204 55201->55150 55202 46aa55 55210 46aab6 55202->55210 55211 46aa60 55202->55211 55206 403634 18 API calls 55203->55206 55207 414ae8 18 API calls 55204->55207 55208 46a945 55205->55208 55206->55196 55209 46aa1a 55207->55209 55215 46a9a6 55208->55215 55216 46a950 55208->55216 55212 403634 18 API calls 55209->55212 55213 403400 4 API calls 55210->55213 55214 403494 4 API calls 55211->55214 55212->55183 55217 46aabe 55213->55217 55221 46aa6e 55214->55221 55218 403400 4 API calls 55215->55218 55219 403494 4 API calls 55216->55219 55220 46aab4 55217->55220 55231 46ab67 55217->55231 55218->55190 55224 46a95e 55219->55224 55220->55217 55240 4951d0 18 API calls 55220->55240 55221->55217 55221->55220 55225 403634 18 API calls 55221->55225 55223 46aae1 55223->55231 55241 49547c 32 API calls 55223->55241 55224->55190 55227 403634 18 API calls 55224->55227 55225->55221 55227->55224 55229 46ac08 55243 429144 SendMessageA SendMessageA 55229->55243 55242 4290f4 SendMessageA 55231->55242 55232->54541 55246 42a040 SendMessageA 55233->55246 55235 469893 55236 4698b3 55235->55236 55247 42a040 SendMessageA 55235->55247 55236->55180 55238 4698a3 55238->55180 55239->55202 55240->55223 55241->55231 55242->55229 55243->55148 55244->55170 55245->55170 55246->55235 55247->55238 55249 47e0f5 55248->55249 55252 47e132 55248->55252 55258 455d0c 55249->55258 55252->54546 55254 47e149 55254->54546 55255->54552 55256->54591 55257->54600 55259 455d1d 55258->55259 55260 455d21 55259->55260 55261 455d2a 55259->55261 55283 455a10 55260->55283 55291 455af0 43 API calls 55261->55291 55264 455d27 55264->55252 55265 47dd4c 55264->55265 55266 47dd8c 55265->55266 55269 47de48 55265->55269 55266->55269 55271 479b34 33 API calls 55266->55271 55272 479cb0 18 API calls 55266->55272 55275 47c648 57 API calls 55266->55275 55277 47ddeb 55266->55277 55280 47ddf4 55266->55280 55267 403420 4 API calls 55268 47df2b 55267->55268 55268->55254 55270 4799f4 33 API calls 55269->55270 55273 47c648 57 API calls 55269->55273 55274 454100 34 API calls 55269->55274 55269->55277 55270->55269 55271->55266 55272->55266 55273->55269 55274->55269 55275->55266 55276 47c648 57 API calls 55276->55280 55277->55267 55278 42c92c 19 API calls 55278->55280 55279 42c954 19 API calls 55279->55280 55280->55266 55280->55276 55280->55278 55280->55279 55282 47de35 55280->55282 55300 47da58 66 API calls 55280->55300 55282->55277 55284 42de1c RegOpenKeyExA 55283->55284 55285 455a2d 55284->55285 55286 455a7b 55285->55286 55292 455944 55285->55292 55286->55264 55289 455944 20 API calls 55290 455a5c RegCloseKey 55289->55290 55290->55264 55291->55264 55297 42dd58 55292->55297 55294 403420 4 API calls 55295 4559f6 55294->55295 55295->55289 55296 45596c 55296->55294 55298 42dc00 20 API calls 55297->55298 55299 42dd61 55298->55299 55299->55296 55300->55280 55302 402648 18 API calls 55301->55302 55303 47e408 55302->55303 55304 47dd4c 75 API calls 55303->55304 55305 47e42b 55304->55305 55306 47e4c0 55305->55306 55307 47e438 55305->55307 55311 47e4d4 55306->55311 55321 47e174 55306->55321 55344 49522c 32 API calls 55307->55344 55310 47e500 55313 402660 4 API calls 55310->55313 55311->55310 55314 402660 4 API calls 55311->55314 55312 47e47a 55312->54605 55315 47e50a 55313->55315 55314->55311 55315->54605 55316->54627 55317->54624 55318->54632 55319->54638 55320->54642 55322 403494 4 API calls 55321->55322 55323 47e1a3 55322->55323 55324 42c92c 19 API calls 55323->55324 55325 47e207 55323->55325 55326 47e1be 55324->55326 55328 47e283 55325->55328 55336 402660 4 API calls 55325->55336 55340 47e217 55325->55340 55345 42ca00 21 API calls 55326->55345 55332 47e2d8 55328->55332 55328->55340 55347 453c0c 25 API calls 55328->55347 55329 403400 4 API calls 55330 47e351 55329->55330 55333 403420 4 API calls 55330->55333 55335 402648 18 API calls 55332->55335 55337 47e35e 55333->55337 55334 47e2cd 55338 403494 4 API calls 55334->55338 55339 47e2ec 55335->55339 55336->55325 55337->55311 55338->55332 55341 47e314 MultiByteToWideChar 55339->55341 55340->55329 55341->55340 55342 47e1c9 55342->55325 55346 42e8a0 CharNextA 55342->55346 55344->55312 55345->55342 55346->55342 55347->55334 55349 46c7fd 55348->55349 55350 414ae8 18 API calls 55349->55350 55364 46c84a 55349->55364 55351 46c813 55350->55351 55566 466924 20 API calls 55351->55566 55352 403420 4 API calls 55354 46c8f4 55352->55354 55354->54656 55561 408be0 19 API calls 55354->55561 55355 46c81b 55356 414b18 18 API calls 55355->55356 55357 46c829 55356->55357 55358 46c836 55357->55358 55361 46c84f 55357->55361 55567 47f3ac 56 API calls 55358->55567 55360 46c867 55568 47f3ac 56 API calls 55360->55568 55361->55360 55363 466a08 CharNextA 55361->55363 55365 46c863 55363->55365 55364->55352 55365->55360 55366 46c87d 55365->55366 55367 46c883 55366->55367 55368 46c899 55366->55368 55569 47f3ac 56 API calls 55367->55569 55370 42c99c CharNextA 55368->55370 55371 46c8a6 55370->55371 55371->55364 55570 466a94 18 API calls 55371->55570 55373 46c8bd 55374 451458 18 API calls 55373->55374 55375 46c8ca 55374->55375 55571 47f3ac 56 API calls 55375->55571 55378 457d10 38 API calls 55377->55378 55379 475fb0 55378->55379 55380 4072a8 SetCurrentDirectoryA 55379->55380 55381 475fba 55380->55381 55572 46e360 55381->55572 55385 475fca 55580 45a148 55385->55580 55388 47c648 57 API calls 55389 476021 55388->55389 55392 476031 55389->55392 56095 453344 18 API calls 55389->56095 55391 476053 55394 4791b8 34 API calls 55391->55394 55392->55391 56096 453344 18 API calls 55392->56096 55562->54664 55566->55355 55567->55364 55568->55364 55569->55364 55570->55373 55571->55364 55573 46e3d3 55572->55573 55575 46e37d 55572->55575 55576 46e3d8 55573->55576 55574 479b34 33 API calls 55574->55575 55575->55573 55575->55574 55577 46e3fe 55576->55577 56102 44fb1c 55577->56102 55579 46e45a 55579->55385 55581 45a14e 55580->55581 55582 45a430 4 API calls 55581->55582 55583 45a16a 55582->55583 55583->55388 56095->55392 56096->55391 56105 44fb30 56102->56105 56106 44fb41 56105->56106 56107 44fb2d 56106->56107 56108 44fb6b MulDiv 56106->56108 56107->55579 56109 4181e0 56108->56109 56110 44fb96 SendMessageA 56109->56110 56110->56107 50726 416410 50727 416422 50726->50727 50728 416462 GetClassInfoA 50727->50728 50746 408d2c 33 API calls 50727->50746 50729 41648e 50728->50729 50731 4164ee 50729->50731 50732 4164b0 RegisterClassA 50729->50732 50733 4164a0 UnregisterClassA 50729->50733 50737 416517 50731->50737 50738 4164e9 50731->50738 50732->50731 50734 4164d8 50732->50734 50733->50732 50747 408cbc 50734->50747 50735 41645d 50735->50728 50755 407544 50737->50755 50738->50731 50739 408cbc 19 API calls 50738->50739 50739->50737 50743 416530 50760 41a1e8 50743->50760 50745 41653a 50746->50735 50748 408cc8 50747->50748 50768 406dec LoadStringA 50748->50768 50751 403450 18 API calls 50752 408cf9 50751->50752 50753 403400 4 API calls 50752->50753 50754 408d0e 50753->50754 50754->50738 50756 407552 50755->50756 50757 407548 50755->50757 50759 418384 7 API calls 50756->50759 50758 402660 4 API calls 50757->50758 50758->50756 50759->50743 50761 41a213 50760->50761 50762 41a2af 50760->50762 50771 403520 50761->50771 50763 403400 4 API calls 50762->50763 50764 41a2c7 50763->50764 50764->50745 50766 41a26b 50767 41a2a3 CreateFontIndirectA 50766->50767 50767->50762 50769 4034e0 18 API calls 50768->50769 50770 406e19 50769->50770 50770->50751 50772 4034e0 18 API calls 50771->50772 50773 40352a 50772->50773 50773->50766 57157 480d39 57158 451004 19 API calls 57157->57158 57159 480d4d 57158->57159 57160 47fde8 35 API calls 57159->57160 57161 480d71 57160->57161 57162 40cc34 57165 406f10 WriteFile 57162->57165 57166 406f2d 57165->57166 50774 41ee54 50775 41ee63 IsWindowVisible 50774->50775 50776 41ee99 50774->50776 50775->50776 50777 41ee6d IsWindowEnabled 50775->50777 50777->50776 50778 41ee77 50777->50778 50779 402648 18 API calls 50778->50779 50780 41ee81 EnableWindow 50779->50780 50780->50776 50781 41fb58 50782 41fb61 50781->50782 50785 41fdfc 50782->50785 50784 41fb6e 50786 41feee 50785->50786 50787 41fe13 50785->50787 50786->50784 50787->50786 50806 41f9bc GetWindowLongA GetSystemMetrics GetSystemMetrics GetWindowLongA 50787->50806 50789 41fe49 50790 41fe73 50789->50790 50791 41fe4d 50789->50791 50816 41f9bc GetWindowLongA GetSystemMetrics GetSystemMetrics GetWindowLongA 50790->50816 50807 41fb9c 50791->50807 50795 41fe81 50797 41fe85 50795->50797 50798 41feab 50795->50798 50796 41fb9c 10 API calls 50800 41fe71 50796->50800 50801 41fb9c 10 API calls 50797->50801 50799 41fb9c 10 API calls 50798->50799 50802 41febd 50799->50802 50800->50784 50803 41fe97 50801->50803 50804 41fb9c 10 API calls 50802->50804 50805 41fb9c 10 API calls 50803->50805 50804->50800 50805->50800 50806->50789 50808 41fbb7 50807->50808 50809 41fbcd 50808->50809 50810 41f93c 4 API calls 50808->50810 50817 41f93c 50809->50817 50810->50809 50812 41fc15 50813 41fc38 SetScrollInfo 50812->50813 50825 41fa9c 50813->50825 50816->50795 50818 4181e0 50817->50818 50819 41f959 GetWindowLongA 50818->50819 50820 41f996 50819->50820 50821 41f976 50819->50821 50837 41f8c8 GetWindowLongA GetSystemMetrics GetSystemMetrics 50820->50837 50836 41f8c8 GetWindowLongA GetSystemMetrics GetSystemMetrics 50821->50836 50824 41f982 50824->50812 50826 41faaa 50825->50826 50827 41fab2 50825->50827 50826->50796 50828 41faf1 50827->50828 50829 41fae1 50827->50829 50835 41faef 50827->50835 50839 417e48 IsWindowVisible ScrollWindow SetWindowPos 50828->50839 50838 417e48 IsWindowVisible ScrollWindow SetWindowPos 50829->50838 50830 41fb31 GetScrollPos 50830->50826 50833 41fb3c 50830->50833 50834 41fb4b SetScrollPos 50833->50834 50834->50826 50835->50830 50836->50824 50837->50824 50838->50835 50839->50835 57167 416bf8 57170 4136f4 57167->57170 57169 416c04 57171 413724 57170->57171 57172 4136ff GetWindowThreadProcessId 57170->57172 57171->57169 57172->57171 57173 41370a GetCurrentProcessId 57172->57173 57173->57171 57174 413714 GetPropA 57173->57174 57174->57171 50840 420598 50841 4205ab 50840->50841 50861 415b30 50841->50861 50843 4206f2 50844 420709 50843->50844 50868 4146d4 KiUserCallbackDispatcher 50843->50868 50845 420720 50844->50845 50869 414718 KiUserCallbackDispatcher 50844->50869 50851 420742 50845->50851 50870 420060 12 API calls 50845->50870 50846 420651 50866 420848 34 API calls 50846->50866 50847 4205e6 50847->50843 50847->50846 50854 420642 MulDiv 50847->50854 50852 42066a 50852->50843 50867 420060 12 API calls 50852->50867 50865 41a304 19 API calls 50854->50865 50857 420687 50858 4206a3 MulDiv 50857->50858 50859 4206c6 50857->50859 50858->50859 50859->50843 50860 4206cf MulDiv 50859->50860 50860->50843 50862 415b42 50861->50862 50871 414470 50862->50871 50864 415b5a 50864->50847 50865->50846 50866->50852 50867->50857 50868->50844 50869->50845 50870->50851 50872 41448a 50871->50872 50875 410458 50872->50875 50874 4144a0 50874->50864 50878 40dca4 50875->50878 50877 41045e 50877->50874 50879 40dd06 50878->50879 50881 40dcb7 50878->50881 50885 40dd14 50879->50885 50883 40dd14 33 API calls 50881->50883 50884 40dce1 50883->50884 50884->50877 50886 40dd24 50885->50886 50888 40dd3a 50886->50888 50897 40e09c 50886->50897 50913 40d5e0 50886->50913 50916 40df4c 50888->50916 50891 40d5e0 19 API calls 50892 40dd42 50891->50892 50892->50891 50893 40ddae 50892->50893 50919 40db60 50892->50919 50895 40df4c 19 API calls 50893->50895 50896 40dd10 50895->50896 50896->50877 50933 40e96c 50897->50933 50899 403778 18 API calls 50900 40e0d7 50899->50900 50900->50899 50901 40e18d 50900->50901 50996 40d774 19 API calls 50900->50996 50997 40e080 19 API calls 50900->50997 50902 40e1b7 50901->50902 50903 40e1a8 50901->50903 50993 40ba24 50902->50993 50942 40e3c0 50903->50942 50909 40e1b5 50910 403400 4 API calls 50909->50910 50911 40e25c 50910->50911 50911->50886 50914 40ea08 19 API calls 50913->50914 50915 40d5ea 50914->50915 50915->50886 51034 40d4bc 50916->51034 51043 40df54 50919->51043 50922 40e96c 19 API calls 50923 40db9e 50922->50923 50924 40e96c 19 API calls 50923->50924 50925 40dba9 50924->50925 50926 40dbc4 50925->50926 50927 40dbbb 50925->50927 50932 40dbc1 50925->50932 51050 40d9d8 50926->51050 51053 40dac8 33 API calls 50927->51053 50930 403420 4 API calls 50931 40dc8f 50930->50931 50931->50892 50932->50930 50999 40d780 50933->50999 50936 4034e0 18 API calls 50937 40e98f 50936->50937 51003 403744 50937->51003 50939 40e996 50940 40d780 19 API calls 50939->50940 50941 40e9a4 50940->50941 50941->50900 50943 40e3f6 50942->50943 50944 40e3ec 50942->50944 50946 40e511 50943->50946 50947 40e495 50943->50947 50948 40e4f6 50943->50948 50949 40e576 50943->50949 50950 40e438 50943->50950 50951 40e4d9 50943->50951 50952 40e47a 50943->50952 50953 40e4bb 50943->50953 50986 40e45c 50943->50986 51008 40d440 19 API calls 50944->51008 50957 40d764 19 API calls 50946->50957 51016 40de24 19 API calls 50947->51016 51021 40e890 19 API calls 50948->51021 50961 40d764 19 API calls 50949->50961 51009 40d764 50950->51009 51019 40e9a8 19 API calls 50951->51019 51015 40d818 19 API calls 50952->51015 51018 40dde4 19 API calls 50953->51018 50965 40e519 50957->50965 50960 403400 4 API calls 50966 40e5eb 50960->50966 50967 40e57e 50961->50967 50964 40e4a0 51017 40d470 19 API calls 50964->51017 50975 40e523 50965->50975 50976 40e51d 50965->50976 50966->50909 50969 40e582 50967->50969 50970 40e59b 50967->50970 50968 40e4e4 51020 409d38 18 API calls 50968->51020 50977 40ea08 19 API calls 50969->50977 51028 40de24 19 API calls 50970->51028 50972 40e461 51014 40ded8 19 API calls 50972->51014 50973 40e444 51012 40de24 19 API calls 50973->51012 51022 40ea08 50975->51022 50981 40e521 50976->50981 50982 40e53c 50976->50982 50977->50986 51026 40de24 19 API calls 50981->51026 50984 40ea08 19 API calls 50982->50984 50987 40e544 50984->50987 50985 40e44f 51013 40e26c 19 API calls 50985->51013 50986->50960 51025 40d8a0 19 API calls 50987->51025 50990 40e566 51027 40e2d4 18 API calls 50990->51027 51029 40b9d0 50993->51029 50996->50900 50997->50900 50998 40d774 19 API calls 50998->50909 51001 40d78b 50999->51001 51000 40d7c5 51000->50936 51001->51000 51007 40d7cc 19 API calls 51001->51007 51004 40374a 51003->51004 51006 40375b 51003->51006 51005 4034bc 18 API calls 51004->51005 51004->51006 51005->51006 51006->50939 51007->51001 51008->50943 51010 40ea08 19 API calls 51009->51010 51011 40d76e 51010->51011 51011->50972 51011->50973 51012->50985 51013->50986 51014->50986 51015->50986 51016->50964 51017->50986 51018->50986 51019->50968 51020->50986 51021->50986 51023 40d780 19 API calls 51022->51023 51024 40ea15 51023->51024 51024->50986 51025->50986 51026->50990 51027->50986 51028->50986 51030 40ba07 51029->51030 51031 40b9e2 51029->51031 51030->50909 51030->50998 51031->51030 51033 40ba84 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 51031->51033 51033->51030 51035 40ea08 19 API calls 51034->51035 51036 40d4c9 51035->51036 51037 40d4dc 51036->51037 51041 40eb0c 19 API calls 51036->51041 51037->50892 51039 40d4d7 51042 40d458 19 API calls 51039->51042 51041->51039 51042->51037 51044 40d764 19 API calls 51043->51044 51045 40df6b 51044->51045 51046 40db93 51045->51046 51047 40ea08 19 API calls 51045->51047 51046->50922 51048 40df78 51047->51048 51048->51046 51054 40ded8 19 API calls 51048->51054 51055 40ab7c 33 API calls 51050->51055 51052 40da00 51052->50932 51053->50932 51054->51046 51055->51052 51056 480dd3 51057 480ddc 51056->51057 51058 480de8 51057->51058 51059 480e06 51057->51059 51060 480dfd 51058->51060 51399 47f8e8 56 API calls 51058->51399 51401 47f718 38 API calls 51059->51401 51400 47f718 38 API calls 51060->51400 51064 480e04 51065 480e33 51064->51065 51066 480e41 51064->51066 51402 476fe4 203 API calls 51065->51402 51068 480e80 51066->51068 51404 47f880 18 API calls 51066->51404 51067 480ea4 51074 480ebc 51067->51074 51075 480eb6 51067->51075 51068->51067 51071 480e99 51068->51071 51072 480e97 51068->51072 51406 47f958 56 API calls 51071->51406 51082 47f8c4 56 API calls 51072->51082 51073 480e38 51073->51066 51403 408be0 19 API calls 51073->51403 51078 480eba 51074->51078 51083 47f8c4 56 API calls 51074->51083 51075->51078 51182 47f8c4 51075->51182 51076 480e73 51405 47f8e8 56 API calls 51076->51405 51187 47ca48 51078->51187 51082->51067 51083->51078 51085 480ee3 51261 47cf70 51085->51261 51482 47f3ac 56 API calls 51182->51482 51184 47f8df 51483 408be0 19 API calls 51184->51483 51484 42d898 GetWindowsDirectoryA 51187->51484 51189 47ca6c 51190 403450 18 API calls 51189->51190 51191 47ca79 51190->51191 51486 42d8c4 GetSystemDirectoryA 51191->51486 51193 47ca81 51194 403450 18 API calls 51193->51194 51195 47ca8e 51194->51195 51488 42d8f0 51195->51488 51197 47ca96 51198 403450 18 API calls 51197->51198 51199 47caa3 51198->51199 51200 47caac 51199->51200 51201 47cac8 51199->51201 51544 42d208 51200->51544 51203 403400 4 API calls 51201->51203 51205 47cac6 51203->51205 51207 47cb0d 51205->51207 51209 42c8cc 19 API calls 51205->51209 51206 403450 18 API calls 51206->51205 51492 47c8d0 51207->51492 51211 47cae8 51209->51211 51212 403450 18 API calls 51211->51212 51215 47caf5 51212->51215 51213 403450 18 API calls 51214 47cb29 51213->51214 51216 47cb47 51214->51216 51218 4035c0 18 API calls 51214->51218 51215->51207 51217 403450 18 API calls 51215->51217 51219 47c8d0 22 API calls 51216->51219 51217->51207 51218->51216 51220 47cb56 51219->51220 51221 403450 18 API calls 51220->51221 51222 47cb63 51221->51222 51223 47cb8b 51222->51223 51224 42c3fc 19 API calls 51222->51224 51225 47cbf2 51223->51225 51228 47c8d0 22 API calls 51223->51228 51226 47cb79 51224->51226 51227 47ccba 51225->51227 51230 47cc12 SHGetKnownFolderPath 51225->51230 51229 4035c0 18 API calls 51226->51229 51232 47cce4 51227->51232 51233 47ccc3 51227->51233 51231 47cba3 51228->51231 51229->51223 51235 47cc67 SHGetKnownFolderPath 51230->51235 51236 47cc2c 51230->51236 51237 403450 18 API calls 51231->51237 51503 42c3fc 51232->51503 51238 42c3fc 19 API calls 51233->51238 51235->51227 51243 47cc81 51235->51243 51554 403ba4 21 API calls 51236->51554 51242 47cbb0 51237->51242 51239 47ccd0 51238->51239 51244 4035c0 18 API calls 51239->51244 51240 47ccf1 51513 4035c0 51240->51513 51247 47cbc3 51242->51247 51552 453344 18 API calls 51242->51552 51555 403ba4 21 API calls 51243->51555 51249 47cce2 51244->51249 51246 47cc47 757283B0 51246->51085 51252 47c8d0 22 API calls 51247->51252 51535 47c9b4 51249->51535 51251 47cc9c 757283B0 51251->51085 51254 47cbd2 51252->51254 51256 403450 18 API calls 51254->51256 51257 47cbdf 51256->51257 51257->51225 51262 47cf78 51261->51262 51591 453a24 51262->51591 51399->51060 51400->51064 51401->51064 51402->51073 51404->51076 51405->51068 51406->51067 51482->51184 51485 42d8b9 51484->51485 51485->51189 51487 42d8e5 51486->51487 51487->51193 51489 403400 4 API calls 51488->51489 51490 42d900 GetModuleHandleA GetProcAddress 51489->51490 51491 42d919 51490->51491 51491->51197 51556 42de1c 51492->51556 51494 47c8f6 51495 47c91c 51494->51495 51496 47c8fa 51494->51496 51497 403400 4 API calls 51495->51497 51559 42dd4c 51496->51559 51499 47c923 51497->51499 51499->51213 51501 47c911 RegCloseKey 51501->51499 51502 403400 4 API calls 51502->51501 51504 42c406 51503->51504 51505 42c429 51503->51505 51589 42c97c CharPrevA 51504->51589 51507 403494 4 API calls 51505->51507 51509 42c432 51507->51509 51508 42c40d 51508->51505 51510 42c418 51508->51510 51509->51240 51511 4035c0 18 API calls 51510->51511 51512 42c426 51511->51512 51512->51240 51514 4035c4 51513->51514 51520 40357c 51513->51520 51514->51520 51536 47c9c2 51535->51536 51537 42de1c RegOpenKeyExA 51536->51537 51545 4038a4 18 API calls 51544->51545 51546 42d21b 51545->51546 51547 42d232 GetEnvironmentVariableA 51546->51547 51551 42d245 51546->51551 51590 42dbd0 18 API calls 51546->51590 51547->51546 51548 42d23e 51547->51548 51549 403400 4 API calls 51548->51549 51549->51551 51551->51206 51552->51247 51554->51246 51555->51251 51557 42de27 51556->51557 51558 42de2d RegOpenKeyExA 51556->51558 51557->51558 51558->51494 51562 42dc00 51559->51562 51563 42dc26 RegQueryValueExA 51562->51563 51568 42dc49 51563->51568 51578 42dc6b 51563->51578 51564 403400 4 API calls 51566 42dd37 51564->51566 51565 42dc63 51567 403400 4 API calls 51565->51567 51566->51501 51566->51502 51567->51578 51568->51565 51569 4034e0 18 API calls 51568->51569 51570 403744 18 API calls 51568->51570 51568->51578 51569->51568 51571 42dca0 RegQueryValueExA 51570->51571 51571->51563 51572 42dcbc 51571->51572 51572->51578 51579 4038a4 51572->51579 51574 42dd10 51576 403450 18 API calls 51574->51576 51576->51578 51577 403744 18 API calls 51577->51574 51578->51564 51581 4038b1 51579->51581 51587 4038e1 51579->51587 51580 403400 4 API calls 51583 4038cb 51580->51583 51582 4038da 51581->51582 51584 4038bd 51581->51584 51585 4034bc 18 API calls 51582->51585 51583->51574 51583->51577 51588 402678 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 51584->51588 51585->51587 51587->51580 51588->51583 51589->51508 51590->51546 51598 453a44 51591->51598 57175 40ce7c 57176 40ce84 57175->57176 57177 40ceae 57176->57177 57178 40ceb2 57176->57178 57179 40cea7 57176->57179 57181 40ceb6 57178->57181 57182 40cec8 57178->57182 57188 406288 GlobalHandle GlobalUnWire GlobalFree 57179->57188 57189 40625c GlobalAlloc GlobalFix 57181->57189 57190 40626c GlobalHandle GlobalUnWire GlobalReAlloc GlobalFix 57182->57190 57185 40cec4 57186 40ced8 57185->57186 57186->57177 57187 408cbc 19 API calls 57186->57187 57187->57177 57188->57177 57189->57185 57190->57186 52215 416a1c 52216 416a47 52215->52216 52217 416a2f 52215->52217 52221 416a42 52216->52221 52240 416990 PtInRect GetCapture 52216->52240 52218 416a31 52217->52218 52219 416a9a 52217->52219 52225 416a64 52218->52225 52226 416a36 52218->52226 52232 415270 52219->52232 52223 415270 73 API calls 52221->52223 52224 416ad1 52221->52224 52223->52224 52225->52221 52231 421aec 6 API calls 52225->52231 52226->52221 52228 416b01 GetCapture 52226->52228 52228->52221 52229 416aa3 52229->52224 52239 4168d0 PtInRect 52229->52239 52231->52221 52233 41527d 52232->52233 52234 4152e3 52233->52234 52235 4152d8 52233->52235 52238 4152e1 52233->52238 52241 424b8c 13 API calls 52234->52241 52235->52238 52242 41505c 60 API calls 52235->52242 52238->52229 52239->52224 52240->52221 52241->52238 52242->52238 57191 41363c SetWindowLongA GetWindowLongA 57192 413699 SetPropA SetPropA 57191->57192 57193 41367b GetWindowLongA 57191->57193 57198 41f39c KiUserCallbackDispatcher 57192->57198 57193->57192 57194 41368a SetWindowLongA 57193->57194 57194->57192 57196 4136e9 57198->57196 52243 42285c 52244 42288c 52243->52244 52245 42286f 52243->52245 52247 422aa1 52244->52247 52248 4228c6 52244->52248 52254 422aff 52244->52254 52245->52244 52246 408cbc 19 API calls 52245->52246 52246->52244 52249 422af3 52247->52249 52250 422ae9 52247->52250 52265 42291d 52248->52265 52283 4231a8 GetSystemMetrics 52248->52283 52249->52254 52258 422b37 52249->52258 52259 422b18 52249->52259 52286 421e2c 25 API calls 52250->52286 52251 4229c9 52255 4229d5 52251->52255 52256 422a0b 52251->52256 52252 422a7c 52261 422a96 ShowWindow 52252->52261 52263 4229df SendMessageA 52255->52263 52264 422a25 ShowWindow 52256->52264 52262 422b41 GetActiveWindow 52258->52262 52266 422b2f SetWindowPos 52259->52266 52260 422961 52284 4231a0 GetSystemMetrics 52260->52284 52261->52254 52267 422b4c 52262->52267 52282 422b6b 52262->52282 52268 4181e0 52263->52268 52270 4181e0 52264->52270 52265->52251 52265->52252 52266->52254 52273 422b54 IsIconic 52267->52273 52271 422a03 ShowWindow 52268->52271 52272 422a47 CallWindowProcA 52270->52272 52274 422a5a SendMessageA 52271->52274 52285 414cc4 52272->52285 52278 422b5e 52273->52278 52273->52282 52274->52254 52275 422b71 52279 422b88 SetWindowPos SetActiveWindow 52275->52279 52277 422b96 52280 422ba0 ShowWindow 52277->52280 52281 41eff4 2 API calls 52278->52281 52279->52254 52280->52254 52281->52282 52282->52275 52282->52277 52283->52260 52284->52265 52285->52274 52286->52249

      Executed Functions

      Function 004707F8 Relevance: 78.0, APIs: 4, Strings: 40, Instructions: 962COMMON
      Download Yara Rule
      Strings
      • Time stamp of existing file: (failed to read), xrefs: 00470B87
      • User opted not to strip the existing file's read-only attribute. Skipping., xrefs: 00470FE6
      • Existing file has a later time stamp. Skipping., xrefs: 00470F1F
      • Incrementing shared file count (64-bit)., xrefs: 004716DC
      • Existing file's SHA-1 hash is different from our file. Proceeding., xrefs: 00470E14
      • Non-default bitness: 32-bit, xrefs: 00470A0B
      • Installing into GAC, xrefs: 00471864
      • Installing the file., xrefs: 00471059
      • Non-default bitness: 64-bit, xrefs: 004709FF
      • Existing file is a newer version. Skipping., xrefs: 00470D52
      • , xrefs: 00470D1F, 00470EF0, 00470F6E
      • Uninstaller requires administrator: %s, xrefs: 004712DF
      • Same time stamp. Skipping., xrefs: 00470EA5
      • Version of our file: (none), xrefs: 00470C4C
      • User opted not to overwrite the existing file. Skipping., xrefs: 00470F9D
      • Will register the file (a DLL/OCX) later., xrefs: 0047166F
      • Same version. Skipping., xrefs: 00470E35
      • Version of existing file: (none), xrefs: 00470E4A
      • Dest file exists., xrefs: 00470B0B
      • Skipping due to "onlyifdoesntexist" flag., xrefs: 00470B1E
      • Version of existing file: %u.%u.%u.%u, xrefs: 00470CCC
      • Skipping due to "onlyifdestfileexists" flag., xrefs: 0047104A
      • Failed to read existing file's SHA-1 hash. Proceeding., xrefs: 00470E20
      • Existing file's SHA-1 hash matches our file. Skipping., xrefs: 00470E05
      • Couldn't read time stamp. Skipping., xrefs: 00470E85
      • Failed to strip read-only attribute., xrefs: 00471023
      • Existing file is protected by Windows File Protection. Skipping., xrefs: 00470F3C
      • .tmp, xrefs: 00471107
      • Time stamp of our file: %s, xrefs: 00470AEB
      • Dest filename: %s, xrefs: 004709E4
      • Will register the file (a type library) later., xrefs: 00471663
      • @, xrefs: 00470900
      • Stripped read-only attribute., xrefs: 00471017
      • -- File entry --, xrefs: 0047084B
      • Time stamp of our file: (failed to read), xrefs: 00470AF7
      • Incrementing shared file count (32-bit)., xrefs: 004716F5
      • Version of our file: %u.%u.%u.%u, xrefs: 00470C40
      • Time stamp of existing file: %s, xrefs: 00470B7B
      • InUn, xrefs: 004712AF
      • Dest file is protected by Windows File Protection., xrefs: 00470A3D
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID:
      • String ID: $-- File entry --$.tmp$@$Couldn't read time stamp. Skipping.$Dest file exists.$Dest file is protected by Windows File Protection.$Dest filename: %s$Existing file has a later time stamp. Skipping.$Existing file is a newer version. Skipping.$Existing file is protected by Windows File Protection. Skipping.$Existing file's SHA-1 hash is different from our file. Proceeding.$Existing file's SHA-1 hash matches our file. Skipping.$Failed to read existing file's SHA-1 hash. Proceeding.$Failed to strip read-only attribute.$InUn$Incrementing shared file count (32-bit).$Incrementing shared file count (64-bit).$Installing into GAC$Installing the file.$Non-default bitness: 32-bit$Non-default bitness: 64-bit$Same time stamp. Skipping.$Same version. Skipping.$Skipping due to "onlyifdestfileexists" flag.$Skipping due to "onlyifdoesntexist" flag.$Stripped read-only attribute.$Time stamp of existing file: %s$Time stamp of existing file: (failed to read)$Time stamp of our file: %s$Time stamp of our file: (failed to read)$Uninstaller requires administrator: %s$User opted not to overwrite the existing file. Skipping.$User opted not to strip the existing file's read-only attribute. Skipping.$Version of existing file: %u.%u.%u.%u$Version of existing file: (none)$Version of our file: %u.%u.%u.%u$Version of our file: (none)$Will register the file (a DLL/OCX) later.$Will register the file (a type library) later.
      • API String ID: 0-4021121268
      • Opcode ID: e917a697eae4277be765ffe002d8ce909916fe71d7203064736d5a46945b2b88
      • Instruction ID: 896a15ddbf27d1a249387bd85057796ee418df23ad279cb6fbf18f0d63f9c71b
      • Opcode Fuzzy Hash: e917a697eae4277be765ffe002d8ce909916fe71d7203064736d5a46945b2b88
      • Instruction Fuzzy Hash: 69927474A04288DFDB11DFA9C445BDDBBB5AF05304F1480ABE848BB392D7789E49CB19
      Function 0042E09C Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 178memorylibraryloaderCOMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 1381 42e09c-42e0ad 1382 42e0b8-42e0dd AllocateAndInitializeSid 1381->1382 1383 42e0af-42e0b3 1381->1383 1384 42e287-42e28f 1382->1384 1385 42e0e3-42e100 GetVersion 1382->1385 1383->1384 1386 42e102-42e117 GetModuleHandleA GetProcAddress 1385->1386 1387 42e119-42e11b 1385->1387 1386->1387 1388 42e142-42e15c GetCurrentThread OpenThreadToken 1387->1388 1389 42e11d-42e12b CheckTokenMembership 1387->1389 1392 42e193-42e1bb GetTokenInformation 1388->1392 1393 42e15e-42e168 GetLastError 1388->1393 1390 42e131-42e13d 1389->1390 1391 42e269-42e27f FreeSid 1389->1391 1390->1391 1394 42e1d6-42e1fa call 402648 GetTokenInformation 1392->1394 1395 42e1bd-42e1c5 GetLastError 1392->1395 1396 42e174-42e187 GetCurrentProcess OpenProcessToken 1393->1396 1397 42e16a-42e16f call 4031bc 1393->1397 1408 42e208-42e210 1394->1408 1409 42e1fc-42e206 call 4031bc * 2 1394->1409 1395->1394 1398 42e1c7-42e1d1 call 4031bc * 2 1395->1398 1396->1392 1401 42e189-42e18e call 4031bc 1396->1401 1397->1384 1398->1384 1401->1384 1410 42e212-42e213 1408->1410 1411 42e243-42e261 call 402660 CloseHandle 1408->1411 1409->1384 1414 42e215-42e228 EqualSid 1410->1414 1418 42e22a-42e237 1414->1418 1419 42e23f-42e241 1414->1419 1418->1419 1422 42e239-42e23d 1418->1422 1419->1411 1419->1414 1422->1411
      APIs
      • AllocateAndInitializeSid.ADVAPI32(0049A788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E0D6
      • GetVersion.KERNEL32(00000000,0042E280,?,0049A788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E0F3
      • GetModuleHandleA.KERNEL32(advapi32.dll,CheckTokenMembership,00000000,0042E280,?,0049A788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E10C
      • GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042E112
      • CheckTokenMembership.KERNELBASE(00000000,00000000,?,00000000,0042E280,?,0049A788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E127
      • FreeSid.ADVAPI32(00000000,0042E287,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E27A
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressAllocateCheckFreeHandleInitializeMembershipModuleProcTokenVersion
      • String ID: CheckTokenMembership$advapi32.dll
      • API String ID: 2252812187-1888249752
      • Opcode ID: 5c42cad4db9fcf560242ee1d3aac7abe20a5a02ada4557c04a2e6c427a8242cf
      • Instruction ID: 64a79065b1545f75a7207ff20d2b94ee55f2d53c9019bd1fb0cbf6b1d5428672
      • Opcode Fuzzy Hash: 5c42cad4db9fcf560242ee1d3aac7abe20a5a02ada4557c04a2e6c427a8242cf
      • Instruction Fuzzy Hash: 71519171B44215EEDB10EAE69842BBF77ACEB09704F9404BBB901F7281D57C99018A7A
      Function 004502C0 Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 45libraryloaderCOMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 1553 4502c0-4502cd 1554 4502d3-4502e0 GetVersion 1553->1554 1555 45037c-450386 1553->1555 1554->1555 1556 4502e6-4502fc LoadLibraryA 1554->1556 1556->1555 1557 4502fe-450377 GetProcAddress * 6 1556->1557 1557->1555
      APIs
      • GetVersion.KERNEL32(00480F2E), ref: 004502D3
      • LoadLibraryA.KERNEL32(Rstrtmgr.dll,00480F2E), ref: 004502EB
      • GetProcAddress.KERNEL32(00000000,RmStartSession), ref: 00450309
      • GetProcAddress.KERNEL32(00000000,RmRegisterResources), ref: 0045031E
      • GetProcAddress.KERNEL32(00000000,RmGetList), ref: 00450333
      • GetProcAddress.KERNEL32(00000000,RmShutdown), ref: 00450348
      • GetProcAddress.KERNEL32(00000000,RmRestart), ref: 0045035D
      • GetProcAddress.KERNEL32(00000000,RmEndSession), ref: 00450372
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressProc$LibraryLoadVersion
      • String ID: RmEndSession$RmGetList$RmRegisterResources$RmRestart$RmShutdown$RmStartSession$Rstrtmgr.dll
      • API String ID: 1968650500-3419246398
      • Opcode ID: 413c4f206b8045e2f4d33f3b3dfad1f18beba421f79b3f8cceefebc0ffa4a89b
      • Instruction ID: e280ef568135b6a824961c3f6584c22665c71b08aeefec24c29af858ffc0af06
      • Opcode Fuzzy Hash: 413c4f206b8045e2f4d33f3b3dfad1f18beba421f79b3f8cceefebc0ffa4a89b
      • Instruction Fuzzy Hash: 02111BB4510301DBD710FB69EDC5A2E36E4E764317B04163BBC04961A2C37C4844CF6C
      Function 00423C0C Relevance: 21.4, APIs: 14, Instructions: 395COMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 2050 423c0c-423c40 2051 423c42-423c43 2050->2051 2052 423c74-423c8b call 423b68 2050->2052 2054 423c45-423c61 call 40b24c 2051->2054 2057 423cec-423cf1 2052->2057 2058 423c8d 2052->2058 2086 423c63-423c6b 2054->2086 2087 423c70-423c72 2054->2087 2060 423cf3 2057->2060 2061 423d27-423d2c 2057->2061 2062 423c93-423c96 2058->2062 2063 423d50-423d60 2058->2063 2064 423fb1-423fb9 2060->2064 2065 423cf9-423d01 2060->2065 2068 423d32-423d35 2061->2068 2069 42409a-4240a8 IsIconic 2061->2069 2066 423cc5-423cc8 2062->2066 2067 423c98 2062->2067 2070 423d62-423d67 2063->2070 2071 423d6b-423d73 call 424194 2063->2071 2075 424152-42415a 2064->2075 2081 423fbf-423fca call 4181e0 2064->2081 2073 423f13-423f3a SendMessageA 2065->2073 2074 423d07-423d0c 2065->2074 2082 423da9-423db0 2066->2082 2083 423cce-423ccf 2066->2083 2077 423df6-423e06 call 423b84 2067->2077 2078 423c9e-423ca1 2067->2078 2079 4240d6-4240eb call 424850 2068->2079 2080 423d3b-423d3c 2068->2080 2069->2075 2076 4240ae-4240b9 GetFocus 2069->2076 2084 423d78-423d80 call 4241dc 2070->2084 2085 423d69-423d8c call 423b84 2070->2085 2071->2075 2073->2075 2089 423d12-423d13 2074->2089 2090 42404a-424055 2074->2090 2091 424171-424177 2075->2091 2076->2075 2098 4240bf-4240c8 call 41eff4 2076->2098 2077->2075 2099 423ca7-423caa 2078->2099 2100 423e1e-423e34 PostMessageA call 423b84 2078->2100 2079->2075 2093 423d42-423d45 2080->2093 2094 4240ed-4240f4 2080->2094 2081->2075 2142 423fd0-423fdf call 4181e0 IsWindowEnabled 2081->2142 2082->2075 2103 423db6-423dbd 2082->2103 2104 423cd5-423cd8 2083->2104 2105 423f3f-423f46 2083->2105 2084->2075 2085->2075 2086->2091 2087->2052 2087->2054 2106 424072-42407d 2089->2106 2107 423d19-423d1c 2089->2107 2090->2075 2109 42405b-42406d 2090->2109 2110 424120-424127 2093->2110 2111 423d4b 2093->2111 2120 4240f6-424109 call 4244d4 2094->2120 2121 42410b-42411e call 42452c 2094->2121 2098->2075 2156 4240ce-4240d4 SetFocus 2098->2156 2117 423cb0-423cb3 2099->2117 2118 423ea5-423eac 2099->2118 2132 423e39-423e3a 2100->2132 2103->2075 2123 423dc3-423dc9 2103->2123 2124 423cde-423ce1 2104->2124 2125 423e3f-423e5f call 423b84 2104->2125 2105->2075 2113 423f4c-423f51 call 404e54 2105->2113 2106->2075 2131 424083-424095 2106->2131 2128 423d22 2107->2128 2129 423f56-423f5e 2107->2129 2109->2075 2126 42413a-424149 2110->2126 2127 424129-424138 2110->2127 2130 42414b-42414c call 423b84 2111->2130 2113->2075 2137 423cb9-423cba 2117->2137 2138 423dce-423ddc IsIconic 2117->2138 2139 423eae-423ec1 call 423b14 2118->2139 2140 423edf-423ef0 call 423b84 2118->2140 2120->2075 2121->2075 2123->2075 2143 423ce7 2124->2143 2144 423e0b-423e19 call 424178 2124->2144 2171 423e83-423ea0 call 423a84 PostMessageA 2125->2171 2172 423e61-423e7e call 423b14 PostMessageA 2125->2172 2126->2075 2127->2075 2128->2130 2129->2075 2154 423f64-423f6b 2129->2154 2167 424151 2130->2167 2131->2075 2132->2075 2157 423cc0 2137->2157 2158 423d91-423d99 2137->2158 2147 423dea-423df1 call 423b84 2138->2147 2148 423dde-423de5 call 423bc0 2138->2148 2184 423ed3-423eda call 423b84 2139->2184 2185 423ec3-423ecd call 41ef58 2139->2185 2178 423ef2-423ef8 call 41eea4 2140->2178 2179 423f06-423f0e call 423a84 2140->2179 2142->2075 2175 423fe5-423ff4 call 4181e0 IsWindowVisible 2142->2175 2143->2130 2144->2075 2147->2075 2148->2075 2154->2075 2170 423f71-423f80 call 4181e0 IsWindowEnabled 2154->2170 2156->2075 2157->2130 2158->2075 2173 423d9f-423da4 call 422c4c 2158->2173 2167->2075 2170->2075 2199 423f86-423f9c call 412310 2170->2199 2171->2075 2172->2075 2173->2075 2175->2075 2201 423ffa-424045 GetFocus call 4181e0 SetFocus call 415240 SetFocus 2175->2201 2197 423efd-423f00 2178->2197 2179->2075 2184->2075 2185->2184 2197->2179 2199->2075 2206 423fa2-423fac 2199->2206 2201->2075 2206->2075
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: cf42306aa727a0723fdb24aa058cf17809279d02823710c8c777b7e0d746f5ac
      • Instruction ID: aa0b3c7f48ab3ae8421f14e957015bd540d4f26150a0c72f33bcf3059b7e5473
      • Opcode Fuzzy Hash: cf42306aa727a0723fdb24aa058cf17809279d02823710c8c777b7e0d746f5ac
      • Instruction Fuzzy Hash: B1E1BD31700124EFDB04DF69E989AADB7B5FB44300FA440AAE554AB352C73CEE91DB09
      Function 0042285C Relevance: 18.3, APIs: 12, Instructions: 255windowCOMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 2237 42285c-42286d 2238 422891-4228b0 2237->2238 2239 42286f-422879 2237->2239 2240 422ba6-422bbd 2238->2240 2241 4228b6-4228c0 2238->2241 2239->2238 2242 42287b-42288c call 408cbc call 40311c 2239->2242 2243 422aa1-422ae7 call 402c00 2241->2243 2244 4228c6-42290b call 402c00 2241->2244 2242->2238 2254 422af3-422afd 2243->2254 2255 422ae9-422aee call 421e2c 2243->2255 2256 422911-42291b 2244->2256 2257 4229af-4229c3 2244->2257 2261 422aff-422b07 call 4166b0 2254->2261 2262 422b0c-422b16 2254->2262 2255->2254 2263 422957-42296b call 4231a8 2256->2263 2264 42291d-422934 call 4146bc 2256->2264 2258 4229c9-4229d3 2257->2258 2259 422a7c-422a9c call 4181e0 ShowWindow 2257->2259 2265 4229d5-422a09 call 4181e0 SendMessageA call 4181e0 ShowWindow 2258->2265 2266 422a0b-422a55 call 4181e0 ShowWindow call 4181e0 CallWindowProcA call 414cc4 2258->2266 2259->2240 2261->2240 2270 422b37-422b4a call 4181e0 GetActiveWindow 2262->2270 2271 422b18-422b35 call 4181e0 SetWindowPos 2262->2271 2283 422970-422984 call 4231a0 2263->2283 2284 42296d 2263->2284 2286 422936 2264->2286 2287 422939-422950 call 414700 2264->2287 2305 422a5a-422a77 SendMessageA 2265->2305 2266->2305 2289 422b4c-422b5c call 4181e0 IsIconic 2270->2289 2290 422b6d-422b6f 2270->2290 2271->2240 2303 422989-42298b 2283->2303 2306 422986 2283->2306 2284->2283 2286->2287 2302 422952-422955 2287->2302 2287->2303 2289->2290 2310 422b5e-422b6b call 4181e0 call 41eff4 2289->2310 2298 422b71-422b94 call 4181e0 SetWindowPos SetActiveWindow 2290->2298 2299 422b96-422ba1 call 4181e0 ShowWindow 2290->2299 2298->2240 2299->2240 2302->2303 2311 42298f-422991 2303->2311 2312 42298d 2303->2312 2305->2240 2306->2303 2310->2290 2316 422993 2311->2316 2317 422995-4229aa 2311->2317 2312->2311 2316->2317 2317->2257
      APIs
      • SendMessageA.USER32(00000000,00000223,00000000,00000000), ref: 004229F4
      • ShowWindow.USER32(00000000,00000003,00000000,00000223,00000000,00000000,00000000,00422BBE), ref: 00422A04
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: MessageSendShowWindow
      • String ID:
      • API String ID: 1631623395-0
      • Opcode ID: 1c0011079dafe5dff071547ba9721c0cddded0b544f1c8b206119c69c5694377
      • Instruction ID: 25a83acf69f399dfd67c515eae6b064ff4aeb934fe47cdbd8e77557c98a4a8ba
      • Opcode Fuzzy Hash: 1c0011079dafe5dff071547ba9721c0cddded0b544f1c8b206119c69c5694377
      • Instruction Fuzzy Hash: A7915171B04214BFDB11EFA9DA86F9D77F4AB08304F5500B6F504AB392CA78AF419B58
      Function 004673A4 Relevance: 13.9, APIs: 4, Strings: 3, Instructions: 1656windowCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 00495E0C: GetWindowRect.USER32(00000000), ref: 00495E22
      • LoadBitmapA.USER32(00400000,STOPIMAGE), ref: 00467773
        • Part of subcall function 0041D6B0: GetObjectA.GDI32(?,00000018,0046778D), ref: 0041D6DB
        • Part of subcall function 00467180: SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 00467223
        • Part of subcall function 00467180: ExtractIconA.SHELL32(00400000,00000000,?), ref: 00467249
        • Part of subcall function 00467180: ExtractIconA.SHELL32(00400000,00000000,00000027), ref: 004672A0
        • Part of subcall function 00466B40: KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,00467828,00000000,00000000,00000000,0000000C,00000000), ref: 00466B58
        • Part of subcall function 00496090: MulDiv.KERNEL32(0000000D,?,0000000D), ref: 0049609A
        • Part of subcall function 0042ED38: GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0042EDA8
        • Part of subcall function 0042ED38: SHAutoComplete.SHLWAPI(00000000,00000001), ref: 0042EDC5
        • Part of subcall function 00495D5C: GetDC.USER32(00000000), ref: 00495D7E
        • Part of subcall function 00495D5C: SelectObject.GDI32(?,00000000), ref: 00495DA4
        • Part of subcall function 00495D5C: ReleaseDC.USER32(00000000,?), ref: 00495DF5
        • Part of subcall function 00496080: MulDiv.KERNEL32(0000004B,?,00000006), ref: 0049608A
      • GetSystemMenu.USER32(00000000,00000000,0000000C,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,?,?,00000000,?), ref: 00468417
      • AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 00468428
      • AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 00468440
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Menu$AppendExtractIconObject$AddressAutoBitmapCallbackCompleteDispatcherFileInfoLoadProcRectReleaseSelectSystemUserWindow
      • String ID: $(Default)$STOPIMAGE
      • API String ID: 616467991-770201673
      • Opcode ID: f14e2e2c7945022918075100a6ddf4db8b185c533a82ffdc0eff1f0eaf0d8951
      • Instruction ID: 0896d781d397a42322064d808f6403a8e3e28a51b2584ebc4fd31ed1a85b02c0
      • Opcode Fuzzy Hash: f14e2e2c7945022918075100a6ddf4db8b185c533a82ffdc0eff1f0eaf0d8951
      • Instruction Fuzzy Hash: 17F2C6386015208FCB00EB69D9D9F9973F1BF49304F1542BAE5049B36ADB74EC46CB9A
      Function 00455E0C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112libraryloaderCOMMON
      Download Yara Rule
      APIs
      • GetModuleHandleA.KERNEL32(kernel32.dll,GetDiskFreeSpaceExA,00000000,00455F4B), ref: 00455E3C
      • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00455E42
      • GetDiskFreeSpaceExA.KERNELBASE(00000000,?,?,00000000,00000000,00455F29,?,00000000,kernel32.dll,GetDiskFreeSpaceExA,00000000,00455F4B), ref: 00455E98
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressDiskFreeHandleModuleProcSpace
      • String ID: GetDiskFreeSpaceExA$kernel32.dll
      • API String ID: 1197914913-3712701948
      • Opcode ID: 34167ab01d1d0053c586b0ed06703d536e73082a4945a6618724962be388ba05
      • Instruction ID: d81c9a8c7c52065d28d66f53e81ce4f313aa74f068c2efe820cb9bfc493487ae
      • Opcode Fuzzy Hash: 34167ab01d1d0053c586b0ed06703d536e73082a4945a6618724962be388ba05
      • Instruction Fuzzy Hash: B0418671A04649AFCF01EFA5C8929EEB7B8EF48305F504567F804F7292D67C5E098B68
      Function 0047531C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 99fileCOMMON
      Download Yara Rule
      APIs
      • FindFirstFileA.KERNEL32(00000000,?,00000000,00475486,?,?,0049D1E0,00000000), ref: 00475375
      • FindNextFileA.KERNEL32(00000000,?,00000000,?,00000000,00475486,?,?,0049D1E0,00000000), ref: 00475452
      • FindClose.KERNEL32(00000000,00000000,?,00000000,?,00000000,00475486,?,?,0049D1E0,00000000), ref: 00475460
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Find$File$CloseFirstNext
      • String ID: unins$unins???.*
      • API String ID: 3541575487-1009660736
      • Opcode ID: c4a7f480b52458263b6745e16b48a7fc777b31ab05d671623832b370294bcdfb
      • Instruction ID: 84bc6d84bd649c21d9f9d36311f1897ceca6327dae076c0eb32c0c1eca708dd7
      • Opcode Fuzzy Hash: c4a7f480b52458263b6745e16b48a7fc777b31ab05d671623832b370294bcdfb
      • Instruction Fuzzy Hash: CE313271600548AFDB10EB65C891BDE77A9DF45309F51C0B6A80CAB3A2DB789F818F58
      Function 00452A60 Relevance: 3.0, APIs: 2, Instructions: 45fileCOMMON
      Download Yara Rule
      APIs
      • FindFirstFileA.KERNEL32(00000000,?,00000000,00452AC3,?,?,-00000001,00000000), ref: 00452A9D
      • GetLastError.KERNEL32(00000000,?,00000000,00452AC3,?,?,-00000001,00000000), ref: 00452AA5
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ErrorFileFindFirstLast
      • String ID:
      • API String ID: 873889042-0
      • Opcode ID: 77a4f9a42a9b182eca9a30cb1eee9c943385d3d0e7805387745d9337962f8593
      • Instruction ID: 3e58272229af866f17ac5928e9872a720c3be2d4903e778e839a846eb7d55d53
      • Opcode Fuzzy Hash: 77a4f9a42a9b182eca9a30cb1eee9c943385d3d0e7805387745d9337962f8593
      • Instruction Fuzzy Hash: 94F0F971A04604AB8B10EF669D4149EF7ACEB8672571046BBFC14E3282DAB84E0485A8
      Function 00408568 Relevance: 1.5, APIs: 1, Instructions: 29COMMON
      Download Yara Rule
      APIs
      • GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049C4C0,00000001,?,00408633,?,00000000,00408712), ref: 00408586
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: InfoLocale
      • String ID:
      • API String ID: 2299586839-0
      • Opcode ID: 64da881718ef9bfb5c3691e8182369eeaf442f2681d4624e7b5adc518b999176
      • Instruction ID: 8daab3ef8e56b0da8b8c23f45c5b5388ad46b50bd825570c2d348c61856efc62
      • Opcode Fuzzy Hash: 64da881718ef9bfb5c3691e8182369eeaf442f2681d4624e7b5adc518b999176
      • Instruction Fuzzy Hash: BFE0223170021466C311AA2A9C86AEAB34C9758310F00427FB904E73C2EDB89E4042A8
      Function 00423B84 Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON
      Download Yara Rule
      APIs
      • NtdllDefWindowProc_A.USER32(?,?,?,?,?,00424151,?,00000000,0042415C), ref: 00423BAE
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: NtdllProc_Window
      • String ID:
      • API String ID: 4255912815-0
      • Opcode ID: 88ecfa13f3ee270e805d5ccef1650ee506ec8760b8390f8b6ad1d401d880426f
      • Instruction ID: a748582893d7571d6ac8bdbe819d0a8fbf5f36db2d3505b6f19a51c7a0bbae16
      • Opcode Fuzzy Hash: 88ecfa13f3ee270e805d5ccef1650ee506ec8760b8390f8b6ad1d401d880426f
      • Instruction Fuzzy Hash: 47F0B979205608AF8B40DF99C588D4ABBE8AB4C260B058195B988CB321C234ED808F90
      Function 0045559C Relevance: 1.5, APIs: 1, Instructions: 20COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: NameUser
      • String ID:
      • API String ID: 2645101109-0
      • Opcode ID: 969018677e36c7ee3cac7a31a88a81c68082f6a067fe28717e4d5eb0c099a74a
      • Instruction ID: 9f318ec9847dd9a6abcb639c8bc611599857aea0b867fcad4bfaeec6bdb042bf
      • Opcode Fuzzy Hash: 969018677e36c7ee3cac7a31a88a81c68082f6a067fe28717e4d5eb0c099a74a
      • Instruction Fuzzy Hash: 8FD0C27230470473CB00AA689C825AA35CD8B84305F00483E3CC5DA2C3FABDDA485756
      Function 0046F1A8 Relevance: 72.2, APIs: 1, Strings: 40, Instructions: 500registryCOMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 844 46f1a8-46f1da 845 46f1f7 844->845 846 46f1dc-46f1e3 844->846 849 46f1fe-46f236 call 403634 call 403738 call 42dec0 845->849 847 46f1e5-46f1ec 846->847 848 46f1ee-46f1f5 846->848 847->845 847->848 848->849 856 46f251-46f27a call 403738 call 42dde4 849->856 857 46f238-46f24c call 403738 call 42dec0 849->857 865 46f27c-46f285 call 46ee78 856->865 866 46f28a-46f2b3 call 46ef94 856->866 857->856 865->866 870 46f2c5-46f2c8 call 403400 866->870 871 46f2b5-46f2c3 call 403494 866->871 875 46f2cd-46f318 call 46ef94 call 42c3fc call 46efdc call 46ef94 870->875 871->875 884 46f32e-46f34f call 45559c call 46ef94 875->884 885 46f31a-46f32d call 46f004 875->885 892 46f3a5-46f3ac 884->892 893 46f351-46f3a4 call 46ef94 call 431404 call 46ef94 call 431404 call 46ef94 884->893 885->884 894 46f3ae-46f3e6 call 431404 call 46ef94 call 431404 call 46ef94 892->894 895 46f3ec-46f3f3 892->895 893->892 928 46f3eb 894->928 899 46f434-46f459 call 40b24c call 46ef94 895->899 900 46f3f5-46f433 call 46ef94 * 3 895->900 919 46f45b-46f466 call 47c648 899->919 920 46f468-46f471 call 403494 899->920 900->899 930 46f476-46f481 call 479198 919->930 920->930 928->895 934 46f483-46f488 930->934 935 46f48a 930->935 936 46f48f-46f659 call 403778 call 46ef94 call 47c648 call 46efdc call 403494 call 40357c * 2 call 46ef94 call 403494 call 40357c * 2 call 46ef94 call 47c648 call 46efdc call 47c648 call 46efdc call 47c648 call 46efdc call 47c648 call 46efdc call 47c648 call 46efdc call 47c648 call 46efdc call 47c648 call 46efdc call 47c648 call 46efdc call 47c648 call 46efdc call 47c648 934->936 935->936 999 46f66f-46f67d call 46f004 936->999 1000 46f65b-46f66d call 46ef94 936->1000 1004 46f682 999->1004 1005 46f683-46f6cc call 46f004 call 46f038 call 46ef94 call 47c648 call 46f09c 1000->1005 1004->1005 1016 46f6f2-46f6ff 1005->1016 1017 46f6ce-46f6ec call 46f004 * 2 1005->1017 1019 46f705-46f70c 1016->1019 1020 46f7ce-46f7d5 1016->1020 1031 46f6f1 1017->1031 1024 46f70e-46f715 1019->1024 1025 46f779-46f788 1019->1025 1021 46f7d7-46f80d call 49522c 1020->1021 1022 46f82f-46f845 RegCloseKey 1020->1022 1021->1022 1024->1025 1029 46f717-46f73b call 430bcc 1024->1029 1028 46f78b-46f798 1025->1028 1032 46f7af-46f7c8 call 430c08 call 46f004 1028->1032 1033 46f79a-46f7a7 1028->1033 1029->1028 1039 46f73d-46f73e 1029->1039 1031->1016 1042 46f7cd 1032->1042 1033->1032 1035 46f7a9-46f7ad 1033->1035 1035->1020 1035->1032 1041 46f740-46f766 call 40b24c call 4799f4 1039->1041 1047 46f773-46f775 1041->1047 1048 46f768-46f76e call 430bcc 1041->1048 1042->1020 1047->1041 1050 46f777 1047->1050 1048->1047 1050->1028
      APIs
        • Part of subcall function 0046EF94: RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,004765A2,?,0049D1E0,?,0046F2AB,?,00000000,0046F846,?,_is1), ref: 0046EFB7
        • Part of subcall function 0046F004: RegSetValueExA.ADVAPI32(?,NoModify,00000000,00000004,00000000,00000004,00000001,?,0046F682,?,?,00000000,0046F846,?,_is1,?), ref: 0046F017
      • RegCloseKey.ADVAPI32(?,0046F84D,?,_is1,?,Software\Microsoft\Windows\CurrentVersion\Uninstall\,00000000,0046F898,?,?,0049D1E0,00000000), ref: 0046F840
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Value$Close
      • String ID: " /SILENT$5.5.5 (a)$Comments$Contact$DisplayIcon$DisplayName$DisplayVersion$EstimatedSize$HelpLink$HelpTelephone$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: Language$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: Setup Version$Inno Setup: User$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$InstallDate$InstallLocation$MajorVersion$MinorVersion$ModifyPath$NoModify$NoRepair$Publisher$QuietUninstallString$Readme$RegisterPreviousData$Software\Microsoft\Windows\CurrentVersion\Uninstall\$URLInfoAbout$URLUpdateInfo$UninstallString$_is1
      • API String ID: 3391052094-1086636208
      • Opcode ID: f1985d017a2f18ca09267267447b8b3de407595befee0309dbb20431479733c2
      • Instruction ID: 919d238161e7e37985259c8afe8e7ed5cdfe626de619bb7a801eef3e398df61e
      • Opcode Fuzzy Hash: f1985d017a2f18ca09267267447b8b3de407595befee0309dbb20431479733c2
      • Instruction Fuzzy Hash: 90125634A00108AFCB04DB55E891ADE77F5EB48304F60817BE854AB395EB78BE45CB5E
      Function 00456638 Relevance: 26.6, APIs: 4, Strings: 11, Instructions: 310COMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 1424 456638-45666a call 403728 1427 456685 1424->1427 1428 45666c-456683 756FE550 1424->1428 1429 45668a-45668c 1427->1429 1428->1429 1430 45668e-4566ab 756FE550 1429->1430 1431 4566b9-4566fd call 403738 * 2 1429->1431 1430->1431 1433 4566ad-4566b4 call 4534b0 1430->1433 1440 4566ff-456705 call 45645c 1431->1440 1441 45670a-45670e 1431->1441 1433->1431 1440->1441 1443 456710-456717 1441->1443 1444 45674e-45675d 1441->1444 1445 456719-456733 call 47c648 call 42db10 1443->1445 1446 456738-456749 call 403738 1443->1446 1452 456770-456775 1444->1452 1453 45675f-45676b call 403738 1444->1453 1445->1446 1446->1444 1456 456785-45678c call 45643c 1452->1456 1457 456777-456780 1452->1457 1453->1452 1461 456792-45679a 1456->1461 1462 4568ed-456900 1456->1462 1457->1456 1463 4567a6-4567b9 1461->1463 1464 45679c-4567a0 1461->1464 1466 456902-456909 call 4534b0 1462->1466 1467 45690e-456912 1462->1467 1472 4567c7-4567cb 1463->1472 1473 4567bb-4567c2 call 4534b0 1463->1473 1464->1462 1464->1463 1466->1467 1470 456914-45691b call 45641c 1467->1470 1471 456937-45693f call 403ca4 1467->1471 1470->1471 1485 45691d-456935 call 42c4f8 call 403ca4 1470->1485 1483 456942-456946 1471->1483 1476 4567cd-4567ed 1472->1476 1477 4567fb-4567fd 1472->1477 1473->1472 1476->1477 1493 4567ef-4567f6 call 4534b0 1476->1493 1479 4567ff-456813 call 403ca4 1477->1479 1480 456868-45686c 1477->1480 1495 456815 call 408c00 1479->1495 1496 45681a-45683c 1479->1496 1486 4568d4-4568df 1480->1486 1487 45686e-45688e 1480->1487 1489 45694d-456957 1483->1489 1490 456948 call 408c00 1483->1490 1485->1483 1486->1462 1506 4568e1-4568e8 call 4534b0 1486->1506 1501 456890-456897 call 4534b0 1487->1501 1502 45689c-4568a3 call 45644c 1487->1502 1503 45695c-45695e 1489->1503 1490->1489 1493->1477 1495->1496 1517 45683e-456845 call 4534b0 1496->1517 1518 45684a-456860 SysFreeString 1496->1518 1501->1502 1502->1486 1519 4568a5-4568c6 1502->1519 1509 456960-456967 call 4534b0 1503->1509 1510 45696c-45698b call 456550 1503->1510 1506->1462 1509->1510 1522 456996-45699a 1510->1522 1523 45698d-456991 SysFreeString 1510->1523 1517->1518 1519->1486 1529 4568c8-4568cf call 4534b0 1519->1529 1525 4569a5-4569a9 1522->1525 1526 45699c-4569a0 1522->1526 1523->1522 1527 4569b4-4569bd 1525->1527 1528 4569ab-4569af 1525->1528 1526->1525 1528->1527 1529->1486
      APIs
      • 756FE550.OLE32(0049AA74,00000000,00000001,0049A774,?,00000000,004569E3), ref: 0045667E
      • 756FE550.OLE32(0049A764,00000000,00000001,0049A774,?,00000000,004569E3), ref: 004566A4
      • SysFreeString.OLEAUT32(00000000), ref: 0045685B
      Strings
      • IPersistFile::Save, xrefs: 00456962
      • IPropertyStore::SetValue(PKEY_AppUserModel_ID), xrefs: 00456840
      • {pf32}\, xrefs: 0045671E
      • %ProgramFiles(x86)%\, xrefs: 0045672E
      • IPropertyStore::SetValue(PKEY_AppUserModel_PreventPinning), xrefs: 004567F1
      • IPropertyStore::SetValue(PKEY_AppUserModel_ExcludeFromShowInNewInstall), xrefs: 00456892
      • IPropertyStore::SetValue(PKEY_AppUserModel_StartPinOption), xrefs: 004568CA
      • IShellLink::QueryInterface(IID_IPersistFile), xrefs: 00456904
      • IPropertyStore::Commit, xrefs: 004568E3
      • CoCreateInstance, xrefs: 004566AF
      • IShellLink::QueryInterface(IID_IPropertyStore), xrefs: 004567BD
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: E550$FreeString
      • String ID: %ProgramFiles(x86)%\$CoCreateInstance$IPersistFile::Save$IPropertyStore::Commit$IPropertyStore::SetValue(PKEY_AppUserModel_ExcludeFromShowInNewInstall)$IPropertyStore::SetValue(PKEY_AppUserModel_ID)$IPropertyStore::SetValue(PKEY_AppUserModel_PreventPinning)$IPropertyStore::SetValue(PKEY_AppUserModel_StartPinOption)$IShellLink::QueryInterface(IID_IPersistFile)$IShellLink::QueryInterface(IID_IPropertyStore)${pf32}\
      • API String ID: 491012016-2363233914
      • Opcode ID: 408380bf8d2395c9e29ec18173e4efe72cc11e6f791a4b28abd212c293816f6c
      • Instruction ID: 4476945c37b4f31b89aba6a543103ab5e85505a484c0bcee886d51158b9c11c4
      • Opcode Fuzzy Hash: 408380bf8d2395c9e29ec18173e4efe72cc11e6f791a4b28abd212c293816f6c
      • Instruction Fuzzy Hash: 1DB14270A00104AFDB51DFA9C945B9E7BF8AF09306F5540A6F804E7362DB78DD48CB69
      Function 00483E58 Relevance: 26.3, APIs: 9, Strings: 6, Instructions: 68libraryloaderCOMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 1532 483e58-483e7d GetModuleHandleA GetProcAddress 1533 483e7f-483e95 GetNativeSystemInfo GetProcAddress 1532->1533 1534 483ee4-483ee9 GetSystemInfo 1532->1534 1535 483eee-483ef7 1533->1535 1536 483e97-483ea2 GetCurrentProcess 1533->1536 1534->1535 1537 483ef9-483efd 1535->1537 1538 483f07-483f0e 1535->1538 1536->1535 1545 483ea4-483ea8 1536->1545 1539 483eff-483f03 1537->1539 1540 483f10-483f17 1537->1540 1541 483f29-483f2e 1538->1541 1543 483f19-483f20 1539->1543 1544 483f05-483f22 1539->1544 1540->1541 1543->1541 1544->1541 1545->1535 1547 483eaa-483eb1 call 45271c 1545->1547 1547->1535 1550 483eb3-483ec0 GetProcAddress 1547->1550 1550->1535 1551 483ec2-483ed9 GetModuleHandleA GetProcAddress 1550->1551 1551->1535 1552 483edb-483ee2 1551->1552 1552->1535
      APIs
      • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00483E69
      • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00483E76
      • GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 00483E84
      • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00483E8C
      • GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 00483E98
      • GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 00483EB9
      • GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 00483ECC
      • GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 00483ED2
      • GetSystemInfo.KERNEL32(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 00483EE9
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressProc$HandleInfoModuleSystem$CurrentNativeProcess
      • String ID: GetNativeSystemInfo$GetSystemWow64DirectoryA$IsWow64Process$RegDeleteKeyExA$advapi32.dll$kernel32.dll
      • API String ID: 2230631259-2623177817
      • Opcode ID: 59f263af4fcdd65992a956226566fe3d4b80b51fd3e4eaa1c72591911b3d10d7
      • Instruction ID: 29dcc52068e6a036ccdcf12c8eee286e016c54428604db045c5eec6500932020
      • Opcode Fuzzy Hash: 59f263af4fcdd65992a956226566fe3d4b80b51fd3e4eaa1c72591911b3d10d7
      • Instruction Fuzzy Hash: 6511BE40D08342A5DA11BB7A5D05B7F2658DB00F1AF040C3BBA80AA286DB7DCE5497BF
      Function 00473B18 Relevance: 25.1, APIs: 9, Strings: 5, Instructions: 585registryCOMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 1558 473b18-473b4b 1559 474236-47426a call 46e614 call 403400 * 2 call 403420 1558->1559 1560 473b51-473b55 1558->1560 1561 473b5c-473b99 call 40b24c call 4799f4 1560->1561 1571 473b9f-473bde call 47e594 call 479638 call 47c648 * 2 1561->1571 1572 47422a-474230 1561->1572 1584 473be4-473beb 1571->1584 1585 473be0 1571->1585 1572->1559 1572->1561 1586 473c04-473c1d 1584->1586 1587 473bed-473bf4 1584->1587 1585->1584 1590 473c43-473c4a 1586->1590 1591 473c1f-473c29 call 473948 1586->1591 1588 473bf6-473bfb call 453344 1587->1588 1589 473c00 1587->1589 1588->1589 1589->1586 1592 473c4c-473c53 1590->1592 1593 473c59-473c60 1590->1593 1591->1590 1602 473c2b-473c3e call 403738 call 42dec0 1591->1602 1592->1593 1596 474107-47413d 1592->1596 1597 473cb3-473cd3 call 47396c 1593->1597 1598 473c62-473c69 1593->1598 1596->1586 1604 474143-47414a 1596->1604 1608 473d46-473d4d 1597->1608 1609 473cd5-473cfa call 403738 call 42dde4 1597->1609 1598->1597 1601 473c6b-473c8d call 403738 call 42de1c 1598->1601 1601->1596 1636 473c93-473cae call 403738 RegDeleteValueA RegCloseKey 1601->1636 1602->1590 1610 47417d-474184 1604->1610 1611 47414c-474156 call 473948 1604->1611 1620 473d96 1608->1620 1621 473d4f-473d73 call 403738 call 42de1c 1608->1621 1640 473cff-473d03 1609->1640 1618 4741b7-4741be 1610->1618 1619 474186-474190 call 473948 1610->1619 1611->1610 1635 474158-474178 call 45a3b4 1611->1635 1622 4741c0-4741e6 call 45a3b4 1618->1622 1623 4741eb-4741f2 1618->1623 1619->1618 1647 474192-4741b2 call 45a3b4 1619->1647 1627 473d9b-473d9d 1620->1627 1621->1627 1658 473d75-473d78 1621->1658 1622->1623 1633 4741f4-47421a call 45a3b4 1623->1633 1634 47421f-474225 call 47967c 1623->1634 1627->1596 1637 473da3-473db8 1627->1637 1633->1634 1634->1572 1635->1610 1636->1596 1645 473dcc-473dd3 1637->1645 1646 473dba-473dc7 call 403738 RegDeleteValueA 1637->1646 1649 473d05-473d09 1640->1649 1650 473d2a-473d31 1640->1650 1653 4740e9-4740ff RegCloseKey 1645->1653 1654 473dd9-473de0 1645->1654 1646->1645 1647->1618 1649->1627 1659 473d0f-473d28 call 47396c 1649->1659 1650->1627 1660 473d33-473d44 call 46ee78 1650->1660 1656 473de2-473df6 call 403738 call 42dd64 1654->1656 1657 473dfc-473e09 1654->1657 1656->1653 1656->1657 1657->1653 1664 473e0f 1657->1664 1658->1627 1663 473d7a-473d81 1658->1663 1659->1627 1660->1627 1663->1627 1668 473d83-473d94 call 46ee78 1663->1668 1664->1653 1669 474036-474051 call 47c648 call 430c58 1664->1669 1670 473fd4-47400d call 47c648 call 406d98 call 403738 RegSetValueExA 1664->1670 1671 473e32-473e3c 1664->1671 1672 47409b-4740cd call 403574 call 403738 * 2 RegSetValueExA 1664->1672 1668->1627 1703 474053-474058 call 453344 1669->1703 1704 47405d-47407d call 403738 RegSetValueExA 1669->1704 1670->1653 1716 474013-47401a 1670->1716 1677 473e45-473e4a 1671->1677 1678 473e3e-473e41 1671->1678 1672->1653 1720 4740cf-4740d6 1672->1720 1688 473e51-473e53 1677->1688 1685 473e43 1678->1685 1686 473e4c 1678->1686 1685->1688 1686->1688 1693 473ef0-473f02 call 40385c 1688->1693 1694 473e59-473e6b call 40385c 1688->1694 1710 473f04-473f1b call 403738 call 42dd58 1693->1710 1711 473f1d-473f20 call 403400 1693->1711 1706 473e86-473e89 call 403400 1694->1706 1707 473e6d-473e84 call 403738 call 42dd4c 1694->1707 1703->1704 1704->1653 1722 47407f-474086 1704->1722 1725 473e8e-473e95 1706->1725 1707->1706 1707->1725 1710->1711 1726 473f25-473f5e call 47c66c 1710->1726 1711->1726 1716->1653 1723 474020-474031 call 46ee78 1716->1723 1720->1653 1727 4740d8-4740e4 call 46ee78 1720->1727 1722->1653 1730 474088-474099 call 46ee78 1722->1730 1723->1653 1733 473e97-473eb5 call 403738 RegQueryValueExA 1725->1733 1734 473ec6-473eeb call 47c66c 1725->1734 1746 473f60-473f70 call 403574 1726->1746 1747 473f7f-473fab call 403574 call 403738 * 2 RegSetValueExA 1726->1747 1727->1653 1730->1653 1733->1734 1749 473eb7-473ebb 1733->1749 1734->1747 1746->1747 1755 473f72-473f7a call 40357c 1746->1755 1747->1653 1761 473fb1-473fb8 1747->1761 1753 473ec3 1749->1753 1754 473ebd-473ec1 1749->1754 1753->1734 1754->1734 1754->1753 1755->1747 1761->1653 1762 473fbe-473fcf call 46ee78 1761->1762 1762->1653
      APIs
      • RegDeleteValueA.ADVAPI32(?,00000000,?,00000002,00000000,00000000,00474111,?,?,?,?,00000000,0047426B,?,?,0049D1E0), ref: 00473CA0
      • RegCloseKey.ADVAPI32(?,?,00000000,?,00000002,00000000,00000000,00474111,?,?,?,?,00000000,0047426B), ref: 00473CA9
        • Part of subcall function 0047396C: GetLastError.KERNEL32(00000000,00000000,00000000,00473A40,?,?,0049D1E0,00000000), ref: 004739F9
      • RegDeleteValueA.ADVAPI32(?,00000000,00000000,00474100,?,?,00000000,00474111,?,?,?,?,00000000,0047426B), ref: 00473DC7
        • Part of subcall function 0042DDE4: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DE10
        • Part of subcall function 0047396C: GetLastError.KERNEL32(00000000,00000000,00000000,00473A40,?,?,0049D1E0,00000000), ref: 00473A0F
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: DeleteErrorLastValue$CloseCreate
      • String ID: Cannot access 64-bit registry keys on this version of Windows$Failed to parse "qword" value$break$olddata${olddata}
      • API String ID: 2638610037-3092547568
      • Opcode ID: 17164574700c52a48af7721f29fa7c6b4207c87033bacf73772f0510ec8b2d04
      • Instruction ID: 06766ed5556eb719019ce5afb71c009034a5ecfcad3daac3ec42ac2cf13cdd63
      • Opcode Fuzzy Hash: 17164574700c52a48af7721f29fa7c6b4207c87033bacf73772f0510ec8b2d04
      • Instruction Fuzzy Hash: 90320E74E00248AFDB15DFA9D485BEEB7F4AF48305F448066F914AB3A2C738AD45CB58
      Function 00468DA4 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 155registryCOMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 1765 468da4-468ddc call 47c648 1768 468de2-468df2 call 4791b8 1765->1768 1769 468fbe-468fd8 call 403420 1765->1769 1774 468df7-468e3c call 4078f4 call 403738 call 42de1c 1768->1774 1780 468e41-468e43 1774->1780 1781 468fb4-468fb8 1780->1781 1782 468e49-468e5e 1780->1782 1781->1769 1781->1774 1783 468e73-468e7a 1782->1783 1784 468e60-468e6e call 42dd4c 1782->1784 1786 468ea7-468eae 1783->1786 1787 468e7c-468e9e call 42dd4c call 42dd64 1783->1787 1784->1783 1788 468f07-468f0e 1786->1788 1789 468eb0-468ed5 call 42dd4c * 2 1786->1789 1787->1786 1808 468ea0 1787->1808 1793 468f54-468f5b 1788->1793 1794 468f10-468f22 call 42dd4c 1788->1794 1811 468ed7-468ee0 call 4314f8 1789->1811 1812 468ee5-468ef7 call 42dd4c 1789->1812 1796 468f96-468fac RegCloseKey 1793->1796 1797 468f5d-468f91 call 42dd4c * 3 1793->1797 1804 468f24-468f2d call 4314f8 1794->1804 1805 468f32-468f44 call 42dd4c 1794->1805 1797->1796 1804->1805 1805->1793 1818 468f46-468f4f call 4314f8 1805->1818 1808->1786 1811->1812 1812->1788 1822 468ef9-468f02 call 4314f8 1812->1822 1818->1793 1822->1788
      APIs
        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00483FBF,?,00000001,?,?,00483FBF,?,00000001,00000000), ref: 0042DE38
      • RegCloseKey.ADVAPI32(?,00468FBE,?,?,00000001,00000000,00000000,00468FD9,?,00000000,00000000,?), ref: 00468FA7
      Strings
      • Inno Setup: Icon Group, xrefs: 00468E82
      • Inno Setup: User Info: Serial, xrefs: 00468F89
      • Inno Setup: Setup Type, xrefs: 00468EB6
      • Inno Setup: Deselected Tasks, xrefs: 00468F35
      • Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00468E03
      • Inno Setup: User Info: Organization, xrefs: 00468F76
      • Inno Setup: Deselected Components, xrefs: 00468EE8
      • Inno Setup: Selected Tasks, xrefs: 00468F13
      • Inno Setup: User Info: Name, xrefs: 00468F63
      • Inno Setup: No Icons, xrefs: 00468E8F
      • Inno Setup: App Path, xrefs: 00468E66
      • %s\%s_is1, xrefs: 00468E21
      • Inno Setup: Selected Components, xrefs: 00468EC6
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CloseOpen
      • String ID: %s\%s_is1$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$Software\Microsoft\Windows\CurrentVersion\Uninstall
      • API String ID: 47109696-1093091907
      • Opcode ID: b8d1216e8efebf1dbe24cedb12c24db51041ee7c630b2c14b755033d53aaaa17
      • Instruction ID: 089233d71a1efac8667e683b93aebe9146307268439e7b786faecd1ad8525d47
      • Opcode Fuzzy Hash: b8d1216e8efebf1dbe24cedb12c24db51041ee7c630b2c14b755033d53aaaa17
      • Instruction Fuzzy Hash: A251D730A006049BCB14DB65C841BDEB7F5EF49304F9085BEE850AB391EB79AF05CB5A
      Function 00472C9C Relevance: 23.1, APIs: 4, Strings: 9, Instructions: 341COMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 1824 472c9c-472d98 call 403728 call 403778 call 403684 call 47c648 call 403494 * 2 call 40357c call 42c804 call 403494 call 40357c call 42c804 call 403494 call 40357c call 42c804 * 2 1855 472d9f-472da3 1824->1855 1856 472d9a-472d9d 1824->1856 1857 472da8-472dac 1855->1857 1858 472da5 1855->1858 1856->1857 1859 472dbf-472dcd call 47296c 1857->1859 1860 472dae-472db9 call 479198 1857->1860 1858->1857 1865 472dcf-472dda call 403494 1859->1865 1866 472ddc-472de2 call 403494 1859->1866 1860->1859 1867 472dbb 1860->1867 1871 472de7-472e43 call 457f1c call 46e278 call 42c8a4 call 46fc2c call 406f50 * 2 call 42cd24 1865->1871 1866->1871 1867->1859 1886 472e45-472e54 call 403738 WritePrivateProfileStringA 1871->1886 1887 472e59-472e77 call 406f50 call 472b4c call 457d10 1871->1887 1886->1887 1896 472e7d-472eaf call 456638 1887->1896 1897 472f2a-472f45 call 472a08 call 403494 1887->1897 1900 472eb4-472eb8 1896->1900 1909 472f49-472f5e call 457d10 1897->1909 1902 472ec6-472ec8 1900->1902 1903 472eba-472ec4 call 42cd48 1900->1903 1907 472ecc-472ed3 1902->1907 1903->1902 1911 472eca 1903->1911 1907->1909 1910 472ed5-472ed9 1907->1910 1916 472f76-472f85 call 403738 SHChangeNotify 1909->1916 1917 472f60-472f74 call 403738 SHChangeNotify 1909->1917 1910->1909 1913 472edb-472ef5 call 42c8fc call 406ac4 1910->1913 1911->1907 1913->1909 1926 472ef7-472f1c call 4554a8 1913->1926 1925 472f8a-472fb3 call 42c8a4 call 403738 SHChangeNotify 1916->1925 1917->1925 1933 4730b7-4730eb call 46e614 call 403400 call 403420 call 403400 1925->1933 1934 472fb9-472fbd 1925->1934 1926->1909 1935 472fc3-473050 call 45a204 call 42c3fc call 40357c call 45a204 call 42c3fc call 40357c call 45a204 1934->1935 1936 473052-473056 1934->1936 1935->1933 1938 473079-4730b2 call 45a204 * 2 1936->1938 1939 473058-473077 call 45a204 1936->1939 1938->1933 1939->1933
      APIs
        • Part of subcall function 0042C804: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C828
      • WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00472E54
      • SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 00472F6F
      • SHChangeNotify.SHELL32(00000002,00000001,00000000,00000000), ref: 00472F85
      • SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 00472FAA
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ChangeNotify$FullNamePathPrivateProfileStringWrite
      • String ID: .lnk$.pif$.url$Creating the icon.$Desktop.ini$Dest filename: %s$Successfully created the icon.$target.lnk${group}\
      • API String ID: 971782779-2902529204
      • Opcode ID: ce71c2a7e26fb7b6508a74b8938571ddbf8c629c0e6c29f47ac95046fd4ef9b9
      • Instruction ID: 69417eb76a4de0c3f78625ae8d8ca34093eef506cfc77e8652370fcf6f2c9048
      • Opcode Fuzzy Hash: ce71c2a7e26fb7b6508a74b8938571ddbf8c629c0e6c29f47ac95046fd4ef9b9
      • Instruction Fuzzy Hash: 11D13474A00149AFDB01EFA9D582BDDBBF5EF08305F50806AF904B7392C6789E45CB69
      Function 0047CA48 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 187COMMON
      Download Yara Rule

      Control-flow Graph

      APIs
        • Part of subcall function 0042D898: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00453DB4,00000000,00454066,?,?,00000000,0049C628,00000004,00000000,00000000,00000000,?,004988E5), ref: 0042D8AB
        • Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7
        • Part of subcall function 0042D8F0: GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,00453B5A,00000000,00453BFD,?,?,00000000,00000000,00000000,00000000,00000000,?,00453FED,00000000), ref: 0042D90A
        • Part of subcall function 0042D8F0: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042D910
      • SHGetKnownFolderPath.SHELL32(0049AD30,00008000,00000000,?,00000000,0047CD1E), ref: 0047CC22
      • 757283B0.OLE32(?,0047CC67), ref: 0047CC5A
        • Part of subcall function 0042D208: GetEnvironmentVariableA.KERNEL32(00000000,00000000,00000000,?,?,00000000,0042DA3E,00000000,0042DAD0,?,?,?,0049C628,00000000,00000000), ref: 0042D233
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Directory$757283AddressEnvironmentFolderHandleKnownModulePathProcSystemVariableWindows
      • String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
      • API String ID: 795111782-544719455
      • Opcode ID: fcc310bf490460646d1fd6b8b4129c3c707d8ae0284c530feea0f38de33a2a7d
      • Instruction ID: 98c8bf546cfcb3b0d768b5071be100863efb26fba80d147bce383fdfc7eb0663
      • Opcode Fuzzy Hash: fcc310bf490460646d1fd6b8b4129c3c707d8ae0284c530feea0f38de33a2a7d
      • Instruction Fuzzy Hash: 0661A035E00204AFDB21FBA5D982A8E7B69EB44319F50C47BE448A7395C73CAA44CB5D
      Function 00423874 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 98windowregistryCOMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 2209 423874-42387e 2210 4239a7-4239ab 2209->2210 2211 423884-4238a6 call 41f3c4 GetClassInfoA 2209->2211 2214 4238d7-4238e0 GetSystemMetrics 2211->2214 2215 4238a8-4238bf RegisterClassA 2211->2215 2217 4238e2 2214->2217 2218 4238e5-4238ef GetSystemMetrics 2214->2218 2215->2214 2216 4238c1-4238d2 call 408cbc call 40311c 2215->2216 2216->2214 2217->2218 2220 4238f1 2218->2220 2221 4238f4-423950 call 403738 call 4062e8 call 403400 call 42364c SetWindowLongA 2218->2221 2220->2221 2232 423952-423965 call 424178 SendMessageA 2221->2232 2233 42396a-423998 GetSystemMenu DeleteMenu * 2 2221->2233 2232->2233 2233->2210 2235 42399a-4239a2 DeleteMenu 2233->2235 2235->2210
      APIs
        • Part of subcall function 0041F3C4: VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041EDA4,?,0042388F,00423C0C,0041EDA4), ref: 0041F3E2
      • GetClassInfoA.USER32(00400000,0042367C), ref: 0042389F
      • RegisterClassA.USER32(0049A630), ref: 004238B7
      • GetSystemMetrics.USER32(00000000), ref: 004238D9
      • GetSystemMetrics.USER32(00000001), ref: 004238E8
      • SetWindowLongA.USER32(00410460,000000FC,0042368C), ref: 00423944
      • SendMessageA.USER32(00410460,00000080,00000001,00000000), ref: 00423965
      • GetSystemMenu.USER32(00410460,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C,0041EDA4), ref: 00423970
      • DeleteMenu.USER32(00000000,0000F030,00000000,00410460,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C,0041EDA4), ref: 0042397F
      • DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F030,00000000,00410460,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001), ref: 0042398C
      • DeleteMenu.USER32(00000000,0000F010,00000000,00000000,0000F000,00000000,00000000,0000F030,00000000,00410460,00000000,00000000,00400000,00000000,00000000,00000000), ref: 004239A2
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Menu$DeleteSystem$ClassMetrics$AllocInfoLongMessageRegisterSendVirtualWindow
      • String ID: |6B
      • API String ID: 183575631-3009739247
      • Opcode ID: 52a3f909060148d9aa4281975783465b641c3a48185e708ae4d2ff0455f652ed
      • Instruction ID: 701f3ba42b2f6941ce043f3d21f0a29caf986c78014eaa590cfe39abddca5976
      • Opcode Fuzzy Hash: 52a3f909060148d9aa4281975783465b641c3a48185e708ae4d2ff0455f652ed
      • Instruction Fuzzy Hash: 0F316FB17402106AEB10BFA5DC82F6A36989B14709F64017BBA44EF2D7C6BDED40876D
      Function 0047D254 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 95libraryloaderCOMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 2321 47d254-47d2aa call 42c3fc call 4035c0 call 47cf18 call 4525d8 2330 47d2b6-47d2c5 call 4525d8 2321->2330 2331 47d2ac-47d2b1 call 453344 2321->2331 2335 47d2c7-47d2cd 2330->2335 2336 47d2df-47d2e5 2330->2336 2331->2330 2339 47d2ef-47d2f7 call 403494 2335->2339 2340 47d2cf-47d2d5 2335->2340 2337 47d2e7-47d2ed 2336->2337 2338 47d2fc-47d324 call 42e394 * 2 2336->2338 2337->2338 2337->2339 2347 47d326-47d346 call 4078f4 call 453344 2338->2347 2348 47d34b-47d365 GetProcAddress 2338->2348 2339->2338 2340->2336 2341 47d2d7-47d2dd 2340->2341 2341->2336 2341->2339 2347->2348 2350 47d367-47d36c call 453344 2348->2350 2351 47d371-47d38e call 403400 * 2 2348->2351 2350->2351
      APIs
      • GetProcAddress.KERNEL32(00000000,SHGetFolderPathA), ref: 0047D356
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressProc
      • String ID: @~I$Failed to get address of SHGetFolderPath function$Failed to get version numbers of _shfoldr.dll$Failed to load DLL "%s"$SHFOLDERDLL$SHGetFolderPathA$_isetup\_shfoldr.dll$shell32.dll$shfolder.dll
      • API String ID: 190572456-3298939431
      • Opcode ID: 4912deedc86249b44c2b2bc209ab311300b7f510cf8b75585d8d8e5d7b3a2fdc
      • Instruction ID: bc39436a4c90ca8ea62b347ec71a57b5bd866838b4fb2709fb97938870acbe9e
      • Opcode Fuzzy Hash: 4912deedc86249b44c2b2bc209ab311300b7f510cf8b75585d8d8e5d7b3a2fdc
      • Instruction Fuzzy Hash: 4C31FB30E101499BCB00EF99D5829EEB7B5EF44318F5084B7E808E7252E738AE05CB6D
      Function 0040631C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 27libraryloaderCOMMON
      Download Yara Rule
      APIs
      • GetModuleHandleA.KERNEL32(kernel32.dll,?,00499100), ref: 00406322
      • GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040632F
      • GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 00406345
      • GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 0040635B
      • SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,00499100), ref: 00406366
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressProc$HandleModulePolicyProcess
      • String ID: SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$kernel32.dll
      • API String ID: 3256987805-3653653586
      • Opcode ID: fb4db72500fb8039bf9e982fa136c472a352d03826636d66c2b82dec8efce00d
      • Instruction ID: 935c6a5f7b98c90e27654dc67135d8c1f882d2ad5d8c1b9d0efaf55941893a49
      • Opcode Fuzzy Hash: fb4db72500fb8039bf9e982fa136c472a352d03826636d66c2b82dec8efce00d
      • Instruction Fuzzy Hash: 97E02D90380702ACEA1032B20D82F3B144C9B54B69B26543B7D56B51C7D9BDDD7059BD
      Function 0041321B Relevance: 14.6, APIs: 6, Strings: 2, Instructions: 639COMMON
      Download Yara Rule
      APIs
      • SetWindowLongA.USER32(?,000000FC,?), ref: 00413664
      • GetWindowLongA.USER32(?,000000F0), ref: 0041366F
      • GetWindowLongA.USER32(?,000000F4), ref: 00413681
      • SetWindowLongA.USER32(?,000000F4,?), ref: 00413694
      • SetPropA.USER32(?,00000000,00000000), ref: 004136AB
      • SetPropA.USER32(?,00000000,00000000), ref: 004136C2
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: LongWindow$Prop
      • String ID: 3A$yA
      • API String ID: 3887896539-3278460822
      • Opcode ID: 1c07f4deed6c4562423c092f4724465a1ea03bd5af76309e9f05fb86f1a2003d
      • Instruction ID: fdf3b7c8caa337f9bceaf96aba7cb52f923b616b33b589c47e9bcf33bd172928
      • Opcode Fuzzy Hash: 1c07f4deed6c4562423c092f4724465a1ea03bd5af76309e9f05fb86f1a2003d
      • Instruction Fuzzy Hash: D322E06508E3C05FE31B9B34896A5D57FA0EE13325B1945DFC4C28B1A3D21E8A8BC71A
      Function 00481C30 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 175windowCOMMON
      Download Yara Rule
      APIs
      • FreeLibrary.KERNEL32(00000000), ref: 00481DED
      • FreeLibrary.KERNEL32(00000000), ref: 00481E01
      • SendNotifyMessageA.USER32(00020412,00000496,00002710,00000000), ref: 00481E73
      Strings
      • Deinitializing Setup., xrefs: 00481C4E
      • GetCustomSetupExitCode, xrefs: 00481C8D
      • DeinitializeSetup, xrefs: 00481CE9
      • Restarting Windows., xrefs: 00481E4E
      • Not restarting Windows because Setup is being run from the debugger., xrefs: 00481E22
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: FreeLibrary$MessageNotifySend
      • String ID: DeinitializeSetup$Deinitializing Setup.$GetCustomSetupExitCode$Not restarting Windows because Setup is being run from the debugger.$Restarting Windows.
      • API String ID: 3817813901-1884538726
      • Opcode ID: f211ac0d1b37887ab1129f0b9ad4c32d24b1f47543329a948a2358cc85fd3b7c
      • Instruction ID: bddaa785ec81662f7bf2f9e5d539fe02af4b88b7679db2884a5df8f2f905bec6
      • Opcode Fuzzy Hash: f211ac0d1b37887ab1129f0b9ad4c32d24b1f47543329a948a2358cc85fd3b7c
      • Instruction Fuzzy Hash: A3516134A042009FD715FF69E845B6A7BE8EB59318F50887BF805873B1DB38AC46CB59
      Function 0042F560 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 90windowregistryCOMMON
      Download Yara Rule
      APIs
      • GetActiveWindow.USER32 ref: 0042F58F
      • GetFocus.USER32 ref: 0042F597
      • RegisterClassA.USER32(0049A7AC), ref: 0042F5B8
      • CreateWindowExA.USER32(00000000,TWindowDisabler-Window,0042F68C,88000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0042F5F6
      • CreateWindowExA.USER32(00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000), ref: 0042F63C
      • ShowWindow.USER32(00000000,00000008,00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000,00000000,TWindowDisabler-Window), ref: 0042F64D
      • SetFocus.USER32(00000000,00000000,0042F66F,?,?,?,00000001,00000000,?,00458352,00000000,0049C628), ref: 0042F654
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Window$CreateFocus$ActiveClassRegisterShow
      • String ID: TWindowDisabler-Window
      • API String ID: 3167913817-1824977358
      • Opcode ID: fb1f9fe1c71c5b8af9586d8a33087bfec474bba9d7159f42365ff7ae09dbc791
      • Instruction ID: dda2d5eb7d34b28f2f272ba96fc4d61883a47f5b0b42ca6576ba0e0cf2f65365
      • Opcode Fuzzy Hash: fb1f9fe1c71c5b8af9586d8a33087bfec474bba9d7159f42365ff7ae09dbc791
      • Instruction Fuzzy Hash: 5521B271740710BAE210EF62DC43F1A76B8EB04B44F91853BF604BB2E1D7B8AD0586AD
      Function 00472B4C Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 67COMMON
      Download Yara Rule
      APIs
      • GetFileAttributesA.KERNEL32(00000000,00000000,00472C0D,?,?,?,00000008,00000000,00000000,00000000,?,00472E69,?,?,00000000,004730EC), ref: 00472B70
        • Part of subcall function 0042CD94: GetPrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0042CE0A
        • Part of subcall function 00406F50: DeleteFileA.KERNEL32(00000000,0049C628,00498C31,00000000,00498C86,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B
      • SetFileAttributesA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00472C0D,?,?,?,00000008,00000000,00000000,00000000,?,00472E69), ref: 00472BE7
      • RemoveDirectoryA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00472C0D,?,?,?,00000008,00000000,00000000,00000000), ref: 00472BED
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: File$Attributes$DeleteDirectoryPrivateProfileRemoveString
      • String ID: .ShellClassInfo$CLSID2$desktop.ini$target.lnk${0AFACED1-E828-11D1-9187-B532F1E9575D}
      • API String ID: 884541143-1710247218
      • Opcode ID: 91b9d32a9e144b1738ef69a7fe7085cb68739ddc56e810c05d10909770faa689
      • Instruction ID: 5d3afa004f47515b0afb51a46fc12790b9d79365c4da9299bd662cb786c7dc46
      • Opcode Fuzzy Hash: 91b9d32a9e144b1738ef69a7fe7085cb68739ddc56e810c05d10909770faa689
      • Instruction Fuzzy Hash: 3E11D0707005147FD712EA698E82A9F73ACDB59714F61857BB404A72C1DB7CEE02865C
      Function 004531F0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46libraryloaderCOMMON
      Download Yara Rule
      APIs
      • GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00499146), ref: 00453210
      • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453216
      • GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00499146), ref: 0045322A
      • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453230
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressHandleModuleProc
      • String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
      • API String ID: 1646373207-2130885113
      • Opcode ID: d0ff59f18b9530acdeb51d97d08688cc37fc3775ca9e0494baf4630f4706f7f5
      • Instruction ID: f910edb4458e3938851fe9583b63f0ae2a58c37d0beebab1d7f8606323274804
      • Opcode Fuzzy Hash: d0ff59f18b9530acdeb51d97d08688cc37fc3775ca9e0494baf4630f4706f7f5
      • Instruction Fuzzy Hash: E601F770240B00BED311AF629C53F663A58D7567ABF6044BBFC14A65C2C67C4A088A2D
      Function 00467180 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 141windowCOMMON
      Download Yara Rule
      APIs
      • SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 00467223
      • ExtractIconA.SHELL32(00400000,00000000,?), ref: 00467249
        • Part of subcall function 004670C0: DrawIconEx.USER32(00000000,00000000,00000000,00000000,00000020,00000020,00000000,00000000,00000003), ref: 00467158
        • Part of subcall function 004670C0: DestroyCursor.USER32(00000000), ref: 0046716E
      • ExtractIconA.SHELL32(00400000,00000000,00000027), ref: 004672A0
      • SHGetFileInfo.SHELL32(00000000,00000000,?,00000160,00001000), ref: 00467301
      • ExtractIconA.SHELL32(00400000,00000000,?), ref: 00467327
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Icon$Extract$FileInfo$CursorDestroyDraw
      • String ID: c:\directory$shell32.dll
      • API String ID: 3376378930-1375355148
      • Opcode ID: f8e7a2be6646ab53a43d8afa294666c4430ced656155bca463c38b02dc44b0f5
      • Instruction ID: 138a6298abd7f9113949ce3c73846b23f8ddde712b50b90900ee050f9a83399f
      • Opcode Fuzzy Hash: f8e7a2be6646ab53a43d8afa294666c4430ced656155bca463c38b02dc44b0f5
      • Instruction Fuzzy Hash: 1D516E70604244AFD710DF65CD8AFDFB7E8EB48308F5081A6F8089B351D678AE81DB69
      Function 00430940 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 23registryclipboardthreadCOMMON
      Download Yara Rule
      APIs
      • RegisterClipboardFormatA.USER32(commdlg_help), ref: 00430948
      • RegisterClipboardFormatA.USER32(commdlg_FindReplace), ref: 00430957
      • GetCurrentThreadId.KERNEL32 ref: 00430971
      • GlobalAddAtomA.KERNEL32(00000000), ref: 00430992
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ClipboardFormatRegister$AtomCurrentGlobalThread
      • String ID: WndProcPtr%.8X%.8X$commdlg_FindReplace$commdlg_help
      • API String ID: 4130936913-2943970505
      • Opcode ID: 7b327a229f15c1775aafcf9e5dce95920728c3daeeeeba03cd54e58be82ef43c
      • Instruction ID: d785860af1824380fd88477401a0ac91f53502c0aef23a259f1a0b6829b03d26
      • Opcode Fuzzy Hash: 7b327a229f15c1775aafcf9e5dce95920728c3daeeeeba03cd54e58be82ef43c
      • Instruction Fuzzy Hash: E5F082B0448340DEE300EB65884271A7BE0AF58318F10567FF488A2392E7389900CB6F
      Function 00455010 Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 154COMMON
      Download Yara Rule
      APIs
      • GetLastError.KERNEL32(?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,0045522C,0045522C,?,0045522C,00000000), ref: 004551BA
      • CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,0045522C,0045522C,?,0045522C), ref: 004551C7
        • Part of subcall function 00454F7C: WaitForInputIdle.USER32(?,00000032), ref: 00454FA8
        • Part of subcall function 00454F7C: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00454FCA
        • Part of subcall function 00454F7C: GetExitCodeProcess.KERNEL32(?,?), ref: 00454FD9
        • Part of subcall function 00454F7C: CloseHandle.KERNEL32(?,00455006,00454FFF,?,?,?,00000000,?,?,004551DB,?,?,?,00000044,00000000,00000000), ref: 00454FF9
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CloseHandleWait$CodeErrorExitIdleInputLastMultipleObjectsProcess
      • String ID: .bat$.cmd$COMMAND.COM" /C $D$cmd.exe" /C "
      • API String ID: 854858120-615399546
      • Opcode ID: 63752eec2b59b4f13cc9efe802cf5237778c55757737ce0832ecc6fe0270d99e
      • Instruction ID: 058baa7e90e176347c833b132b7c272bf8058e823d6e061bdbf2f6311869cd9e
      • Opcode Fuzzy Hash: 63752eec2b59b4f13cc9efe802cf5237778c55757737ce0832ecc6fe0270d99e
      • Instruction Fuzzy Hash: 41516D34B0074DABCF10EFA5D852BDEBBB9AF44305F50447BB804B7292D7789A098B59
      Function 0042368C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 96windowCOMMON
      Download Yara Rule
      APIs
      • LoadIconA.USER32(00400000,MAINICON), ref: 0042371C
      • GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 00423749
      • OemToCharA.USER32(?,?), ref: 0042375C
      • CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 0042379C
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Char$FileIconLoadLowerModuleName
      • String ID: 2$MAINICON
      • API String ID: 3935243913-3181700818
      • Opcode ID: cf430e0210604bfe20bf37cdaa13f201e8b9ac728ae33447d1f713ae06624bab
      • Instruction ID: b862ab30e907d7d11921ba87c75f7ed125cbb11c913e829f49b155bf854cd81d
      • Opcode Fuzzy Hash: cf430e0210604bfe20bf37cdaa13f201e8b9ac728ae33447d1f713ae06624bab
      • Instruction Fuzzy Hash: 55318370A042549ADF10EF69D8C57C67BA8AF14308F4441BAE844DB393D7BED988CB69
      Function 00418F38 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55threadCOMMON
      Download Yara Rule
      APIs
      • GetCurrentProcessId.KERNEL32(00000000), ref: 00418F3D
      • GlobalAddAtomA.KERNEL32(00000000), ref: 00418F5E
      • GetCurrentThreadId.KERNEL32 ref: 00418F79
      • GlobalAddAtomA.KERNEL32(00000000), ref: 00418F9A
        • Part of subcall function 004230C8: GetDC.USER32(00000000), ref: 0042311E
        • Part of subcall function 004230C8: EnumFontsA.GDI32(00000000,00000000,00423068,00410460,00000000,?,?,00000000,?,00418FD3,00000000,?,?,?,00000001), ref: 00423131
        • Part of subcall function 004230C8: GetDeviceCaps.GDI32(00000000,0000005A), ref: 00423139
        • Part of subcall function 004230C8: ReleaseDC.USER32(00000000,00000000), ref: 00423144
        • Part of subcall function 0042368C: LoadIconA.USER32(00400000,MAINICON), ref: 0042371C
        • Part of subcall function 0042368C: GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 00423749
        • Part of subcall function 0042368C: OemToCharA.USER32(?,?), ref: 0042375C
        • Part of subcall function 0042368C: CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 0042379C
        • Part of subcall function 0041F118: GetVersion.KERNEL32(?,00418FF0,00000000,?,?,?,00000001), ref: 0041F126
        • Part of subcall function 0041F118: SetErrorMode.KERNEL32(00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F142
        • Part of subcall function 0041F118: LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F14E
        • Part of subcall function 0041F118: SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F15C
        • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F18C
        • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F1B5
        • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F1CA
        • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F1DF
        • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F1F4
        • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F209
        • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F21E
        • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F233
        • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F248
        • Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F25D
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressProc$AtomCharCurrentErrorGlobalLoadMode$CapsDeviceEnumFileFontsIconLibraryLowerModuleNameProcessReleaseThreadVersion
      • String ID: ControlOfs%.8X%.8X$Delphi%.8X
      • API String ID: 316262546-2767913252
      • Opcode ID: c36a4b23e5562d697b2f903a7a5cb31fd54b934549e848baf1f30e72e67c2608
      • Instruction ID: 262aedaf28d83917acc42982c60ac9de39c1673015ef694de88cecf514dc8a08
      • Opcode Fuzzy Hash: c36a4b23e5562d697b2f903a7a5cb31fd54b934549e848baf1f30e72e67c2608
      • Instruction Fuzzy Hash: 66112E706142419AD740FF75A88274A7BE19B68318F40943FF448A7391DB3D99448B5F
      Function 0042DE44 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 32registrylibraryloaderCOMMON
      Download Yara Rule
      APIs
      • RegDeleteKeyA.ADVAPI32(00000000,00000000), ref: 0042DE50
      • GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,?,00000000,0042DFEB,00000000,0042E003,?,?,?,?,00000006,?,00000000,00497D9D), ref: 0042DE6B
      • GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042DE71
      • RegDeleteKeyExA.KERNELBASE(00000000,00000000,00000100,00000000,?,00000000,0042DFEB,00000000,0042E003,?,?,?,?,00000006,?,00000000), ref: 0042DE8D
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Delete$AddressHandleModuleProc
      • String ID: RegDeleteKeyExA$advapi32.dll
      • API String ID: 636244128-1846899949
      • Opcode ID: 7c0b6ea7bcf1210885e3a643890e25c79888cd60f6735391ad7bc9aa4f19570a
      • Instruction ID: 3a2ca878903e1795670eed695717ef80bb4394372fb88417f4d80fec8e7fd05d
      • Opcode Fuzzy Hash: 7c0b6ea7bcf1210885e3a643890e25c79888cd60f6735391ad7bc9aa4f19570a
      • Instruction Fuzzy Hash: 1CE06DF1B41B70BAD72022657C8ABA33729DB79365F655437F105AD19182BC1C40CE9C
      Function 0041363C Relevance: 9.1, APIs: 6, Instructions: 60COMMON
      Download Yara Rule
      APIs
      • SetWindowLongA.USER32(?,000000FC,?), ref: 00413664
      • GetWindowLongA.USER32(?,000000F0), ref: 0041366F
      • GetWindowLongA.USER32(?,000000F4), ref: 00413681
      • SetWindowLongA.USER32(?,000000F4,?), ref: 00413694
      • SetPropA.USER32(?,00000000,00000000), ref: 004136AB
      • SetPropA.USER32(?,00000000,00000000), ref: 004136C2
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: LongWindow$Prop
      • String ID:
      • API String ID: 3887896539-0
      • Opcode ID: 55b4cfc7ed5f4da29afab9da53070d8663b34cf21f33470337f2daa11a5508e3
      • Instruction ID: 32a7d7ee2a8f5ff67583a88600f624804d914e0ed1a23c97313bafe8e531d0b4
      • Opcode Fuzzy Hash: 55b4cfc7ed5f4da29afab9da53070d8663b34cf21f33470337f2daa11a5508e3
      • Instruction Fuzzy Hash: 55110D76100204BFDF00DF99DC84E9A37E8EB08364F104266B918DB3A2C739E990DB99
      Function 00401A90 Relevance: 9.1, APIs: 6, Instructions: 59COMMON
      Download Yara Rule
      APIs
      • RtlEnterCriticalSection.KERNEL32(0049C420,00000000,00401B68), ref: 00401ABD
      • LocalFree.KERNEL32(00000000,00000000,00401B68), ref: 00401ACF
      • VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00401B68), ref: 00401AEE
      • LocalFree.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00401B68), ref: 00401B2D
      • RtlLeaveCriticalSection.KERNEL32(0049C420,00401B6F), ref: 00401B58
      • RtlDeleteCriticalSection.KERNEL32(0049C420,00401B6F), ref: 00401B62
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
      • String ID:
      • API String ID: 3782394904-0
      • Opcode ID: 881435858a3df7288aae927e3c0e93e2fd7e3e12d101c835c3d014fcf42cc859
      • Instruction ID: ece8596464e12e4b83b5bd96c0fd07c419ca8ccd111934747786d766a0fa6b25
      • Opcode Fuzzy Hash: 881435858a3df7288aae927e3c0e93e2fd7e3e12d101c835c3d014fcf42cc859
      • Instruction Fuzzy Hash: AC119D30B403405BEB15ABA59CE2B363BE4A765708F94007BF40067AF1D67C984087AE
      Function 004556D8 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 142registryCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00483FBF,?,00000001,?,?,00483FBF,?,00000001,00000000), ref: 0042DE38
      • RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,0045586F,?,00000000,004558AF), ref: 004557B5
      Strings
      • SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00455738
      • WININIT.INI, xrefs: 004557E4
      • PendingFileRenameOperations2, xrefs: 00455784
      • PendingFileRenameOperations, xrefs: 00455754
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CloseOpen
      • String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager$WININIT.INI
      • API String ID: 47109696-2199428270
      • Opcode ID: 8c0e85f1c7885db24e52a249d5dd3c3b4f133e831d547577a59a6845a7cbc00a
      • Instruction ID: 0fa1da25f67206326559771d92c7e47b52ca8d856d575cc5f046ac455f5bab2a
      • Opcode Fuzzy Hash: 8c0e85f1c7885db24e52a249d5dd3c3b4f133e831d547577a59a6845a7cbc00a
      • Instruction Fuzzy Hash: FF51A974E006089FDB10EF61DC51AEEB7B9EF44305F50857BEC04A7292DB78AE49CA58
      Function 0047CF70 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 101COMMON
      Download Yara Rule
      APIs
      • CreateDirectoryA.KERNEL32(00000000,00000000,00000000,0047D0C6,?,?,00000000,0049C628,00000000,00000000,?,00498A79,00000000,00498C22,?,00000000), ref: 0047D003
      • GetLastError.KERNEL32(00000000,00000000,00000000,0047D0C6,?,?,00000000,0049C628,00000000,00000000,?,00498A79,00000000,00498C22,?,00000000), ref: 0047D00C
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CreateDirectoryErrorLast
      • String ID: Created temporary directory: $\_setup64.tmp$_isetup
      • API String ID: 1375471231-2952887711
      • Opcode ID: 1eecf4954ce0daf108bada4207312d6aeeb0373aff1a8b62d3740012125efc95
      • Instruction ID: af260f6f7480edecd638166999e30f7be440663a8b327b718aa5de057e1adae4
      • Opcode Fuzzy Hash: 1eecf4954ce0daf108bada4207312d6aeeb0373aff1a8b62d3740012125efc95
      • Instruction Fuzzy Hash: 58413474E101099BDB00EFA5D882ADEB7B5EF45309F50843BE81477392DB38AE05CB69
      Function 00452510 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON
      Download Yara Rule
      APIs
      • 74D41520.VERSION(00000000,?,?,?,@~I), ref: 00452530
      • 74D41500.VERSION(00000000,?,00000000,?,00000000,004525AB,?,00000000,?,?,?,@~I), ref: 0045255D
      • 74D41540.VERSION(?,004525D4,?,?,00000000,?,00000000,?,00000000,004525AB,?,00000000,?,?,?,@~I), ref: 00452577
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: D41500D41520D41540
      • String ID: @~I$%E
      • API String ID: 2153611984-12183032
      • Opcode ID: ecc4a53eae0f0353b9c4fbae86b81e22f468796990bc4f412eb59b78197fba3a
      • Instruction ID: d9114bf675870787a38e05941c017967a2856d65250c066ee12fed36e81ef4e1
      • Opcode Fuzzy Hash: ecc4a53eae0f0353b9c4fbae86b81e22f468796990bc4f412eb59b78197fba3a
      • Instruction Fuzzy Hash: B2218331A00608BFDB01DAA989519AFB7FCEB4A300F554477F800E7242E6B9AE04C765
      Function 00423A84 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON
      Download Yara Rule
      APIs
      • EnumWindows.USER32(00423A1C), ref: 00423AA8
      • GetWindow.USER32(?,00000003), ref: 00423ABD
      • GetWindowLongA.USER32(?,000000EC), ref: 00423ACC
      • SetWindowPos.USER32(00000000,\AB,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,004241AB,?,?,00423D73), ref: 00423B02
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Window$EnumLongWindows
      • String ID: \AB
      • API String ID: 4191631535-3948367934
      • Opcode ID: a0c9b363d8d6b9641aeb8446b7a4c92f3f3c9368b10cc117bc4f3e1b93ce2f77
      • Instruction ID: 4b6871d745899257b3dec3320e13ee817e68a68cd1b349d039e0556484540124
      • Opcode Fuzzy Hash: a0c9b363d8d6b9641aeb8446b7a4c92f3f3c9368b10cc117bc4f3e1b93ce2f77
      • Instruction Fuzzy Hash: 51115E70700610ABDB109F28D885F5677E8EB08715F10026AF994AB2E3C378ED41CB58
      Function 0046BB68 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 320COMMON
      Download Yara Rule
      Strings
      • Need to restart Windows? %s, xrefs: 0046BEED
      • PrepareToInstall failed: %s, xrefs: 0046BEC6
      • NextButtonClick, xrefs: 0046BCA4
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID:
      • String ID: Need to restart Windows? %s$NextButtonClick$PrepareToInstall failed: %s
      • API String ID: 0-2329492092
      • Opcode ID: 40441c914f135716c9ceef7eed125ab3c48c0eff0d988ea92ecbec2cb997f9fb
      • Instruction ID: 90597b727b8db671a1353bb67a89dff92caaf8a867f7f44957cc6056c8ca7693
      • Opcode Fuzzy Hash: 40441c914f135716c9ceef7eed125ab3c48c0eff0d988ea92ecbec2cb997f9fb
      • Instruction Fuzzy Hash: 20D13234A04108DFCB05EF99C585AEE77F5EF09304F6444BAE404AB352E778AE41CB9A
      Function 00483460 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 226COMMON
      Download Yara Rule
      APIs
      • SetActiveWindow.USER32(?,?,00000000,004837B1), ref: 00483584
      • SHChangeNotify.SHELL32(08000000,00000000,00000000,00000000), ref: 00483622
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ActiveChangeNotifyWindow
      • String ID: $Need to restart Windows? %s
      • API String ID: 1160245247-4200181552
      • Opcode ID: b5dd91243014db4656f03101863c25a3411c418fd9b98f7e5bae53e627ce7ab2
      • Instruction ID: 3cd60a37b7a546e93b5b4b6a9d2fae219af0f2955b55f79ce689c7847cb83c99
      • Opcode Fuzzy Hash: b5dd91243014db4656f03101863c25a3411c418fd9b98f7e5bae53e627ce7ab2
      • Instruction Fuzzy Hash: 7E91B174A002449FDB10FF69D885B9E77E4AF49709F0444BBE8009B362D778AE05CB5E
      Function 0046FC2C Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0042C804: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C828
      • GetLastError.KERNEL32(00000000,0046FE29,?,?,0049D1E0,00000000), ref: 0046FD06
      • SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 0046FD80
      • SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 0046FDA5
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ChangeNotify$ErrorFullLastNamePath
      • String ID: Creating directory: %s
      • API String ID: 2451617938-483064649
      • Opcode ID: ea98750c62917a0b095afa7e3a142fc5e1a7eb630e2ee66878a1c52750688c13
      • Instruction ID: 2176636529ded56865c731fef9b171ef17a3b5c51acbe279b014175de5f2d579
      • Opcode Fuzzy Hash: ea98750c62917a0b095afa7e3a142fc5e1a7eb630e2ee66878a1c52750688c13
      • Instruction Fuzzy Hash: 98514474E00248ABDB01DFA5D982BDEBBF5AF49304F50857AE841B7382D7785E08CB59
      Function 00454DD4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 102libraryloaderCOMMON
      Download Yara Rule
      APIs
      • GetProcAddress.KERNEL32(00000000,SfcIsFileProtected), ref: 00454E82
      • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,00454F48), ref: 00454EEC
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressByteCharMultiProcWide
      • String ID: SfcIsFileProtected$sfc.dll
      • API String ID: 2508298434-591603554
      • Opcode ID: f4f56a787e99a845eb3d5b1c2e7df3c43ee97e9317219f384cf6a68eabf0849a
      • Instruction ID: b2847923d767e65e5d440d88bb0f32644e07ad36dde2f92948a3e34ea362eb02
      • Opcode Fuzzy Hash: f4f56a787e99a845eb3d5b1c2e7df3c43ee97e9317219f384cf6a68eabf0849a
      • Instruction Fuzzy Hash: 59419A71A04318ABEB20DF55DC85B9DB7B8AB4430DF5041B7A908A7293D7785F89CA1C
      Function 00416410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89registryCOMMON
      Download Yara Rule
      APIs
      • GetClassInfoA.USER32(00400000,?,?), ref: 0041647F
      • UnregisterClassA.USER32(?,00400000), ref: 004164AB
      • RegisterClassA.USER32(?), ref: 004164CE
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Class$InfoRegisterUnregister
      • String ID: @
      • API String ID: 3749476976-2766056989
      • Opcode ID: f889ae0e136f37cae535d00dc6459a6586e66bd55a8c0ed2d7a3a1af51bd0401
      • Instruction ID: 17bdcee1d95e3fed1dd3d41c9f7bbe28a180c173fc6d114d8d51d8d3f9958cb1
      • Opcode Fuzzy Hash: f889ae0e136f37cae535d00dc6459a6586e66bd55a8c0ed2d7a3a1af51bd0401
      • Instruction Fuzzy Hash: 63316F702042408BD720EF69C981B9B77E5AB85308F04457FF949DB392DB39DD44CB6A
      Function 00404D2A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72windowCOMMON
      Download Yara Rule
      APIs
      • MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00404DC5
      • ExitProcess.KERNEL32 ref: 00404E0D
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ExitMessageProcess
      • String ID: Error$Runtime error at 00000000
      • API String ID: 1220098344-2970929446
      • Opcode ID: d2d2115462cf46c609d5747887fa32ed032da6f71deecf4a39b0bc855ac853b0
      • Instruction ID: fb75bd3449ddbba25be9859e6e9cdae11be236df4b8f13ef698ff7f8a35764cd
      • Opcode Fuzzy Hash: d2d2115462cf46c609d5747887fa32ed032da6f71deecf4a39b0bc855ac853b0
      • Instruction Fuzzy Hash: 5E215360B44241CBEB11ABB5ACC17263B9197E5348F048177E740B73E2C67C9D5587AE
      Function 0042ED38 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 55libraryloaderCOMMON
      Download Yara Rule
      APIs
      • SHAutoComplete.SHLWAPI(00000000,00000001), ref: 0042EDC5
        • Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7
        • Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
        • Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD
      • GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0042EDA8
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressAutoCompleteDirectoryErrorLibraryLoadModeProcSystem
      • String ID: SHAutoComplete$shlwapi.dll
      • API String ID: 395431579-1506664499
      • Opcode ID: d2add807985338a3a4de70ffbea5f6e522c174cd2b64bb88ee8a0c215b8dc213
      • Instruction ID: 8774d5b728639f053903c60940f16a99d8dd695e97b41c3f5606bf77cec82f81
      • Opcode Fuzzy Hash: d2add807985338a3a4de70ffbea5f6e522c174cd2b64bb88ee8a0c215b8dc213
      • Instruction Fuzzy Hash: 4B11A330B40315BBD711EB62EC85B9E7BA8DB55704F90487BF40066291DBB89E05CA1C
      Function 00455A10 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41registryCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00483FBF,?,00000001,?,?,00483FBF,?,00000001,00000000), ref: 0042DE38
      • RegCloseKey.ADVAPI32(?,00455A7B,?,00000001,00000000), ref: 00455A6E
      Strings
      • SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00455A1C
      • PendingFileRenameOperations2, xrefs: 00455A4F
      • PendingFileRenameOperations, xrefs: 00455A40
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CloseOpen
      • String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager
      • API String ID: 47109696-2115312317
      • Opcode ID: 0895c05d49b7e3939e62ac7a28adf6fe7b3a2f4fac34ac9f1d41a877c72018e9
      • Instruction ID: e9356c19d9a7d2c1b22529064790e486fb2be540b5bf165494b3782c633fa2c0
      • Opcode Fuzzy Hash: 0895c05d49b7e3939e62ac7a28adf6fe7b3a2f4fac34ac9f1d41a877c72018e9
      • Instruction Fuzzy Hash: A3F0F671304A08BFDB04D661DC62A3B739CE744725FB08167F800CB682EA7CBD04915C
      Function 004722A8 Relevance: 6.3, APIs: 4, Instructions: 272fileCOMMON
      Download Yara Rule
      APIs
      • FindNextFileA.KERNEL32(000000FF,?,00000000,00472479,?,00000000,?,0049D1E0,00000000,00472669,?,00000000,?,00000000,?,00472835), ref: 00472455
      • FindClose.KERNEL32(000000FF,00472480,00472479,?,00000000,?,0049D1E0,00000000,00472669,?,00000000,?,00000000,?,00472835,?), ref: 00472473
      • FindNextFileA.KERNEL32(000000FF,?,00000000,0047259B,?,00000000,?,0049D1E0,00000000,00472669,?,00000000,?,00000000,?,00472835), ref: 00472577
      • FindClose.KERNEL32(000000FF,004725A2,0047259B,?,00000000,?,0049D1E0,00000000,00472669,?,00000000,?,00000000,?,00472835,?), ref: 00472595
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Find$CloseFileNext
      • String ID:
      • API String ID: 2066263336-0
      • Opcode ID: 007053e9bd20528639a8735c34a263578ff26602242c2f5639289e9f43ca8aae
      • Instruction ID: 7d8bdb7c330d0d553e19ff0d3186efde989b23172d2229495bc5b4a4d049c591
      • Opcode Fuzzy Hash: 007053e9bd20528639a8735c34a263578ff26602242c2f5639289e9f43ca8aae
      • Instruction Fuzzy Hash: DBC14D3490425DAFCF11DFA5C981ADEBBB9FF48304F5081AAE808B3251D7789A46CF54
      Function 004800D4 Relevance: 6.1, APIs: 4, Instructions: 147fileCOMMON
      Download Yara Rule
      APIs
      • FindNextFileA.KERNEL32(000000FF,?,?,?,?,00000000,004802CD,?,00000000,00000000,?,?,00481523,?,?,00000000), ref: 0048017A
      • FindClose.KERNEL32(000000FF,000000FF,?,?,?,?,00000000,004802CD,?,00000000,00000000,?,?,00481523,?,?), ref: 00480187
      • FindNextFileA.KERNEL32(000000FF,?,00000000,004802A0,?,?,?,?,00000000,004802CD,?,00000000,00000000,?,?,00481523), ref: 0048027C
      • FindClose.KERNEL32(000000FF,004802A7,004802A0,?,?,?,?,00000000,004802CD,?,00000000,00000000,?,?,00481523,?), ref: 0048029A
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Find$CloseFileNext
      • String ID:
      • API String ID: 2066263336-0
      • Opcode ID: bdb86fe88c629f6dd0367188ec83508b9b79f0751c1c8c61e5389748b8fb4acd
      • Instruction ID: 5208c2ed5f7d44eac0491ddb6a85d3f93b460d577737497756e59a9d78ea2d88
      • Opcode Fuzzy Hash: bdb86fe88c629f6dd0367188ec83508b9b79f0751c1c8c61e5389748b8fb4acd
      • Instruction Fuzzy Hash: 4E514071A006499FCB60EF65CC45ADEB7B8EF88315F1044AAA818E7341D6789F89CF58
      Function 00421274 Relevance: 6.1, APIs: 4, Instructions: 127windowCOMMON
      Download Yara Rule
      APIs
      • GetMenu.USER32(00000000), ref: 00421361
      • SetMenu.USER32(00000000,00000000), ref: 0042137E
      • SetMenu.USER32(00000000,00000000), ref: 004213B3
      • SetMenu.USER32(00000000,00000000), ref: 004213CF
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Menu
      • String ID:
      • API String ID: 3711407533-0
      • Opcode ID: e97f0d0fd48087c2803a00cef18cd1164762120fd483752062b803fa073f2342
      • Instruction ID: 73bdf447030a427dfdc8c5b0c3a18704960cc3a96cd20152b70bbf588139ae23
      • Opcode Fuzzy Hash: e97f0d0fd48087c2803a00cef18cd1164762120fd483752062b803fa073f2342
      • Instruction Fuzzy Hash: 88418B3070426457EB20EA3AA88579B36965B65318F4841BFFC40DF7A3CABDCD85839C
      Function 00416B42 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON
      Download Yara Rule
      APIs
      • SendMessageA.USER32(?,?,?,?), ref: 00416B84
      • SetTextColor.GDI32(?,00000000), ref: 00416B9E
      • SetBkColor.GDI32(?,00000000), ref: 00416BB8
      • CallWindowProcA.USER32(?,?,?,?,?), ref: 00416BE0
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Color$CallMessageProcSendTextWindow
      • String ID:
      • API String ID: 601730667-0
      • Opcode ID: 072521f5090f240ceba025e33949739ce14f97652003165ca459573163e57643
      • Instruction ID: 4ea48ea5c9b96bae81565ca4ce64eb356f32bd46963e120bc97d04dec40f2685
      • Opcode Fuzzy Hash: 072521f5090f240ceba025e33949739ce14f97652003165ca459573163e57643
      • Instruction Fuzzy Hash: BC115171705604AFD710EE6ECC84E8777ECEF49310715887EB959CB612C638F8418B69
      Function 00454F7C Relevance: 6.1, APIs: 4, Instructions: 54COMMON
      Download Yara Rule
      APIs
      • WaitForInputIdle.USER32(?,00000032), ref: 00454FA8
      • MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00454FCA
      • GetExitCodeProcess.KERNEL32(?,?), ref: 00454FD9
      • CloseHandle.KERNEL32(?,00455006,00454FFF,?,?,?,00000000,?,?,004551DB,?,?,?,00000044,00000000,00000000), ref: 00454FF9
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Wait$CloseCodeExitHandleIdleInputMultipleObjectsProcess
      • String ID:
      • API String ID: 4071923889-0
      • Opcode ID: e6feda7d3358a80d2693463bb1cb51aaf78648cef31b4280cf5022ab190105ae
      • Instruction ID: ea90b2abd28d60bbe0c33bbe6d7a83e36ef454db8471bda6b5c19e9a906557d9
      • Opcode Fuzzy Hash: e6feda7d3358a80d2693463bb1cb51aaf78648cef31b4280cf5022ab190105ae
      • Instruction Fuzzy Hash: B9012D31A006097FEB1097AA8C02F6FBBECDF49764F610127F904D72C2C5788D409A78
      Function 004230C8 Relevance: 6.1, APIs: 4, Instructions: 54COMMON
      Download Yara Rule
      APIs
      • GetDC.USER32(00000000), ref: 0042311E
      • EnumFontsA.GDI32(00000000,00000000,00423068,00410460,00000000,?,?,00000000,?,00418FD3,00000000,?,?,?,00000001), ref: 00423131
      • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00423139
      • ReleaseDC.USER32(00000000,00000000), ref: 00423144
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CapsDeviceEnumFontsRelease
      • String ID:
      • API String ID: 2698912916-0
      • Opcode ID: ae3b46bdf4144dece9088701a44aa945a4d7eb571b2044da6dc5baa79edeb2ca
      • Instruction ID: a9d24610abdaa6694e735d00c6d38f20457f2ac5f1468c421a1b182fb2ef8db9
      • Opcode Fuzzy Hash: ae3b46bdf4144dece9088701a44aa945a4d7eb571b2044da6dc5baa79edeb2ca
      • Instruction Fuzzy Hash: 8D01CC716042102AE700BF6A5C82B9B3AA49F01319F40027BF808AA3C6DA7E980547AE
      Function 004019CC Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON
      Download Yara Rule
      APIs
      • RtlInitializeCriticalSection.KERNEL32(0049C420,00000000,00401A82,?,?,0040222E,022A0650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
      • RtlEnterCriticalSection.KERNEL32(0049C420,0049C420,00000000,00401A82,?,?,0040222E,022A0650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
      • LocalAlloc.KERNEL32(00000000,00000FF8,0049C420,00000000,00401A82,?,?,0040222E,022A0650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
      • RtlLeaveCriticalSection.KERNEL32(0049C420,00401A89,00000000,00401A82,?,?,0040222E,022A0650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CriticalSection$AllocEnterInitializeLeaveLocal
      • String ID:
      • API String ID: 730355536-0
      • Opcode ID: 258d9deb6f7a10e014db2841a00646f08a98b62604f56307b5f20277c9267f14
      • Instruction ID: 68a963c4b4ce3cb9fa4489d147f84cdc209e61955976dc0c42ca8291dd14a8a4
      • Opcode Fuzzy Hash: 258d9deb6f7a10e014db2841a00646f08a98b62604f56307b5f20277c9267f14
      • Instruction Fuzzy Hash: 1501C0707842405EFB19AB6998A27353ED4D796748F91803BF440A6AF1C67C4840CB6D
      Function 0047D124 Relevance: 6.0, APIs: 4, Instructions: 35sleepCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ErrorLast$CountSleepTick
      • String ID:
      • API String ID: 2227064392-0
      • Opcode ID: 5e041b4854f84dd5c8ffe11e4d8ae333ce3d70cb233263dd3e5c8c0398f1b675
      • Instruction ID: 88a935f4bff1a7cda84d50ccab120ccf5a46d2436649f0ddad28cd11edbfaae5
      • Opcode Fuzzy Hash: 5e041b4854f84dd5c8ffe11e4d8ae333ce3d70cb233263dd3e5c8c0398f1b675
      • Instruction Fuzzy Hash: E4E0EDA27A9210458B2135BE1C826AF4A68CFC2334F68553FF0C8E6292C8584C0A863E
      Function 0045C264 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 166COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0045092C: SetEndOfFile.KERNEL32(?,?,0045C342,00000000,0045C4CD,?,00000000,00000002,00000002), ref: 00450933
      • FlushFileBuffers.KERNEL32(?), ref: 0045C499
      Strings
      • NumRecs range exceeded, xrefs: 0045C396
      • EndOffset range exceeded, xrefs: 0045C3CD
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: File$BuffersFlush
      • String ID: EndOffset range exceeded$NumRecs range exceeded
      • API String ID: 3593489403-659731555
      • Opcode ID: 5f94b386db4922d9a6d7df15eba8f7cef35965c566d297d1a11ab2140469b1ea
      • Instruction ID: 8eda1547737c5d84e7ccfe7966ff70e1a393b030727219d53a7e6597f82188d8
      • Opcode Fuzzy Hash: 5f94b386db4922d9a6d7df15eba8f7cef35965c566d297d1a11ab2140469b1ea
      • Instruction Fuzzy Hash: 33617334A002588FDB25DF25C891AD9B7B5AF49305F0084DAED88AB353D674AEC8CF54
      Function 00483968 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON
      Download Yara Rule
      APIs
      • GetForegroundWindow.USER32(00000000,00483AF2,?,00000000,00483B33,?,?,?,?,00000000,00000000,00000000,?,0046BDF1), ref: 004839A1
      • SetActiveWindow.USER32(?,00000000,00483AF2,?,00000000,00483B33,?,?,?,?,00000000,00000000,00000000,?,0046BDF1), ref: 004839B3
      Strings
      • Will not restart Windows automatically., xrefs: 00483AD2
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Window$ActiveForeground
      • String ID: Will not restart Windows automatically.
      • API String ID: 307657957-4169339592
      • Opcode ID: f2c0c7ae88c9a1c977d1f2e06e6fb28cfa539c0beb9938399133172c65ca23d7
      • Instruction ID: 179e77541fb544bac6a7c6ee7372f3d74283346fcc557f02defac7d99283c3b4
      • Opcode Fuzzy Hash: f2c0c7ae88c9a1c977d1f2e06e6fb28cfa539c0beb9938399133172c65ca23d7
      • Instruction Fuzzy Hash: 1D413530604240AECB11FF65DC02B6D7BE09B65F09F180CB7E880573A2D2BD6A46A71D
      Function 004990E8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 00403344: GetModuleHandleA.KERNEL32(00000000,004990F6), ref: 0040334B
        • Part of subcall function 00403344: GetCommandLineA.KERNEL32(00000000,004990F6), ref: 00403356
        • Part of subcall function 0040631C: GetModuleHandleA.KERNEL32(kernel32.dll,?,00499100), ref: 00406322
        • Part of subcall function 0040631C: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040632F
        • Part of subcall function 0040631C: GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 00406345
        • Part of subcall function 0040631C: GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 0040635B
        • Part of subcall function 0040631C: SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,00499100), ref: 00406366
        • Part of subcall function 004063C4: 6F571CD0.COMCTL32(00499105), ref: 004063C4
        • Part of subcall function 00410764: GetCurrentThreadId.KERNEL32 ref: 004107B2
        • Part of subcall function 00419040: GetVersion.KERNEL32(0049911E), ref: 00419040
        • Part of subcall function 0044F744: GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,00499132), ref: 0044F77F
        • Part of subcall function 0044F744: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044F785
        • Part of subcall function 0044FC10: GetVersionExA.KERNEL32(0049C790,00499137), ref: 0044FC1F
        • Part of subcall function 004531F0: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00499146), ref: 00453210
        • Part of subcall function 004531F0: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453216
        • Part of subcall function 004531F0: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00499146), ref: 0045322A
        • Part of subcall function 004531F0: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453230
        • Part of subcall function 004570B4: GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 004570D8
        • Part of subcall function 004645F4: LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,0049915A), ref: 00464603
        • Part of subcall function 004645F4: GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 00464609
        • Part of subcall function 0046CE48: GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 0046CE5D
        • Part of subcall function 00478FB4: GetModuleHandleA.KERNEL32(kernel32.dll,?,00499164), ref: 00478FBA
        • Part of subcall function 00478FB4: GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 00478FC7
        • Part of subcall function 00478FB4: GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 00478FD7
        • Part of subcall function 00484364: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 00484453
        • Part of subcall function 004960F4: RegisterClipboardFormatA.USER32(QueryCancelAutoPlay), ref: 0049610D
      • SetErrorMode.KERNEL32(00000001,00000000,004991AC), ref: 0049917E
        • Part of subcall function 00498EA8: GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,00499188,00000001,00000000,004991AC), ref: 00498EB2
        • Part of subcall function 00498EA8: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00498EB8
        • Part of subcall function 004244D4: SendMessageA.USER32(?,0000B020,00000000,?), ref: 004244F3
        • Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC
      • ShowWindow.USER32(?,00000005,00000000,004991AC), ref: 004991DF
        • Part of subcall function 004829A4: SetActiveWindow.USER32(?), ref: 00482A52
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressProc$HandleModule$Window$Version$ActiveClipboardCommandCurrentErrorF571FormatLibraryLineLoadMessageModePolicyProcessRegisterSendShowTextThread
      • String ID: Setup
      • API String ID: 3527831634-3839654196
      • Opcode ID: c59cda99c7f3b7dd56ce25b8713d597b36d481173d63b5a40afe6873286dddfb
      • Instruction ID: 269abd3331905c75c8a085e9ea64c9f4e062dff64d37a48967bf0643ce2afdb9
      • Opcode Fuzzy Hash: c59cda99c7f3b7dd56ce25b8713d597b36d481173d63b5a40afe6873286dddfb
      • Instruction Fuzzy Hash: 9C31D5312546409FDA01BBBBED53A1D3BA8EB8971CB51447FF80486593DE3D5C508A3E
      Function 00453A24 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON
      Download Yara Rule
      APIs
      • CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,00453B13,?,?,00000000,0049C628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00453A6A
      • GetLastError.KERNEL32(00000000,00000000,?,00000000,00453B13,?,?,00000000,0049C628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00453A73
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CreateDirectoryErrorLast
      • String ID: .tmp
      • API String ID: 1375471231-2986845003
      • Opcode ID: 8326ea691d92b319eae40e0868bf4200299e6435eaf0a251bd2c26a13e9fea0a
      • Instruction ID: 2c169793aa1d4e8b0ae54453200dd0eeecd34c8d921a2c5b894f13e1de3ec917
      • Opcode Fuzzy Hash: 8326ea691d92b319eae40e0868bf4200299e6435eaf0a251bd2c26a13e9fea0a
      • Instruction Fuzzy Hash: BD213575A002089BDB01EFA5C8429DEB7B8EF49305F50457BE801B7343DA3CAF058B69
      Function 00484364 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68libraryloaderCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 00483E58: GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00483E69
        • Part of subcall function 00483E58: GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00483E76
        • Part of subcall function 00483E58: GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 00483E84
        • Part of subcall function 00483E58: GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00483E8C
        • Part of subcall function 00483E58: GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 00483E98
        • Part of subcall function 00483E58: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 00483EB9
        • Part of subcall function 00483E58: GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 00483ECC
        • Part of subcall function 00483E58: GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 00483ED2
        • Part of subcall function 00484184: GetVersionExA.KERNEL32(?,00484396,00000000,0048446B,?,?,?,?,?,00499169), ref: 00484192
        • Part of subcall function 00484184: GetVersionExA.KERNEL32(0000009C,?,00484396,00000000,0048446B,?,?,?,?,?,00499169), ref: 004841E4
        • Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
        • Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD
      • GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 00484453
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressProc$HandleModuleVersion$CurrentErrorInfoLibraryLoadModeNativeProcessSystem
      • String ID: SHGetKnownFolderPath$shell32.dll
      • API String ID: 3869789854-2936008475
      • Opcode ID: 6e632a5fc1652dc2cb73537de3c19423d59f8d29a9b232880bcd190a523d1805
      • Instruction ID: 2b158ccf600997a1d48e7bca93d97b59053c96c6275c7fefbd1af4682491a366
      • Opcode Fuzzy Hash: 6e632a5fc1652dc2cb73537de3c19423d59f8d29a9b232880bcd190a523d1805
      • Instruction Fuzzy Hash: CE21FEB0A103116EC700BFBE5D5620A3BA5EBA471C381493BF804EB3D1D77E64159B6E
      Function 00452908 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42fileCOMMON
      Download Yara Rule
      APIs
      • DeleteFileA.KERNEL32(00000000,00000000,00452965,?,-00000001,?), ref: 0045293F
      • GetLastError.KERNEL32(00000000,00000000,00452965,?,-00000001,?), ref: 00452947
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: DeleteErrorFileLast
      • String ID: 0(H
      • API String ID: 2018770650-4268776330
      • Opcode ID: fbcc140a81a3acb9c96393828f2cc587f034b3ec3a8bc9b7824854e1d547cdb8
      • Instruction ID: a1d21d86fbcf93c7076efe682877c1f84c37cf58088428800e153654eea74c02
      • Opcode Fuzzy Hash: fbcc140a81a3acb9c96393828f2cc587f034b3ec3a8bc9b7824854e1d547cdb8
      • Instruction Fuzzy Hash: 05F0C2B2B04608ABDB01EFB59D414AEB7E8EB4E315B6045B7FC04E3742E6B85E148598
      Function 00452E10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON
      Download Yara Rule
      APIs
      • RemoveDirectoryA.KERNEL32(00000000,00000000,00452E6D,?,-00000001,00000000), ref: 00452E47
      • GetLastError.KERNEL32(00000000,00000000,00452E6D,?,-00000001,00000000), ref: 00452E4F
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: DirectoryErrorLastRemove
      • String ID: 0(H
      • API String ID: 377330604-4268776330
      • Opcode ID: 8769a646033274a50feaa89106c60670f2dbad91017c501587ea10a2b48d2d14
      • Instruction ID: a8b2bafe79397aca91686f8656b478e2385adfe3b855dfce5f6cc0b9ba314abc
      • Opcode Fuzzy Hash: 8769a646033274a50feaa89106c60670f2dbad91017c501587ea10a2b48d2d14
      • Instruction Fuzzy Hash: 70F0FC71A04708AFCF01EF759D4249EB7E8DB4E31575049B7FC14E3642E7785E048598
      Function 0047C9B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36registryCOMMON
      Download Yara Rule
      APIs
      • RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,0047CD08,00000000,0047CD1E), ref: 0047CA16
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Close
      • String ID: RegisteredOrganization$RegisteredOwner
      • API String ID: 3535843008-1113070880
      • Opcode ID: 33038bb034d0984985c816098cb44169ecc5dcb76246990e0ff32b8c974480d2
      • Instruction ID: 70857084149a5beb2a7d1338117c8c2bf8ba385f4f19f0c503d2a96cb260f129
      • Opcode Fuzzy Hash: 33038bb034d0984985c816098cb44169ecc5dcb76246990e0ff32b8c974480d2
      • Instruction Fuzzy Hash: FBF0B4B1B00208AFD740D678EDC2B9B7369D740304F60807FE5059B341D67CAE01975C
      Function 004755E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28fileCOMMON
      Download Yara Rule
      APIs
      • CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,00475817), ref: 00475605
      • CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,00475817), ref: 0047561C
        • Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049C628,00000004,00000000,00000000,00000000,?,004988E5,00000000), ref: 0045349F
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CloseCreateErrorFileHandleLast
      • String ID: CreateFile
      • API String ID: 2528220319-823142352
      • Opcode ID: 8c7955b74f907502151e7606906df582427e1046de69f3d68eddfbc4164f6004
      • Instruction ID: a80e148c354c4078e0aab9d7e8afc8ab7fd6315c0d5d69ed643d7865c3d880f6
      • Opcode Fuzzy Hash: 8c7955b74f907502151e7606906df582427e1046de69f3d68eddfbc4164f6004
      • Instruction Fuzzy Hash: 50E06D302417047BEA10FA69CCC6F4A77989B04728F10C152FA48AF3E2C5B9EC408618
      Function 004570B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11libraryloaderCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 00457044: CoInitialize.OLE32(00000000), ref: 0045704A
        • Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
        • Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD
      • GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 004570D8
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressErrorInitializeLibraryLoadModeProc
      • String ID: SHCreateItemFromParsingName$shell32.dll
      • API String ID: 2906209438-2320870614
      • Opcode ID: dc66c58bdd2784791d6d63ed99ce16bff03f35d2417aa22f22154252a14bddde
      • Instruction ID: b955550d369f4af000036abf7723848837eaccdf6feff582815f7c0fd81aadc9
      • Opcode Fuzzy Hash: dc66c58bdd2784791d6d63ed99ce16bff03f35d2417aa22f22154252a14bddde
      • Instruction Fuzzy Hash: 02C08CA0B4861052CB40B3BA640320E1841AB8071FB10C07B7A04A66C7CE3C88088B6E
      Function 0046CE48 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8libraryloaderCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
        • Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD
      • GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 0046CE5D
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressErrorLibraryLoadModeProc
      • String ID: SHPathPrepareForWriteA$shell32.dll
      • API String ID: 2492108670-2683653824
      • Opcode ID: e405cdeb591fb651f38ec7bd58ada79ee2f0f05c5c029f4c4b8f158261703452
      • Instruction ID: a9843c9daa69a260ebfe6647d266bdab58c4a766ac2a56c9c88a30f8c22b1be1
      • Opcode Fuzzy Hash: e405cdeb591fb651f38ec7bd58ada79ee2f0f05c5c029f4c4b8f158261703452
      • Instruction Fuzzy Hash: BFB092A1B0570046CB5077B6989262A28259B81B19F60843B7488AB695EB3E88058B5F
      Function 00482058 Relevance: 4.6, APIs: 3, Instructions: 98windowCOMMON
      Download Yara Rule
      APIs
      • GetSystemMenu.USER32(00000000,00000000,00000000,00482190), ref: 00482128
      • AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 00482139
      • AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 00482151
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Menu$Append$System
      • String ID:
      • API String ID: 1489644407-0
      • Opcode ID: b385d2c2fee1308f5711df35bc4334c2fbda66480b25a04308bee292125f65d0
      • Instruction ID: 3870c0d8195f6f7ddbf9cfc00c40ab75f467e446c70bd50681a2ce88f54bc534
      • Opcode Fuzzy Hash: b385d2c2fee1308f5711df35bc4334c2fbda66480b25a04308bee292125f65d0
      • Instruction Fuzzy Hash: D831A1707043446AD721FB368D86B9E3AA49B16318F54543FF9009B3E3CABC9D0987AD
      Function 0044B38C Relevance: 4.6, APIs: 3, Instructions: 74COMMON
      Download Yara Rule
      APIs
      • GetDC.USER32(00000000), ref: 0044B401
      • SelectObject.GDI32(?,00000000), ref: 0044B424
      • ReleaseDC.USER32(00000000,?), ref: 0044B457
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ObjectReleaseSelect
      • String ID:
      • API String ID: 1831053106-0
      • Opcode ID: 66f610a2f1dd75c524d6f684b296bfc340aa9b76b7ea9dc8bcd6144b5817c44b
      • Instruction ID: 242bcfed98594cbdcf51f2854abe94a1ec69c13560e3a72339b9f4254961cc58
      • Opcode Fuzzy Hash: 66f610a2f1dd75c524d6f684b296bfc340aa9b76b7ea9dc8bcd6144b5817c44b
      • Instruction Fuzzy Hash: 62216570A04248AFEB15DFA6C841B9F7BB9DB49304F11806AF904A7682D778D940CB59
      Function 0044B0C0 Relevance: 4.6, APIs: 3, Instructions: 72COMMON
      Download Yara Rule
      APIs
      • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0044B14C,?,004829BF,?,?), ref: 0044B11E
      • DrawTextW.USER32(?,?,00000000,?,?), ref: 0044B131
      • DrawTextA.USER32(?,00000000,00000000,?,?), ref: 0044B165
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: DrawText$ByteCharMultiWide
      • String ID:
      • API String ID: 65125430-0
      • Opcode ID: 8563819130f5cea45a586b3b419c35d5147b321fdd9d10c596e2d3e9505563a3
      • Instruction ID: a4608c71d04b28885266ea781e5967b5ad27746b42a56a1f72551bbb702c58a2
      • Opcode Fuzzy Hash: 8563819130f5cea45a586b3b419c35d5147b321fdd9d10c596e2d3e9505563a3
      • Instruction Fuzzy Hash: 3D11B9B27046047FEB00DA6A9C91D6F77ECDB49750F10817BF504D7290D6389E018669
      Function 004243FC Relevance: 4.6, APIs: 3, Instructions: 59windowCOMMON
      Download Yara Rule
      APIs
      • PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00424412
      • TranslateMessage.USER32(?), ref: 0042448F
      • DispatchMessageA.USER32(?), ref: 00424499
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Message$DispatchPeekTranslate
      • String ID:
      • API String ID: 4217535847-0
      • Opcode ID: d4f7142ddfb2041a0388c754ad29f8297397d1c5d5a6fc901d04af05902ad934
      • Instruction ID: 8eae6dca0d2455523dd27ca57e4683f6da326f6f2f90499d04ddbfd693f83f9d
      • Opcode Fuzzy Hash: d4f7142ddfb2041a0388c754ad29f8297397d1c5d5a6fc901d04af05902ad934
      • Instruction Fuzzy Hash: E3116D303043205AEB20FA24A941B9F73D4DFC5758F80481EFC99972C2D77D9D49879A
      Function 00416644 Relevance: 4.5, APIs: 3, Instructions: 39COMMON
      Download Yara Rule
      APIs
      • SetPropA.USER32(00000000,00000000), ref: 0041666A
      • SetPropA.USER32(00000000,00000000), ref: 0041667F
      • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,00000000,00000000,?,00000000,00000000), ref: 004166A6
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Prop$Window
      • String ID:
      • API String ID: 3363284559-0
      • Opcode ID: 2d73b2248289de54f738391a3d398201797fdebe71aa41298530983bb3220f01
      • Instruction ID: a636ca464bd0df0fc67768fb893299e601c729d66e76b164383dc375a9dbcd08
      • Opcode Fuzzy Hash: 2d73b2248289de54f738391a3d398201797fdebe71aa41298530983bb3220f01
      • Instruction Fuzzy Hash: E5F01271741220ABDB10AB598C85FA732DCAB09714F16057AB905EF286C678DC40C7A8
      Function 0041EE54 Relevance: 4.5, APIs: 3, Instructions: 27windowCOMMON
      Download Yara Rule
      APIs
      • IsWindowVisible.USER32(?), ref: 0041EE64
      • IsWindowEnabled.USER32(?), ref: 0041EE6E
      • EnableWindow.USER32(?,00000000), ref: 0041EE94
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Window$EnableEnabledVisible
      • String ID:
      • API String ID: 3234591441-0
      • Opcode ID: 908e1640c45beef437f125b63470cd7f97cb81b788dbbb5d15c196427eefded0
      • Instruction ID: 8b334d5574dba77d14df167aff8fbd97924ad8003ce697a24827bf0bfa1ada00
      • Opcode Fuzzy Hash: 908e1640c45beef437f125b63470cd7f97cb81b788dbbb5d15c196427eefded0
      • Instruction Fuzzy Hash: 69E0EDB4200305AAE310AB2BDC81B5B7B9CAB14354F558437A9099B292D67ED8508ABD
      Function 004837F8 Relevance: 4.5, APIs: 3, Instructions: 25threadCOMMON
      Download Yara Rule
      APIs
      • GetForegroundWindow.USER32(00000000,00000000,?,?,0048385D,?,00483942,?,?,00000000), ref: 004837FE
      • GetWindowThreadProcessId.USER32(00000000,?), ref: 00483810
      • GetCurrentProcessId.KERNEL32(00000000,?,00000000,00000000,?,?,0048385D,?,00483942,?,?,00000000), ref: 00483819
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ProcessWindow$CurrentForegroundThread
      • String ID:
      • API String ID: 3477312055-0
      • Opcode ID: d2635c8f6e4c954f43635f7c951b614f71adc5b1264abc7e4a6b913000aafc16
      • Instruction ID: 5d11f781899e090513e627e213ec8bac45031b0538b13b2ac18f996cd3591ce0
      • Opcode Fuzzy Hash: d2635c8f6e4c954f43635f7c951b614f71adc5b1264abc7e4a6b913000aafc16
      • Instruction Fuzzy Hash: B7D01233505A2A6EA610FAE55D818AFB3DCD900758754017BF904A3241D7299E0446FD
      Function 00406288 Relevance: 4.5, APIs: 3, Instructions: 7COMMON
      Download Yara Rule
      APIs
      • GlobalHandle.KERNEL32 ref: 00406289
      • GlobalUnWire.KERNEL32(00000000), ref: 00406290
      • GlobalFree.KERNEL32(00000000), ref: 00406295
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Global$FreeHandleWire
      • String ID:
      • API String ID: 318822183-0
      • Opcode ID: 6fb441d58b367f32f482df158d6c8a90520777f868e58a6b13673b60c2f5b21c
      • Instruction ID: 0bd3332245bc481727117fba3a6c85ee4c387b864c86d5f24a339be909c9c9d3
      • Opcode Fuzzy Hash: 6fb441d58b367f32f482df158d6c8a90520777f868e58a6b13673b60c2f5b21c
      • Instruction Fuzzy Hash: 4FA001C4800A01A9DC0432B2080B93B200CD84122C390096B3408BA182887C88401A3D
      Function 00469F38 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 232COMMON
      Download Yara Rule
      APIs
      • SetActiveWindow.USER32(?), ref: 0046A049
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ActiveWindow
      • String ID: PrepareToInstall
      • API String ID: 2558294473-1101760603
      • Opcode ID: cb1d2e01ee30e0d9d9d5957d957870874cdb05eaea7a7978ad1feaf5c5457947
      • Instruction ID: c6fcc4da8437ad9deaf3f31bc7b9c1787f312b88a14d5d76669f4651e657ab28
      • Opcode Fuzzy Hash: cb1d2e01ee30e0d9d9d5957d957870874cdb05eaea7a7978ad1feaf5c5457947
      • Instruction Fuzzy Hash: 09A10A34A00105DFD700EF69D986E9EB7F5AF48304F5580B6E404AB362D738AE45DF9A
      Function 0046C514 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 209COMMON
      Download Yara Rule
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID:
      • String ID: /:*?"<>|
      • API String ID: 0-4078764451
      • Opcode ID: c96106cfc0cd8103ff6a75e3e8764dc67b611ee9d870184ba0226f85e47180cd
      • Instruction ID: 190302c3af8078684b82dcd48a6d7ef8ab8ee803c0fd766cdc88f4833f534e2d
      • Opcode Fuzzy Hash: c96106cfc0cd8103ff6a75e3e8764dc67b611ee9d870184ba0226f85e47180cd
      • Instruction Fuzzy Hash: D371A670A402056BDB20E766CCD2BEEB7A19F41708F108077F544AB392E779AD458B5E
      Function 004829A4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58COMMON
      Download Yara Rule
      APIs
      • SetActiveWindow.USER32(?), ref: 00482A52
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ActiveWindow
      • String ID: InitializeWizard
      • API String ID: 2558294473-2356795471
      • Opcode ID: 2e9b410ef9385fd40d76c35b0c2cb8d80ae288a68d8002f68427ff38a807edd9
      • Instruction ID: 444aaa6351c1f2e32dff9f8196bc33658d97b33103b2121e2e05cca258361f5a
      • Opcode Fuzzy Hash: 2e9b410ef9385fd40d76c35b0c2cb8d80ae288a68d8002f68427ff38a807edd9
      • Instruction Fuzzy Hash: 8D119131604600AFD314FB29FD86B197BE4EB18728F60047BF404D72A1DA79AC46CB1E
      Function 0047D178 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51COMMON
      Download Yara Rule
      APIs
      Strings
      • Failed to remove temporary directory: , xrefs: 0047D1DB
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CountTick
      • String ID: Failed to remove temporary directory:
      • API String ID: 536389180-3544197614
      • Opcode ID: dd9a5857a99a118a51438a50b17ffe6a365ad9b023db0066fafebb99be548814
      • Instruction ID: 4731e8837947617e959e06c9afdf3f02271a57ed853b0b6efef870f50a9632f3
      • Opcode Fuzzy Hash: dd9a5857a99a118a51438a50b17ffe6a365ad9b023db0066fafebb99be548814
      • Instruction Fuzzy Hash: 3F019630A502047ADB11EB72DC07B9A77A8DF45708F61C877B804A61A2D67DA905C91C
      Function 0047C8D0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00483FBF,?,00000001,?,?,00483FBF,?,00000001,00000000), ref: 0042DE38
      • RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,?,?,0047CB1C,00000000,0047CD1E), ref: 0047C915
      Strings
      • Software\Microsoft\Windows\CurrentVersion, xrefs: 0047C8E5
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CloseOpen
      • String ID: Software\Microsoft\Windows\CurrentVersion
      • API String ID: 47109696-1019749484
      • Opcode ID: e9787bef6ac19e4bfb9f572c5fd9890d4545c898d878564b3c33c032b2a88c1f
      • Instruction ID: 9d58ec73c0f425f388190a16e5dd3d85ae7c647c6e00b65b3c59fd1b9070581d
      • Opcode Fuzzy Hash: e9787bef6ac19e4bfb9f572c5fd9890d4545c898d878564b3c33c032b2a88c1f
      • Instruction Fuzzy Hash: 13F0A7B170411467EB00A65E6D82BAFA6DDDB84758F20403FF648DB342D9BDDE0243AC
      Function 0046EF94 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34registryCOMMON
      Download Yara Rule
      APIs
      • RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,004765A2,?,0049D1E0,?,0046F2AB,?,00000000,0046F846,?,_is1), ref: 0046EFB7
      Strings
      • Inno Setup: Setup Version, xrefs: 0046EFB5
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Value
      • String ID: Inno Setup: Setup Version
      • API String ID: 3702945584-4166306022
      • Opcode ID: fe03c3dd2396c9e95d885c00497c93f7ec796e661533446ba5b6ce09adc28a67
      • Instruction ID: c391946ca8a1dfb9bd2a8f8d535a4e5f0653d7f158c17c03f22a663429f2d6a6
      • Opcode Fuzzy Hash: fe03c3dd2396c9e95d885c00497c93f7ec796e661533446ba5b6ce09adc28a67
      • Instruction Fuzzy Hash: 27E06D753012043FD710AA2B9C85F6BBADCDF98365F10403AB908DB392D578DD0182A9
      Function 0046F004 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24registryCOMMON
      Download Yara Rule
      APIs
      • RegSetValueExA.ADVAPI32(?,NoModify,00000000,00000004,00000000,00000004,00000001,?,0046F682,?,?,00000000,0046F846,?,_is1,?), ref: 0046F017
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Value
      • String ID: NoModify
      • API String ID: 3702945584-1699962838
      • Opcode ID: 1c7c00c04468899ca031aa7ee4f10a7c436259a2e48e4711054821b9a4a361ff
      • Instruction ID: 36b047244b8a46f46e2a66ab8a4e2d38b38e826dd2d039d91b27308d321ef38c
      • Opcode Fuzzy Hash: 1c7c00c04468899ca031aa7ee4f10a7c436259a2e48e4711054821b9a4a361ff
      • Instruction Fuzzy Hash: 65E0DFB4200308BFEB04DB51CC0AF2B73ECDB08310F104019BA049B280E670EE00C668
      Function 0042DE1C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18registryCOMMON
      Download Yara Rule
      APIs
      • RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00483FBF,?,00000001,?,?,00483FBF,?,00000001,00000000), ref: 0042DE38
      Strings
      • System\CurrentControlSet\Control\Windows, xrefs: 0042DE36
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Open
      • String ID: System\CurrentControlSet\Control\Windows
      • API String ID: 71445658-1109719901
      • Opcode ID: a11f376e1d034aeb0d9ae53f60934921bcd728bb93d306f1768079d63b1ffdfe
      • Instruction ID: 60e43675bb36a9eef4a15598a1848ca3f705ecc445ee8c9fe52fc6b05f1352bb
      • Opcode Fuzzy Hash: a11f376e1d034aeb0d9ae53f60934921bcd728bb93d306f1768079d63b1ffdfe
      • Instruction Fuzzy Hash: 29D09E72950128BB9B009A89DC41DFB775DDB15760F45441BF9049B141C5B4AC5197E4
      Function 00454100 Relevance: 3.2, APIs: 2, Instructions: 200fileCOMMON
      Download Yara Rule
      APIs
      • FindNextFileA.KERNEL32(000000FF,?,00000000,00454346,?,00000000,004543BA,?,?,-00000001,00000000,?,0047D1D7,00000000,0047D124,00000000), ref: 00454322
      • FindClose.KERNEL32(000000FF,0045434D,00454346,?,00000000,004543BA,?,?,-00000001,00000000,?,0047D1D7,00000000,0047D124,00000000,00000000), ref: 00454340
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Find$CloseFileNext
      • String ID:
      • API String ID: 2066263336-0
      • Opcode ID: d7d19a167540dce38df5648ecaebac000f2b3f204f6cf67b83d58a1036ca4065
      • Instruction ID: 54d7d993b90550b5414970fc4389b15b7902a372ed294bc13edf2f45dfba5a61
      • Opcode Fuzzy Hash: d7d19a167540dce38df5648ecaebac000f2b3f204f6cf67b83d58a1036ca4065
      • Instruction Fuzzy Hash: BE817430A0424D9FCF11DFA5C8457EFBB74AF49309F1440A6EC546B3A2D3399A8ACB58
      Function 0047E850 Relevance: 3.2, APIs: 2, Instructions: 160windowCOMMON
      Download Yara Rule
      APIs
      • GetACP.KERNEL32(?,?,00000001,00000000,0047EB2F,?,-0000001A,004809E5,-00000010,?,00000004,0000001B,00000000,00480D32,?,0045DB68), ref: 0047E8C6
        • Part of subcall function 0042E31C: GetDC.USER32(00000000), ref: 0042E32B
        • Part of subcall function 0042E31C: EnumFontsA.GDI32(?,00000000,0042E308,00000000,00000000,0042E374,?,00000000,00000000,00480D99,?,?,00000001,00000000,00000002,00000000), ref: 0042E356
        • Part of subcall function 0042E31C: ReleaseDC.USER32(00000000,?), ref: 0042E36E
      • SendNotifyMessageA.USER32(00020412,00000496,00002711,-00000001), ref: 0047EA96
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: EnumFontsMessageNotifyReleaseSend
      • String ID:
      • API String ID: 2649214853-0
      • Opcode ID: 294179d95b55cc06d1b7139614fb9670c0477800ae487fd9c719b3ed4dbbba23
      • Instruction ID: 875d0545c0fbee78004b1ef47b0e79431a7a3ba41dae77712d889a667401c5f0
      • Opcode Fuzzy Hash: 294179d95b55cc06d1b7139614fb9670c0477800ae487fd9c719b3ed4dbbba23
      • Instruction Fuzzy Hash: FF5176756001008BD710FF26D88169A7BA9BB99309B50C67BA8485F356C73CDD46C79D
      Function 00402088 Relevance: 3.1, APIs: 2, Instructions: 122COMMON
      Download Yara Rule
      APIs
      • RtlEnterCriticalSection.KERNEL32(0049C420,00000000,004021FC), ref: 004020CB
        • Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32(0049C420,00000000,00401A82,?,?,0040222E,022A0650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
        • Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(0049C420,0049C420,00000000,00401A82,?,?,0040222E,022A0650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
        • Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,0049C420,00000000,00401A82,?,?,0040222E,022A0650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
        • Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32(0049C420,00401A89,00000000,00401A82,?,?,0040222E,022A0650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CriticalSection$Enter$AllocInitializeLeaveLocal
      • String ID:
      • API String ID: 296031713-0
      • Opcode ID: 9ff25e6ef130306316fad2516815ef3529b78dceb096dc67e5da241148ce4d9d
      • Instruction ID: 6f01476fa854e093772c88cc0e1a6b3f7d7d3886978438045dd483ce2d71c460
      • Opcode Fuzzy Hash: 9ff25e6ef130306316fad2516815ef3529b78dceb096dc67e5da241148ce4d9d
      • Instruction Fuzzy Hash: FA41D3B2F403019FDB10CF68DD9522A77A4F7A9324F15417BD854A77E1D3789841CB98
      Function 0042DC00 Relevance: 3.1, APIs: 2, Instructions: 113registryCOMMON
      Download Yara Rule
      APIs
      • RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,0042DD38), ref: 0042DC3C
      • RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,70000000,?,?,00000000,?,00000000,?,00000000,0042DD38), ref: 0042DCAC
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: QueryValue
      • String ID:
      • API String ID: 3660427363-0
      • Opcode ID: b62dc44b296d1c54c0416b8d239270b5fe200a79a82432283709fd1da487490f
      • Instruction ID: 5bd1c55a509b6dee259ffcee94d68868fe84ce326e73fb4cf6662c4527ef549e
      • Opcode Fuzzy Hash: b62dc44b296d1c54c0416b8d239270b5fe200a79a82432283709fd1da487490f
      • Instruction Fuzzy Hash: 9D414171E00529ABDB11DF95D881BAFB7B8EB04704F918466E810F7241D778AE00CBA5
      Function 0042DEC0 Relevance: 3.1, APIs: 2, Instructions: 111registryCOMMON
      Download Yara Rule
      APIs
      • RegEnumKeyExA.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,0042DFD6,?,?,00000008,00000000,00000000,0042E003), ref: 0042DF6C
      • RegCloseKey.ADVAPI32(?,0042DFDD,?,00000000,00000000,00000000,00000000,00000000,0042DFD6,?,?,00000008,00000000,00000000,0042E003), ref: 0042DFD0
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CloseEnum
      • String ID:
      • API String ID: 2818636725-0
      • Opcode ID: fcca4ea9b8b2b8ec9d436ce0368beb54095d9e53c5dd498a7b406997cc9304dd
      • Instruction ID: 5fc6f256b2d9dc567edc518b3c74b45b45629f96c5c1cd0dd022a126bea0e7a6
      • Opcode Fuzzy Hash: fcca4ea9b8b2b8ec9d436ce0368beb54095d9e53c5dd498a7b406997cc9304dd
      • Instruction Fuzzy Hash: 5C31B270F04248AEDB11DFA2DD42BAEBBB9EB49304F91407BE501E6280D6785E01CA2D
      Function 004527E8 Relevance: 3.1, APIs: 2, Instructions: 60processCOMMON
      Download Yara Rule
      APIs
      • CreateProcessA.KERNEL32(00000000,00000000,?,?,00458278,00000000,00458260,?,?,?,00000000,00452862,?,?,?,00000001), ref: 0045283C
      • GetLastError.KERNEL32(00000000,00000000,?,?,00458278,00000000,00458260,?,?,?,00000000,00452862,?,?,?,00000001), ref: 00452844
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CreateErrorLastProcess
      • String ID:
      • API String ID: 2919029540-0
      • Opcode ID: c95f5f81879e10580f0beb684fbefc560c00cfbc54ddd80bc382dcc14dc7984f
      • Instruction ID: fcc055d8c1a696a2a0db1e32a085008d871673fec5534948229a16d4440eefa6
      • Opcode Fuzzy Hash: c95f5f81879e10580f0beb684fbefc560c00cfbc54ddd80bc382dcc14dc7984f
      • Instruction Fuzzy Hash: A2113C72600208AF8B40DEA9DD41D9F77ECEB4E310B114567FD18D3241D678EE148B68
      Function 0040ADD8 Relevance: 3.1, APIs: 2, Instructions: 51COMMON
      Download Yara Rule
      APIs
      • FindResourceA.KERNEL32(00400000,00000000,0000000A), ref: 0040ADF2
      • FreeResource.KERNEL32(00000000,00400000,00000000,0000000A,F0E80040,00000000,?,?,0040AF4F,00000000,0040AF67,?,?,?,00000000), ref: 0040AE03
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Resource$FindFree
      • String ID:
      • API String ID: 4097029671-0
      • Opcode ID: b4aec30f57e91fa5e066b06f894e099c16544c4ee311f6c56d801c6bb7443772
      • Instruction ID: 1462426bf02b0a84ee0805d627a90520e1dc0c26d68b1654c1ee9aa64efe8ccd
      • Opcode Fuzzy Hash: b4aec30f57e91fa5e066b06f894e099c16544c4ee311f6c56d801c6bb7443772
      • Instruction Fuzzy Hash: 0D01F271300700AFD700FFA9EC92E1A77EDDB8AB14710807AF500AB2D1DA39AC10966A
      Function 0041EEA4 Relevance: 3.0, APIs: 2, Instructions: 49threadCOMMON
      Download Yara Rule
      APIs
      • GetCurrentThreadId.KERNEL32 ref: 0041EEF3
      • EnumThreadWindows.USER32(00000000,0041EE54,00000000), ref: 0041EEF9
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Thread$CurrentEnumWindows
      • String ID:
      • API String ID: 2396873506-0
      • Opcode ID: c02483761d9af733a7f6458d3fbff844fc4edf6f8a52523c61ee62f03e069ec2
      • Instruction ID: 4de41dbf7b75fb218e259e9c61c6b0a53bf629257b57e72df0ec23b2eb6fcd43
      • Opcode Fuzzy Hash: c02483761d9af733a7f6458d3fbff844fc4edf6f8a52523c61ee62f03e069ec2
      • Instruction Fuzzy Hash: E2016D74B04704BFD705CF6AEC1195ABBE8E749720B22C877EC04D3690E7385820DE9A
      Function 00452C80 Relevance: 3.0, APIs: 2, Instructions: 48fileCOMMON
      Download Yara Rule
      APIs
      • MoveFileA.KERNEL32(00000000,00000000), ref: 00452CC2
      • GetLastError.KERNEL32(00000000,00000000,00000000,00452CE8), ref: 00452CCA
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ErrorFileLastMove
      • String ID:
      • API String ID: 55378915-0
      • Opcode ID: bd02338dff925e1bcf0a80027825a402961c9c10eaaecac7b210e684feb30c76
      • Instruction ID: 1f9035ddd188b097fe3d15476f32cd7793c58c8f4df07880d9fc6ba60e4ff235
      • Opcode Fuzzy Hash: bd02338dff925e1bcf0a80027825a402961c9c10eaaecac7b210e684feb30c76
      • Instruction Fuzzy Hash: 9401D671A04208AB8712EB799D4149EB7ECEB8A32575045BBFC04E3243EA785E048558
      Function 00452770 Relevance: 3.0, APIs: 2, Instructions: 43COMMON
      Download Yara Rule
      APIs
      • CreateDirectoryA.KERNEL32(00000000,00000000,00000000,004527CF), ref: 004527A9
      • GetLastError.KERNEL32(00000000,00000000,00000000,004527CF), ref: 004527B1
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CreateDirectoryErrorLast
      • String ID:
      • API String ID: 1375471231-0
      • Opcode ID: 903dc6f46ae0353656b5ef1fe2250cc8cd8775a19ac3db80fd29e7e5856ea863
      • Instruction ID: e3b373b60118a844676bb749001e6832c3b26a50706decb61b3ae2e0e224b701
      • Opcode Fuzzy Hash: 903dc6f46ae0353656b5ef1fe2250cc8cd8775a19ac3db80fd29e7e5856ea863
      • Instruction Fuzzy Hash: 40F02871A00308BBCB01EF759D4259EB7E8EB4E311B2045B7FC04E3642E6B94E04859C
      Function 00452AE0 Relevance: 3.0, APIs: 2, Instructions: 41COMMON
      Download Yara Rule
      APIs
      • GetFileAttributesA.KERNEL32(00000000,00000000,00452B3F,?,?,00000000), ref: 00452B19
      • GetLastError.KERNEL32(00000000,00000000,00452B3F,?,?,00000000), ref: 00452B21
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AttributesErrorFileLast
      • String ID:
      • API String ID: 1799206407-0
      • Opcode ID: 5b540095fd9a5d31e192f3d174c5804a213c57257777ce78e18fbc01343e29a9
      • Instruction ID: ab2d8551c2587fa33e08e03b3339d41412f2fea6ae8ede581cb29ed56d474115
      • Opcode Fuzzy Hash: 5b540095fd9a5d31e192f3d174c5804a213c57257777ce78e18fbc01343e29a9
      • Instruction Fuzzy Hash: DDF0FC71A04708ABCB11EF759D414AEB7E8EB4A32575047B7FC14E3282D7B86E04859C
      Function 0042323C Relevance: 3.0, APIs: 2, Instructions: 35COMMON
      Download Yara Rule
      APIs
      • LoadCursorA.USER32(00000000,00007F00), ref: 00423249
      • LoadCursorA.USER32(00000000,00000000), ref: 00423273
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CursorLoad
      • String ID:
      • API String ID: 3238433803-0
      • Opcode ID: f50906273b4dd4b76e2408c8e955edc8cf5c14898db3d3c1ed1d0f377b452c19
      • Instruction ID: 7cd693af4f5fe314f4f144fbb382ce8dd64a96311c29a7cef9afb5b40cbca783
      • Opcode Fuzzy Hash: f50906273b4dd4b76e2408c8e955edc8cf5c14898db3d3c1ed1d0f377b452c19
      • Instruction Fuzzy Hash: 5FF0A711B04254AADA109A7E6CC0D6A72A8DF82735B61037BFA3EC72D1C62E1D414679
      Function 0042E394 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON
      Download Yara Rule
      APIs
      • SetErrorMode.KERNEL32(00008000), ref: 0042E39E
      • LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ErrorLibraryLoadMode
      • String ID:
      • API String ID: 2987862817-0
      • Opcode ID: 4bb5710dc3172506f3a82e57bec548632d1945d06b3d92e94bd16d63dfaa8550
      • Instruction ID: 14c2566281f292fbf4bc3f3871eddb8f7eb4f11f4d1149329263d7d1c8790498
      • Opcode Fuzzy Hash: 4bb5710dc3172506f3a82e57bec548632d1945d06b3d92e94bd16d63dfaa8550
      • Instruction Fuzzy Hash: 02F08970B147447FDB119F779CA241BBBECDB49B1175249B6F800A3591E53C4910C928
      Function 0046E13C Relevance: 3.0, APIs: 2, Instructions: 28COMMON
      Download Yara Rule
      APIs
      • GetVersion.KERNEL32(?,0046E1D2), ref: 0046E146
      • 756FE550.OLE32(0049AB98,00000000,00000001,0049ABA8,?,?,0046E1D2), ref: 0046E162
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: E550Version
      • String ID:
      • API String ID: 1323609852-0
      • Opcode ID: c2e108f7b56692ac873cba0790bc3952f2a2098fcf35aa231a08526eaacaf708
      • Instruction ID: 95f25ee8db0030cadbc810d8c495b3ab00f398313f00538af4315926b72c1bbf
      • Opcode Fuzzy Hash: c2e108f7b56692ac873cba0790bc3952f2a2098fcf35aa231a08526eaacaf708
      • Instruction Fuzzy Hash: BAF0A034642200AEEB20E76ACC46B8B37C46B22318F14007BF144C7291E2BC9492869F
      Function 0047CC67 Relevance: 3.0, APIs: 2, Instructions: 26COMMON
      Download Yara Rule
      APIs
      • SHGetKnownFolderPath.SHELL32(0049AD40,00008000,00000000,?), ref: 0047CC77
      • 757283B0.OLE32(?,0047CCBA), ref: 0047CCAD
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: 757283FolderKnownPath
      • String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
      • API String ID: 733073498-544719455
      • Opcode ID: 22657732ddb36b50c5cfd1384dfe0831046bf8cbba1529c886ea6590bcb70017
      • Instruction ID: cfbf6c223cf3afd6cdedd5c27fb16fa42648066dab15293e033e5a7925f9a24f
      • Opcode Fuzzy Hash: 22657732ddb36b50c5cfd1384dfe0831046bf8cbba1529c886ea6590bcb70017
      • Instruction Fuzzy Hash: FDE09231700600BEEB12DFA1DD52F6977ACEB48B04B618477F408E2A80D67CAD00865C
      Function 0048382C Relevance: 3.0, APIs: 2, Instructions: 17COMMON
      Download Yara Rule
      APIs
      • GetTickCount.KERNEL32 ref: 00483836
      • GetTickCount.KERNEL32 ref: 0048382D
        • Part of subcall function 004837F8: GetForegroundWindow.USER32(00000000,00000000,?,?,0048385D,?,00483942,?,?,00000000), ref: 004837FE
        • Part of subcall function 004837F8: GetWindowThreadProcessId.USER32(00000000,?), ref: 00483810
        • Part of subcall function 004837F8: GetCurrentProcessId.KERNEL32(00000000,?,00000000,00000000,?,?,0048385D,?,00483942,?,?,00000000), ref: 00483819
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CountProcessTickWindow$CurrentForegroundThread
      • String ID:
      • API String ID: 711787588-0
      • Opcode ID: 120b11d2bf9850009e1f207d5b15bc1123ac6b1b15330d1b2931d20fc979b4e6
      • Instruction ID: a68ad34387677c18adc6102fc80b4dd6e8427e36267791dfee8170d6bf9eeddc
      • Opcode Fuzzy Hash: 120b11d2bf9850009e1f207d5b15bc1123ac6b1b15330d1b2931d20fc979b4e6
      • Instruction Fuzzy Hash: E1D0C98160068256DD153BFF968222D4184AB1575EF102E7FB44699283DC5C8606633F
      Function 0041EFF4 Relevance: 3.0, APIs: 2, Instructions: 16threadCOMMON
      Download Yara Rule
      APIs
      • GetCurrentThreadId.KERNEL32 ref: 0041F00E
      • EnumThreadWindows.USER32(00000000,0041EF90,00000000), ref: 0041F014
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Thread$CurrentEnumWindows
      • String ID:
      • API String ID: 2396873506-0
      • Opcode ID: d175bc6ee8bbfc749e3fed62a58a63b33cd9a105b2aa63e9ce100911f10ddd18
      • Instruction ID: 91a5b9257cbe4d153b63383d24fe1682f79f6fb92a6a8760fcbdcd854e13a614
      • Opcode Fuzzy Hash: d175bc6ee8bbfc749e3fed62a58a63b33cd9a105b2aa63e9ce100911f10ddd18
      • Instruction Fuzzy Hash: 6BE04275B00200AFDB10EF7DAD45B5A3BE0E324324F124C3BA808D71A1E27858A4DB9F
      Function 004014E4 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON
      Download Yara Rule
      APIs
      • VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,004017ED), ref: 00401513
      • VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,004017ED), ref: 0040153A
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Virtual$AllocFree
      • String ID:
      • API String ID: 2087232378-0
      • Opcode ID: 7d9236a51a6e62d759a8b4f250f4c89c76a4556442c2f53cae6702f33709ebd9
      • Instruction ID: 72296c24d993e0564b30de85c6f195fe79285825457dd4606d191d555c4bfbf2
      • Opcode Fuzzy Hash: 7d9236a51a6e62d759a8b4f250f4c89c76a4556442c2f53cae6702f33709ebd9
      • Instruction Fuzzy Hash: D1F08272B0063067EB605A6A4C81B6359849BC5794F254076FD09FF3E9D6B58C0142A9
      Function 004085DC Relevance: 1.6, APIs: 1, Instructions: 99COMMON
      Download Yara Rule
      APIs
      • GetSystemDefaultLCID.KERNEL32(00000000,00408712), ref: 004085FB
        • Part of subcall function 00406DEC: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00406E09
        • Part of subcall function 00408568: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049C4C0,00000001,?,00408633,?,00000000,00408712), ref: 00408586
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: DefaultInfoLoadLocaleStringSystem
      • String ID:
      • API String ID: 1658689577-0
      • Opcode ID: fca7547e3638193b824a1cb857b9f4b1c35dbd26232a6776dc15243f5bef776f
      • Instruction ID: 88e8ba0be63a734383a1a6e5d65c1d41f49f3475fbf491600a9c992d064d6bc0
      • Opcode Fuzzy Hash: fca7547e3638193b824a1cb857b9f4b1c35dbd26232a6776dc15243f5bef776f
      • Instruction Fuzzy Hash: C0315035E00109ABCF00EF55CC819EEB779EF84314F558577E815BB286EB38AE018B98
      Function 0041FB9C Relevance: 1.6, APIs: 1, Instructions: 65COMMON
      Download Yara Rule
      APIs
      • SetScrollInfo.USER32(00000000,?,?,00000001), ref: 0041FC39
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: InfoScroll
      • String ID:
      • API String ID: 629608716-0
      • Opcode ID: a0ce2aaa01497ac04468ea6ac7a83421c49688bcbeeff2d3e991700215f3b25f
      • Instruction ID: 6365c2cd079840e4170b7c9ce409c3d873e807bce8729d2e10e5c00059922083
      • Opcode Fuzzy Hash: a0ce2aaa01497ac04468ea6ac7a83421c49688bcbeeff2d3e991700215f3b25f
      • Instruction Fuzzy Hash: D8214FB1608746AFC351DF3984407A6BBE4BB48344F14893EE498C3741E778E99ACBD6
      Function 0046C4A8 Relevance: 1.5, APIs: 1, Instructions: 37COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0041EEA4: GetCurrentThreadId.KERNEL32 ref: 0041EEF3
        • Part of subcall function 0041EEA4: EnumThreadWindows.USER32(00000000,0041EE54,00000000), ref: 0041EEF9
      • SHPathPrepareForWriteA.SHELL32(00000000,00000000,00000000,00000000,00000000,0046C506,?,00000000,?,?,0046C718,?,00000000,0046C78C), ref: 0046C4EA
        • Part of subcall function 0041EF58: IsWindow.USER32(?), ref: 0041EF66
        • Part of subcall function 0041EF58: EnableWindow.USER32(?,00000001), ref: 0041EF75
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ThreadWindow$CurrentEnableEnumPathPrepareWindowsWrite
      • String ID:
      • API String ID: 3319771486-0
      • Opcode ID: dbae09f81caea43298e1e2d0d49e25f8bee619fdb8f5cd46b78ac08149b29795
      • Instruction ID: e5e9e719de3a057d7f130b497200caeef730ae12372367b2a58313213cac24a5
      • Opcode Fuzzy Hash: dbae09f81caea43298e1e2d0d49e25f8bee619fdb8f5cd46b78ac08149b29795
      • Instruction Fuzzy Hash: C4F0B470708340BFEB059F61AC96B257798E745714F91043BF409C6590E6796840C51E
      Function 0042C804 Relevance: 1.5, APIs: 1, Instructions: 34COMMON
      Download Yara Rule
      APIs
      • GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C828
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: FullNamePath
      • String ID:
      • API String ID: 608056474-0
      • Opcode ID: 404cb4b5e2fcfd5f5575b5bb4968c34695dd09af5eb22de3e31c11f27b4b622b
      • Instruction ID: 6606bf2b7c9dfab17883fe50ba403ab283daefcc93ad666015e5601c34742c6c
      • Opcode Fuzzy Hash: 404cb4b5e2fcfd5f5575b5bb4968c34695dd09af5eb22de3e31c11f27b4b622b
      • Instruction Fuzzy Hash: 88E0EC6170055023D621755F5CC15EF518D8BD43B6F04413BB958DF3D1DAFDCE45019A
      Function 00416550 Relevance: 1.5, APIs: 1, Instructions: 32COMMON
      Download Yara Rule
      APIs
      • CreateWindowExA.USER32(?,?,?,?,?,?,?,?,?,00000000,00400000,?), ref: 00416585
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CreateWindow
      • String ID:
      • API String ID: 716092398-0
      • Opcode ID: 5ff731208ea2669c00132db587fc5b09c37a3f2098bcfa82a293bed1c7b74572
      • Instruction ID: 0c02f625eff59d096721037d9f94d65fc7bd043eed4bfd3cc04e62c8adee1921
      • Opcode Fuzzy Hash: 5ff731208ea2669c00132db587fc5b09c37a3f2098bcfa82a293bed1c7b74572
      • Instruction Fuzzy Hash: D3F019B2200510AFDB84DEDCD8C0F9373ECEB0C250B0481A6BA08CB21AD220EC108BB0
      Function 004149B4 Relevance: 1.5, APIs: 1, Instructions: 31COMMON
      Download Yara Rule
      APIs
      • KiUserCallbackDispatcher.NTDLL(?,?), ref: 004149EF
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CallbackDispatcherUser
      • String ID:
      • API String ID: 2492992576-0
      • Opcode ID: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
      • Instruction ID: 59ac3629b8f45f7a6bca1b57e2bf54285868c68ba6336e642f1ef9b7bb8d2b05
      • Opcode Fuzzy Hash: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
      • Instruction Fuzzy Hash: B2F0DA762042019FC740DF6CC8C488A77E5FF89255B5546A9F989CB356C731EC54CB91
      Function 004507C4 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON
      Download Yara Rule
      APIs
      • CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00450804
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CreateFile
      • String ID:
      • API String ID: 823142352-0
      • Opcode ID: 25a3a1c597d96d6ec6eeff5ed90690fea83c0a7d17e9792404b65ad20c66f51d
      • Instruction ID: ff74e5a8d4592d8fd3b5a2de0ea1d69cf02ca9f83d78e7382fef9d423995e771
      • Opcode Fuzzy Hash: 25a3a1c597d96d6ec6eeff5ed90690fea83c0a7d17e9792404b65ad20c66f51d
      • Instruction Fuzzy Hash: A7E06DA13401483ED280AAAC6C42F9237CC931A714F008433B998C7241C46199218BE9
      Function 0042CCCC Relevance: 1.5, APIs: 1, Instructions: 29COMMON
      Download Yara Rule
      APIs
      • GetFileAttributesA.KERNEL32(00000000,00000000,0042CD14,?,00000001,?,?,00000000,?,0042CD66,00000000,00452A25,00000000,00452A46,?,00000000), ref: 0042CCF7
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AttributesFile
      • String ID:
      • API String ID: 3188754299-0
      • Opcode ID: a1ebe1bbf11a3f0589be15ad0de550f021876ee2d34cf3deda41d0e0afd3aa3f
      • Instruction ID: d3c11148bbbe1678040d416a6bc301cfea82702c80b798926358c5e84281cc0e
      • Opcode Fuzzy Hash: a1ebe1bbf11a3f0589be15ad0de550f021876ee2d34cf3deda41d0e0afd3aa3f
      • Instruction Fuzzy Hash: 80E065B1304304BFD701EB66EC92A5EBAACDB49754BA14876B50097592D5B86E008468
      Function 0042E8C8 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON
      Download Yara Rule
      APIs
      • FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453273,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8E7
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: FormatMessage
      • String ID:
      • API String ID: 1306739567-0
      • Opcode ID: 07eb917982e44065cc90d67cadef310e262c4caec6bcfbb1197f6d5f5d2cfc19
      • Instruction ID: fbc307da5c1359fbfbc351051067b699ae1438aedf6613c80dda169529e76e7e
      • Opcode Fuzzy Hash: 07eb917982e44065cc90d67cadef310e262c4caec6bcfbb1197f6d5f5d2cfc19
      • Instruction Fuzzy Hash: BCE0206278431116F2353416AC47B77150E43C0708F944027BB90DF3D3D6AF9945D25E
      Function 0041AF70 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
      Download Yara Rule
      APIs
      • GetTextExtentPointA.GDI32(?,00000000,00000000), ref: 0041AF9B
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ExtentPointText
      • String ID:
      • API String ID: 566491939-0
      • Opcode ID: fe3873e992a20e622ffaf78f93863b288a9be0a8311253c2d6346deae250c6a6
      • Instruction ID: 6b43be1268843882f9474f888990ee0a0f71ddbfb678ee1088bae751a0726d8f
      • Opcode Fuzzy Hash: fe3873e992a20e622ffaf78f93863b288a9be0a8311253c2d6346deae250c6a6
      • Instruction Fuzzy Hash: E3E086F13097102BD600E67E1DC19DB77DC8A483697148177F458E7392D62DDE1A43AE
      Function 004062E8 Relevance: 1.5, APIs: 1, Instructions: 27COMMON
      Download Yara Rule
      APIs
      • CreateWindowExA.USER32(00000000,0042367C,00000000,94CA0000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00406311
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CreateWindow
      • String ID:
      • API String ID: 716092398-0
      • Opcode ID: ff94722aa4050723ad3f6c96c0112c9f8192a5aa4540eb1f1ae13447e7542d04
      • Instruction ID: 53e57476791a39574122dfc8a3f58f2f78c4a621b5a82e38d1c80b15216a1e52
      • Opcode Fuzzy Hash: ff94722aa4050723ad3f6c96c0112c9f8192a5aa4540eb1f1ae13447e7542d04
      • Instruction Fuzzy Hash: EEE0FEB2214209BBDB00DE8ADCC1DABB7ACFB4C654F808105BB1C972428275AC608B71
      Function 0042DDE4 Relevance: 1.5, APIs: 1, Instructions: 26registryCOMMON
      Download Yara Rule
      APIs
      • RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DE10
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Create
      • String ID:
      • API String ID: 2289755597-0
      • Opcode ID: 296f4a6b1841180fcb6525c1425398a2afe0618770c3240f8adf4a5c8222c494
      • Instruction ID: 68673b5cf84413dff1d7ecec16939cb2303f89f305828e6cd22260af4b89741b
      • Opcode Fuzzy Hash: 296f4a6b1841180fcb6525c1425398a2afe0618770c3240f8adf4a5c8222c494
      • Instruction Fuzzy Hash: EDE07EB2610119AF9B40DE8CDC81EEB37ADAB1D350F404016FA08E7200C2B4EC519BB4
      Function 00454BF8 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
      Download Yara Rule
      APIs
      • FindClose.KERNEL32(00000000,000000FF,00470ABC,00000000,004718D2,?,00000000,0047191D,?,00000000,00471A56,?,00000000,?,00000000), ref: 00454C0E
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CloseFind
      • String ID:
      • API String ID: 1863332320-0
      • Opcode ID: dc99d001edf3baea6326abfbd90fb8e30a524ed5b4843756c6e8f4cefad87e6f
      • Instruction ID: 5c2dbd3a099336849a47a332199978da45cb785deb8a29a76394180ab3bc5383
      • Opcode Fuzzy Hash: dc99d001edf3baea6326abfbd90fb8e30a524ed5b4843756c6e8f4cefad87e6f
      • Instruction Fuzzy Hash: A1E09BB09097004BC715DF39858031A76D19FC9325F05C96AEC99CF3D7E77D84454617
      Function 0041467C Relevance: 1.5, APIs: 1, Instructions: 23COMMON
      Download Yara Rule
      APIs
      • KiUserCallbackDispatcher.NTDLL(00495F26,?,00495F48,?,?,00000000,00495F26,?,?), ref: 0041469B
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CallbackDispatcherUser
      • String ID:
      • API String ID: 2492992576-0
      • Opcode ID: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
      • Instruction ID: 3a83c41fa5c3d176b15f2666d2672a78f9af76d4247255e2ff0bda4df6ea0631
      • Opcode Fuzzy Hash: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
      • Instruction Fuzzy Hash: 59E012723001199F8250CE5EDC88C57FBEDEBC966130983A6F508C7306DA31EC44C7A0
      Function 00406F10 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON
      Download Yara Rule
      APIs
      • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00406F24
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: FileWrite
      • String ID:
      • API String ID: 3934441357-0
      • Opcode ID: 4c02731fe18b0a47ab7745946c5e8dd4c7dfafdb2aa22804bebcbb41d9412fbb
      • Instruction ID: adeaf4ebd0e6cd94d64be6b3cb299443ba394f13a0b1cd3d8337db6b6af80796
      • Opcode Fuzzy Hash: 4c02731fe18b0a47ab7745946c5e8dd4c7dfafdb2aa22804bebcbb41d9412fbb
      • Instruction Fuzzy Hash: 53D012722091506AD220965A6C44EAB6BDCCBC5770F11063AB558C2181D7209C01C675
      Function 0042364C Relevance: 1.5, APIs: 1, Instructions: 22COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 004235F8: SystemParametersInfoA.USER32(00000048,00000000,00000000,00000000), ref: 0042360D
      • ShowWindow.USER32(00410460,00000009,?,00000000,0041EDA4,0042393A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00423667
        • Part of subcall function 00423628: SystemParametersInfoA.USER32(00000049,00000000,00000000,00000000), ref: 00423644
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: InfoParametersSystem$ShowWindow
      • String ID:
      • API String ID: 3202724764-0
      • Opcode ID: 5ea0717b5a237d90ae3b60c45d238232e42852dd61880cea7560cbd7bb09fbd7
      • Instruction ID: 3e39ddd90fb628193caaea160b6f4ed5bf244f394cc2da11a07db6b12dca8b82
      • Opcode Fuzzy Hash: 5ea0717b5a237d90ae3b60c45d238232e42852dd61880cea7560cbd7bb09fbd7
      • Instruction Fuzzy Hash: 34D05E123821703142307ABB280699B46EC8D822EB389043BB5449B312ED5DCE01116C
      Function 004242C4 Relevance: 1.5, APIs: 1, Instructions: 21COMMON
      Download Yara Rule
      APIs
      • SetWindowTextA.USER32(?,00000000), ref: 004242DC
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: TextWindow
      • String ID:
      • API String ID: 530164218-0
      • Opcode ID: 968e2600307bd84f4d65718215a4df57ccfa9b7919b98356d7a542cd4e907fd2
      • Instruction ID: e359d8c046b4275bb87a72ac3440150ee0889cd0e7de0465f76ccf46c1161c2e
      • Opcode Fuzzy Hash: 968e2600307bd84f4d65718215a4df57ccfa9b7919b98356d7a542cd4e907fd2
      • Instruction Fuzzy Hash: 81D05EE27011602BCB01BAED54C4AC667CC9B8D25AB1840BBF904EF257D638CE40C398
      Function 0042CD6C Relevance: 1.5, APIs: 1, Instructions: 18COMMON
      Download Yara Rule
      APIs
      • GetFileAttributesA.KERNEL32(00000000,?,00452C55,00000000,00452C6E,?,-00000001,00000000), ref: 0042CD77
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AttributesFile
      • String ID:
      • API String ID: 3188754299-0
      • Opcode ID: fc34f2137eef7bb4dc4de094efd6e6cefb9e20129c0f8ee63852c37c04a828d7
      • Instruction ID: 2eab32a2699244162946c929296992ee32eb3599f5fc22494aed3d9886f7b4af
      • Opcode Fuzzy Hash: fc34f2137eef7bb4dc4de094efd6e6cefb9e20129c0f8ee63852c37c04a828d7
      • Instruction Fuzzy Hash: 51D012D036121015DF1455BD28C535F05884B65375BA82F37B66DE62E2D23D8857281C
      Function 00466B40 Relevance: 1.5, APIs: 1, Instructions: 16COMMON
      Download Yara Rule
      APIs
      • KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,00467828,00000000,00000000,00000000,0000000C,00000000), ref: 00466B58
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CallbackDispatcherUser
      • String ID:
      • API String ID: 2492992576-0
      • Opcode ID: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
      • Instruction ID: a3a9c25b9c80179eca176ae0059a0aa24e3542550d9dc9bac8dced773014ab2a
      • Opcode Fuzzy Hash: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
      • Instruction Fuzzy Hash: 0ED09272210A109F8364CAADC9C4C97B3ECEF4C2213004659E54AC3B15D664FC018BA0
      Function 0042CD24 Relevance: 1.5, APIs: 1, Instructions: 16COMMON
      Download Yara Rule
      APIs
      • GetFileAttributesA.KERNEL32(00000000,00000000,004515CB,00000000), ref: 0042CD2F
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AttributesFile
      • String ID:
      • API String ID: 3188754299-0
      • Opcode ID: 6c89678bae6bf830f8c17c6268c6e12585ebb299e13ef4789985508e770dba46
      • Instruction ID: 53db4a1afaa3b7bebcc80daf879f764776582c58df104e6651e2d127eece83ed
      • Opcode Fuzzy Hash: 6c89678bae6bf830f8c17c6268c6e12585ebb299e13ef4789985508e770dba46
      • Instruction Fuzzy Hash: 48C08CE03222001A9E60A6BD2CC551F06CC891423A3A41E3BB129EB2E2D23D88162818
      Function 00406EC0 Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON
      Download Yara Rule
      APIs
      • CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,0040A6D4,0040CC80,?,00000000,?), ref: 00406EDD
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CreateFile
      • String ID:
      • API String ID: 823142352-0
      • Opcode ID: d487f09bce5ab2446fefe52ff91139140134d323c8d44495a9ab4cbc0f9c4527
      • Instruction ID: fbce42704b7dd2fd8be74a622cf743b4adaa06f64be9adac3ea2875d17ee2119
      • Opcode Fuzzy Hash: d487f09bce5ab2446fefe52ff91139140134d323c8d44495a9ab4cbc0f9c4527
      • Instruction Fuzzy Hash: EAC048A13C130032F92035A60C87F16008C5754F0AE60C43AB740BF1C2D8E9A818022C
      Function 0041F39C Relevance: 1.5, APIs: 1, Instructions: 14COMMON
      Download Yara Rule
      APIs
      • KiUserCallbackDispatcher.NTDLL(?,?,?,00000000), ref: 0041F3B0
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CallbackDispatcherUser
      • String ID:
      • API String ID: 2492992576-0
      • Opcode ID: aa2ab5d04534ce78fd06398472ac87fc8e200d4b6eb1d54961e47d4e7a3c3f50
      • Instruction ID: 48f25c4fc7afed193c39a16cc91a0304f94a1296cd048c63733264e3b5f0309e
      • Opcode Fuzzy Hash: aa2ab5d04534ce78fd06398472ac87fc8e200d4b6eb1d54961e47d4e7a3c3f50
      • Instruction Fuzzy Hash: D2D0C932100108AFDB018E94AC018677B69EB48210B148815FD0485221D633E831AA91
      Function 0045092C Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON
      Download Yara Rule
      APIs
      • SetEndOfFile.KERNEL32(?,?,0045C342,00000000,0045C4CD,?,00000000,00000002,00000002), ref: 00450933
        • Part of subcall function 004506B4: GetLastError.KERNEL32(004504D0,00450776,?,00000000,?,0049836C,00000001,00000000,00000002,00000000,004984CD,?,?,00000005,00000000,00498501), ref: 004506B7
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ErrorFileLast
      • String ID:
      • API String ID: 734332943-0
      • Opcode ID: dfd6122944db5b319254e7b77af95d7469dcf5406d44b15aeae4525e96e42585
      • Instruction ID: 9573b676cf6dd5fef234c73c81a1a5d02d78d5ca05287b50762f3c98dcfac2da
      • Opcode Fuzzy Hash: dfd6122944db5b319254e7b77af95d7469dcf5406d44b15aeae4525e96e42585
      • Instruction Fuzzy Hash: 1AC04CA5700211479F10A6BA85C1A0662D86A5D3157144066BD08CF207D668D8148A18
      Function 00406F50 Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON
      Download Yara Rule
      APIs
      • DeleteFileA.KERNEL32(00000000,0049C628,00498C31,00000000,00498C86,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: DeleteFile
      • String ID:
      • API String ID: 4033686569-0
      • Opcode ID: 974406c8209f5f2baf9aa7f60898e2c16b4dbb69ce3e1bfb04616041c36a0a4c
      • Instruction ID: 1cff4f98fe1f8e2c1d524c72e998173d896329315b0501cca3ecf0a0fad01fcd
      • Opcode Fuzzy Hash: 974406c8209f5f2baf9aa7f60898e2c16b4dbb69ce3e1bfb04616041c36a0a4c
      • Instruction Fuzzy Hash: E4B012E13D224A26CB0079FE4CC1D1A00CC4A293063406A3A3006F72C3D83CC8180014
      Function 004072A8 Relevance: 1.5, APIs: 1, Instructions: 11COMMON
      Download Yara Rule
      APIs
      • SetCurrentDirectoryA.KERNEL32(00000000,?,004982FA,00000000,004984CD,?,?,00000005,00000000,00498501,?,?,00000000), ref: 004072B3
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CurrentDirectory
      • String ID:
      • API String ID: 1611563598-0
      • Opcode ID: 9cfe1b671e2ded52e2a4f1899edd371c25323ab6eac1b77aed394817f5a1d109
      • Instruction ID: 2ee9fcf0c2ecb8048618371478a38130c752a95b947e2a8aefd026f579ab26ad
      • Opcode Fuzzy Hash: 9cfe1b671e2ded52e2a4f1899edd371c25323ab6eac1b77aed394817f5a1d109
      • Instruction Fuzzy Hash: 33B012E03D120A2BCA0079FE4CC192A00CC46292163401B3B3006EB1C3D83DC8180824
      Function 0044FE04 Relevance: 1.5, APIs: 1, Instructions: 11COMMON
      Download Yara Rule
      APIs
      • FreeLibrary.KERNEL32(00000000,00450010,00000000,?,004683FA,0000000C,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,?), ref: 0044FE22
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: FreeLibrary
      • String ID:
      • API String ID: 3664257935-0
      • Opcode ID: 82c135690cb37029a64c6e2747bbdbe9eb358ee8a54c9e2beae830715a753dc4
      • Instruction ID: bf3cd9b1fc5eea5e44a7e6704e69b51bce2c1b39ef47238947553d88e88682d9
      • Opcode Fuzzy Hash: 82c135690cb37029a64c6e2747bbdbe9eb358ee8a54c9e2beae830715a753dc4
      • Instruction Fuzzy Hash: 67D0C9B05022448ED750EB75E94871233E0F364346F125837A400CA16AE3398894EFAD
      Function 0042E3EF Relevance: 1.5, APIs: 1, Instructions: 10COMMON
      Download Yara Rule
      APIs
      • SetErrorMode.KERNEL32(?,0042E40D), ref: 0042E400
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ErrorMode
      • String ID:
      • API String ID: 2340568224-0
      • Opcode ID: cb8e2ebd86b0ac1182f6c4657d989dfa6a466ad308997f4b3834ff3b1e7758f7
      • Instruction ID: 426ac138898b17598b25982f2c454791bd479401c65f9a69ae9baa170422678e
      • Opcode Fuzzy Hash: cb8e2ebd86b0ac1182f6c4657d989dfa6a466ad308997f4b3834ff3b1e7758f7
      • Instruction Fuzzy Hash: CDB09B7670C6105EE709D6D5B45552D63D4D7C57207E14477F010D2581D57D58054E18
      Function 0047D4A8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
      Download Yara Rule
      APIs
      • FreeLibrary.KERNEL32(00000000,00481E0B), ref: 0047D4BE
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: FreeLibrary
      • String ID:
      • API String ID: 3664257935-0
      • Opcode ID: 8cec373e994d30c1194968ae062add5c89bef3d1aeff6b29735dbd1bd485e345
      • Instruction ID: 3594e3fbca060532f54f402781d86c56d6f8120f57f80614c359da84ab34fd22
      • Opcode Fuzzy Hash: 8cec373e994d30c1194968ae062add5c89bef3d1aeff6b29735dbd1bd485e345
      • Instruction Fuzzy Hash: DDC0EAB1E902019EC758AB7DE989A5636E4A728305B01897BA418C6274E738B4488F18
      Function 00482048 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON
      Download Yara Rule
      APIs
      • PostMessageA.USER32(00000000,00000012,00000000,00000000), ref: 00482050
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: MessagePost
      • String ID:
      • API String ID: 410705778-0
      • Opcode ID: cab4005e88ba2cdea2d2864549b62f14f1d56f585ed6791aa38b378b51621342
      • Instruction ID: fbd2fd99f2342ae97ce2e912f06b4f6775a0193fa59faa32ac81747571f1ea96
      • Opcode Fuzzy Hash: cab4005e88ba2cdea2d2864549b62f14f1d56f585ed6791aa38b378b51621342
      • Instruction Fuzzy Hash: E2A002343C430430F47462511D03F4400441744F05EE1909573053C0C704D82520201E
      Function 004165EC Relevance: 1.5, APIs: 1, Instructions: 4COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: DestroyWindow
      • String ID:
      • API String ID: 3375834691-0
      • Opcode ID: 1244af60e57b01067fe56da529b9c4312cbd500fa9ed17bad69dff1823a021af
      • Instruction ID: 4f6e5339ba6c71e81ef5aec1f6829bfe42d3c8de95bc03762545e97b2cddf6f9
      • Opcode Fuzzy Hash: 1244af60e57b01067fe56da529b9c4312cbd500fa9ed17bad69dff1823a021af
      • Instruction Fuzzy Hash: 1AA00275501500AADA00E7B5D849F7E2298BB44204FD905F9714897056C57C99008B55
      Function 0047E174 Relevance: 1.4, APIs: 1, Instructions: 157COMMON
      Download Yara Rule
      APIs
      • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,0047E35F,?,?,?,?,00000000,00000000,00000000,00000000), ref: 0047E319
        • Part of subcall function 0042CA00: GetSystemMetrics.USER32(0000002A), ref: 0042CA12
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ByteCharMetricsMultiSystemWide
      • String ID:
      • API String ID: 224039744-0
      • Opcode ID: cf2d294a0c176ba4b0a84a6b6d042752cacc0e24fbe341cb32020e1a635ab033
      • Instruction ID: 2647b8cebaaf01057470fca103781b46ae04bb0ae08e27737b6fdd7404d6d7bc
      • Opcode Fuzzy Hash: cf2d294a0c176ba4b0a84a6b6d042752cacc0e24fbe341cb32020e1a635ab033
      • Instruction Fuzzy Hash: 14517870A00245AFD720DF99D885FA9B7B8EB1D309F1181B7E804A7392C7749E45CB59
      Function 0041F3C4 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON
      Download Yara Rule
      APIs
      • VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041EDA4,?,0042388F,00423C0C,0041EDA4), ref: 0041F3E2
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 3cbaba1d1ed1e926f28d71c5e63335cf9c0629673821937be195d69802fdb84b
      • Instruction ID: 76554604a7858b969097af1b7ecb2f553aa84ce625af1746b6c15b3b7cba3152
      • Opcode Fuzzy Hash: 3cbaba1d1ed1e926f28d71c5e63335cf9c0629673821937be195d69802fdb84b
      • Instruction Fuzzy Hash: 851148742007059BCB20DF19C8C0B82FBE4EB98390F10C53AE9688B385D378E8458BA9
      Function 00452FC4 Relevance: 1.3, APIs: 1, Instructions: 48COMMON
      Download Yara Rule
      APIs
      • GetLastError.KERNEL32(00000000,0045302D), ref: 0045300F
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ErrorLast
      • String ID:
      • API String ID: 1452528299-0
      • Opcode ID: 9b36e42861a8e97045d3d1c2d68090febbf4b925d95e27d87fd5eab6f39d8911
      • Instruction ID: b902f5f71593d0acd8113edc39c0d5725662cc955bae9521e0e34912f41e4d76
      • Opcode Fuzzy Hash: 9b36e42861a8e97045d3d1c2d68090febbf4b925d95e27d87fd5eab6f39d8911
      • Instruction Fuzzy Hash: 850170356042486FC701DF699C008EEFBE8EB4D76171082B7FC24C3382D7345E059664
      Function 0040170C Relevance: 1.3, APIs: 1, Instructions: 48COMMON
      Download Yara Rule
      APIs
      • VirtualFree.KERNEL32(00000000,00000000,00004000,?,?,?,?,?,00401973), ref: 00401766
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: FreeVirtual
      • String ID:
      • API String ID: 1263568516-0
      • Opcode ID: c2ec33a786a38e7bd0169ef8bddb7cde116ed653613200da8896670bb901eae8
      • Instruction ID: be7f0be69d4b25e877c81db3c68dd302dbc4ff1700a0c49f545652be0e594e9c
      • Opcode Fuzzy Hash: c2ec33a786a38e7bd0169ef8bddb7cde116ed653613200da8896670bb901eae8
      • Instruction Fuzzy Hash: 1401FC766442148FC3109F29DCC0E2677E8D794378F15453EDA85673A1D37A6C0187D8

      Non-executed Functions

      Function 0041F118 Relevance: 45.6, APIs: 15, Strings: 11, Instructions: 87libraryloaderCOMMON
      Download Yara Rule
      APIs
      • GetVersion.KERNEL32(?,00418FF0,00000000,?,?,?,00000001), ref: 0041F126
      • SetErrorMode.KERNEL32(00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F142
      • LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F14E
      • SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F15C
      • GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F18C
      • GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F1B5
      • GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F1CA
      • GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F1DF
      • GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F1F4
      • GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F209
      • GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F21E
      • GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F233
      • GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F248
      • GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F25D
      • FreeLibrary.KERNEL32(00000001,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F26F
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressProc$ErrorLibraryMode$FreeLoadVersion
      • String ID: BtnWndProc3d$CTL3D32.DLL$Ctl3DColorChange$Ctl3dAutoSubclass$Ctl3dCtlColorEx$Ctl3dDlgFramePaint$Ctl3dRegister$Ctl3dSubclassCtl$Ctl3dSubclassDlgEx$Ctl3dUnAutoSubclass$Ctl3dUnregister
      • API String ID: 2323315520-3614243559
      • Opcode ID: c1c9d1b6053ab75c91c2e88ec5f32a1b3c473af182a6c91a5ff75eeef97b1c1c
      • Instruction ID: 51138a549d975858c6f438e0ddf30f49d7aaf9b1ba912d381aeb5f1a0b1755e8
      • Opcode Fuzzy Hash: c1c9d1b6053ab75c91c2e88ec5f32a1b3c473af182a6c91a5ff75eeef97b1c1c
      • Instruction Fuzzy Hash: 9B3110B1740700ABDB00EBB5AC86A7A3794F768324751093BB508DB192D77D4C658F9D
      Function 004585C8 Relevance: 40.4, APIs: 11, Strings: 12, Instructions: 186pipeprocessfileCOMMON
      Download Yara Rule
      APIs
      • GetTickCount.KERNEL32 ref: 0045862F
      • QueryPerformanceCounter.KERNEL32(00000000,00000000,004588C2,?,?,00000000,00000000,?,00458FBE,?,00000000,00000000), ref: 00458638
      • GetSystemTimeAsFileTime.KERNEL32(00000000,00000000), ref: 00458642
      • GetCurrentProcessId.KERNEL32(?,00000000,00000000,004588C2,?,?,00000000,00000000,?,00458FBE,?,00000000,00000000), ref: 0045864B
      • CreateNamedPipeA.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 004586C1
      • GetLastError.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000,?,00000000,00000000), ref: 004586CF
      • CreateFileA.KERNEL32(00000000,C0000000,00000000,0049AB24,00000003,00000000,00000000,00000000,0045887E), ref: 00458717
      • SetNamedPipeHandleState.KERNEL32(000000FF,00000002,00000000,00000000,00000000,0045886D,?,00000000,C0000000,00000000,0049AB24,00000003,00000000,00000000,00000000,0045887E), ref: 00458750
        • Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7
      • CreateProcessA.KERNEL32(00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 004587F9
      • CloseHandle.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000), ref: 0045882F
      • CloseHandle.KERNEL32(000000FF,00458874,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 00458867
        • Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049C628,00000004,00000000,00000000,00000000,?,004988E5,00000000), ref: 0045349F
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CreateHandle$CloseErrorFileLastNamedPipeProcessSystemTime$CountCounterCurrentDirectoryPerformanceQueryStateTick
      • String ID: 64-bit helper EXE wasn't extracted$Cannot utilize 64-bit features on this version of Windows$CreateFile$CreateNamedPipe$CreateProcess$D$Helper process PID: %u$SetNamedPipeHandleState$Starting 64-bit helper process.$\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x$helper %d 0x%x$i
      • API String ID: 770386003-3271284199
      • Opcode ID: 2e439d91bb2bc0df059e464c05c25920f638d62ef039cd5a1f0a9cc4d7afe18c
      • Instruction ID: 2bf2c1a5785ca2e529196f6a5ffd0644dc0b7763769c2876684f7691b318427f
      • Opcode Fuzzy Hash: 2e439d91bb2bc0df059e464c05c25920f638d62ef039cd5a1f0a9cc4d7afe18c
      • Instruction Fuzzy Hash: 66710470E003449EDB11EB65CC45B9EB7F4EB05705F1084BAF904FB282DB7899488F69
      Function 00478898 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 94COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 00478704: GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,022A2BE8,?,?,?,022A2BE8,004788C8,00000000,004789E6,?,?,-00000010,?), ref: 0047871D
        • Part of subcall function 00478704: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00478723
        • Part of subcall function 00478704: GetFileAttributesA.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,022A2BE8,?,?,?,022A2BE8,004788C8,00000000,004789E6,?,?,-00000010,?), ref: 00478736
        • Part of subcall function 00478704: CreateFileA.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,022A2BE8,?,?,?,022A2BE8), ref: 00478760
        • Part of subcall function 00478704: CloseHandle.KERNEL32(00000000,?,?,?,022A2BE8,004788C8,00000000,004789E6,?,?,-00000010,?), ref: 0047877E
        • Part of subcall function 004787DC: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,0047886E,?,?,?,022A2BE8,?,004788D0,00000000,004789E6,?,?,-00000010,?), ref: 0047880C
      • ShellExecuteEx.SHELL32(0000003C), ref: 00478920
      • GetLastError.KERNEL32(00000000,004789E6,?,?,-00000010,?), ref: 00478929
      • MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00478976
      • GetExitCodeProcess.KERNEL32(00000000,00000000), ref: 0047899A
      • CloseHandle.KERNEL32(00000000,004789CB,00000000,00000000,000000FF,000000FF,00000000,004789C4,?,00000000,004789E6,?,?,-00000010,?), ref: 004789BE
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Handle$CloseFile$AddressAttributesCodeCreateCurrentDirectoryErrorExecuteExitLastModuleMultipleObjectsProcProcessShellWait
      • String ID: <$GetExitCodeProcess$MsgWaitForMultipleObjects$ShellExecuteEx$ShellExecuteEx returned hProcess=0$runas
      • API String ID: 883996979-221126205
      • Opcode ID: ab954273edd387bf37095ca0a4e21e321cf1adc72b3c2f5bfa5e99950c490c1d
      • Instruction ID: 52c0b85df27041ba1a2752735e5c03e18a5bd66cad03a31f77198c3576fe1549
      • Opcode Fuzzy Hash: ab954273edd387bf37095ca0a4e21e321cf1adc72b3c2f5bfa5e99950c490c1d
      • Instruction Fuzzy Hash: 243147F0A40205AEDB51EFA6C8496EEB6B8EF45318F50843FF518E7281DB7C4905CB5A
      Function 00418384 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58windowCOMMON
      Download Yara Rule
      APIs
      • IsIconic.USER32(?), ref: 00418393
      • GetWindowPlacement.USER32(?,0000002C), ref: 004183B0
      • GetWindowRect.USER32(?), ref: 004183CC
      • GetWindowLongA.USER32(?,000000F0), ref: 004183DA
      • GetWindowLongA.USER32(?,000000F8), ref: 004183EF
      • ScreenToClient.USER32(00000000), ref: 004183F8
      • ScreenToClient.USER32(00000000,?), ref: 00418403
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Window$ClientLongScreen$IconicPlacementRect
      • String ID: ,
      • API String ID: 2266315723-3772416878
      • Opcode ID: 093fbc58c9f2bb22a74bd7cb36b3f86111f4d6c014dbe9a16a5ffda61369e0f0
      • Instruction ID: 8875a2d430ef8be2c5346fa25315cde737655516302bc4d2344e38a88124d083
      • Opcode Fuzzy Hash: 093fbc58c9f2bb22a74bd7cb36b3f86111f4d6c014dbe9a16a5ffda61369e0f0
      • Instruction Fuzzy Hash: 2B112B71505201ABEB00DF69C885F9B77E8AF48314F04067EFD58DB296D738D900CB65
      Function 004555E4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON
      Download Yara Rule
      APIs
      • GetCurrentProcess.KERNEL32(00000028), ref: 004555F3
      • OpenProcessToken.ADVAPI32(00000000,00000028), ref: 004555F9
      • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 00455612
      • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 00455639
      • GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 0045563E
      • ExitWindowsEx.USER32(00000002,00000000), ref: 0045564F
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
      • String ID: SeShutdownPrivilege
      • API String ID: 107509674-3733053543
      • Opcode ID: 7edfcf9cc11a03a5d38e9ca1be1e40f7490575bd2a4dde823e12e2a46e911632
      • Instruction ID: 0962c3bd28717059a66d7edd8a60bb9ec64b33e91818a01feebfb328f8f752a0
      • Opcode Fuzzy Hash: 7edfcf9cc11a03a5d38e9ca1be1e40f7490575bd2a4dde823e12e2a46e911632
      • Instruction Fuzzy Hash: 0BF0C870294B41B9E610AA718C17F3B21C89B40709F80083ABD05E90D3D7BCD40C4A2E
      Function 004985E4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90fileCOMMON
      Download Yara Rule
      APIs
      • FindFirstFileA.KERNEL32(00000000,?,00000000,00498722,?,?,00000000,0049C628,?,004988AC,00000000,00498900,?,?,00000000,0049C628), ref: 0049863B
      • SetFileAttributesA.KERNEL32(00000000,00000010), ref: 004986BE
      • FindNextFileA.KERNEL32(000000FF,?,00000000,004986FA,?,00000000,?,00000000,00498722,?,?,00000000,0049C628,?,004988AC,00000000), ref: 004986D6
      • FindClose.KERNEL32(000000FF,00498701,004986FA,?,00000000,?,00000000,00498722,?,?,00000000,0049C628,?,004988AC,00000000,00498900), ref: 004986F4
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: FileFind$AttributesCloseFirstNext
      • String ID: isRS-$isRS-???.tmp
      • API String ID: 134685335-3422211394
      • Opcode ID: 4e351ffd10c5ab426f7c4bc7913a4dccd988db4808743d5b00b30a726643bba4
      • Instruction ID: 80859704ccdb1d23d9c3006f8c9fb9361beafdb06de4d3c721a10bf0d833455f
      • Opcode Fuzzy Hash: 4e351ffd10c5ab426f7c4bc7913a4dccd988db4808743d5b00b30a726643bba4
      • Instruction Fuzzy Hash: E6316A719016189FCF10EF69CC41ADEBBBCDB46315F5084FBA908A72A1DB3C9E458E58
      Function 00457594 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 241windownativeCOMMON
      Download Yara Rule
      APIs
      • PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00457611
      • PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00457638
      • SetForegroundWindow.USER32(?), ref: 00457649
      • NtdllDefWindowProc_A.USER32(00000000,?,?,?,00000000,00457921,?,00000000,0045795D), ref: 0045790C
      Strings
      • Cannot evaluate variable because [Code] isn't running yet, xrefs: 0045778C
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: MessagePostWindow$ForegroundNtdllProc_
      • String ID: Cannot evaluate variable because [Code] isn't running yet
      • API String ID: 2236967946-3182603685
      • Opcode ID: 850caed3594c866fbdf3aa0bf044961757acada5fde38a3a7ffd9f08a17c3a45
      • Instruction ID: 2f5857e1df9ead339aa620d4c3f6a36f667527057927d99a91d4b86bc2c14e6e
      • Opcode Fuzzy Hash: 850caed3594c866fbdf3aa0bf044961757acada5fde38a3a7ffd9f08a17c3a45
      • Instruction Fuzzy Hash: 7891E134608204DFEB15CF59E951F5ABBF5EB8D304F2184BAED0497792C638AE05DB28
      Function 00417CD0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowCOMMON
      Download Yara Rule
      APIs
      • IsIconic.USER32(?), ref: 00417D0F
      • SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417D2D
      • GetWindowPlacement.USER32(?,0000002C), ref: 00417D63
      • SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417D8A
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Window$Placement$Iconic
      • String ID: ,
      • API String ID: 568898626-3772416878
      • Opcode ID: c97a19e10a8a035096ba50bab8b979699742d4b68dace37a45aae527b270654f
      • Instruction ID: e85585575f8c5a3e7823c55acc6b28d6d187d41511fbfc80546af44b70413e2d
      • Opcode Fuzzy Hash: c97a19e10a8a035096ba50bab8b979699742d4b68dace37a45aae527b270654f
      • Instruction Fuzzy Hash: 4C2112716042089BDF10EF69D8C1AEA77B8AF48314F05456AFD18DF346D678DD84CBA8
      Function 00464158 Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON
      Download Yara Rule
      APIs
      • SetErrorMode.KERNEL32(00000001,00000000,0046433F), ref: 004641CD
      • FindFirstFileA.KERNEL32(00000000,?,00000000,0046430A,?,00000001,00000000,0046433F), ref: 00464213
      • FindNextFileA.KERNEL32(000000FF,?,00000000,004642EC,?,00000000,?,00000000,0046430A,?,00000001,00000000,0046433F), ref: 004642C8
      • FindClose.KERNEL32(000000FF,004642F3,004642EC,?,00000000,?,00000000,0046430A,?,00000001,00000000,0046433F), ref: 004642E6
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Find$File$CloseErrorFirstModeNext
      • String ID:
      • API String ID: 4011626565-0
      • Opcode ID: 067ea5333009e25bbc711db4b398af08451a5f912e90d533e67b6ad470860914
      • Instruction ID: 9d9184480f8630aada0b530c6bd54f2fc26159d28d851f3c8c43bf9f92f270d6
      • Opcode Fuzzy Hash: 067ea5333009e25bbc711db4b398af08451a5f912e90d533e67b6ad470860914
      • Instruction Fuzzy Hash: 77418370A00A18DBCF10EFA5DC959DEB7B8EB88305F5044AAF804A7341E7789E448E59
      Function 00463CDC Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON
      Download Yara Rule
      APIs
      • SetErrorMode.KERNEL32(00000001,00000000,00463E99), ref: 00463D0D
      • FindFirstFileA.KERNEL32(00000000,?,00000000,00463E6C,?,00000001,00000000,00463E99), ref: 00463D9C
      • FindNextFileA.KERNEL32(000000FF,?,00000000,00463E4E,?,00000000,?,00000000,00463E6C,?,00000001,00000000,00463E99), ref: 00463E2E
      • FindClose.KERNEL32(000000FF,00463E55,00463E4E,?,00000000,?,00000000,00463E6C,?,00000001,00000000,00463E99), ref: 00463E48
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Find$File$CloseErrorFirstModeNext
      • String ID:
      • API String ID: 4011626565-0
      • Opcode ID: e957110e323ac027e4b42d93a224c0b05c8db03a3fa71442f80e216588b42eeb
      • Instruction ID: 85e7d80bc36d7b3e80fea797042c039a90a2821ca6a16b1e557570abf42aa49f
      • Opcode Fuzzy Hash: e957110e323ac027e4b42d93a224c0b05c8db03a3fa71442f80e216588b42eeb
      • Instruction Fuzzy Hash: 3A41B770A00A589FCB11EF65CC45ADEB7B8EB88705F4044BAF404A7381E67D9F48CE59
      Function 0042E934 Relevance: 7.6, APIs: 5, Instructions: 50fileCOMMON
      Download Yara Rule
      APIs
      • CreateFileA.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E956
      • DeviceIoControl.KERNEL32(00000000,0009C040,?,00000002,00000000,00000000,?,00000000), ref: 0042E981
      • GetLastError.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E98E
      • CloseHandle.KERNEL32(00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E996
      • SetLastError.KERNEL32(00000000,00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E99C
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ErrorLast$CloseControlCreateDeviceFileHandle
      • String ID:
      • API String ID: 1177325624-0
      • Opcode ID: ee59bea8a4aaf0f7d5082fffd9147f4968d42f177d0d423473c0ce8d554f826d
      • Instruction ID: 013f2dc7f49162440c3438d6a7b95a09da9df1f91c5a42efe57d27a03fa2289a
      • Opcode Fuzzy Hash: ee59bea8a4aaf0f7d5082fffd9147f4968d42f177d0d423473c0ce8d554f826d
      • Instruction Fuzzy Hash: B3F06DB23916203AF620B17A5C86F6F418C8B89B68F10423BBA04FF1D1D5A89D0615AE
      Function 00483D18 Relevance: 6.0, APIs: 4, Instructions: 47windowCOMMON
      Download Yara Rule
      APIs
      • IsIconic.USER32(?), ref: 00483D56
      • GetWindowLongA.USER32(00000000,000000F0), ref: 00483D74
      • ShowWindow.USER32(00000000,00000005,00000000,000000F0,0049D0A8,00483232,00483266,00000000,00483286,?,?,?,0049D0A8), ref: 00483D96
      • ShowWindow.USER32(00000000,00000000,00000000,000000F0,0049D0A8,00483232,00483266,00000000,00483286,?,?,?,0049D0A8), ref: 00483DAA
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Window$Show$IconicLong
      • String ID:
      • API String ID: 2754861897-0
      • Opcode ID: 389f8ce0739bf852d84ac54ad69fa6dbb4ffb62abd6d9979117d70a3584cbf3c
      • Instruction ID: 57b8ba767bb14856b53862c67dbaf1bd9829d4355129962855c6674791d41db7
      • Opcode Fuzzy Hash: 389f8ce0739bf852d84ac54ad69fa6dbb4ffb62abd6d9979117d70a3584cbf3c
      • Instruction Fuzzy Hash: D6012171A01200AFDB10BF258D4AB5A37C96B14749F48087BB8049F2A3CA6DDEC6871C
      Function 00462750 Relevance: 4.6, APIs: 3, Instructions: 67fileCOMMON
      Download Yara Rule
      APIs
      • FindFirstFileA.KERNEL32(00000000,?,00000000,00462824), ref: 004627A8
      • FindNextFileA.KERNEL32(000000FF,?,00000000,00462804,?,00000000,?,00000000,00462824), ref: 004627E4
      • FindClose.KERNEL32(000000FF,0046280B,00462804,?,00000000,?,00000000,00462824), ref: 004627FE
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Find$File$CloseFirstNext
      • String ID:
      • API String ID: 3541575487-0
      • Opcode ID: 856d7593cb43740f07bcb46fe37da2a51cd50a555a8e0902936735ef4e0e5da2
      • Instruction ID: e6acefadc91213b77ea930f6be1f86c6134c8588622ee3d3acab995ed1c325b6
      • Opcode Fuzzy Hash: 856d7593cb43740f07bcb46fe37da2a51cd50a555a8e0902936735ef4e0e5da2
      • Instruction Fuzzy Hash: 87210831904B08BECB11EB65CC41ACEB7ACDB49304F5084B7E808E32A1F6789E44CE69
      Function 004241DC Relevance: 4.5, APIs: 3, Instructions: 32windowCOMMON
      Download Yara Rule
      APIs
      • IsIconic.USER32(?), ref: 004241E4
      • SetActiveWindow.USER32(?,?,?,0046CDAB), ref: 004241F1
        • Part of subcall function 0042364C: ShowWindow.USER32(00410460,00000009,?,00000000,0041EDA4,0042393A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00423667
        • Part of subcall function 00423B14: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000013,?,022A25AC,0042420A,?,?,?,0046CDAB), ref: 00423B4F
      • SetFocus.USER32(00000000,?,?,?,0046CDAB), ref: 0042421E
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Window$ActiveFocusIconicShow
      • String ID:
      • API String ID: 649377781-0
      • Opcode ID: 53192fbc2d376408b6a7592020268cf0f19ef0554392b866cb21d045f5b5e384
      • Instruction ID: 6cf1072edfdcbdc10be5342105da43d08ebac29b83130216d88bebc3c0a9f649
      • Opcode Fuzzy Hash: 53192fbc2d376408b6a7592020268cf0f19ef0554392b866cb21d045f5b5e384
      • Instruction Fuzzy Hash: D0F030B170012097CB10BFAA98C5B9676A8AB48344F5500BBBD05DF357CA7CDC018778
      Function 00417CCE Relevance: 3.0, APIs: 2, Instructions: 49windowCOMMON
      Download Yara Rule
      APIs
      • IsIconic.USER32(?), ref: 00417D0F
      • SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417D2D
      • GetWindowPlacement.USER32(?,0000002C), ref: 00417D63
      • SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417D8A
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Window$Placement$Iconic
      • String ID:
      • API String ID: 568898626-0
      • Opcode ID: 9ef793f64476ba3670797da2b61b23caf71dafcf449f40e3f64fdc7b9d7188a5
      • Instruction ID: d9358ea7cd183770b33139a8ac7b7a0a70302bd2c01e5fc8313c3e2814ac7f2c
      • Opcode Fuzzy Hash: 9ef793f64476ba3670797da2b61b23caf71dafcf449f40e3f64fdc7b9d7188a5
      • Instruction Fuzzy Hash: 33012C71204108ABDB10EE59D8C1EF673A8AF45724F154566FD19DF242D639ED8087A8
      Function 00417598 Relevance: 3.0, APIs: 2, Instructions: 44windowCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CaptureIconic
      • String ID:
      • API String ID: 2277910766-0
      • Opcode ID: 7fa27b407c95a580b40b80c825161d04fdb91ada3891ed934125e399eda476fd
      • Instruction ID: 8aba3c17a51676f3c591df3a769934e6fada85f5983ed2975779da0f1d736f23
      • Opcode Fuzzy Hash: 7fa27b407c95a580b40b80c825161d04fdb91ada3891ed934125e399eda476fd
      • Instruction Fuzzy Hash: 95F0A4723056425BD730AB2EC884AA762F69F84314B14403BE419CBFA1EA3CDCC08798
      Function 00424194 Relevance: 3.0, APIs: 2, Instructions: 22windowCOMMON
      Download Yara Rule
      APIs
      • IsIconic.USER32(?), ref: 0042419B
        • Part of subcall function 00423A84: EnumWindows.USER32(00423A1C), ref: 00423AA8
        • Part of subcall function 00423A84: GetWindow.USER32(?,00000003), ref: 00423ABD
        • Part of subcall function 00423A84: GetWindowLongA.USER32(?,000000EC), ref: 00423ACC
        • Part of subcall function 00423A84: SetWindowPos.USER32(00000000,\AB,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,004241AB,?,?,00423D73), ref: 00423B02
      • SetActiveWindow.USER32(?,?,?,00423D73,00000000,0042415C), ref: 004241AF
        • Part of subcall function 0042364C: ShowWindow.USER32(00410460,00000009,?,00000000,0041EDA4,0042393A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00423667
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Window$ActiveEnumIconicLongShowWindows
      • String ID:
      • API String ID: 2671590913-0
      • Opcode ID: b2ff140757208bd7b7cc33ac29151dbeb423d1cdddd3b288bc041a56f1810338
      • Instruction ID: ce5d4440ec1c13bcfda566247f28ea27228b22b89c70f7a48f218b5e8bc86154
      • Opcode Fuzzy Hash: b2ff140757208bd7b7cc33ac29151dbeb423d1cdddd3b288bc041a56f1810338
      • Instruction Fuzzy Hash: 55E01AA070011087DB10AFAADCC8B9632A9BB48304F55017ABD49CF35BD63CC8608724
      Function 004125D8 Relevance: 1.7, APIs: 1, Instructions: 188nativeCOMMON
      Download Yara Rule
      APIs
      • NtdllDefWindowProc_A.USER32(?,?,?,?,00000000,004127D5), ref: 004127C3
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: NtdllProc_Window
      • String ID:
      • API String ID: 4255912815-0
      • Opcode ID: 0e36fe40e3ed70381f0dab2a9a1a7a663e67c9b0e28b76027b050b9984444561
      • Instruction ID: d615f29355be4e01b6e220915eca320fe799af87d388166cc169c2c15004e021
      • Opcode Fuzzy Hash: 0e36fe40e3ed70381f0dab2a9a1a7a663e67c9b0e28b76027b050b9984444561
      • Instruction Fuzzy Hash: 7B5102357082048FD710DB6ADA80A9BF3E5EF98314B2082BBD814C77A1D7B8AD91C75C
      Function 00478E54 Relevance: 1.6, APIs: 1, Instructions: 107nativeCOMMON
      Download Yara Rule
      APIs
      • NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 00478FA2
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: NtdllProc_Window
      • String ID:
      • API String ID: 4255912815-0
      • Opcode ID: 6622871a3d25a77a7c52fd87bc343b2d99cdf5d6dad228cc0c48b4500dd05a90
      • Instruction ID: 812dc23779c06e4c9e492650aad51c0d53e2f15d0cf78477df5b2a81f8941c1c
      • Opcode Fuzzy Hash: 6622871a3d25a77a7c52fd87bc343b2d99cdf5d6dad228cc0c48b4500dd05a90
      • Instruction Fuzzy Hash: 7A416975604105DFCB10CF99C6888AAB7F6FB48310B24C99AE80CEB701D738EE41DB59
      Function 0042F520 Relevance: 1.5, APIs: 1, Instructions: 17nativeCOMMON
      Download Yara Rule
      APIs
      • NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 0042F53C
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: NtdllProc_Window
      • String ID:
      • API String ID: 4255912815-0
      • Opcode ID: 84fa915654b0e9cabe4af8b3610e56d273e883bd018482bfacacc2813b1fcd3b
      • Instruction ID: 7ca9c19e24a5def9c493c34941f9da96f9ca037215ec7a65a90973bf7a04e639
      • Opcode Fuzzy Hash: 84fa915654b0e9cabe4af8b3610e56d273e883bd018482bfacacc2813b1fcd3b
      • Instruction Fuzzy Hash: FCD09E7120011D7B9B00DE99E840D6B33AD9B88710B909925F945D7642D634ED9197A5
      Function 0044B658 Relevance: 166.5, APIs: 48, Strings: 47, Instructions: 252libraryloaderCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0044B604: GetVersionExA.KERNEL32(00000094), ref: 0044B621
      • LoadLibraryA.KERNEL32(uxtheme.dll,?,0044F775,00499132), ref: 0044B67F
      • GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044B697
      • GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044B6A9
      • GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044B6BB
      • GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044B6CD
      • GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6DF
      • GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6F1
      • GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044B703
      • GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044B715
      • GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044B727
      • GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044B739
      • GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044B74B
      • GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044B75D
      • GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044B76F
      • GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044B781
      • GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044B793
      • GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044B7A5
      • GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044B7B7
      • GetProcAddress.KERNEL32(00000000,GetThemeString), ref: 0044B7C9
      • GetProcAddress.KERNEL32(00000000,GetThemeBool), ref: 0044B7DB
      • GetProcAddress.KERNEL32(00000000,GetThemeInt), ref: 0044B7ED
      • GetProcAddress.KERNEL32(00000000,GetThemeEnumValue), ref: 0044B7FF
      • GetProcAddress.KERNEL32(00000000,GetThemePosition), ref: 0044B811
      • GetProcAddress.KERNEL32(00000000,GetThemeFont), ref: 0044B823
      • GetProcAddress.KERNEL32(00000000,GetThemeRect), ref: 0044B835
      • GetProcAddress.KERNEL32(00000000,GetThemeMargins), ref: 0044B847
      • GetProcAddress.KERNEL32(00000000,GetThemeIntList), ref: 0044B859
      • GetProcAddress.KERNEL32(00000000,GetThemePropertyOrigin), ref: 0044B86B
      • GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 0044B87D
      • GetProcAddress.KERNEL32(00000000,GetThemeFilename), ref: 0044B88F
      • GetProcAddress.KERNEL32(00000000,GetThemeSysColor), ref: 0044B8A1
      • GetProcAddress.KERNEL32(00000000,GetThemeSysColorBrush), ref: 0044B8B3
      • GetProcAddress.KERNEL32(00000000,GetThemeSysBool), ref: 0044B8C5
      • GetProcAddress.KERNEL32(00000000,GetThemeSysSize), ref: 0044B8D7
      • GetProcAddress.KERNEL32(00000000,GetThemeSysFont), ref: 0044B8E9
      • GetProcAddress.KERNEL32(00000000,GetThemeSysString), ref: 0044B8FB
      • GetProcAddress.KERNEL32(00000000,GetThemeSysInt), ref: 0044B90D
      • GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0044B91F
      • GetProcAddress.KERNEL32(00000000,IsAppThemed), ref: 0044B931
      • GetProcAddress.KERNEL32(00000000,GetWindowTheme), ref: 0044B943
      • GetProcAddress.KERNEL32(00000000,EnableThemeDialogTexture), ref: 0044B955
      • GetProcAddress.KERNEL32(00000000,IsThemeDialogTextureEnabled), ref: 0044B967
      • GetProcAddress.KERNEL32(00000000,GetThemeAppProperties), ref: 0044B979
      • GetProcAddress.KERNEL32(00000000,SetThemeAppProperties), ref: 0044B98B
      • GetProcAddress.KERNEL32(00000000,GetCurrentThemeName), ref: 0044B99D
      • GetProcAddress.KERNEL32(00000000,GetThemeDocumentationProperty), ref: 0044B9AF
      • GetProcAddress.KERNEL32(00000000,DrawThemeParentBackground), ref: 0044B9C1
      • GetProcAddress.KERNEL32(00000000,EnableTheming), ref: 0044B9D3
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressProc$LibraryLoadVersion
      • String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$uxtheme.dll
      • API String ID: 1968650500-2910565190
      • Opcode ID: b3b629e164e0bcbb2f4f21ab717bcbf6f1bf226c725e79d5b94aea17d5e0faf4
      • Instruction ID: d8631715d28996979fdae4650c7d0794c4595fe18b81985758329e998cd54f82
      • Opcode Fuzzy Hash: b3b629e164e0bcbb2f4f21ab717bcbf6f1bf226c725e79d5b94aea17d5e0faf4
      • Instruction Fuzzy Hash: 8D91A3F0A40B51ABEB00EFB598D6A2A3BA8EB1571431005BBB454EF295D778DC108F9D
      Function 00492C54 Relevance: 56.4, APIs: 16, Strings: 16, Instructions: 431sleepCOMMON
      Download Yara Rule
      APIs
      • Sleep.KERNEL32(00000000,00000000,00493149,?,?,?,?,00000000,00000000,00000000), ref: 00492C94
      • FindWindowA.USER32(00000000,00000000), ref: 00492CC5
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: FindSleepWindow
      • String ID: CALLDLLPROC$CHARTOOEMBUFF$CREATEMUTEX$FINDWINDOWBYCLASSNAME$FINDWINDOWBYWINDOWNAME$FREEDLL$LOADDLL$OEMTOCHARBUFF$POSTBROADCASTMESSAGE$POSTMESSAGE$REGISTERWINDOWMESSAGE$SENDBROADCASTMESSAGE$SENDBROADCASTNOTIFYMESSAGE$SENDMESSAGE$SENDNOTIFYMESSAGE$SLEEP
      • API String ID: 3078808852-3310373309
      • Opcode ID: 209ce56279b41e139487b1de548d766a6f4010473a2ba67d6f924af110f83750
      • Instruction ID: 859a33d1fca16724c105442f7365beb0e22e3e48fafdb4d5e2e24ed56419331c
      • Opcode Fuzzy Hash: 209ce56279b41e139487b1de548d766a6f4010473a2ba67d6f924af110f83750
      • Instruction Fuzzy Hash: 4CC172A0B042006BDF14BF3E9C4251F59AA9B85709B11D93FB446EB38BCE7DED0A4359
      Function 0041CA0C Relevance: 33.2, APIs: 22, Instructions: 213windowCOMMON
      Download Yara Rule
      APIs
      • GetDC.USER32(00000000), ref: 0041CA40
      • CreateCompatibleDC.GDI32(?), ref: 0041CA4C
      • CreateBitmap.GDI32(0041A944,?,00000001,00000001,00000000), ref: 0041CA70
      • CreateCompatibleBitmap.GDI32(?,0041A944,?), ref: 0041CA80
      • SelectObject.GDI32(0041CE3C,00000000), ref: 0041CA9B
      • FillRect.USER32(0041CE3C,?,?), ref: 0041CAD6
      • SetTextColor.GDI32(0041CE3C,00000000), ref: 0041CAEB
      • SetBkColor.GDI32(0041CE3C,00000000), ref: 0041CB02
      • PatBlt.GDI32(0041CE3C,00000000,00000000,0041A944,?,00FF0062), ref: 0041CB18
      • CreateCompatibleDC.GDI32(?), ref: 0041CB2B
      • SelectObject.GDI32(00000000,00000000), ref: 0041CB5C
      • SelectPalette.GDI32(00000000,00000000,00000001), ref: 0041CB74
      • RealizePalette.GDI32(00000000), ref: 0041CB7D
      • SelectPalette.GDI32(0041CE3C,00000000,00000001), ref: 0041CB8C
      • RealizePalette.GDI32(0041CE3C), ref: 0041CB95
      • SetTextColor.GDI32(00000000,00000000), ref: 0041CBAE
      • SetBkColor.GDI32(00000000,00000000), ref: 0041CBC5
      • BitBlt.GDI32(0041CE3C,00000000,00000000,0041A944,?,00000000,00000000,00000000,00CC0020), ref: 0041CBE1
      • SelectObject.GDI32(00000000,?), ref: 0041CBEE
      • DeleteDC.GDI32(00000000), ref: 0041CC04
        • Part of subcall function 0041A058: GetSysColor.USER32(?), ref: 0041A062
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ColorSelect$CreatePalette$CompatibleObject$BitmapRealizeText$DeleteFillRect
      • String ID:
      • API String ID: 269503290-0
      • Opcode ID: b1a77ee72b466d7e805cf3b902d200046335a56e1df857dfbdb0577e6a302f53
      • Instruction ID: 91afdf38925dfcc0a19aef53af63d8b93a06df8cfedaf367688fa0d34ebdb442
      • Opcode Fuzzy Hash: b1a77ee72b466d7e805cf3b902d200046335a56e1df857dfbdb0577e6a302f53
      • Instruction Fuzzy Hash: 01610071A44648AFDF10EBE9DC86FDFB7B8EB48704F10446AB504E7281D67CA940CB68
      Function 00498910 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 251synchronizationCOMMON
      Download Yara Rule
      APIs
      • ShowWindow.USER32(?,00000005,00000000,00498CA8,?,?,00000000,?,00000000,00000000,?,0049905F,00000000,00499069,?,00000000), ref: 00498993
      • CreateMutexA.KERNEL32(00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00498CA8,?,?,00000000,?,00000000,00000000,?,0049905F,00000000), ref: 004989A6
      • ShowWindow.USER32(?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00498CA8,?,?,00000000,?,00000000,00000000), ref: 004989B6
      • MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 004989D7
      • ShowWindow.USER32(?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00498CA8,?,?,00000000,?,00000000), ref: 004989E7
        • Part of subcall function 0042D44C: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D4DA,?,?,?,00000001,?,0045607E,00000000,004560E6), ref: 0042D481
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ShowWindow$CreateFileModuleMultipleMutexNameObjectsWait
      • String ID: .lst$.msg$/REG$/REGU$Inno-Setup-RegSvr-Mutex$Setup
      • API String ID: 2000705611-3672972446
      • Opcode ID: 0ee30b030a223bb986c1424f6ab252984ba86cb58e5f345b355ebf9cee720eb9
      • Instruction ID: 0f540f509e6931216bdbe5ecc0cea1e8f213896d66e56a8b70982051fc109662
      • Opcode Fuzzy Hash: 0ee30b030a223bb986c1424f6ab252984ba86cb58e5f345b355ebf9cee720eb9
      • Instruction Fuzzy Hash: 9691A470A042049FDF11EB69C856BAE7BA4EB4A704F55447BF500AB6D2CA7CAC05CB2D
      Function 0045A6D8 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 209COMMON
      Download Yara Rule
      APIs
      • GetLastError.KERNEL32(00000000,0045A994,?,?,?,?,?,00000006,?,00000000,00497D9D,?,00000000,00497E40), ref: 0045A846
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ErrorLast
      • String ID: .chm$.chw$.fts$.gid$.hlp$.lnk$Deleting file: %s$Failed to delete the file; it may be in use (%d).$Failed to strip read-only attribute.$Stripped read-only attribute.$The file appears to be in use (%d). Will delete on restart.
      • API String ID: 1452528299-3112430753
      • Opcode ID: 6d1df708071d15be242919af5905c289a4adc26d3bbbcb2c64de1c41dd6f4b7e
      • Instruction ID: 43962401d403c06de7b31dde6fd87328655f81364e16ca473e433d379c6e1912
      • Opcode Fuzzy Hash: 6d1df708071d15be242919af5905c289a4adc26d3bbbcb2c64de1c41dd6f4b7e
      • Instruction Fuzzy Hash: EC719070B002545BCB00EB6998417AE77A49F4931AF91896BFC01AB383DB7C9E1DC75E
      Function 0045CBC0 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 182libraryloadermemoryCOMMON
      Download Yara Rule
      APIs
      • GetVersion.KERNEL32 ref: 0045CBDA
      • GetModuleHandleA.KERNEL32(advapi32.dll), ref: 0045CBFA
      • GetProcAddress.KERNEL32(00000000,GetNamedSecurityInfoW), ref: 0045CC07
      • GetProcAddress.KERNEL32(00000000,SetNamedSecurityInfoW), ref: 0045CC14
      • GetProcAddress.KERNEL32(00000000,SetEntriesInAclW), ref: 0045CC22
        • Part of subcall function 0045CAC8: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0045CB67,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0045CB41
      • AllocateAndInitializeSid.ADVAPI32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045CE15,?,?,00000000), ref: 0045CCDB
      • GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045CE15,?,?,00000000), ref: 0045CCE4
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressProc$AllocateByteCharErrorHandleInitializeLastModuleMultiVersionWide
      • String ID: GetNamedSecurityInfoW$SetEntriesInAclW$SetNamedSecurityInfoW$W$advapi32.dll
      • API String ID: 59345061-4263478283
      • Opcode ID: e3c8f610604f8d1a61e317c05f23941b5211fd13382de67720a36eb0bbeb7958
      • Instruction ID: 5051393f708b4b79d3e4214e138d4444fa461422948ec18671ed0486df3430fb
      • Opcode Fuzzy Hash: e3c8f610604f8d1a61e317c05f23941b5211fd13382de67720a36eb0bbeb7958
      • Instruction Fuzzy Hash: 45517471900308EFDB10DF99C881BEEBBB8EB49715F14806AF905E7241D678A945CFA9
      Function 0041B3AC Relevance: 21.1, APIs: 14, Instructions: 126windowCOMMON
      Download Yara Rule
      APIs
      • CreateCompatibleDC.GDI32(00000000), ref: 0041B3C3
      • CreateCompatibleDC.GDI32(00000000), ref: 0041B3CD
      • GetObjectA.GDI32(?,00000018,00000004), ref: 0041B3DF
      • CreateBitmap.GDI32(0000000B,?,00000001,00000001,00000000), ref: 0041B3F6
      • GetDC.USER32(00000000), ref: 0041B402
      • CreateCompatibleBitmap.GDI32(00000000,0000000B,?), ref: 0041B42F
      • ReleaseDC.USER32(00000000,00000000), ref: 0041B455
      • SelectObject.GDI32(00000000,?), ref: 0041B470
      • SelectObject.GDI32(?,00000000), ref: 0041B47F
      • StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B4AB
      • SelectObject.GDI32(00000000,00000000), ref: 0041B4B9
      • SelectObject.GDI32(?,00000000), ref: 0041B4C7
      • DeleteDC.GDI32(00000000), ref: 0041B4D0
      • DeleteDC.GDI32(?), ref: 0041B4D9
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Object$CreateSelect$Compatible$BitmapDelete$ReleaseStretch
      • String ID:
      • API String ID: 644427674-0
      • Opcode ID: 9212dc48eb065078ffd6e64a0fe4b3e7e755c3ed7e1f96497366cc94fc87ddf9
      • Instruction ID: 0f3e5998203d07172116f12fa3fedaa120d09cd030f2870c51d139f455c41937
      • Opcode Fuzzy Hash: 9212dc48eb065078ffd6e64a0fe4b3e7e755c3ed7e1f96497366cc94fc87ddf9
      • Instruction Fuzzy Hash: E941AD71E44619AFDB10DAE9C846FEFB7BCEB08704F104466B614F7281D6786D408BA8
      Function 00454874 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 244registryCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00483FBF,?,00000001,?,?,00483FBF,?,00000001,00000000), ref: 0042DE38
      • RegQueryValueExA.ADVAPI32(0045AB6A,00000000,00000000,?,00000000,?,00000000,00454B0D,?,0045AB6A,00000003,00000000,00000000,00454B44), ref: 0045498D
        • Part of subcall function 0042E8C8: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453273,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8E7
      • RegQueryValueExA.ADVAPI32(0045AB6A,00000000,00000000,00000000,?,00000004,00000000,00454A57,?,0045AB6A,00000000,00000000,?,00000000,?,00000000), ref: 00454A11
      • RegQueryValueExA.ADVAPI32(0045AB6A,00000000,00000000,00000000,?,00000004,00000000,00454A57,?,0045AB6A,00000000,00000000,?,00000000,?,00000000), ref: 00454A40
      Strings
      • , xrefs: 004548FE
      • Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 004548AB
      • RegOpenKeyEx, xrefs: 00454910
      • Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 004548E4
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: QueryValue$FormatMessageOpen
      • String ID: $RegOpenKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
      • API String ID: 2812809588-1577016196
      • Opcode ID: 2f08f04db0511fade3553c7c6f237fac6394575d5deabc3e408e9eda029bcf30
      • Instruction ID: 3b35aed17da8244e85d272d2923899a44a2159637523a8fd9e70e85f8d21f96a
      • Opcode Fuzzy Hash: 2f08f04db0511fade3553c7c6f237fac6394575d5deabc3e408e9eda029bcf30
      • Instruction Fuzzy Hash: 23914871E44148ABDB10DF95C842BDEB7FCEB49309F50406BF900FB282D6789E458B69
      Function 00459458 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 165registryCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 00459364: RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,004594A1,00000000,00459659,?,00000000,00000000,00000000), ref: 004593B1
      • RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00459659,?,00000000,00000000,00000000), ref: 004594FF
      • RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00459659,?,00000000,00000000,00000000), ref: 00459569
        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00483FBF,?,00000001,?,?,00483FBF,?,00000001,00000000), ref: 0042DE38
      • RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000001,00000000,00000000,00459659,?,00000000,00000000,00000000), ref: 004595D0
      Strings
      • v4.0.30319, xrefs: 004594F1
      • SOFTWARE\Microsoft\.NETFramework\Policy\v2.0, xrefs: 0045951C
      • v1.1.4322, xrefs: 004595C2
      • .NET Framework not found, xrefs: 0045961D
      • v2.0.50727, xrefs: 0045955B
      • SOFTWARE\Microsoft\.NETFramework\Policy\v1.1, xrefs: 00459583
      • SOFTWARE\Microsoft\.NETFramework\Policy\v4.0, xrefs: 004594B2
      • .NET Framework version %s not found, xrefs: 00459609
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Close$Open
      • String ID: .NET Framework not found$.NET Framework version %s not found$SOFTWARE\Microsoft\.NETFramework\Policy\v1.1$SOFTWARE\Microsoft\.NETFramework\Policy\v2.0$SOFTWARE\Microsoft\.NETFramework\Policy\v4.0$v1.1.4322$v2.0.50727$v4.0.30319
      • API String ID: 2976201327-446240816
      • Opcode ID: ff2b6af7e5c086a855278264fd341eab3723ad98b019ff3e6db88a5e0e65c9b5
      • Instruction ID: 81ee8c6a45b9b23f46d813c67303bebc6eb40883e83401b15e0d015f99a83bd9
      • Opcode Fuzzy Hash: ff2b6af7e5c086a855278264fd341eab3723ad98b019ff3e6db88a5e0e65c9b5
      • Instruction Fuzzy Hash: EB51A131A04148EBCB01DF64C861BEE77A6DB59305F54447BA801EB353EA3DAE1ECB19
      Function 00458A44 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 70sleepsynchronizationCOMMON
      Download Yara Rule
      APIs
      • CloseHandle.KERNEL32(?), ref: 00458A7B
      • TerminateProcess.KERNEL32(?,00000001,?,00002710,?), ref: 00458A97
      • WaitForSingleObject.KERNEL32(?,00002710,?), ref: 00458AA5
      • GetExitCodeProcess.KERNEL32(?), ref: 00458AB6
      • CloseHandle.KERNEL32(?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00458AFD
      • Sleep.KERNEL32(000000FA,?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00458B19
      Strings
      • Helper process exited, but failed to get exit code., xrefs: 00458AEF
      • Helper process exited with failure code: 0x%x, xrefs: 00458AE3
      • Stopping 64-bit helper process. (PID: %u), xrefs: 00458A6D
      • Helper isn't responding; killing it., xrefs: 00458A87
      • Helper process exited., xrefs: 00458AC5
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CloseHandleProcess$CodeExitObjectSingleSleepTerminateWait
      • String ID: Helper isn't responding; killing it.$Helper process exited with failure code: 0x%x$Helper process exited, but failed to get exit code.$Helper process exited.$Stopping 64-bit helper process. (PID: %u)
      • API String ID: 3355656108-1243109208
      • Opcode ID: 82a4a8b6a8cb783b8d50086b3e418d053ad70280f482195291431655f8ddd5cb
      • Instruction ID: 3f2324d87e707cedf1d5c4e10b6e93e7b0b52df74c864805f1ac214018e434b5
      • Opcode Fuzzy Hash: 82a4a8b6a8cb783b8d50086b3e418d053ad70280f482195291431655f8ddd5cb
      • Instruction Fuzzy Hash: 2F2130706087409AD720E779C44575BB6D49F08345F04CC2FF99AEB283DF78E8488B2A
      Function 00454528 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 228registryCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0042DDE4: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DE10
      • RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,004546FF,?,00000000,004547C3), ref: 0045464F
      • RegCloseKey.ADVAPI32(?,?,?,00000000,00000004,00000000,00000001,?,00000000,?,00000000,004546FF,?,00000000,004547C3), ref: 0045478B
        • Part of subcall function 0042E8C8: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453273,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8E7
      Strings
      • Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00454597
      • RegCreateKeyEx, xrefs: 004545C3
      • Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00454567
      • , xrefs: 004545B1
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CloseCreateFormatMessageQueryValue
      • String ID: $RegCreateKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
      • API String ID: 2481121983-1280779767
      • Opcode ID: cc6665c6f8d47dcd358d4cc416d9ecd71d05ddf972c53818a0ce936b74a9c3c6
      • Instruction ID: 93c55a0ab54dbcba353dd8d7ef9dbdddde8d62e860aeeeeaccb8ee2ace91ec52
      • Opcode Fuzzy Hash: cc6665c6f8d47dcd358d4cc416d9ecd71d05ddf972c53818a0ce936b74a9c3c6
      • Instruction Fuzzy Hash: 49810F75A00209AFDB00DFD5C981BDEB7B8EB49309F10452AF900FB282D7789E45CB69
      Function 00497190 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 141fileCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 004538BC: CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,asI,_iu,?,00000000,004539F6), ref: 004539AB
        • Part of subcall function 004538BC: CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,asI,_iu,?,00000000,004539F6), ref: 004539BB
      • CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0049720D
      • SetFileAttributesA.KERNEL32(00000000,00000080,00000000,00497361), ref: 0049722E
      • CreateWindowExA.USER32(00000000,STATIC,00497370,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 00497255
      • SetWindowLongA.USER32(?,000000FC,004969E8), ref: 00497268
      • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00497334,?,?,000000FC,004969E8,00000000,STATIC,00497370), ref: 00497298
      • MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 0049730C
      • CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00497334,?,?,000000FC,004969E8,00000000), ref: 00497318
        • Part of subcall function 00453D30: WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00453E17
      • DestroyWindow.USER32(?,0049733B,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00497334,?,?,000000FC,004969E8,00000000,STATIC), ref: 0049732E
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Window$File$CloseCreateHandle$AttributesCopyDestroyLongMultipleObjectsPrivateProfileStringWaitWrite
      • String ID: /SECONDPHASE="%s" /FIRSTPHASEWND=$%x $STATIC
      • API String ID: 1549857992-2312673372
      • Opcode ID: 638975be5a90d50e3b605b1e49b7eb2f5ed4f7d9641967e285dd575213b23448
      • Instruction ID: cf08c6c0df85773511bd90435510a992162f62aa3bbe36377fb46bffd16b674f
      • Opcode Fuzzy Hash: 638975be5a90d50e3b605b1e49b7eb2f5ed4f7d9641967e285dd575213b23448
      • Instruction Fuzzy Hash: 4A413C70A54208AFDF10EBA5DC42F9E7BB8EB08704F51457AF900FB291D6799E00DB68
      Function 0042E418 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 86registrylibraryloaderCOMMON
      Download Yara Rule
      APIs
      • GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,0042E51D,?,00000000,0047EAB8,00000000), ref: 0042E441
      • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042E447
      • RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0042E51D,?,00000000,0047EAB8,00000000), ref: 0042E495
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressCloseHandleModuleProc
      • String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$QaE$kernel32.dll
      • API String ID: 4190037839-2312295185
      • Opcode ID: 83570bd0ce43e78f261925d77abc78ba83d1fb8bd641887165153b6bed6d5ea9
      • Instruction ID: dcbdb1b25fdf23572bf88c9a65674c04ba25a3dfd682240825f74d76f424645b
      • Opcode Fuzzy Hash: 83570bd0ce43e78f261925d77abc78ba83d1fb8bd641887165153b6bed6d5ea9
      • Instruction Fuzzy Hash: 68213230B10225BBDB10EAE6DC51B9E76B8EB44308F904477A504E7281E77CDE419B5C
      Function 004629F0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON
      Download Yara Rule
      APIs
      • GetActiveWindow.USER32 ref: 004629FC
      • GetModuleHandleA.KERNEL32(user32.dll), ref: 00462A10
      • GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 00462A1D
      • GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 00462A2A
      • GetWindowRect.USER32(?,00000000), ref: 00462A76
      • SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,?,00000000), ref: 00462AB4
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Window$AddressProc$ActiveHandleModuleRect
      • String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
      • API String ID: 2610873146-3407710046
      • Opcode ID: e54ea61e7ff53ccb6155445239e3f4edb54d22f30a98655ad845b77929937b23
      • Instruction ID: 9842ae50c22ead81fa156f5b7a64e1f536071a607b34688e3e3cbcd016f18cd1
      • Opcode Fuzzy Hash: e54ea61e7ff53ccb6155445239e3f4edb54d22f30a98655ad845b77929937b23
      • Instruction Fuzzy Hash: 15219576701B057BD610D6A88D85F3B36D8EB88715F094A2AF944DB3C1E6F8DC018B9A
      Function 0042F188 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON
      Download Yara Rule
      APIs
      • GetActiveWindow.USER32 ref: 0042F194
      • GetModuleHandleA.KERNEL32(user32.dll), ref: 0042F1A8
      • GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0042F1B5
      • GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0042F1C2
      • GetWindowRect.USER32(?,00000000), ref: 0042F20E
      • SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D), ref: 0042F24C
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Window$AddressProc$ActiveHandleModuleRect
      • String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
      • API String ID: 2610873146-3407710046
      • Opcode ID: 4e0847af1d2ea56083bdd1c82c540be19fadf87330c2f71622929ccca62b1737
      • Instruction ID: 78f5e3e222a42cc18cdbf1d154cf4d1e82dacf0ae8140000a22c19f5604f87d1
      • Opcode Fuzzy Hash: 4e0847af1d2ea56083bdd1c82c540be19fadf87330c2f71622929ccca62b1737
      • Instruction Fuzzy Hash: 0821F57A704710ABD300E664DC81F3B37A9DB89714F88457AF944DB381DA79EC044BA9
      Function 00458C1C Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 127pipeCOMMON
      Download Yara Rule
      APIs
      • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00458DFB,?,00000000,00458E5E,?,?,00000000,00000000), ref: 00458C79
      • TransactNamedPipe.KERNEL32(?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00458D90,?,00000000,00000001,00000000,00000000,00000000,00458DFB), ref: 00458CD6
      • GetLastError.KERNEL32(?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00458D90,?,00000000,00000001,00000000,00000000,00000000,00458DFB), ref: 00458CE3
      • MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00458D2F
      • GetOverlappedResult.KERNEL32(?,?,00000000,00000001,00458D69,?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00458D90,?,00000000), ref: 00458D55
      • GetLastError.KERNEL32(?,?,00000000,00000001,00458D69,?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00458D90,?,00000000), ref: 00458D5C
        • Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049C628,00000004,00000000,00000000,00000000,?,004988E5,00000000), ref: 0045349F
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ErrorLast$CreateEventMultipleNamedObjectsOverlappedPipeResultTransactWait
      • String ID: CreateEvent$TransactNamedPipe
      • API String ID: 2182916169-3012584893
      • Opcode ID: ef16c20a6daf1f887f3bc2a9a4f4fdabf826d35dd2b72c43caf5f800eb3833ff
      • Instruction ID: 06b5d05a5e38ae799b2edb69ba26f0faef77b18cb4ad173b91f5c3c95d125767
      • Opcode Fuzzy Hash: ef16c20a6daf1f887f3bc2a9a4f4fdabf826d35dd2b72c43caf5f800eb3833ff
      • Instruction Fuzzy Hash: EF418E75A00608AFDB15DF95C981F9EB7F8EB48714F1044AAF900F72D2DA789E44CA28
      Function 00456D20 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 99libraryloaderCOMMON
      Download Yara Rule
      APIs
      • GetModuleHandleA.KERNEL32(OLEAUT32.DLL,UnRegisterTypeLib,00000000,00456E85,?,?,00000031,?), ref: 00456D48
      • GetProcAddress.KERNEL32(00000000,OLEAUT32.DLL), ref: 00456D4E
      • LoadTypeLib.OLEAUT32(00000000,?), ref: 00456D9B
        • Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049C628,00000004,00000000,00000000,00000000,?,004988E5,00000000), ref: 0045349F
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressErrorHandleLastLoadModuleProcType
      • String ID: GetProcAddress$ITypeLib::GetLibAttr$LoadTypeLib$OLEAUT32.DLL$UnRegisterTypeLib$UnRegisterTypeLib
      • API String ID: 1914119943-2711329623
      • Opcode ID: e2963ea3afedc97cdb575031c9274042e2bd1e61e6c3a56a36b999a051922bf2
      • Instruction ID: d1bb8c6bfccdc0522a96f5e3020b18907c52df716e7671809b7eaf465cfb4023
      • Opcode Fuzzy Hash: e2963ea3afedc97cdb575031c9274042e2bd1e61e6c3a56a36b999a051922bf2
      • Instruction Fuzzy Hash: 6831A375A00604AFDB41EFAACC12D5BB7BDEB8970675244A6FD04D3352DB38DD08CA28
      Function 00416D80 Relevance: 15.2, APIs: 10, Instructions: 167windowCOMMON
      Download Yara Rule
      APIs
      • RectVisible.GDI32(?,?), ref: 00416E13
      • SaveDC.GDI32(?), ref: 00416E27
      • IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 00416E4A
      • RestoreDC.GDI32(?,?), ref: 00416E65
      • CreateSolidBrush.GDI32(00000000), ref: 00416EE5
      • FrameRect.USER32(?,?,?), ref: 00416F18
      • DeleteObject.GDI32(?), ref: 00416F22
      • CreateSolidBrush.GDI32(00000000), ref: 00416F32
      • FrameRect.USER32(?,?,?), ref: 00416F65
      • DeleteObject.GDI32(?), ref: 00416F6F
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Rect$BrushCreateDeleteFrameObjectSolid$ClipIntersectRestoreSaveVisible
      • String ID:
      • API String ID: 375863564-0
      • Opcode ID: c0e852fad3f8100a43f66ba4c7f0a8b2961b499ee907491dc16e69cd98bdc1bc
      • Instruction ID: c082a38e55a2621cff38c0036c5e412d4739722926df34ebe37a7eff5f7859fc
      • Opcode Fuzzy Hash: c0e852fad3f8100a43f66ba4c7f0a8b2961b499ee907491dc16e69cd98bdc1bc
      • Instruction Fuzzy Hash: 70515A712086459FDB50EF69C8C4B9B77E8AF48314F15466AFD488B286C738EC81CB99
      Function 00404ABF Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON
      Download Yara Rule
      APIs
      • CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B46
      • GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B6A
      • SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B86
      • ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00404BA7
      • SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00404BD0
      • SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00404BDA
      • GetStdHandle.KERNEL32(000000F5), ref: 00404BFA
      • GetFileType.KERNEL32(?,000000F5), ref: 00404C11
      • CloseHandle.KERNEL32(?,?,000000F5), ref: 00404C2C
      • GetLastError.KERNEL32(000000F5), ref: 00404C46
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
      • String ID:
      • API String ID: 1694776339-0
      • Opcode ID: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
      • Instruction ID: 0555156f4d2a620bb114dc01d937536d57074fdea11cd86abdfeb4dd56d828b4
      • Opcode Fuzzy Hash: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
      • Instruction Fuzzy Hash: 3741B3F02093009AF7305E248905B2375E5EBC0755F208E3FE296BA6E0D7BDE8458B1D
      Function 004221E8 Relevance: 15.1, APIs: 10, Instructions: 74windowCOMMON
      Download Yara Rule
      APIs
      • GetSystemMenu.USER32(00000000,00000000), ref: 00422233
      • DeleteMenu.USER32(00000000,0000F130,00000000,00000000,00000000), ref: 00422251
      • DeleteMenu.USER32(00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 0042225E
      • DeleteMenu.USER32(00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 0042226B
      • DeleteMenu.USER32(00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 00422278
      • DeleteMenu.USER32(00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000), ref: 00422285
      • DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000), ref: 00422292
      • DeleteMenu.USER32(00000000,0000F120,00000000,00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000), ref: 0042229F
      • EnableMenuItem.USER32(00000000,0000F020,00000001), ref: 004222BD
      • EnableMenuItem.USER32(00000000,0000F030,00000001), ref: 004222D9
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Menu$Delete$EnableItem$System
      • String ID:
      • API String ID: 3985193851-0
      • Opcode ID: 4d8bc361089dd12c5078b36f4c4993afe50deda9ff5b79e06e1db0131907f366
      • Instruction ID: 662ae76830c3dbb110fd6952920e185112f137d20e740dc0dcce1beff7d7cd05
      • Opcode Fuzzy Hash: 4d8bc361089dd12c5078b36f4c4993afe50deda9ff5b79e06e1db0131907f366
      • Instruction Fuzzy Hash: AF2144703407047AE720E724CD8BF9BBBD89B04708F5451A5BA487F6D3C6F9AB804698
      Function 0046168C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 82COMMON
      Download Yara Rule
      APIs
      • SHGetMalloc.SHELL32(?), ref: 004616C7
      • GetActiveWindow.USER32 ref: 0046172B
      • CoInitialize.OLE32(00000000), ref: 0046173F
      • SHBrowseForFolder.SHELL32(?), ref: 00461756
      • 756CD120.OLE32(00461797,00000000,?,?,?,?,?,00000000,0046181B), ref: 0046176B
      • SetActiveWindow.USER32(?,00461797,00000000,?,?,?,?,?,00000000,0046181B), ref: 00461781
      • SetActiveWindow.USER32(?,?,00461797,00000000,?,?,?,?,?,00000000,0046181B), ref: 0046178A
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ActiveWindow$BrowseD120FolderInitializeMalloc
      • String ID: A
      • API String ID: 2698730301-3554254475
      • Opcode ID: 5603a2cb31405411be66734efc370ddb963b83ed3a096b7d96b6f585c2116f38
      • Instruction ID: d2afb22326a53bedce378f8eb5644f44213a7745cdf118f233388cc01fcefbab
      • Opcode Fuzzy Hash: 5603a2cb31405411be66734efc370ddb963b83ed3a096b7d96b6f585c2116f38
      • Instruction Fuzzy Hash: 08313071E00348AFDB10EFA6D885A9EBBF8EB09304F55847AF404E7251E7785A04CF59
      Function 0045D2B4 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 41libraryloaderCOMMON
      Download Yara Rule
      APIs
      • GetProcAddress.KERNEL32(00000000,inflateInit_), ref: 0045D2BD
      • GetProcAddress.KERNEL32(00000000,inflate), ref: 0045D2CD
      • GetProcAddress.KERNEL32(00000000,inflateEnd), ref: 0045D2DD
      • GetProcAddress.KERNEL32(00000000,inflateReset), ref: 0045D2ED
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressProc
      • String ID: inflate$inflateEnd$inflateInit_$inflateReset
      • API String ID: 190572456-3516654456
      • Opcode ID: e8f2002ffeb0441f5c53312c1ad0b406bb5b9f8a302b1f9ae14f157040297e3c
      • Instruction ID: f14a6f29d3d580ddf5395e5b7fc75b1b79391794d4065f69be09c6ed3bcb937a
      • Opcode Fuzzy Hash: e8f2002ffeb0441f5c53312c1ad0b406bb5b9f8a302b1f9ae14f157040297e3c
      • Instruction Fuzzy Hash: 470162B0D00701DAE324DF72AD4672637A5ABA430EF10803B9D09932A6D37D044ADF2E
      Function 0041A8DC Relevance: 13.7, APIs: 9, Instructions: 176windowCOMMON
      Download Yara Rule
      APIs
      • SetBkColor.GDI32(?,00000000), ref: 0041A9B9
      • BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0041A9F3
      • SetBkColor.GDI32(?,?), ref: 0041AA08
      • StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00CC0020), ref: 0041AA52
      • SetTextColor.GDI32(00000000,00000000), ref: 0041AA5D
      • SetBkColor.GDI32(00000000,00FFFFFF), ref: 0041AA6D
      • StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00E20746), ref: 0041AAAC
      • SetTextColor.GDI32(00000000,00000000), ref: 0041AAB6
      • SetBkColor.GDI32(00000000,?), ref: 0041AAC3
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Color$StretchText
      • String ID:
      • API String ID: 2984075790-0
      • Opcode ID: 8339573435af0571ac004b9edfe9888bf518b81d8e89d3dd49c7a051c1e5b4c2
      • Instruction ID: e47558b52586b5da4299fc567d0e44b5417240ec4c6cf29b3c61b3fe783309fe
      • Opcode Fuzzy Hash: 8339573435af0571ac004b9edfe9888bf518b81d8e89d3dd49c7a051c1e5b4c2
      • Instruction Fuzzy Hash: 6961E6B5A00505AFCB40EFADD985E9AB7F8EF08314B108166F508DB262CB74ED40CF99
      Function 004580C4 Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 126COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7
      • CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,00458278,?, /s ",?,regsvr32.exe",?,00458278), ref: 004581EA
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CloseDirectoryHandleSystem
      • String ID: /s "$ /u$0x%x$CreateProcess$D$Spawning 32-bit RegSvr32: $Spawning 64-bit RegSvr32: $regsvr32.exe"
      • API String ID: 2051275411-1862435767
      • Opcode ID: 273894a50eb0074ef48da2fb742bcd465b439a2fe4c22764832b139c2e06b0fa
      • Instruction ID: cda81b302c56d3c3b7af3d8ffa4af26d40175ae7a7c1cff7e24eee752c39b11a
      • Opcode Fuzzy Hash: 273894a50eb0074ef48da2fb742bcd465b439a2fe4c22764832b139c2e06b0fa
      • Instruction Fuzzy Hash: 21411670A047486BDB10EFD6D842B8DBBF9AF45305F50407FB904BB292DF789A098B19
      Function 0044D178 Relevance: 13.6, APIs: 9, Instructions: 90COMMON
      Download Yara Rule
      APIs
      • OffsetRect.USER32(?,00000001,00000001), ref: 0044D1A9
      • GetSysColor.USER32(00000014), ref: 0044D1B0
      • SetTextColor.GDI32(00000000,00000000), ref: 0044D1C8
      • DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D1F1
      • OffsetRect.USER32(?,000000FF,000000FF), ref: 0044D1FB
      • GetSysColor.USER32(00000010), ref: 0044D202
      • SetTextColor.GDI32(00000000,00000000), ref: 0044D21A
      • DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D243
      • DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D26E
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Text$Color$Draw$OffsetRect
      • String ID:
      • API String ID: 1005981011-0
      • Opcode ID: c06c2bb1661cabc99be4074b90a59bff72ed56e1745f0cb5f3e87312b67fa2d3
      • Instruction ID: 8406a00effd73db105afccad7da3796984cf264811f0ddac3e5cace4e0ac1d2b
      • Opcode Fuzzy Hash: c06c2bb1661cabc99be4074b90a59bff72ed56e1745f0cb5f3e87312b67fa2d3
      • Instruction Fuzzy Hash: A021BDB42015047FC710FB2ACD8AE8B6BDCDF19319B05457AB958EB292C67CDD404668
      Function 00496A34 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 90sleepsynchronizationthreadCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0045092C: SetEndOfFile.KERNEL32(?,?,0045C342,00000000,0045C4CD,?,00000000,00000002,00000002), ref: 00450933
        • Part of subcall function 00406F50: DeleteFileA.KERNEL32(00000000,0049C628,00498C31,00000000,00498C86,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B
      • GetWindowThreadProcessId.USER32(00000000,?), ref: 00496AC5
      • OpenProcess.KERNEL32(00100000,00000000,?,00000000,?), ref: 00496AD9
      • SendNotifyMessageA.USER32(00000000,0000054D,00000000,00000000), ref: 00496AF3
      • WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 00496AFF
      • CloseHandle.KERNEL32(00000000,00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 00496B05
      • Sleep.KERNEL32(000001F4,00000000,0000054D,00000000,00000000,00000000,?), ref: 00496B18
      Strings
      • Deleting Uninstall data files., xrefs: 00496A3B
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: FileProcess$CloseDeleteHandleMessageNotifyObjectOpenSendSingleSleepThreadWaitWindow
      • String ID: Deleting Uninstall data files.
      • API String ID: 1570157960-2568741658
      • Opcode ID: eba98680a5b5d835c96334c8e3c2c26ce864e5226ac3704a2cdb361a903f3cfe
      • Instruction ID: c7fdef5db47779181808cd77ece5851621b80ba90656bd45fa302bbeaa1d0a37
      • Opcode Fuzzy Hash: eba98680a5b5d835c96334c8e3c2c26ce864e5226ac3704a2cdb361a903f3cfe
      • Instruction Fuzzy Hash: 39214171B44240BEEB11EB7AEC86B2677A8D75532CF12843BB50596292D6789C00CF2D
      Function 0047034C Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 89registrywindowCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00483FBF,?,00000001,?,?,00483FBF,?,00000001,00000000), ref: 0042DE38
      • RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,00470449,?,?,?,?,00000000), ref: 004703B3
      • RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,00470449), ref: 004703CA
      • AddFontResourceA.GDI32(00000000), ref: 004703E7
      • SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 004703FB
      Strings
      • Failed to set value in Fonts registry key., xrefs: 004703BC
      • Failed to open Fonts registry key., xrefs: 004703D1
      • AddFontResource, xrefs: 00470405
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CloseFontMessageNotifyOpenResourceSendValue
      • String ID: AddFontResource$Failed to open Fonts registry key.$Failed to set value in Fonts registry key.
      • API String ID: 955540645-649663873
      • Opcode ID: bf8fae512462ad3bf027ad30c73487e73c403b0abecb579832f13559f0c1ce99
      • Instruction ID: de0fcad7f59b8b6e3f36252054ef2b9b6c1aa86c0dcba491f5fd59bb8c0745b9
      • Opcode Fuzzy Hash: bf8fae512462ad3bf027ad30c73487e73c403b0abecb579832f13559f0c1ce99
      • Instruction Fuzzy Hash: AA21CF74741204BBD710EB668C42FAF67AC8B44708F608477BA04FB3C2DA7C9E06966D
      Function 00462E30 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75windowCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 00416410: GetClassInfoA.USER32(00400000,?,?), ref: 0041647F
        • Part of subcall function 00416410: UnregisterClassA.USER32(?,00400000), ref: 004164AB
        • Part of subcall function 00416410: RegisterClassA.USER32(?), ref: 004164CE
      • GetVersion.KERNEL32 ref: 00462E60
      • SendMessageA.USER32(00000000,0000112C,00000004,00000004), ref: 00462E9E
      • SHGetFileInfo.SHELL32(00462F3C,00000000,?,00000160,00004011), ref: 00462EBB
      • LoadCursorA.USER32(00000000,00007F02), ref: 00462ED9
      • SetCursor.USER32(00000000,00000000,00007F02,00462F3C,00000000,?,00000160,00004011), ref: 00462EDF
      • SetCursor.USER32(?,00462F1F,00007F02,00462F3C,00000000,?,00000160,00004011), ref: 00462F12
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ClassCursor$Info$FileLoadMessageRegisterSendUnregisterVersion
      • String ID: Explorer
      • API String ID: 2594429197-512347832
      • Opcode ID: 7a51c55cbf713d8fcd07557a16d6659ed9972606bb3847d908a6f75d172ce693
      • Instruction ID: 4c9b61fcaeb9a6098bded6494fcb300de98feacffa2aea191203b59a87b37782
      • Opcode Fuzzy Hash: 7a51c55cbf713d8fcd07557a16d6659ed9972606bb3847d908a6f75d172ce693
      • Instruction Fuzzy Hash: BE21E7307403047AEB15BB758D47B9A37989B09708F4004BBBA05EA1C3EEBD9901966D
      Function 00478704 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66libraryfileloaderCOMMON
      Download Yara Rule
      APIs
      • GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,022A2BE8,?,?,?,022A2BE8,004788C8,00000000,004789E6,?,?,-00000010,?), ref: 0047871D
      • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00478723
      • GetFileAttributesA.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,022A2BE8,?,?,?,022A2BE8,004788C8,00000000,004789E6,?,?,-00000010,?), ref: 00478736
      • CreateFileA.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,022A2BE8,?,?,?,022A2BE8), ref: 00478760
      • CloseHandle.KERNEL32(00000000,?,?,?,022A2BE8,004788C8,00000000,004789E6,?,?,-00000010,?), ref: 0047877E
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: FileHandle$AddressAttributesCloseCreateModuleProc
      • String ID: GetFinalPathNameByHandleA$kernel32.dll
      • API String ID: 2704155762-2318956294
      • Opcode ID: 84faee84c7ae1c4c6466e44721508a772d43d2df2870f468474a87cc3996cec3
      • Instruction ID: 047dad14a5c36f1309200c40cf8025e008869f39560cb3fb271412dec8c4dd3c
      • Opcode Fuzzy Hash: 84faee84c7ae1c4c6466e44721508a772d43d2df2870f468474a87cc3996cec3
      • Instruction Fuzzy Hash: 900161607C170466E524317B4C8AFBB654C8B90779F24813BBA5EEA2D2DDAC9D06015E
      Function 00459E0C Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 121COMMON
      Download Yara Rule
      APIs
      • GetLastError.KERNEL32(00000000,00459F8E,?,00000000,00000000,00000000,?,00000006,?,00000000,00497D9D,?,00000000,00497E40), ref: 00459ED2
        • Part of subcall function 004543F4: FindClose.KERNEL32(000000FF,004544EA), ref: 004544D9
      Strings
      • Not stripping read-only attribute because the directory does not appear to be empty., xrefs: 00459EAC
      • Deleting directory: %s, xrefs: 00459E5B
      • Failed to delete directory (%d)., xrefs: 00459F68
      • Failed to delete directory (%d). Will delete on restart (if empty)., xrefs: 00459F47
      • Failed to strip read-only attribute., xrefs: 00459EA0
      • Failed to delete directory (%d). Will retry later., xrefs: 00459EEB
      • Stripped read-only attribute., xrefs: 00459E94
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CloseErrorFindLast
      • String ID: Deleting directory: %s$Failed to delete directory (%d).$Failed to delete directory (%d). Will delete on restart (if empty).$Failed to delete directory (%d). Will retry later.$Failed to strip read-only attribute.$Not stripping read-only attribute because the directory does not appear to be empty.$Stripped read-only attribute.
      • API String ID: 754982922-1448842058
      • Opcode ID: 1b71d0690e542172990efccc202b515c87a2533f8f31a94b91900e666793e578
      • Instruction ID: 6514b8a34a7b0766e49f3a9923416089df7947466bf5f8ea7a116c2356c1b58d
      • Opcode Fuzzy Hash: 1b71d0690e542172990efccc202b515c87a2533f8f31a94b91900e666793e578
      • Instruction Fuzzy Hash: BB41A331A04208CACB10EB69C8413AEB6A55F4530AF54897BAC01D73D3CB7C8E0DC79E
      Function 00422E50 Relevance: 12.1, APIs: 8, Instructions: 119windowCOMMON
      Download Yara Rule
      APIs
      • GetCapture.USER32 ref: 00422EA4
      • GetCapture.USER32 ref: 00422EB3
      • SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 00422EB9
      • ReleaseCapture.USER32 ref: 00422EBE
      • GetActiveWindow.USER32 ref: 00422ECD
      • SendMessageA.USER32(00000000,0000B000,00000000,00000000), ref: 00422F4C
      • SendMessageA.USER32(00000000,0000B001,00000000,00000000), ref: 00422FB0
      • GetActiveWindow.USER32 ref: 00422FBF
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CaptureMessageSend$ActiveWindow$Release
      • String ID:
      • API String ID: 862346643-0
      • Opcode ID: ed41a728d45d1141f63d62ff64c149c436f45776abe0442a94f47a2e158cc53e
      • Instruction ID: 1357ae16d8856f0372d1bd804dfe5642ed2db6f67eb3355d1ef670384bd1027f
      • Opcode Fuzzy Hash: ed41a728d45d1141f63d62ff64c149c436f45776abe0442a94f47a2e158cc53e
      • Instruction Fuzzy Hash: 3E417330B00245AFDB10EF69DA86B9E77F1EF44304F5540BAF404AB2A2D7789E50DB49
      Function 0042F290 Relevance: 12.1, APIs: 8, Instructions: 102windowCOMMON
      Download Yara Rule
      APIs
      • GetWindowLongA.USER32(?,000000F0), ref: 0042F2BA
      • GetWindowLongA.USER32(?,000000EC), ref: 0042F2D1
      • GetActiveWindow.USER32 ref: 0042F2DA
      • MessageBoxA.USER32(00000000,00000000,00000000,00000000), ref: 0042F307
      • SetActiveWindow.USER32(?,0042F437,00000000,?), ref: 0042F328
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Window$ActiveLong$Message
      • String ID:
      • API String ID: 2785966331-0
      • Opcode ID: 3c98a287bcbc3a43e0e15f0e9e9e6331c1ebdf7e57234939d5281d79aaa85a99
      • Instruction ID: 0ece09a01b05ac2bd58e3a2932475df1b460f34b24c2cf045fcfc9444de4ea96
      • Opcode Fuzzy Hash: 3c98a287bcbc3a43e0e15f0e9e9e6331c1ebdf7e57234939d5281d79aaa85a99
      • Instruction Fuzzy Hash: 6931C171A00254AFDB01EBA5DC52E6EBBB8EB09304B9144BAB804E3291D6389D10CB58
      Function 00429480 Relevance: 12.1, APIs: 8, Instructions: 62COMMON
      Download Yara Rule
      APIs
      • GetDC.USER32(00000000), ref: 0042948A
      • GetTextMetricsA.GDI32(00000000), ref: 00429493
        • Part of subcall function 0041A1E8: CreateFontIndirectA.GDI32(?), ref: 0041A2A7
      • SelectObject.GDI32(00000000,00000000), ref: 004294A2
      • GetTextMetricsA.GDI32(00000000,?), ref: 004294AF
      • SelectObject.GDI32(00000000,00000000), ref: 004294B6
      • ReleaseDC.USER32(00000000,00000000), ref: 004294BE
      • GetSystemMetrics.USER32(00000006), ref: 004294E3
      • GetSystemMetrics.USER32(00000006), ref: 004294FD
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Metrics$ObjectSelectSystemText$CreateFontIndirectRelease
      • String ID:
      • API String ID: 1583807278-0
      • Opcode ID: b6c9b4590bedf8a5668c90f2a33c64f3739a4c15a772245c738bb335bb7cd0f7
      • Instruction ID: a57f56e533d485e90500cc8844f53ed5573372bce62f15aaf232a07072237724
      • Opcode Fuzzy Hash: b6c9b4590bedf8a5668c90f2a33c64f3739a4c15a772245c738bb335bb7cd0f7
      • Instruction Fuzzy Hash: 4D01C4A17087203BE321767A8CC6F6F65C8DB44358F84043BF686D63D3D96C9C41866A
      Function 0041DE24 Relevance: 12.1, APIs: 8, Instructions: 60windowCOMMON
      Download Yara Rule
      APIs
      • GetDC.USER32(00000000), ref: 0041DE27
      • GetDeviceCaps.GDI32(00000000,0000005A), ref: 0041DE31
      • ReleaseDC.USER32(00000000,00000000), ref: 0041DE3E
      • MulDiv.KERNEL32(00000008,00000060,00000048), ref: 0041DE4D
      • GetStockObject.GDI32(00000007), ref: 0041DE5B
      • GetStockObject.GDI32(00000005), ref: 0041DE67
      • GetStockObject.GDI32(0000000D), ref: 0041DE73
      • LoadIconA.USER32(00000000,00007F00), ref: 0041DE84
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ObjectStock$CapsDeviceIconLoadRelease
      • String ID:
      • API String ID: 225703358-0
      • Opcode ID: 60385fb8b99907decc0c048c95daa02a15d012cadae0939c392207dec41f8ec1
      • Instruction ID: b1570225ef860401f90fbe0181f630f16bcc097e3e60e5a01c67c65972f4669b
      • Opcode Fuzzy Hash: 60385fb8b99907decc0c048c95daa02a15d012cadae0939c392207dec41f8ec1
      • Instruction Fuzzy Hash: BE114FB06453015EE340FFA65D92B6A36A0DB25709F40913FF609AF3D2DA7E1C448B6E
      Function 00463240 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 273COMMON
      Download Yara Rule
      APIs
      • LoadCursorA.USER32(00000000,00007F02), ref: 00463344
      • SetCursor.USER32(00000000,00000000,00007F02,00000000,004633D9), ref: 0046334A
      • SetCursor.USER32(?,004633C1,00007F02,00000000,004633D9), ref: 004633B4
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Cursor$Load
      • String ID: $ $Internal error: Item already expanding
      • API String ID: 1675784387-1948079669
      • Opcode ID: 040729a671edf880b94918ceea5f8eaec20fdfbf8da854279a56862745118dff
      • Instruction ID: e4e85f4aa3fa623d7d3a169fbc538aa22306e9421cedfdc69a3031d12d347dae
      • Opcode Fuzzy Hash: 040729a671edf880b94918ceea5f8eaec20fdfbf8da854279a56862745118dff
      • Instruction Fuzzy Hash: 4CB18270604284EFDB11DF29C545B9ABBF1BF04305F1484AAE8469B792DB78EE44CB4A
      Function 00453D30 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 225COMMON
      Download Yara Rule
      APIs
      • WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00453E17
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: PrivateProfileStringWrite
      • String ID: .tmp$MoveFileEx$NUL$WININIT.INI$[rename]
      • API String ID: 390214022-3304407042
      • Opcode ID: fdade099f246913e7a06ab1ae0640b7e0c900ce3f8fcc8a3e0a9d6328466fa06
      • Instruction ID: 4c4b1d7f09994941c57eaafc4db68242d6a3f6c21ecd3f2b5b8f846a746055a2
      • Opcode Fuzzy Hash: fdade099f246913e7a06ab1ae0640b7e0c900ce3f8fcc8a3e0a9d6328466fa06
      • Instruction Fuzzy Hash: 40911434E002099BDB01EFA5D842BDEB7F5AF4874AF608466E90077392D7786E49CB58
      Function 00476FE4 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 200windowCOMMON
      Download Yara Rule
      APIs
      • GetClassInfoW.USER32(00000000,COMBOBOX,?), ref: 0047703D
      • SetWindowLongW.USER32(00000000,000000FC,00476F98), ref: 00477064
      • GetACP.KERNEL32(00000000,0047727C,?,00000000,004772A6), ref: 004770A1
      • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 004770E7
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ClassInfoLongMessageSendWindow
      • String ID: COMBOBOX$Inno Setup: Language
      • API String ID: 3391662889-4234151509
      • Opcode ID: 792a324ed7b622f9147234cb48189f9456c6b168bf74eb73557f96826f908a3d
      • Instruction ID: bd130a87903a889a3fd89afc2b0fe1c2965db49caec4f6fa4ce11e662dd4e942
      • Opcode Fuzzy Hash: 792a324ed7b622f9147234cb48189f9456c6b168bf74eb73557f96826f908a3d
      • Instruction Fuzzy Hash: 38811D34A042059FCB10DF69C885A9AB7F1FB09304F9580BBF818EB362D778AD41CB59
      Function 00408720 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON
      Download Yara Rule
      APIs
      • GetSystemDefaultLCID.KERNEL32(00000000,00408968,?,?,?,?,00000000,00000000,00000000,?,0040996F,00000000,00409982), ref: 0040873A
        • Part of subcall function 00408568: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049C4C0,00000001,?,00408633,?,00000000,00408712), ref: 00408586
        • Part of subcall function 004085B4: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,004087B6,?,?,?,00000000,00408968), ref: 004085C7
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: InfoLocale$DefaultSystem
      • String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
      • API String ID: 1044490935-665933166
      • Opcode ID: 192c3065348d067df08b1004c58281bebe04a3c301eaaaa353b7bc13eb4c98c7
      • Instruction ID: f98ab489913726d0c786ac72485cda7c249a24ea469f35a64f172a62ee223423
      • Opcode Fuzzy Hash: 192c3065348d067df08b1004c58281bebe04a3c301eaaaa353b7bc13eb4c98c7
      • Instruction Fuzzy Hash: 6E516F64B00108ABDB01FBA58D916AEB7A9DB94308F50D07FB041BB3C2CE3DDA05875D
      Function 004116F4 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158windowCOMMON
      Download Yara Rule
      APIs
      • GetVersion.KERNEL32(00000000,004118F9), ref: 0041178C
      • InsertMenuItemA.USER32(?,000000FF,00000001,0000002C), ref: 0041184A
        • Part of subcall function 00411AAC: CreatePopupMenu.USER32 ref: 00411AC6
      • InsertMenuA.USER32(?,000000FF,?,?,00000000), ref: 004118D6
        • Part of subcall function 00411AAC: CreateMenu.USER32 ref: 00411AD0
      • InsertMenuA.USER32(?,000000FF,?,00000000,00000000), ref: 004118BD
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Menu$Insert$Create$ItemPopupVersion
      • String ID: ,$?
      • API String ID: 2359071979-2308483597
      • Opcode ID: c0aa214a3dbd1df998103f0fa781b997bbdc0f30310c5116cc1a990c77879af7
      • Instruction ID: 70c43b14af81a53109b5f0ae1afe130dedb0e354e111122ad404179c6957f781
      • Opcode Fuzzy Hash: c0aa214a3dbd1df998103f0fa781b997bbdc0f30310c5116cc1a990c77879af7
      • Instruction Fuzzy Hash: 00512674A00244ABDB10EF6ADC816EA7BF9AF09304B11817BF904E73A6D73CD941CB58
      Function 0041BE63 Relevance: 10.7, APIs: 7, Instructions: 153windowCOMMON
      Download Yara Rule
      APIs
      • GetObjectA.GDI32(?,00000018,?), ref: 0041BF28
      • GetObjectA.GDI32(?,00000018,?), ref: 0041BF37
      • GetBitmapBits.GDI32(?,?,?), ref: 0041BF88
      • GetBitmapBits.GDI32(?,?,?), ref: 0041BF96
      • DeleteObject.GDI32(?), ref: 0041BF9F
      • DeleteObject.GDI32(?), ref: 0041BFA8
      • CreateIcon.USER32(00400000,?,?,?,?,?,?), ref: 0041BFC5
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Object$BitmapBitsDelete$CreateIcon
      • String ID:
      • API String ID: 1030595962-0
      • Opcode ID: 46aac32cfbebcf8150d575d8a1e8ed9b9c385cdc1cb9fa531b0b219a9faf1949
      • Instruction ID: 3143f4dd2d978d1f76384b00d7b793367abe982dfce487da2deedea9b663f500
      • Opcode Fuzzy Hash: 46aac32cfbebcf8150d575d8a1e8ed9b9c385cdc1cb9fa531b0b219a9faf1949
      • Instruction Fuzzy Hash: 6951F571A00219AFCB10DFA9C9819EEB7F9EF48314B11416AF914E7395D738AD81CB68
      Function 0041CED8 Relevance: 10.7, APIs: 7, Instructions: 152windowCOMMON
      Download Yara Rule
      APIs
      • SetStretchBltMode.GDI32(00000000,00000003), ref: 0041CEFE
      • GetDeviceCaps.GDI32(00000000,00000026), ref: 0041CF1D
      • SelectPalette.GDI32(?,?,00000001), ref: 0041CF83
      • RealizePalette.GDI32(?), ref: 0041CF92
      • StretchBlt.GDI32(00000000,?,?,?,?,?,00000000,00000000,00000000,?,?), ref: 0041CFFC
      • StretchDIBits.GDI32(?,?,?,?,?,00000000,00000000,00000000,?,?,?,00000000,?), ref: 0041D03A
      • SelectPalette.GDI32(?,?,00000001), ref: 0041D05F
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: PaletteStretch$Select$BitsCapsDeviceModeRealize
      • String ID:
      • API String ID: 2222416421-0
      • Opcode ID: 5be0e4e6833feb243a8d388dd1011de92277052336d3d318ec39d49e9b6efc72
      • Instruction ID: 4b814cf558339e083a7fb5ccd56fb4ffad9fd0a27a4bfdacf16c2dd2476febac
      • Opcode Fuzzy Hash: 5be0e4e6833feb243a8d388dd1011de92277052336d3d318ec39d49e9b6efc72
      • Instruction Fuzzy Hash: D2515EB0604200AFDB14DFA8C985F9BBBE9EF08304F10459AB549DB292C778ED81CB58
      Function 004572DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON
      Download Yara Rule
      APIs
      • SendMessageA.USER32(00000000,?,?), ref: 0045732E
        • Part of subcall function 0042427C: GetWindowTextA.USER32(?,?,00000100), ref: 0042429C
        • Part of subcall function 0041EEA4: GetCurrentThreadId.KERNEL32 ref: 0041EEF3
        • Part of subcall function 0041EEA4: EnumThreadWindows.USER32(00000000,0041EE54,00000000), ref: 0041EEF9
        • Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC
      • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00457395
      • TranslateMessage.USER32(?), ref: 004573B3
      • DispatchMessageA.USER32(?), ref: 004573BC
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Message$TextThreadWindow$CurrentDispatchEnumSendTranslateWindows
      • String ID: [Paused]
      • API String ID: 1007367021-4230553315
      • Opcode ID: 310ea5782384ce6805c1fb03ac5ab216e7e921b9f3239f258cdfa318487fbf48
      • Instruction ID: edfd94200f1223d9ec42e95931478697cc02f6c552246070e836a46f73d16df6
      • Opcode Fuzzy Hash: 310ea5782384ce6805c1fb03ac5ab216e7e921b9f3239f258cdfa318487fbf48
      • Instruction Fuzzy Hash: ED317531908244AADB11DB79EC81B9E7FB8EB4D314F5540B7ED00E7292D63C9909DB29
      Function 0046B478 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99sleepCOMMON
      Download Yara Rule
      APIs
      • GetCursor.USER32(00000000,0046B5B7), ref: 0046B534
      • LoadCursorA.USER32(00000000,00007F02), ref: 0046B542
      • SetCursor.USER32(00000000,00000000,00007F02,00000000,0046B5B7), ref: 0046B548
      • Sleep.KERNEL32(000002EE,00000000,00000000,00007F02,00000000,0046B5B7), ref: 0046B552
      • SetCursor.USER32(00000000,000002EE,00000000,00000000,00007F02,00000000,0046B5B7), ref: 0046B558
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Cursor$LoadSleep
      • String ID: CheckPassword
      • API String ID: 4023313301-1302249611
      • Opcode ID: f9232d32fe8750cf1aa7f1ce8e5c4c48254f6a50c6f475b413fdfe92d04fe973
      • Instruction ID: 52475523c8855b0971816624e6821ed1736627c30ccdf395b7cccd8d108c94b7
      • Opcode Fuzzy Hash: f9232d32fe8750cf1aa7f1ce8e5c4c48254f6a50c6f475b413fdfe92d04fe973
      • Instruction Fuzzy Hash: DC316334640204AFD711EB69C889FDA7BE0EF45308F5580B6B804DB392D778AE80CB99
      Function 00478000 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 92windowCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 00477F28: GetWindowThreadProcessId.USER32(00000000), ref: 00477F30
        • Part of subcall function 00477F28: GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,00478027,0049D0A8,00000000), ref: 00477F43
        • Part of subcall function 00477F28: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00477F49
      • SendMessageA.USER32(00000000,0000004A,00000000,004783BA), ref: 00478035
      • GetTickCount.KERNEL32 ref: 0047807A
      • GetTickCount.KERNEL32 ref: 00478084
      • MsgWaitForMultipleObjects.USER32(00000000,00000000,00000000,0000000A,000000FF), ref: 004780D9
      Strings
      • CallSpawnServer: Unexpected response: $%x, xrefs: 0047806A
      • CallSpawnServer: Unexpected status: %d, xrefs: 004780C2
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CountTick$AddressHandleMessageModuleMultipleObjectsProcProcessSendThreadWaitWindow
      • String ID: CallSpawnServer: Unexpected response: $%x$CallSpawnServer: Unexpected status: %d
      • API String ID: 613034392-3771334282
      • Opcode ID: e795a715ebc2210226078f00cca7059390596775f56cb21ae37f00e80c6c78cb
      • Instruction ID: 0164f356c35a16adb57d8a62159ffb0f412001f8ab662b64042fc9ea57691742
      • Opcode Fuzzy Hash: e795a715ebc2210226078f00cca7059390596775f56cb21ae37f00e80c6c78cb
      • Instruction Fuzzy Hash: 1831C234F402559ADF10EBB9C9467EEB6A0AF04314F50807AF548EB382DA7C8D05879D
      Function 00459784 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 86libraryloaderCOMMON
      Download Yara Rule
      APIs
      • GetProcAddress.KERNEL32(626D6573,CreateAssemblyCache), ref: 0045983F
      Strings
      • Fusion.dll, xrefs: 004597DF
      • .NET Framework CreateAssemblyCache function failed, xrefs: 00459862
      • Failed to load .NET Framework DLL "%s", xrefs: 00459824
      • Failed to get address of .NET Framework CreateAssemblyCache function, xrefs: 0045984A
      • CreateAssemblyCache, xrefs: 00459836
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressProc
      • String ID: .NET Framework CreateAssemblyCache function failed$CreateAssemblyCache$Failed to get address of .NET Framework CreateAssemblyCache function$Failed to load .NET Framework DLL "%s"$Fusion.dll
      • API String ID: 190572456-3990135632
      • Opcode ID: 79fe707f02e33d1c2961f48ff62acb64304cdcd84adde0050bb8772b9a6698dc
      • Instruction ID: 9a538673283cb431493768ab67eac729fe35d93f11f945e2dcd414e2b3f175b6
      • Opcode Fuzzy Hash: 79fe707f02e33d1c2961f48ff62acb64304cdcd84adde0050bb8772b9a6698dc
      • Instruction Fuzzy Hash: A2318B70E10649ABCB10FFA5C88169EB7B8EF45315F50857BE814E7382DB389E08C799
      Function 0041C148 Relevance: 10.6, APIs: 7, Instructions: 70windowCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0041C048: GetObjectA.GDI32(?,00000018), ref: 0041C055
      • GetFocus.USER32 ref: 0041C168
      • GetDC.USER32(?), ref: 0041C174
      • SelectPalette.GDI32(?,?,00000000), ref: 0041C195
      • RealizePalette.GDI32(?), ref: 0041C1A1
      • GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 0041C1B8
      • SelectPalette.GDI32(?,00000000,00000000), ref: 0041C1E0
      • ReleaseDC.USER32(?,?), ref: 0041C1ED
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Palette$Select$BitsFocusObjectRealizeRelease
      • String ID:
      • API String ID: 3303097818-0
      • Opcode ID: 26117fda3ddcda01a6cc84f42a4f6ec069d0e010bd6cdd98afb854c6c7779a8d
      • Instruction ID: 25a0b6576c779426e59073023ceed4ef49f3845c1b310514cd4f08ef327de147
      • Opcode Fuzzy Hash: 26117fda3ddcda01a6cc84f42a4f6ec069d0e010bd6cdd98afb854c6c7779a8d
      • Instruction Fuzzy Hash: 49116D71A44604BFDF10DBE9CC81FAFB7FCEB48700F50486AB518E7281DA7899008B28
      Function 00418C54 Relevance: 10.6, APIs: 7, Instructions: 67COMMON
      Download Yara Rule
      APIs
      • GetSystemMetrics.USER32(0000000E), ref: 00418C70
      • GetSystemMetrics.USER32(0000000D), ref: 00418C78
      • 6F552980.COMCTL32(00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418C7E
        • Part of subcall function 004107F8: 6F54C400.COMCTL32(0049C628,000000FF,00000000,00418CAC,00000000,00418D08,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 004107FC
      • 6F5BCB00.COMCTL32(0049C628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418CCE
      • 6F5BC740.COMCTL32(00000000,?,0049C628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001), ref: 00418CD9
      • 6F5BCB00.COMCTL32(0049C628,00000001,?,?,00000000,?,0049C628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000), ref: 00418CEC
      • 6F550860.COMCTL32(0049C628,00418D0F,?,00000000,?,0049C628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000,0000000E), ref: 00418D02
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: MetricsSystem$C400C740F550860F552980
      • String ID:
      • API String ID: 1828538299-0
      • Opcode ID: b0bc427a64d40e2cdb4ba1a9dac6b0f96cc2bfc42510db51987cf4ced86dbdff
      • Instruction ID: e7ebbfb341522daaf16a193f07e8787bb45d642da6b7ae2fd3fde5be7fc5e4a9
      • Opcode Fuzzy Hash: b0bc427a64d40e2cdb4ba1a9dac6b0f96cc2bfc42510db51987cf4ced86dbdff
      • Instruction Fuzzy Hash: 3F112475744204BBDB50EBA9DC82F9D73F8DB08704F504066B514EB2C1DAB9AD808758
      Function 00484048 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61registryCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00483FBF,?,00000001,?,?,00483FBF,?,00000001,00000000), ref: 0042DE38
      • RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,00484100), ref: 004840E5
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CloseOpen
      • String ID: LanmanNT$ProductType$ServerNT$System\CurrentControlSet\Control\ProductOptions$WinNT
      • API String ID: 47109696-2530820420
      • Opcode ID: b39bfe74539bbe5a20bf0c2c434715a31f43c7a60d08a07575989125a6c3a451
      • Instruction ID: 4d4b33c6353c265131fe463574db4bb43001997333066e3575d57f2dcf89af6c
      • Opcode Fuzzy Hash: b39bfe74539bbe5a20bf0c2c434715a31f43c7a60d08a07575989125a6c3a451
      • Instruction Fuzzy Hash: C1119330A042459ADB00F765DC5975F7BA8DBE6704F218877A900EB682E739DE91C72C
      Function 0041B462 Relevance: 10.6, APIs: 7, Instructions: 57windowCOMMON
      Download Yara Rule
      APIs
      • SelectObject.GDI32(00000000,?), ref: 0041B470
      • SelectObject.GDI32(?,00000000), ref: 0041B47F
      • StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B4AB
      • SelectObject.GDI32(00000000,00000000), ref: 0041B4B9
      • SelectObject.GDI32(?,00000000), ref: 0041B4C7
      • DeleteDC.GDI32(00000000), ref: 0041B4D0
      • DeleteDC.GDI32(?), ref: 0041B4D9
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ObjectSelect$Delete$Stretch
      • String ID:
      • API String ID: 1458357782-0
      • Opcode ID: 8542cbb8adbe0fd8af4a730cfe3faeef428ae57c020086fb9cb954466ea4b08d
      • Instruction ID: 052e9154069abc57648b404522aaf552eddfcc6d95cd3388d63b7ef9ce004286
      • Opcode Fuzzy Hash: 8542cbb8adbe0fd8af4a730cfe3faeef428ae57c020086fb9cb954466ea4b08d
      • Instruction Fuzzy Hash: 7B115C72E40619ABDB10DAD9DC86FEFB7BCEF08704F144555B614F7282C678AC418BA8
      Function 00495A48 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57COMMON
      Download Yara Rule
      APIs
      • GetDC.USER32(00000000), ref: 00495A59
        • Part of subcall function 0041A1E8: CreateFontIndirectA.GDI32(?), ref: 0041A2A7
      • SelectObject.GDI32(00000000,00000000), ref: 00495A7B
      • GetTextExtentPointA.GDI32(00000000,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,00495FF9), ref: 00495A8F
      • GetTextMetricsA.GDI32(00000000,?), ref: 00495AB1
      • ReleaseDC.USER32(00000000,00000000), ref: 00495ACE
      Strings
      • ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz, xrefs: 00495A86
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Text$CreateExtentFontIndirectMetricsObjectPointReleaseSelect
      • String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
      • API String ID: 2948443157-222967699
      • Opcode ID: 316de07bddff98118a0c71dd7b0b835aab520f1145cc0c49afa7d6e5291fcc8b
      • Instruction ID: c3cee262f510061f99dda7aa9a20ba0f6124b10bede894f20eac2018434fd412
      • Opcode Fuzzy Hash: 316de07bddff98118a0c71dd7b0b835aab520f1145cc0c49afa7d6e5291fcc8b
      • Instruction Fuzzy Hash: 93014875604708BFDB05DBA5CC81E5FB7ECDB48704F614576F604E7291D6789E008B58
      Function 00423394 Relevance: 10.6, APIs: 7, Instructions: 56threadwindowCOMMON
      Download Yara Rule
      APIs
      • GetCursorPos.USER32 ref: 004233AF
      • WindowFromPoint.USER32(?,?), ref: 004233BC
      • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 004233CA
      • GetCurrentThreadId.KERNEL32 ref: 004233D1
      • SendMessageA.USER32(00000000,00000084,?,?), ref: 004233EA
      • SendMessageA.USER32(00000000,00000020,00000000,00000000), ref: 00423401
      • SetCursor.USER32(00000000), ref: 00423413
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CursorMessageSendThreadWindow$CurrentFromPointProcess
      • String ID:
      • API String ID: 1770779139-0
      • Opcode ID: 134875e674979cd567c136abb418dc525a6250aa5b529fa10794d0eebf3240cc
      • Instruction ID: 22bb490dc700fc35bbf8fe9eba0271ced42fa0644d0760cf779c582944844a3d
      • Opcode Fuzzy Hash: 134875e674979cd567c136abb418dc525a6250aa5b529fa10794d0eebf3240cc
      • Instruction Fuzzy Hash: BA01D4223046103AD6217B755D82E2F26E8DB85B15F50407FF504BB283DA3D9D11937D
      Function 0049586C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47libraryloaderCOMMON
      Download Yara Rule
      APIs
      • GetModuleHandleA.KERNEL32(user32.dll), ref: 0049587C
      • GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 00495889
      • GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 00495896
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressProc$HandleModule
      • String ID: GetMonitorInfoA$MonitorFromRect$user32.dll
      • API String ID: 667068680-2254406584
      • Opcode ID: bc5d85cad421cfd666303808505a6fcca2eea280aa1f9c47ee5c8e86b84fbab4
      • Instruction ID: c2800f387dbf5c449328e37c173a5aabc67a289cf085d7c0fa86ddcdc9610187
      • Opcode Fuzzy Hash: bc5d85cad421cfd666303808505a6fcca2eea280aa1f9c47ee5c8e86b84fbab4
      • Instruction Fuzzy Hash: 6AF0CD92A41F1526DA12B1664C42B7F6ACCCB95761F240037BE04A6282E9AC8C254BED
      Function 0045D188 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 34libraryloaderCOMMON
      Download Yara Rule
      APIs
      • GetProcAddress.KERNEL32(00000000,ISCryptGetVersion), ref: 0045D191
      • GetProcAddress.KERNEL32(00000000,ArcFourInit), ref: 0045D1A1
      • GetProcAddress.KERNEL32(00000000,ArcFourCrypt), ref: 0045D1B1
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressProc
      • String ID: ArcFourCrypt$ArcFourInit$ISCryptGetVersion
      • API String ID: 190572456-508647305
      • Opcode ID: 43c308cf23e86c7c68af6160549feadfa6e7ef3e1edc1213ff0607e099070cf5
      • Instruction ID: 760cd2a864a9e1796cc6a8c16a9b6e4b518228a672e7f6b7c74141ea69608c8f
      • Opcode Fuzzy Hash: 43c308cf23e86c7c68af6160549feadfa6e7ef3e1edc1213ff0607e099070cf5
      • Instruction Fuzzy Hash: 69F030F0D01700CAD314EF76AD457263B96EB9830EF14C03BA414CA1A2D7794456DF1C
      Function 0045D688 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 33libraryloaderCOMMON
      Download Yara Rule
      APIs
      • GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressInit), ref: 0045D691
      • GetProcAddress.KERNEL32(00000000,BZ2_bzDecompress), ref: 0045D6A1
      • GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressEnd), ref: 0045D6B1
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressProc
      • String ID: BZ2_bzDecompress$BZ2_bzDecompressEnd$BZ2_bzDecompressInit
      • API String ID: 190572456-212574377
      • Opcode ID: ff3b3472e75bf541ca23cd004b5952c455680e4b3d04889bd37c414c9a7dced9
      • Instruction ID: 28c0a2368456a3a58bd76b95839cc9862ceb14e5247f60e44f7901e6159fbc10
      • Opcode Fuzzy Hash: ff3b3472e75bf541ca23cd004b5952c455680e4b3d04889bd37c414c9a7dced9
      • Instruction Fuzzy Hash: 56F0BDB0D00705DED724EF36AC9672736D5AB6831EF14843B990D9526AD778045BCF2C
      Function 0042EA1C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 30libraryloaderwindowCOMMON
      Download Yara Rule
      APIs
      • GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilterEx,00000004,0049A934,004571F1,00457594,00457148,00000000,00000B06,00000000,00000000,00000001,00000000,00000002,00000000,004816A4), ref: 0042EA35
      • GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EA3B
      • InterlockedExchange.KERNEL32(0049C668,00000001), ref: 0042EA4C
        • Part of subcall function 0042E9AC: GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042EA70,00000004,0049A934,004571F1,00457594,00457148,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042E9C2
        • Part of subcall function 0042E9AC: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E9C8
        • Part of subcall function 0042E9AC: InterlockedExchange.KERNEL32(0049C660,00000001), ref: 0042E9D9
      • ChangeWindowMessageFilterEx.USER32(00000000,?,00000001,00000000,00000004,0049A934,004571F1,00457594,00457148,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042EA60
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressExchangeHandleInterlockedModuleProc$ChangeFilterMessageWindow
      • String ID: ChangeWindowMessageFilterEx$user32.dll
      • API String ID: 142928637-2676053874
      • Opcode ID: 4f6d81ffa70e1dfa219394794dfa4c4920c45a597ffed152464e23b4e9c135f6
      • Instruction ID: 868e598f1dfdb19ab3f6af13543706ee41780d41e05dd8d4067fd60d38f2d441
      • Opcode Fuzzy Hash: 4f6d81ffa70e1dfa219394794dfa4c4920c45a597ffed152464e23b4e9c135f6
      • Instruction Fuzzy Hash: E2E092A1741B20BAEA10B7B67CC6FAA2658EB14B6DF501037F100A51D1C2BD0C80CF5D
      Function 0044C7DC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 28libraryloaderCOMMON
      Download Yara Rule
      APIs
      • LoadLibraryA.KERNEL32(oleacc.dll,?,0044F089), ref: 0044C7EB
      • GetProcAddress.KERNEL32(00000000,LresultFromObject), ref: 0044C7FC
      • GetProcAddress.KERNEL32(00000000,CreateStdAccessibleObject), ref: 0044C80C
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressProc$LibraryLoad
      • String ID: CreateStdAccessibleObject$LresultFromObject$oleacc.dll
      • API String ID: 2238633743-1050967733
      • Opcode ID: 4d087ee6ce3b94ab326fb7762e122d3d22abd7848642861eea9ac3f89c9c3772
      • Instruction ID: f6c43001a98f23dcf5993b44d1547f2cd2c1eb373bb7d181d1ef9ee7095f500e
      • Opcode Fuzzy Hash: 4d087ee6ce3b94ab326fb7762e122d3d22abd7848642861eea9ac3f89c9c3772
      • Instruction Fuzzy Hash: 50F0F8B02C230A8AF750BBB5ECD57263694E37570AF18267BA001552A2CBBD4884CF5C
      Function 00478FB4 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 14libraryloaderCOMMON
      Download Yara Rule
      APIs
      • GetModuleHandleA.KERNEL32(kernel32.dll,?,00499164), ref: 00478FBA
      • GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 00478FC7
      • GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 00478FD7
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressProc$HandleModule
      • String ID: VerSetConditionMask$VerifyVersionInfoW$kernel32.dll
      • API String ID: 667068680-222143506
      • Opcode ID: 95c4b76a0c8dcd2084581fa4153e0367cda4b116a215065e47933a859f5191f6
      • Instruction ID: e72cf036c242c5ab711552664871c72727fed367e5d11c95c6dfe9b968b9431a
      • Opcode Fuzzy Hash: 95c4b76a0c8dcd2084581fa4153e0367cda4b116a215065e47933a859f5191f6
      • Instruction Fuzzy Hash: BDC012F0680B01ADD600B7721C87D7A254CD52072C320843FB45D65183D97D0C104F3C
      Function 0041B66C Relevance: 9.1, APIs: 6, Instructions: 144windowCOMMON
      Download Yara Rule
      APIs
      • GetFocus.USER32 ref: 0041B745
      • GetDC.USER32(?), ref: 0041B751
      • SelectPalette.GDI32(00000000,?,00000000), ref: 0041B786
      • RealizePalette.GDI32(00000000), ref: 0041B792
      • CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041B7C0
      • SelectPalette.GDI32(00000000,00000000,00000000), ref: 0041B7F4
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Palette$Select$BitmapCreateFocusRealize
      • String ID:
      • API String ID: 3275473261-0
      • Opcode ID: 9b17a45ebd00e155e5aeae17ac6cac102e8e00fd56b9a0d3692e3d2bf0971335
      • Instruction ID: 38bdddf8d72f5571b31e8017bfcff87152bbfcb95d4f6cd7f9962c0a723fddb9
      • Opcode Fuzzy Hash: 9b17a45ebd00e155e5aeae17ac6cac102e8e00fd56b9a0d3692e3d2bf0971335
      • Instruction Fuzzy Hash: 8A512F70A002099FDF11DFA9C881AEEBBF9FF49704F104066F504A7791D7799981CBA9
      Function 0041B93C Relevance: 9.1, APIs: 6, Instructions: 142windowCOMMON
      Download Yara Rule
      APIs
      • GetFocus.USER32 ref: 0041BA17
      • GetDC.USER32(?), ref: 0041BA23
      • SelectPalette.GDI32(00000000,?,00000000), ref: 0041BA5D
      • RealizePalette.GDI32(00000000), ref: 0041BA69
      • CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041BA8D
      • SelectPalette.GDI32(00000000,00000000,00000000), ref: 0041BAC1
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Palette$Select$BitmapCreateFocusRealize
      • String ID:
      • API String ID: 3275473261-0
      • Opcode ID: f1b656a7ede54f8d65f93cc35dc493626dae048aef23b352968a277fb398f08e
      • Instruction ID: 3fcaffe560058c7771eaec6053d79e0e1924f360d52694d27862de55114c0f48
      • Opcode Fuzzy Hash: f1b656a7ede54f8d65f93cc35dc493626dae048aef23b352968a277fb398f08e
      • Instruction Fuzzy Hash: 9D512A74A002189FDB11DFA9C891AAEBBF9FF49700F154066F904EB751D738AD40CBA4
      Function 0041B508 Relevance: 9.1, APIs: 6, Instructions: 113windowCOMMON
      Download Yara Rule
      APIs
      • GetFocus.USER32 ref: 0041B57E
      • GetDC.USER32(?), ref: 0041B58A
      • GetDeviceCaps.GDI32(?,00000068), ref: 0041B5A6
      • GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 0041B5C3
      • GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 0041B5DA
      • ReleaseDC.USER32(?,?), ref: 0041B626
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: EntriesPaletteSystem$CapsDeviceFocusRelease
      • String ID:
      • API String ID: 2502006586-0
      • Opcode ID: e956e6ae92597662ed98b2f51c6b506043ab8b509e5ceb21f610fa5f8f95298e
      • Instruction ID: 1753bd22f5710d4f749a3cf2d8329d0f84e6490acb09e3fae29671003709e3a5
      • Opcode Fuzzy Hash: e956e6ae92597662ed98b2f51c6b506043ab8b509e5ceb21f610fa5f8f95298e
      • Instruction Fuzzy Hash: D0410631A04258AFDF10DFA9C885AAFBBB4EF59704F1484AAF500EB351D3389D51CBA5
      Function 0045D04C Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 73COMMON
      Download Yara Rule
      APIs
      • SetLastError.KERNEL32(00000057,00000000,0045D118,?,?,?,?,00000000), ref: 0045D0B7
      • SetLastError.KERNEL32(00000000,00000002,?,?,?,0045D184,?,00000000,0045D118,?,?,?,?,00000000), ref: 0045D0F6
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ErrorLast
      • String ID: CLASSES_ROOT$CURRENT_USER$MACHINE$USERS
      • API String ID: 1452528299-1580325520
      • Opcode ID: 44daac30ba6290961f85a10f910adeebe56024b8db7d764ffa7b36a0de599fb3
      • Instruction ID: 81e1e27ad3ae8d1ea1d6b81b4c13ff0be47bc54c17845d393ef4ad8e2f10c1e8
      • Opcode Fuzzy Hash: 44daac30ba6290961f85a10f910adeebe56024b8db7d764ffa7b36a0de599fb3
      • Instruction Fuzzy Hash: 2C117535A04608AFD731DA91C942B9EB6ADDF4470AF6040776D00572C3D67C5F0B992E
      Function 0041BD8C Relevance: 9.1, APIs: 6, Instructions: 71COMMON
      Download Yara Rule
      APIs
      • GetSystemMetrics.USER32(0000000B), ref: 0041BDD5
      • GetSystemMetrics.USER32(0000000C), ref: 0041BDDF
      • GetDC.USER32(00000000), ref: 0041BDE9
      • GetDeviceCaps.GDI32(00000000,0000000E), ref: 0041BE10
      • GetDeviceCaps.GDI32(00000000,0000000C), ref: 0041BE1D
      • ReleaseDC.USER32(00000000,00000000), ref: 0041BE56
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CapsDeviceMetricsSystem$Release
      • String ID:
      • API String ID: 447804332-0
      • Opcode ID: 3bdc6123dd6674b0137b7fef1a93c0b96d54f33e4692062cf67464f69f8f60e7
      • Instruction ID: d5b995c8e3894394b735eabd433659eae54025482fea58e306a85006fdca5b97
      • Opcode Fuzzy Hash: 3bdc6123dd6674b0137b7fef1a93c0b96d54f33e4692062cf67464f69f8f60e7
      • Instruction Fuzzy Hash: E5212A74E04648AFEB00EFA9C941BEEB7B4EB48714F10846AF514B7690D7785940CB69
      Function 0047EB34 Relevance: 9.1, APIs: 6, Instructions: 57COMMON
      Download Yara Rule
      APIs
      • GetWindowLongA.USER32(?,000000EC), ref: 0047EB42
      • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC,?,0046CDA1), ref: 0047EB68
      • GetWindowLongA.USER32(?,000000EC), ref: 0047EB78
      • SetWindowLongA.USER32(?,000000EC,00000000), ref: 0047EB99
      • ShowWindow.USER32(?,00000005,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC), ref: 0047EBAD
      • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000057,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000), ref: 0047EBC9
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Window$Long$Show
      • String ID:
      • API String ID: 3609083571-0
      • Opcode ID: 45ec1cf8c65fa1a1d4c9e25a20d0fe29d262eedc4c1703c24f1e77e0302aa631
      • Instruction ID: 558760181b7e7de2d8b346cb17cfb8003feda8981b89fed89de8fe354906c256
      • Opcode Fuzzy Hash: 45ec1cf8c65fa1a1d4c9e25a20d0fe29d262eedc4c1703c24f1e77e0302aa631
      • Instruction Fuzzy Hash: 780112B6645210ABD700D7A9CD81F6637D8AB1C334F0943A6B955DF3E3C638E8409B08
      Function 0041B270 Relevance: 9.0, APIs: 6, Instructions: 43COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0041A6E0: CreateBrushIndirect.GDI32 ref: 0041A74B
      • UnrealizeObject.GDI32(00000000), ref: 0041B27C
      • SelectObject.GDI32(?,00000000), ref: 0041B28E
      • SetBkColor.GDI32(?,00000000), ref: 0041B2B1
      • SetBkMode.GDI32(?,00000002), ref: 0041B2BC
      • SetBkColor.GDI32(?,00000000), ref: 0041B2D7
      • SetBkMode.GDI32(?,00000001), ref: 0041B2E2
        • Part of subcall function 0041A058: GetSysColor.USER32(?), ref: 0041A062
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Color$ModeObject$BrushCreateIndirectSelectUnrealize
      • String ID:
      • API String ID: 3527656728-0
      • Opcode ID: 90af7722afa79acc590a6ee3060039fb524340e2cf7ce152cccbdcb584e8dbde
      • Instruction ID: d03b18a2b949c207061bd18b8e5d47ed8ce294e6be165222704fda36eef26a4f
      • Opcode Fuzzy Hash: 90af7722afa79acc590a6ee3060039fb524340e2cf7ce152cccbdcb584e8dbde
      • Instruction Fuzzy Hash: 56F0CD756015009BDE00FFAAD9CBE4B3B989F043097048496B908DF187CA3CD8649B3A
      Function 004538BC Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 100fileCOMMON
      Download Yara Rule
      APIs
      • CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,asI,_iu,?,00000000,004539F6), ref: 004539AB
      • CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,asI,_iu,?,00000000,004539F6), ref: 004539BB
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CloseCreateFileHandle
      • String ID: .tmp$_iu$asI
      • API String ID: 3498533004-3416993101
      • Opcode ID: 1dee75e2bfc2da78c26475f080e8b0a4db6a1a73d39b0bf1d20dabbe4352c150
      • Instruction ID: 7da7e9bbb2667b7856572ae533a3071efe8e017fb0344d9459fa270775feb22d
      • Opcode Fuzzy Hash: 1dee75e2bfc2da78c26475f080e8b0a4db6a1a73d39b0bf1d20dabbe4352c150
      • Instruction Fuzzy Hash: 1831C5B0A00249ABCB11EF95D842B9EBBB4AF44345F20453AF810B73C2D7785F058B69
      Function 0049829C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 97COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC
      • ShowWindow.USER32(?,00000005,00000000,00498501,?,?,00000000), ref: 004982D2
        • Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7
        • Part of subcall function 004072A8: SetCurrentDirectoryA.KERNEL32(00000000,?,004982FA,00000000,004984CD,?,?,00000005,00000000,00498501,?,?,00000000), ref: 004072B3
        • Part of subcall function 0042D44C: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D4DA,?,?,?,00000001,?,0045607E,00000000,004560E6), ref: 0042D481
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: DirectoryWindow$CurrentFileModuleNameShowSystemText
      • String ID: .dat$.msg$IMsg$Uninstall
      • API String ID: 3312786188-1660910688
      • Opcode ID: b40716ae20ef38e55cf5fb00421125a37882471468cc83c968af959bd4861768
      • Instruction ID: 2b9c2c46f3884c4a48dc033c97e5b42376d3325146b4dc4ed866e5651845f74c
      • Opcode Fuzzy Hash: b40716ae20ef38e55cf5fb00421125a37882471468cc83c968af959bd4861768
      • Instruction Fuzzy Hash: 1C315234A00114AFCB11EF69DC92D6EBB75FB89718F91847AF800A7352DB39AD05CB58
      Function 0042EAA8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49libraryloaderCOMMON
      Download Yara Rule
      APIs
      • GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonCreate), ref: 0042EADA
      • GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EAE0
      • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,user32.dll,ShutdownBlockReasonCreate), ref: 0042EB09
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressByteCharHandleModuleMultiProcWide
      • String ID: ShutdownBlockReasonCreate$user32.dll
      • API String ID: 828529508-2866557904
      • Opcode ID: eb577c3347fbf9fd6a249885fcfc34f4074b2fa1c1d8d6afc25abb851ecf655c
      • Instruction ID: 7e091cf0cf0c4dae12ae48626bdfb721f4796128e550bb25d34418d77cfbcdd5
      • Opcode Fuzzy Hash: eb577c3347fbf9fd6a249885fcfc34f4074b2fa1c1d8d6afc25abb851ecf655c
      • Instruction Fuzzy Hash: 70F0C8D034061136E620B57F5C82F7B598C8F94759F140436B109E62C2D96CA905426E
      Function 00457FF8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON
      Download Yara Rule
      APIs
      • MsgWaitForMultipleObjects.USER32(00000001,00000001,00000000,000000FF,000000FF), ref: 00458028
      • GetExitCodeProcess.KERNEL32(?,?), ref: 00458049
      • CloseHandle.KERNEL32(?,0045807C), ref: 0045806F
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CloseCodeExitHandleMultipleObjectsProcessWait
      • String ID: GetExitCodeProcess$MsgWaitForMultipleObjects
      • API String ID: 2573145106-3235461205
      • Opcode ID: 0bf7457be4cd743180d0df9cbaebe39186a44c2eb61f5ac505f25413929649f5
      • Instruction ID: 8ca2d0058ba7cbb50b4a329ddd8c934ddf4c064d08651955299a62d5c280044d
      • Opcode Fuzzy Hash: 0bf7457be4cd743180d0df9cbaebe39186a44c2eb61f5ac505f25413929649f5
      • Instruction Fuzzy Hash: F301A231600204AFD710EBA98C42A5A73A8EB49B25F51407BFC10E73D3DE399E08961D
      Function 0042E9AC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON
      Download Yara Rule
      APIs
      • GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042EA70,00000004,0049A934,004571F1,00457594,00457148,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042E9C2
      • GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E9C8
      • InterlockedExchange.KERNEL32(0049C660,00000001), ref: 0042E9D9
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressExchangeHandleInterlockedModuleProc
      • String ID: ChangeWindowMessageFilter$user32.dll
      • API String ID: 3478007392-2498399450
      • Opcode ID: c36f8f94805b7d902051433b35875e22838e6d9aa50e17b7a9d16ab54da6b357
      • Instruction ID: b8f9bf3d9be2f8c1d209f28124344a0c8d199a24e32242aaf2824e6907578135
      • Opcode Fuzzy Hash: c36f8f94805b7d902051433b35875e22838e6d9aa50e17b7a9d16ab54da6b357
      • Instruction Fuzzy Hash: 59E0ECB2740324AADA107B626ECAF663558A724B19F902437F001751E1C6FD0C80CA2D
      Function 00477F28 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderthreadCOMMON
      Download Yara Rule
      APIs
      • GetWindowThreadProcessId.USER32(00000000), ref: 00477F30
      • GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,00478027,0049D0A8,00000000), ref: 00477F43
      • GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00477F49
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressHandleModuleProcProcessThreadWindow
      • String ID: AllowSetForegroundWindow$user32.dll
      • API String ID: 1782028327-3855017861
      • Opcode ID: afc54861c8e7a9e311f6dec3000d7eb502ec530a4813a9c9c4fe9e845c6217e4
      • Instruction ID: bb94c84c7b6da0bace4c8c5367c9ec9106dc9a44addef0b25af840ec1b7a485c
      • Opcode Fuzzy Hash: afc54861c8e7a9e311f6dec3000d7eb502ec530a4813a9c9c4fe9e845c6217e4
      • Instruction Fuzzy Hash: 21D09E9064870169D91077B58E46E9F225C8984718790843BF55CF21C6DA7CDC058A7D
      Function 00416C2C Relevance: 7.6, APIs: 5, Instructions: 104COMMON
      Download Yara Rule
      APIs
      • BeginPaint.USER32(00000000,?), ref: 00416C52
      • SaveDC.GDI32(?), ref: 00416C83
      • ExcludeClipRect.GDI32(?,?,?,?,?,?,00000000,00416D45), ref: 00416CE4
      • RestoreDC.GDI32(?,?), ref: 00416D0B
      • EndPaint.USER32(00000000,?,00416D4C,00000000,00416D45), ref: 00416D3F
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Paint$BeginClipExcludeRectRestoreSave
      • String ID:
      • API String ID: 3808407030-0
      • Opcode ID: ad781fe6fb59047a66b80eb53a3f65b2019eba16d1c733f202b60e39d660354f
      • Instruction ID: 8164e3b37c2b38cc39b91ef4074089abf19b8963c3e0e5cbd12a4ce3d65b1abe
      • Opcode Fuzzy Hash: ad781fe6fb59047a66b80eb53a3f65b2019eba16d1c733f202b60e39d660354f
      • Instruction Fuzzy Hash: A1415070A002049FCB14DBA9C585FAA77F9FF48304F1540AEE8459B362D778DD81CB58
      Function 00414800 Relevance: 7.6, APIs: 5, Instructions: 102COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: b6913cb722474124f75cff2ee5949f067bbdde1b56a592e148b6496e85af3d5a
      • Instruction ID: a833d86c80f2fb81cba799e3b93fc1891ddf3ebdd98a67124a25423b7ab76754
      • Opcode Fuzzy Hash: b6913cb722474124f75cff2ee5949f067bbdde1b56a592e148b6496e85af3d5a
      • Instruction Fuzzy Hash: 563132746057809FC320EF69C984B9BB7E8AF89354F04491EF9D5C3752C638E8818F19
      Function 004297CC Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
      Download Yara Rule
      APIs
      • SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429808
      • SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429837
      • SendMessageA.USER32(00000000,000000C1,00000000,00000000), ref: 00429853
      • SendMessageA.USER32(00000000,000000B1,00000000,00000000), ref: 0042987E
      • SendMessageA.USER32(00000000,000000C2,00000000,00000000), ref: 0042989C
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: MessageSend
      • String ID:
      • API String ID: 3850602802-0
      • Opcode ID: 399f588db94bb8b810bf5b46e1237ea7bfd7cbebe0e15a3dbf36720fb68daebb
      • Instruction ID: 8b65b0e689063cc909dba6714575951256d1ad54ff8cece17fd29570ea6901c2
      • Opcode Fuzzy Hash: 399f588db94bb8b810bf5b46e1237ea7bfd7cbebe0e15a3dbf36720fb68daebb
      • Instruction Fuzzy Hash: 6E219D707107057BEB10AB62DC82F5B7AECAB41708F54443EB501AB2D2DFB8AE418228
      Function 0041BBB8 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
      Download Yara Rule
      APIs
      • GetSystemMetrics.USER32(0000000B), ref: 0041BBCA
      • GetSystemMetrics.USER32(0000000C), ref: 0041BBD4
      • GetDC.USER32(00000000), ref: 0041BC12
      • CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041BC59
      • DeleteObject.GDI32(00000000), ref: 0041BC9A
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: MetricsSystem$BitmapCreateDeleteObject
      • String ID:
      • API String ID: 1095203571-0
      • Opcode ID: d6ecec59309c4539c21f746b1d4641e0a999657a412e1d938322a226e3514674
      • Instruction ID: 2a907a32995036c4e239f44386a828d3a2f1e7d44945ead90e55d18394f4d4ff
      • Opcode Fuzzy Hash: d6ecec59309c4539c21f746b1d4641e0a999657a412e1d938322a226e3514674
      • Instruction Fuzzy Hash: 5D315C70E00208EFDB04DFA5C941AAEB7F5EB48700F2084AAF514AB781D7789E40DB98
      Function 0047396C Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 71COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0045D04C: SetLastError.KERNEL32(00000057,00000000,0045D118,?,?,?,?,00000000), ref: 0045D0B7
      • GetLastError.KERNEL32(00000000,00000000,00000000,00473A40,?,?,0049D1E0,00000000), ref: 004739F9
      • GetLastError.KERNEL32(00000000,00000000,00000000,00473A40,?,?,0049D1E0,00000000), ref: 00473A0F
      Strings
      • Failed to set permissions on registry key (%d)., xrefs: 00473A20
      • Could not set permissions on the registry key because it currently does not exist., xrefs: 00473A03
      • Setting permissions on registry key: %s\%s, xrefs: 004739BE
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ErrorLast
      • String ID: Could not set permissions on the registry key because it currently does not exist.$Failed to set permissions on registry key (%d).$Setting permissions on registry key: %s\%s
      • API String ID: 1452528299-4018462623
      • Opcode ID: 9a94751b9ceec0cea8b53b55177164b16b416a6e1b82bbbcb04e7a33a0ca06f9
      • Instruction ID: 0a2381b1912759d686c5a064c86faa76dce3aa6e719ea4785adaf7dc2ecde98c
      • Opcode Fuzzy Hash: 9a94751b9ceec0cea8b53b55177164b16b416a6e1b82bbbcb04e7a33a0ca06f9
      • Instruction Fuzzy Hash: 10218670A042449FCB00DFAAC8426EEBBE4DB89315F50457AE448E7392DB785E0597AD
      Function 00403CA4 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON
      Download Yara Rule
      APIs
      • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
      • SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9
      • MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403CFC
      • SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00403D06
      • MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403D15
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ByteCharMultiWide$AllocString
      • String ID:
      • API String ID: 262959230-0
      • Opcode ID: dcd45591e65b03bd276bb2a5b0fabad56ebf76f0c081827c2345b0a7b763a240
      • Instruction ID: 657f84db466bd1c54801a2b30447fc2084338491f8142acf58a262d5883cef98
      • Opcode Fuzzy Hash: dcd45591e65b03bd276bb2a5b0fabad56ebf76f0c081827c2345b0a7b763a240
      • Instruction Fuzzy Hash: FCF0A4917442043BF21025A65C43F6B198CCB82B9BF50053FB704FA1D2D87C9D04427D
      Function 004143E0 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON
      Download Yara Rule
      APIs
      • SelectPalette.GDI32(00000000,00000000,00000000), ref: 00414419
      • RealizePalette.GDI32(00000000), ref: 00414421
      • SelectPalette.GDI32(00000000,00000000,00000001), ref: 00414435
      • RealizePalette.GDI32(00000000), ref: 0041443B
      • ReleaseDC.USER32(00000000,00000000), ref: 00414446
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Palette$RealizeSelect$Release
      • String ID:
      • API String ID: 2261976640-0
      • Opcode ID: c9c8aa66f6917016d7555c0ac5b3df2d15848593dde74026b2272496f15e705b
      • Instruction ID: 3cc421e061c7a323c9855e33cbe13bf4890882f9e8533d15179bd5f7679f66d2
      • Opcode Fuzzy Hash: c9c8aa66f6917016d7555c0ac5b3df2d15848593dde74026b2272496f15e705b
      • Instruction Fuzzy Hash: A2018F7520C3806AE600A63D8C85A9F6BED9FCA718F15446EF495DB282DA7AC8018765
      Function 00424CE0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 190COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0041F074: GetActiveWindow.USER32 ref: 0041F077
        • Part of subcall function 0041F074: GetCurrentThreadId.KERNEL32 ref: 0041F08C
        • Part of subcall function 0041F074: EnumThreadWindows.USER32(00000000,Function_0001F050), ref: 0041F092
        • Part of subcall function 004231A8: GetSystemMetrics.USER32(00000000), ref: 004231AA
      • OffsetRect.USER32(?,?,?), ref: 00424DC9
      • DrawTextA.USER32(00000000,00000000,000000FF,?,00000C10), ref: 00424E8C
      • OffsetRect.USER32(?,?,?), ref: 00424E9D
        • Part of subcall function 00423564: GetCurrentThreadId.KERNEL32 ref: 00423579
        • Part of subcall function 00423564: SetWindowsHookExA.USER32(00000003,00423520,00000000,00000000), ref: 00423589
        • Part of subcall function 00423564: CreateThread.KERNEL32(00000000,000003E8,004234D0,00000000,00000000), ref: 004235AD
        • Part of subcall function 00424B2C: SetTimer.USER32(00000000,00000001,?,004234B4), ref: 00424B47
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Thread$CurrentOffsetRectWindows$ActiveCreateDrawEnumHookMetricsSystemTextTimerWindow
      • String ID: vLB
      • API String ID: 1477829881-1797516613
      • Opcode ID: 6336c60e64649286a245b44d46559bc289005ddee16d0498013c52c3d52a7627
      • Instruction ID: b45c0c3bb27c28e933d22bed36287d6572db73be915ebea65d6241a4fe5449bb
      • Opcode Fuzzy Hash: 6336c60e64649286a245b44d46559bc289005ddee16d0498013c52c3d52a7627
      • Instruction Fuzzy Hash: 7E812675A003188FCB14DFA8D880ADEBBF4FF88314F50416AE905AB296E738AD45CF44
      Function 00406FA4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 156shareCOMMON
      Download Yara Rule
      APIs
      • WNetGetUniversalNameA.MPR(00000000,00000001,?,00000400), ref: 00407003
      • WNetOpenEnumA.MPR(00000001,00000001,00000000,00000000,?), ref: 0040707D
      • WNetEnumResourceA.MPR(?,FFFFFFFF,?,?), ref: 004070D5
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Enum$NameOpenResourceUniversal
      • String ID: Z
      • API String ID: 3604996873-1505515367
      • Opcode ID: 80d5d24c5cc1cd957ebe10b4970d3637aa7fe9c4f627cb318ad46338a568aecc
      • Instruction ID: f2bb682c730c97d5af452be79e127298b11fec363d1d43a15518f059abcad36a
      • Opcode Fuzzy Hash: 80d5d24c5cc1cd957ebe10b4970d3637aa7fe9c4f627cb318ad46338a568aecc
      • Instruction Fuzzy Hash: CB516470E04208AFDB11DF95C951AAFBBB9EF09304F1045BAE500BB3D1D778AE458B5A
      Function 0044CFC0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON
      Download Yara Rule
      APIs
      • SetRectEmpty.USER32(?), ref: 0044D04E
      • DrawTextA.USER32(00000000,00000000,00000000,?,00000D20), ref: 0044D079
      • DrawTextA.USER32(00000000,00000000,00000000,00000000,00000800), ref: 0044D101
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: DrawText$EmptyRect
      • String ID:
      • API String ID: 182455014-2867612384
      • Opcode ID: 9342ac6c83ac2351db6e75e145b3a1785d61d95e184629f5b3317e8731ad5951
      • Instruction ID: ac611c4ae9e9b4e435f74cd3b872a097dcdbbef8ea8fa2dc8c743a2ef399c877
      • Opcode Fuzzy Hash: 9342ac6c83ac2351db6e75e145b3a1785d61d95e184629f5b3317e8731ad5951
      • Instruction Fuzzy Hash: 18517171E00248AFDB11DFA5C885BDEBBF8BF48308F18447AE845EB252D7789945CB64
      Function 0042EF74 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON
      Download Yara Rule
      APIs
      • GetDC.USER32(00000000), ref: 0042EF9E
        • Part of subcall function 0041A1E8: CreateFontIndirectA.GDI32(?), ref: 0041A2A7
      • SelectObject.GDI32(?,00000000), ref: 0042EFC1
      • ReleaseDC.USER32(00000000,?), ref: 0042F0A0
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CreateFontIndirectObjectReleaseSelect
      • String ID: ...\
      • API String ID: 3133960002-983595016
      • Opcode ID: f4419e26e150698def1edcae614262169de195db2bdb855112bb161bc373889c
      • Instruction ID: de545d42c11d103cbad381cc3223c2b5efa9fdb4a6e9ae4bb0445229962d8c70
      • Opcode Fuzzy Hash: f4419e26e150698def1edcae614262169de195db2bdb855112bb161bc373889c
      • Instruction Fuzzy Hash: 5A316370B00128AFDB11EB96D841BAEB7F8EB09348F90447BE410A7392D7785E49CA59
      Function 00498750 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON
      Download Yara Rule
      APIs
      • GetFileAttributesA.KERNEL32(00000000,004990A0,00000000,00498846,?,?,00000000,0049C628), ref: 004987C0
      • SetFileAttributesA.KERNEL32(00000000,00000000,00000000,004990A0,00000000,00498846,?,?,00000000,0049C628), ref: 004987E9
      • MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 00498802
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: File$Attributes$Move
      • String ID: isRS-%.3u.tmp
      • API String ID: 3839737484-3657609586
      • Opcode ID: 2e79d6205de39ee5bd8e21d0bf6f01d2e229e005eddd2bc7530ab10d976f7253
      • Instruction ID: 82621092ba519d6558eab5b6810e2d5fb819a527f63b2b6426a9ae6067d1da2d
      • Opcode Fuzzy Hash: 2e79d6205de39ee5bd8e21d0bf6f01d2e229e005eddd2bc7530ab10d976f7253
      • Instruction Fuzzy Hash: C9214471E00219ABDF00EFA9C8819AFBBB8EB45314F50457FB414F72D1DA389E018A69
      Function 00456BFC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65registryCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0042C804: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C828
        • Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
        • Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9
      • LoadTypeLib.OLEAUT32(00000000,00000000), ref: 00456C50
      • RegisterTypeLib.OLEAUT32(00000000,00000000,00000000), ref: 00456C7D
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Type$AllocByteCharFullLoadMultiNamePathRegisterStringWide
      • String ID: LoadTypeLib$RegisterTypeLib
      • API String ID: 1312246647-2435364021
      • Opcode ID: 99adc2ab1761f2fa15f1ac99c5dc87c93e60f5f8f6cafab150dd189b668492eb
      • Instruction ID: 3ed1135b8019c5f4588910a0035f5c9e1cabb82a18fedb82429c118dce795412
      • Opcode Fuzzy Hash: 99adc2ab1761f2fa15f1ac99c5dc87c93e60f5f8f6cafab150dd189b668492eb
      • Instruction Fuzzy Hash: 2911B430B00604AFDB02EFA6CD51A5EB7BDEB89705F5184B6FC44D3752DA389904CA24
      Function 00457154 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60windowCOMMON
      Download Yara Rule
      APIs
      • SendMessageA.USER32(00000000,00000B06,00000000,00000000), ref: 0045716E
      • SendMessageA.USER32(00000000,00000B00,00000000,00000000), ref: 0045720B
      Strings
      • Failed to create DebugClientWnd, xrefs: 004571D4
      • Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x), xrefs: 0045719A
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: MessageSend
      • String ID: Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x)$Failed to create DebugClientWnd
      • API String ID: 3850602802-3720027226
      • Opcode ID: 96cbba74a9c55f6125d2765dfa445b780da3f95576ff60ac99610d3b0598a53f
      • Instruction ID: aa14c65db6cdd99b67d70119d4cc5236aa31a4fc47b3e85e0ebf9eb66bd2cffc
      • Opcode Fuzzy Hash: 96cbba74a9c55f6125d2765dfa445b780da3f95576ff60ac99610d3b0598a53f
      • Instruction Fuzzy Hash: DB112370608240AFD710AB68EC81B4F7BD89B58319F14447AF9848B383D7788819C7AE
      Function 004968E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59processCOMMON
      Download Yara Rule
      APIs
      • CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,004969A8,?,0049699C,00000000,00496983), ref: 0049694E
      • CloseHandle.KERNEL32(iI,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,004969A8,?,0049699C,00000000), ref: 00496965
        • Part of subcall function 00496838: GetLastError.KERNEL32(00000000,004968D0,?,?,?,?), ref: 0049685C
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CloseCreateErrorHandleLastProcess
      • String ID: psI$iI
      • API String ID: 3798668922-3774315737
      • Opcode ID: cf283c8603ff895351109cbf5c8e6e249ce522223dede431b24c2ff3919a7ee0
      • Instruction ID: 10186b6b9f3658dcfa801a6576978a188435e4e7341e7dcc7eead78f3a974db4
      • Opcode Fuzzy Hash: cf283c8603ff895351109cbf5c8e6e249ce522223dede431b24c2ff3919a7ee0
      • Instruction Fuzzy Hash: DB0161B1604248AFDF00EBA5DC42E9FBFACEF49714F52003BB904E7281D6785E058A29
      Function 00478A80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55windowkeyboardCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC
      • GetFocus.USER32 ref: 00478AEB
      • GetKeyState.USER32(0000007A), ref: 00478AFD
      • WaitMessage.USER32(?,00000000,00478B24,?,00000000,00478B4B,?,?,00000001,00000000,?,?,?,004807DE,00000000,004816A4), ref: 00478B07
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: FocusMessageStateTextWaitWindow
      • String ID: Wnd=$%x
      • API String ID: 1381870634-2927251529
      • Opcode ID: 95e2632fb63b5825483ccaa5c16028881b79b7a74636cba41af72dea4bfdaa6b
      • Instruction ID: 4a656451e32f28a531afd2ae7378f5801c6f2a9c595db78dcddbffc4d70283d4
      • Opcode Fuzzy Hash: 95e2632fb63b5825483ccaa5c16028881b79b7a74636cba41af72dea4bfdaa6b
      • Instruction Fuzzy Hash: 0611C470A44645AFCB00EBA5CC4A99E7BF8EB48304F51847FF408E7281DB386900CA29
      Function 0046E760 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46timeCOMMON
      Download Yara Rule
      APIs
      • FileTimeToLocalFileTime.KERNEL32(?), ref: 0046E768
      • FileTimeToSystemTime.KERNEL32(?,?,?), ref: 0046E777
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Time$File$LocalSystem
      • String ID: %.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u$(invalid)
      • API String ID: 1748579591-1013271723
      • Opcode ID: b5a965d629e679462cee1fe0d12d3cfb9bd2af2622692aeb463d283e3c1ff69e
      • Instruction ID: d6c712b8a1c8fe7cad0a5a3f3eb7758ab27952dbda4e85a7147eb7d881f6fbea
      • Opcode Fuzzy Hash: b5a965d629e679462cee1fe0d12d3cfb9bd2af2622692aeb463d283e3c1ff69e
      • Instruction Fuzzy Hash: 25113AA440C3919ED300DF2AC04432BBAE4ABD9704F04892EF8C8C6381E779C848DB77
      Function 00453F76 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43fileCOMMON
      Download Yara Rule
      APIs
      • SetFileAttributesA.KERNEL32(00000000,00000020), ref: 00453F83
        • Part of subcall function 00406F50: DeleteFileA.KERNEL32(00000000,0049C628,00498C31,00000000,00498C86,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B
      • MoveFileA.KERNEL32(00000000,00000000), ref: 00453FA8
        • Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049C628,00000004,00000000,00000000,00000000,?,004988E5,00000000), ref: 0045349F
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: File$AttributesDeleteErrorLastMove
      • String ID: DeleteFile$MoveFile
      • API String ID: 3024442154-139070271
      • Opcode ID: af3126191ca54be2b14b7bcabd5526068bb9cd492029050b8beb60dc3650c2cb
      • Instruction ID: b5871bee3d194af1fa843ac656f6d820fc0ba16d57580c91db5694710367c43f
      • Opcode Fuzzy Hash: af3126191ca54be2b14b7bcabd5526068bb9cd492029050b8beb60dc3650c2cb
      • Instruction Fuzzy Hash: AEF062716142045BD701FBA2D84266EA7ECDB8435EF60443BB900BB6C3DA3C9E094529
      Function 00459364 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39registryCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00483FBF,?,00000001,?,?,00483FBF,?,00000001,00000000), ref: 0042DE38
      • RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,004594A1,00000000,00459659,?,00000000,00000000,00000000), ref: 004593B1
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CloseOpen
      • String ID: .NET Framework not found$InstallRoot$SOFTWARE\Microsoft\.NETFramework
      • API String ID: 47109696-2631785700
      • Opcode ID: 71efe52f3b5d833c881730dd537475a26ae2595cd9ebfdad929fce7fd53757e2
      • Instruction ID: eb971141c82c6e90af09bd69be2b9c7788e5252ab351c10859e118dada29c764
      • Opcode Fuzzy Hash: 71efe52f3b5d833c881730dd537475a26ae2595cd9ebfdad929fce7fd53757e2
      • Instruction Fuzzy Hash: BDF0AF31700110DBCB10EB5AD845B6E6299DBD931AF10503BF981DB293E73CCC178629
      Function 00483FA0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39registryCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00483FBF,?,00000001,?,?,00483FBF,?,00000001,00000000), ref: 0042DE38
      • RegQueryValueExA.ADVAPI32(?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 00483FE1
      • RegCloseKey.ADVAPI32(?,?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 00484004
      Strings
      • CSDVersion, xrefs: 00483FD8
      • System\CurrentControlSet\Control\Windows, xrefs: 00483FAE
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CloseOpenQueryValue
      • String ID: CSDVersion$System\CurrentControlSet\Control\Windows
      • API String ID: 3677997916-1910633163
      • Opcode ID: f3e1b682b595892edc8e04416e9bcb6bd900fcb4c9496300ad687447a84e512d
      • Instruction ID: b915f471b655e7fdef170db69507dca06909280b60962d587ed7fc305732f584
      • Opcode Fuzzy Hash: f3e1b682b595892edc8e04416e9bcb6bd900fcb4c9496300ad687447a84e512d
      • Instruction Fuzzy Hash: 15F0A475E00209E6DF10EAE09C45BEF73BCAB45308F204867EB14E7280F639AA048B59
      Function 0042D8F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27libraryloaderCOMMON
      Download Yara Rule
      APIs
      • GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,00453B5A,00000000,00453BFD,?,?,00000000,00000000,00000000,00000000,00000000,?,00453FED,00000000), ref: 0042D90A
      • GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042D910
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressHandleModuleProc
      • String ID: GetSystemWow64DirectoryA$kernel32.dll
      • API String ID: 1646373207-4063490227
      • Opcode ID: 3965e48138ab8598cb17ff311cd558fd433aca8a834515e354a81fb776e31baf
      • Instruction ID: 657275fb9dfacbe144619f02b172540cf2f0c5a6f4252bec6bd03a25d2dd35a2
      • Opcode Fuzzy Hash: 3965e48138ab8598cb17ff311cd558fd433aca8a834515e354a81fb776e31baf
      • Instruction Fuzzy Hash: A5E0DFE0B40B0122D70032BA1C82B6B108D4B84728F90053B3894E62D6DDBCD9840A6D
      Function 0042EB54 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23libraryloaderCOMMON
      Download Yara Rule
      APIs
      • GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonDestroy,?,00000000,0042EAD0), ref: 0042EB62
      • GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EB68
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressHandleModuleProc
      • String ID: ShutdownBlockReasonDestroy$user32.dll
      • API String ID: 1646373207-260599015
      • Opcode ID: 88ce12e330a2fc51ece58c284b54de3a76b504cb94a4c995bd1a3fb2c6ea0693
      • Instruction ID: e1ec077e445c8734ae54db5ffdd633522f5c412f0b7fee52e54de0d29bb4c321
      • Opcode Fuzzy Hash: 88ce12e330a2fc51ece58c284b54de3a76b504cb94a4c995bd1a3fb2c6ea0693
      • Instruction Fuzzy Hash: A2D0C793311732665D10B1F73CD1EAB058C891527935404B7F515E5641D55DEC1115AD
      Function 0044F744 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON
      Download Yara Rule
      APIs
      • GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,00499132), ref: 0044F77F
      • GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044F785
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressHandleModuleProc
      • String ID: NotifyWinEvent$user32.dll
      • API String ID: 1646373207-597752486
      • Opcode ID: 0c4814f5095d2f26bf1dd295da01d2ea10056342ce4be8cb0cb6f46b9460fbf4
      • Instruction ID: a548b1a2c93a9987e8a55f60344bf8fc374f152cafbee3c82208bfc9f7b62feb
      • Opcode Fuzzy Hash: 0c4814f5095d2f26bf1dd295da01d2ea10056342ce4be8cb0cb6f46b9460fbf4
      • Instruction Fuzzy Hash: 59E012F0E417019AFF00BBF569C6B193A90E76431DF41047BF104A6292CB7C44184F6E
      Function 00498EA8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON
      Download Yara Rule
      APIs
      • GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,00499188,00000001,00000000,004991AC), ref: 00498EB2
      • GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00498EB8
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressHandleModuleProc
      • String ID: DisableProcessWindowsGhosting$user32.dll
      • API String ID: 1646373207-834958232
      • Opcode ID: f82e9a8c1fc520efc3493493f57f3e11975ff19308d5bc5f03be5583808cd056
      • Instruction ID: a85b6fa453d319a71eefe831850ebd09cb83ca2f3b2a56c048834f0552a6e23a
      • Opcode Fuzzy Hash: f82e9a8c1fc520efc3493493f57f3e11975ff19308d5bc5f03be5583808cd056
      • Instruction Fuzzy Hash: D0B00280A41B02699D5172BA0D27F1B0848886676E714047F7414E51C6DE6C8D11593D
      Function 004645F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 8libraryloaderCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0044B658: LoadLibraryA.KERNEL32(uxtheme.dll,?,0044F775,00499132), ref: 0044B67F
        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044B697
        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044B6A9
        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044B6BB
        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044B6CD
        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6DF
        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6F1
        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044B703
        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044B715
        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044B727
        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044B739
        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044B74B
        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044B75D
        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044B76F
        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044B781
        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044B793
        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044B7A5
        • Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044B7B7
      • LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,0049915A), ref: 00464603
      • GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 00464609
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AddressProc$LibraryLoad
      • String ID: SHPathPrepareForWriteA$shell32.dll
      • API String ID: 2238633743-2683653824
      • Opcode ID: 266b5aae74457c18d17694bc6f9d4dc2bcbfde0c5a5f95e23c1699c5c17d9369
      • Instruction ID: 6f0f7d0aca7b5f2124629fae06fe0de77c927d41fde507854a0da375de159762
      • Opcode Fuzzy Hash: 266b5aae74457c18d17694bc6f9d4dc2bcbfde0c5a5f95e23c1699c5c17d9369
      • Instruction Fuzzy Hash: A9B092D0A8274064C90077B2981B90F2A4488A271EB10053B710877483EABC84100EAE
      Function 0047DA58 Relevance: 6.2, APIs: 4, Instructions: 195fileCOMMON
      Download Yara Rule
      APIs
      • FindNextFileA.KERNEL32(000000FF,?,00000000,0047DBCC,?,?,?,?,00000000,0047DD21,?,?,?,00000000,?,0047DE30), ref: 0047DBA8
      • FindClose.KERNEL32(000000FF,0047DBD3,0047DBCC,?,?,?,?,00000000,0047DD21,?,?,?,00000000,?,0047DE30,00000000), ref: 0047DBC6
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Find$CloseFileNext
      • String ID:
      • API String ID: 2066263336-0
      • Opcode ID: 91c2c6b9b170dacd631fc7eeee3f842cb9bcc68b02f971b73079f95bff7e9483
      • Instruction ID: 2a35a6999a453231ff6cf52326074d4c8e5400bf28a19e29f9dab68c88990ac4
      • Opcode Fuzzy Hash: 91c2c6b9b170dacd631fc7eeee3f842cb9bcc68b02f971b73079f95bff7e9483
      • Instruction Fuzzy Hash: 83812B74D0424D9FDF12DFA5C841ADFBBB9EF49304F5080AAE808A7291D639AA46CF54
      Function 00475940 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 114COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0042EE30: GetTickCount.KERNEL32 ref: 0042EE36
        • Part of subcall function 0042EC88: MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 0042ECBD
      • GetLastError.KERNEL32(00000000,00475AB5,?,?,0049D1E0,00000000), ref: 0047599E
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CountErrorFileLastMoveTick
      • String ID: $LoggedMsgBox returned an unexpected value. Assuming Cancel.$MoveFileEx
      • API String ID: 2406187244-2685451598
      • Opcode ID: eefa15005827e49071ab2b851c4f9491611c7044eef03091ba63e79c4b402804
      • Instruction ID: 970d0f228ed0ee64b1f253f167705d001af74b9d4c262bd7fbc13ac5fa24ecbb
      • Opcode Fuzzy Hash: eefa15005827e49071ab2b851c4f9491611c7044eef03091ba63e79c4b402804
      • Instruction Fuzzy Hash: DA4156B1A006198FCB10EFA5D882AEE77B4EF48314F508537E514BB391D7789A058BAD
      Function 00413CF8 Relevance: 6.1, APIs: 4, Instructions: 107COMMON
      Download Yara Rule
      APIs
      • GetDesktopWindow.USER32 ref: 00413D46
      • GetDesktopWindow.USER32 ref: 00413DFE
        • Part of subcall function 00418EC0: 6F5BC6F0.COMCTL32(?,00000000,00413FC3,00000000,004140D3,?,?,0049C628), ref: 00418EDC
        • Part of subcall function 00418EC0: ShowCursor.USER32(00000001,?,00000000,00413FC3,00000000,004140D3,?,?,0049C628), ref: 00418EF9
      • SetCursor.USER32(00000000,?,?,?,?,00413AF3,00000000,00413B06), ref: 00413E3C
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CursorDesktopWindow$Show
      • String ID:
      • API String ID: 2074268717-0
      • Opcode ID: c82077e875ceebfb446ca8bdba497cc44f2f016adda31143cf8d95e20cbb1c8e
      • Instruction ID: 896cdbd04830fa17f0c4ad14c6e5261715e4716651aaca0f773e018681f1b2d9
      • Opcode Fuzzy Hash: c82077e875ceebfb446ca8bdba497cc44f2f016adda31143cf8d95e20cbb1c8e
      • Instruction Fuzzy Hash: 13414774600220EFCB14EF29E9C4B9677E1AB65325B16807BE405DB366DA38FD80CF58
      Function 00408A54 Relevance: 6.1, APIs: 4, Instructions: 95windowCOMMON
      Download Yara Rule
      APIs
      • GetModuleFileNameA.KERNEL32(00400000,?,00000100), ref: 00408A75
      • LoadStringA.USER32(00400000,0000FF9E,?,00000040), ref: 00408AE4
      • LoadStringA.USER32(00400000,0000FF9F,?,00000040), ref: 00408B7F
      • MessageBoxA.USER32(00000000,?,?,00002010), ref: 00408BBE
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: LoadString$FileMessageModuleName
      • String ID:
      • API String ID: 704749118-0
      • Opcode ID: 3d0272cb4438d2cd0cd3bc083d72a7d886fa44808b7212d57058cdfaaef78319
      • Instruction ID: dd649895f54789da5ab3727b704ba240b85178ea5423077ea4551db47b7443ef
      • Opcode Fuzzy Hash: 3d0272cb4438d2cd0cd3bc083d72a7d886fa44808b7212d57058cdfaaef78319
      • Instruction Fuzzy Hash: E83121716083849BD370EB65C945BDBB7D89B86704F40483FB6C8E72D1EBB89904876B
      Function 0044E8C4 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON
      Download Yara Rule
      APIs
      • SendMessageA.USER32(00000000,000001A1,?,00000000), ref: 0044E90D
        • Part of subcall function 0044CF50: SendMessageA.USER32(00000000,000001A0,?,00000000), ref: 0044CF82
      • InvalidateRect.USER32(00000000,00000000,00000001,00000000,000001A1,?,00000000), ref: 0044E991
        • Part of subcall function 0042BBB4: SendMessageA.USER32(00000000,0000018E,00000000,00000000), ref: 0042BBC8
      • IsRectEmpty.USER32(?), ref: 0044E953
      • ScrollWindowEx.USER32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000006), ref: 0044E976
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: MessageSend$Rect$EmptyInvalidateScrollWindow
      • String ID:
      • API String ID: 855768636-0
      • Opcode ID: a1c58a036e7e3939ccc2b3173b4d8f234b74dbe4772ee025e66f17fd3de39d14
      • Instruction ID: f7bad605b8f68185b4e834990bb8ca2287257270a928060092b59a923d315d7c
      • Opcode Fuzzy Hash: a1c58a036e7e3939ccc2b3173b4d8f234b74dbe4772ee025e66f17fd3de39d14
      • Instruction Fuzzy Hash: E5114A71B0030067E650BA7B8C86B5B76C9AB88748F15083FB545EB387DE7DDD094299
      Function 00495E64 Relevance: 6.1, APIs: 4, Instructions: 81COMMON
      Download Yara Rule
      APIs
      • OffsetRect.USER32(?,?,00000000), ref: 00495EC8
      • OffsetRect.USER32(?,00000000,?), ref: 00495EE3
      • OffsetRect.USER32(?,?,00000000), ref: 00495EFD
      • OffsetRect.USER32(?,00000000,?), ref: 00495F18
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: OffsetRect
      • String ID:
      • API String ID: 177026234-0
      • Opcode ID: 758979e9218dc4969a003e38f205f50134a882301915ac1ed28822b64ab0e268
      • Instruction ID: 46025b2b902532244ab058fbba81834a109846b8a776b76840e75eab68b8dfff
      • Opcode Fuzzy Hash: 758979e9218dc4969a003e38f205f50134a882301915ac1ed28822b64ab0e268
      • Instruction Fuzzy Hash: D9218EB6704601ABCB00DF69CD85E5BB7EAEBC4344F248A2AF544C7249E638ED448B65
      Function 00417218 Relevance: 6.1, APIs: 4, Instructions: 72COMMON
      Download Yara Rule
      APIs
      • GetCursorPos.USER32 ref: 00417260
      • SetCursor.USER32(00000000), ref: 004172A3
      • GetLastActivePopup.USER32(?), ref: 004172CD
      • GetForegroundWindow.USER32(?), ref: 004172D4
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Cursor$ActiveForegroundLastPopupWindow
      • String ID:
      • API String ID: 1959210111-0
      • Opcode ID: 42b2b2f1fee3895b97051f62777c7582eb45c1fc4d7e4805d7efff34dea4a97c
      • Instruction ID: 6015a550b49415ac2d233993b55ed4bb4288d084877657d9c2e64f8629c913b3
      • Opcode Fuzzy Hash: 42b2b2f1fee3895b97051f62777c7582eb45c1fc4d7e4805d7efff34dea4a97c
      • Instruction Fuzzy Hash: 562183313086118BC720AFA9D885AD733F1AF48754B0544ABF8558B352DB3DDC82CB5E
      Function 00495B1C Relevance: 6.1, APIs: 4, Instructions: 59COMMON
      Download Yara Rule
      APIs
      • MulDiv.KERNEL32(?,00000008,?), ref: 00495B31
      • MulDiv.KERNEL32(?,00000008,?), ref: 00495B45
      • MulDiv.KERNEL32(?,00000008,?), ref: 00495B59
      • MulDiv.KERNEL32(?,00000008,?), ref: 00495B77
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: b0bc83cb44cddb6cfb83e9cff79c84a8c4632dee95d4fc6912c32f85648e17c5
      • Instruction ID: 6116e2a20741203e8feef447184c07a5babf2283b0e9d97c936b49cc9c6ac3c7
      • Opcode Fuzzy Hash: b0bc83cb44cddb6cfb83e9cff79c84a8c4632dee95d4fc6912c32f85648e17c5
      • Instruction Fuzzy Hash: 38112172A05504AFCB40DEA9C8C4D9B7BECEF4D370B24416AF908DB242D674ED408BA8
      Function 0041F480 Relevance: 6.1, APIs: 4, Instructions: 56registryCOMMON
      Download Yara Rule
      APIs
      • GetClassInfoA.USER32(00400000,0041F470,?), ref: 0041F4A1
      • UnregisterClassA.USER32(0041F470,00400000), ref: 0041F4CA
      • RegisterClassA.USER32(0049A598), ref: 0041F4D4
      • SetWindowLongA.USER32(00000000,000000FC,00000000), ref: 0041F50F
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Class$InfoLongRegisterUnregisterWindow
      • String ID:
      • API String ID: 4025006896-0
      • Opcode ID: 53e043847a4320692bf40591cb358f998b84f484cc4b5b8a7050902d03c12cba
      • Instruction ID: 1564972ae72e56a1e1df30b4864def064323a8a7c50b4cb7330e0cbd62eddf2f
      • Opcode Fuzzy Hash: 53e043847a4320692bf40591cb358f998b84f484cc4b5b8a7050902d03c12cba
      • Instruction Fuzzy Hash: 67015271340104BBCB10EFE8DD81E9B73999729314F11423BB605EB2E2D6399C558BBD
      Function 0040D010 Relevance: 6.1, APIs: 4, Instructions: 51COMMON
      Download Yara Rule
      APIs
      • FindResourceA.KERNEL32(00400000,?,00000000), ref: 0040D027
      • LoadResource.KERNEL32(00400000,72756F73,0040A7C8,00400000,00000001,00000000,?,0040CF84,00000000,?,00000000,?,?,0047CF34,0000000A,00000000), ref: 0040D041
      • SizeofResource.KERNEL32(00400000,72756F73,00400000,72756F73,0040A7C8,00400000,00000001,00000000,?,0040CF84,00000000,?,00000000,?,?,0047CF34), ref: 0040D05B
      • LockResource.KERNEL32(74536563,00000000,00400000,72756F73,00400000,72756F73,0040A7C8,00400000,00000001,00000000,?,0040CF84,00000000,?,00000000,?), ref: 0040D065
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Resource$FindLoadLockSizeof
      • String ID:
      • API String ID: 3473537107-0
      • Opcode ID: f701ce4f04cb0ebdd1143b5585c75acb70ffd029a82b31343d3be87257736b7b
      • Instruction ID: ce77ce8360aa458f47a01e9b0563465317cd85cc21d7bcd45488e041df035c61
      • Opcode Fuzzy Hash: f701ce4f04cb0ebdd1143b5585c75acb70ffd029a82b31343d3be87257736b7b
      • Instruction Fuzzy Hash: 49F04F726056046F9B14EE59A881D5B77ECDE88268310013AF908E7286DA38DD018B68
      Function 004706F0 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON
      Download Yara Rule
      APIs
      • GetLastError.KERNEL32(?,00000000), ref: 00470741
      Strings
      • Setting NTFS compression on file: %s, xrefs: 0047070F
      • Failed to set NTFS compression state (%d)., xrefs: 00470752
      • Unsetting NTFS compression on file: %s, xrefs: 00470727
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ErrorLast
      • String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on file: %s$Unsetting NTFS compression on file: %s
      • API String ID: 1452528299-3038984924
      • Opcode ID: cb352b682511378ef55ab38e48569ac0c35d814b9dedbee4e01c79f3aa9ccf61
      • Instruction ID: 516ba9922c05d2884c901261e3297babd46d2414ea2f30b5c6a01ed0c8da25d4
      • Opcode Fuzzy Hash: cb352b682511378ef55ab38e48569ac0c35d814b9dedbee4e01c79f3aa9ccf61
      • Instruction Fuzzy Hash: 06016721D0924896CB08D7AD94412DDBBA49F49304F44C5AFE459E7382DB781A098BAA
      Function 00455D9C Relevance: 6.0, APIs: 4, Instructions: 41registrywindowCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00483FBF,?,00000001,?,?,00483FBF,?,00000001,00000000), ref: 0042DE38
      • RegDeleteValueA.ADVAPI32(?,00000000,00000082,00000002,00000000,?,?,00000000,0045B7AE,?,?,?,?,?,00000000,0045B7D5), ref: 00455DD8
      • RegCloseKey.ADVAPI32(00000000,?,00000000,00000082,00000002,00000000,?,?,00000000,0045B7AE,?,?,?,?,?,00000000), ref: 00455DE1
      • RemoveFontResourceA.GDI32(00000000), ref: 00455DEE
      • SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 00455E02
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CloseDeleteFontMessageNotifyOpenRemoveResourceSendValue
      • String ID:
      • API String ID: 4283692357-0
      • Opcode ID: 8f4524ec4b62dec5390bdd2ed83ea6772c50fa7bfc1a3ba25c401c368cf37ed2
      • Instruction ID: a9a8af30189c92b571934aff020c7041fd05f253265614bca04673beed127bfa
      • Opcode Fuzzy Hash: 8f4524ec4b62dec5390bdd2ed83ea6772c50fa7bfc1a3ba25c401c368cf37ed2
      • Instruction Fuzzy Hash: 08F0BEB174070036EA10B6B6AC4BF2B26CC8F54745F10883ABA00EF2C3D97CDC04966D
      Function 0046FF44 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON
      Download Yara Rule
      APIs
      • GetLastError.KERNEL32(00000000,00000000), ref: 0046FF95
      Strings
      • Unsetting NTFS compression on directory: %s, xrefs: 0046FF7B
      • Failed to set NTFS compression state (%d)., xrefs: 0046FFA6
      • Setting NTFS compression on directory: %s, xrefs: 0046FF63
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ErrorLast
      • String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on directory: %s$Unsetting NTFS compression on directory: %s
      • API String ID: 1452528299-1392080489
      • Opcode ID: 77060103e7a82cec4092835f2ea5e015ec8224a44b08f7b5060cbdeda988ed54
      • Instruction ID: a045838dcc4f37756fc34b517471cd96220c37e591c9b42891c7cb6a53decabf
      • Opcode Fuzzy Hash: 77060103e7a82cec4092835f2ea5e015ec8224a44b08f7b5060cbdeda988ed54
      • Instruction Fuzzy Hash: E4016721E0825856CB04D7ADA4412DDBBA49F4E314F54C1BFA495D7286EB780A0C879A
      Function 00478598 Relevance: 6.0, APIs: 4, Instructions: 31COMMON
      Download Yara Rule
      APIs
      • GetCurrentProcess.KERNEL32(00000008,?,?,?,00000001,00000000,00000002,00000000,004816A4,?,?,?,?,?,0049921B,00000000), ref: 004785A1
      • OpenProcessToken.ADVAPI32(00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,004816A4,?,?,?,?,?,0049921B), ref: 004785A7
      • GetTokenInformation.ADVAPI32(00000008,00000012(TokenIntegrityLevel),00000000,00000004,00000008,00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,004816A4), ref: 004785C9
      • CloseHandle.KERNEL32(00000000,00000008,TokenIntegrityLevel,00000000,00000004,00000008,00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,004816A4), ref: 004785DA
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ProcessToken$CloseCurrentHandleInformationOpen
      • String ID:
      • API String ID: 215268677-0
      • Opcode ID: 06d41b12d0d877b6bf14acd877a92edcadf3f207d8b3780faa116844b8d07ee0
      • Instruction ID: 7a0968ec8f136f967f8939260ff1f9597a88f05d56cd6bcf815474b891c9e107
      • Opcode Fuzzy Hash: 06d41b12d0d877b6bf14acd877a92edcadf3f207d8b3780faa116844b8d07ee0
      • Instruction Fuzzy Hash: 66F037716447007BD600E6B58D81E5B73DCEB44354F04493E7E94D71C1DA78DC089776
      Function 00424240 Relevance: 6.0, APIs: 4, Instructions: 26windowCOMMON
      Download Yara Rule
      APIs
      • GetLastActivePopup.USER32(?), ref: 0042424C
      • IsWindowVisible.USER32(?), ref: 0042425D
      • IsWindowEnabled.USER32(?), ref: 00424267
      • SetForegroundWindow.USER32(?), ref: 00424271
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Window$ActiveEnabledForegroundLastPopupVisible
      • String ID:
      • API String ID: 2280970139-0
      • Opcode ID: 7ea25e86981cd22a436f7730a5ce4b99d9904119f75a67690abc0c6a5277efc1
      • Instruction ID: 2c5ff33fc315f6eb6fab431e1453bcb0e66c5aaaa6596e28cc8dc28fd0b03a53
      • Opcode Fuzzy Hash: 7ea25e86981cd22a436f7730a5ce4b99d9904119f75a67690abc0c6a5277efc1
      • Instruction Fuzzy Hash: C7E0EC61B02672D6AE31FA7B2881A9F518C9D45BE434641EBBC04FB38ADB2CDC1141BD
      Function 0040626C Relevance: 6.0, APIs: 4, Instructions: 11memoryCOMMON
      Download Yara Rule
      APIs
      • GlobalHandle.KERNEL32 ref: 0040626F
      • GlobalUnWire.KERNEL32(00000000), ref: 00406276
      • GlobalReAlloc.KERNEL32(00000000,00000000), ref: 0040627B
      • GlobalFix.KERNEL32(00000000), ref: 00406281
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Global$AllocHandleWire
      • String ID:
      • API String ID: 2210401237-0
      • Opcode ID: cbc5b304f88c7a08b053d0b09bd11fc9f2d944e51c7d356257a26bde9ab667b0
      • Instruction ID: 5df08fd8dc2b017785a639aa93036e57be915985ffe03f20f856cac12e18577c
      • Opcode Fuzzy Hash: cbc5b304f88c7a08b053d0b09bd11fc9f2d944e51c7d356257a26bde9ab667b0
      • Instruction Fuzzy Hash: 0BB009C4810A01BEEC0473B24C0BE3F245CD88172C3904A6F3448BA183987C9C405A3A
      Function 0047A5F4 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 210registryCOMMON
      Download Yara Rule
      APIs
      • RegCloseKey.ADVAPI32(?,?,?,?,00000001,00000000,00000000,0047BEDD,?,00000000,00000000,00000001,00000000,0047A891,?,00000000), ref: 0047A855
      Strings
      • Failed to parse "reg" constant, xrefs: 0047A85C
      • Cannot access a 64-bit key in a "reg" constant on this version of Windows, xrefs: 0047A6C9
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Close
      • String ID: Cannot access a 64-bit key in a "reg" constant on this version of Windows$Failed to parse "reg" constant
      • API String ID: 3535843008-1938159461
      • Opcode ID: c60f311d79c224dfc362c2749d46616026ebc5b2af15052a5460d0979b2401ec
      • Instruction ID: 001d7052bab1efafb9f85154a11dff06e437df12a15571a1df2c1c4f382e212c
      • Opcode Fuzzy Hash: c60f311d79c224dfc362c2749d46616026ebc5b2af15052a5460d0979b2401ec
      • Instruction Fuzzy Hash: 35815374E00108AFCB10EFA5D481ADEBBF9AF88314F54817AE854B7391D7389E05CB99
      Function 00476740 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 105timeCOMMON
      Download Yara Rule
      APIs
      • LocalFileTimeToFileTime.KERNEL32(?,?,?,00000000,00000000,00476873,?,00000000,00476884,?,00000000,004768CD), ref: 00476844
      • SetFileTime.KERNEL32(?,00000000,00000000,?,?,?,?,00000000,00000000,00476873,?,00000000,00476884,?,00000000,004768CD), ref: 00476858
      Strings
      • Extracting temporary file: , xrefs: 00476780
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: FileTime$Local
      • String ID: Extracting temporary file:
      • API String ID: 791338737-4171118009
      • Opcode ID: 541ef390b8a454b92050565b0f576b2e48f67177e9f76e74fea367fb25747d71
      • Instruction ID: f3a2b65f93f92646adb6002ee314f887bdea4c0ad4fc48674df75dbdf8adc8f3
      • Opcode Fuzzy Hash: 541ef390b8a454b92050565b0f576b2e48f67177e9f76e74fea367fb25747d71
      • Instruction Fuzzy Hash: E541A970E006496FCB01EFA5C892E9FBBB9EF09304F52847AF814A7391D7789905CB59
      Function 0046CC64 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 89COMMON
      Download Yara Rule
      Strings
      • Failed to proceed to next wizard page; aborting., xrefs: 0046CD7C
      • Failed to proceed to next wizard page; showing wizard., xrefs: 0046CD90
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID:
      • String ID: Failed to proceed to next wizard page; aborting.$Failed to proceed to next wizard page; showing wizard.
      • API String ID: 0-1974262853
      • Opcode ID: 39c603f3da5e8e6da3562071ff758269a6d43c0f9aff8d68f89b87ccc057ce94
      • Instruction ID: b6ca7043fe10e2652c72014a267ee34eb1496f960dd642c93ae57dd861da4d8a
      • Opcode Fuzzy Hash: 39c603f3da5e8e6da3562071ff758269a6d43c0f9aff8d68f89b87ccc057ce94
      • Instruction Fuzzy Hash: C331C130A04204AFD711EB58D985BAA7BF5EB05308F2400BBF4489B3A2D7787E41DB0D
      Function 0047922C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 86registryCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00483FBF,?,00000001,?,?,00483FBF,?,00000001,00000000), ref: 0042DE38
      • RegCloseKey.ADVAPI32(?,00479312,?,?,00000001,00000000,00000000,0047932D), ref: 004792FB
      Strings
      • %s\%s_is1, xrefs: 004792A4
      • Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00479286
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CloseOpen
      • String ID: %s\%s_is1$Software\Microsoft\Windows\CurrentVersion\Uninstall
      • API String ID: 47109696-1598650737
      • Opcode ID: 9b2e946d5899b9a5b5433d1c8e1a9fae6c82f9be74ccb941a7dabe4cf8b29487
      • Instruction ID: 49a346c6c8189a3db07ea358deb0dc233baf706630e3e1f4ad9cd37f683b27aa
      • Opcode Fuzzy Hash: 9b2e946d5899b9a5b5433d1c8e1a9fae6c82f9be74ccb941a7dabe4cf8b29487
      • Instruction Fuzzy Hash: D4218170B00644AFDB01DBAACC41ADEBBE9EB4D304F91847AE804E7391D7789D018B59
      Function 00450168 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78windowCOMMON
      Download Yara Rule
      APIs
      • SendMessageA.USER32(00000000,0000044B,00000000,?), ref: 004501FD
      • ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 0045022E
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ExecuteMessageSendShell
      • String ID: open
      • API String ID: 812272486-2758837156
      • Opcode ID: ea446b968c091deb5619fe0c64f284e9fafe3e6cb185d1fb8701354efc215884
      • Instruction ID: 7f57506e0c07b49dd0b520b237e7736b759e9f4ed638734fb0c833ac5abbff07
      • Opcode Fuzzy Hash: ea446b968c091deb5619fe0c64f284e9fafe3e6cb185d1fb8701354efc215884
      • Instruction Fuzzy Hash: A1216074E00204AFDB10DFA9C896B9EBBF8EB44705F1081BAB404E7292D678DE45CA59
      Function 00455290 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON
      Download Yara Rule
      APIs
      • ShellExecuteEx.SHELL32(0000003C), ref: 0045532C
      • GetLastError.KERNEL32(0000003C,00000000,00455375,?,?,?), ref: 0045533D
        • Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: DirectoryErrorExecuteLastShellSystem
      • String ID: <
      • API String ID: 893404051-4251816714
      • Opcode ID: 5a23c991ea1f4f9f6b13be7a01823eb161f98855501a952691e7822c27d307b8
      • Instruction ID: 92df0b2f1231c5c49ece4c570041ef31d6ed92e86db86b93cafb864a5026e18c
      • Opcode Fuzzy Hash: 5a23c991ea1f4f9f6b13be7a01823eb161f98855501a952691e7822c27d307b8
      • Instruction Fuzzy Hash: 172167B0600609ABDB10EF65C8926AE7BE8AF44355F54403AFC44E7291D7789E49CB98
      Function 00402584 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON
      Download Yara Rule
      APIs
      • RtlEnterCriticalSection.KERNEL32(0049C420,00000000,)), ref: 004025C7
      • RtlLeaveCriticalSection.KERNEL32(0049C420,0040263D), ref: 00402630
        • Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32(0049C420,00000000,00401A82,?,?,0040222E,022A0650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
        • Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(0049C420,0049C420,00000000,00401A82,?,?,0040222E,022A0650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
        • Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,0049C420,00000000,00401A82,?,?,0040222E,022A0650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
        • Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32(0049C420,00401A89,00000000,00401A82,?,?,0040222E,022A0650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: CriticalSection$EnterLeave$AllocInitializeLocal
      • String ID: )
      • API String ID: 2227675388-1084416617
      • Opcode ID: 94eed0a9be2c3ee170c705f4af63db45f02aa9b7064399c91cb7111f76640db2
      • Instruction ID: 1fa17fb08616f6b4eef2bbe9ac14d29337f111a30cd6b0cffb698505e2c33406
      • Opcode Fuzzy Hash: 94eed0a9be2c3ee170c705f4af63db45f02aa9b7064399c91cb7111f76640db2
      • Instruction Fuzzy Hash: A21134307042006FEB10AB795F6A62A6AD4D795358B60087FF404F32D2D9BD8C02825C
      Function 0049706E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON
      Download Yara Rule
      APIs
      • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097), ref: 004970A9
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Window
      • String ID: /INITPROCWND=$%x $@
      • API String ID: 2353593579-4169826103
      • Opcode ID: 2b11d8bc3c534e138800ad0cfd641c484f27e4cac2aae1223636dbf2942fd761
      • Instruction ID: 27b6959225009179d71714de2407b6757a93da0b12486f53c706093c408d73e1
      • Opcode Fuzzy Hash: 2b11d8bc3c534e138800ad0cfd641c484f27e4cac2aae1223636dbf2942fd761
      • Instruction Fuzzy Hash: 0811A231A182489FDB01DBA4DC42BAEBFE8EB48314F51847BE504E7291DB3C9905C75C
      Function 00447414 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
        • Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9
      • SysFreeString.OLEAUT32(?), ref: 004474C6
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: String$AllocByteCharFreeMultiWide
      • String ID: NIL Interface Exception$Unknown Method
      • API String ID: 3952431833-1023667238
      • Opcode ID: 68784d6db451ced0cb76174b103882e66c2be5d8f7e965ee48eac584af4b4338
      • Instruction ID: c71f63dc48a525ba77490e76e14047fbf5e7b25ce244d131e113cf4708b6d3e8
      • Opcode Fuzzy Hash: 68784d6db451ced0cb76174b103882e66c2be5d8f7e965ee48eac584af4b4338
      • Instruction Fuzzy Hash: DF11B9706082089FEB10DFA58C52A6EBBBCEB09704F91407AF504F7681D77C9D01CB69
      Function 0042DD64 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56registryCOMMON
      Download Yara Rule
      APIs
      • RegQueryValueExA.ADVAPI32(?,Inno Setup: No Icons,00000000,00000000,00000000,00000000), ref: 0042DD78
      • RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,Inno Setup: No Icons,00000000,00000000,00000000), ref: 0042DDB8
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Value$EnumQuery
      • String ID: Inno Setup: No Icons
      • API String ID: 1576479698-2016326496
      • Opcode ID: f350c76201ab4997d4652543ced6fce67a53d94d17f0ed1fe822a95ce8049552
      • Instruction ID: 1f9698fd4e7a3c5b204893953a849f33624a46b7d24a37d40f6251e799f9796a
      • Opcode Fuzzy Hash: f350c76201ab4997d4652543ced6fce67a53d94d17f0ed1fe822a95ce8049552
      • Instruction Fuzzy Hash: BA012B33B55B7179FB3045216D01F7B57889B82B60F64013BF942EA2C0D6999C0493AE
      Function 00452E88 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON
      Download Yara Rule
      APIs
      • SetFileAttributesA.KERNEL32(00000000,?,00000000,00452EE9,?,?,-00000001,?), ref: 00452EC3
      • GetLastError.KERNEL32(00000000,?,00000000,00452EE9,?,?,-00000001,?), ref: 00452ECB
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: AttributesErrorFileLast
      • String ID: 0(H
      • API String ID: 1799206407-4268776330
      • Opcode ID: 639054bdfccb1e92e79adc417b540f40f046fb4b195b8a4a2f0ac4cfae6b9ee3
      • Instruction ID: d2ab7b9b66ca24062e77e49c95e81f13ab46b8af1b1b2eb811bbb53637dcbd2b
      • Opcode Fuzzy Hash: 639054bdfccb1e92e79adc417b540f40f046fb4b195b8a4a2f0ac4cfae6b9ee3
      • Instruction Fuzzy Hash: 86F0F971A04204AB8B01DB7A9D4249EB7ECEB8A32171045BBFC04E3642E7B84E048558
      Function 00497DA4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 004555E4: GetCurrentProcess.KERNEL32(00000028), ref: 004555F3
        • Part of subcall function 004555E4: OpenProcessToken.ADVAPI32(00000000,00000028), ref: 004555F9
      • SetForegroundWindow.USER32(?), ref: 00497DD6
      Strings
      • Not restarting Windows because Uninstall is being run from the debugger., xrefs: 00497E01
      • Restarting Windows., xrefs: 00497DB3
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Process$CurrentForegroundOpenTokenWindow
      • String ID: Not restarting Windows because Uninstall is being run from the debugger.$Restarting Windows.
      • API String ID: 3179053593-4147564754
      • Opcode ID: 99a2c689f2aff4ac444e5b827a7270568ad8548d7ccbd1776e14de301935e8b8
      • Instruction ID: ca25da4fbe953d28e2ba1dad80811693e03ea22c752e99a0fcc25da02e3f468d
      • Opcode Fuzzy Hash: 99a2c689f2aff4ac444e5b827a7270568ad8548d7ccbd1776e14de301935e8b8
      • Instruction Fuzzy Hash: 6E01D4746081406BEF12FB65E842B5D3FA89B55308F5080BFF400AB6D3CA3D9D098B2D
      Function 00498544 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 0047D4A8: FreeLibrary.KERNEL32(00000000,00481E0B), ref: 0047D4BE
        • Part of subcall function 0047D178: GetTickCount.KERNEL32 ref: 0047D1C2
        • Part of subcall function 00457294: SendMessageA.USER32(00000000,00000B01,00000000,00000000), ref: 004572B3
      • GetCurrentProcess.KERNEL32(00000001,?,?,?,?,00498E9B), ref: 00498599
      • TerminateProcess.KERNEL32(00000000,00000001,?,?,?,?,00498E9B), ref: 0049859F
      Strings
      • Detected restart. Removing temporary directory., xrefs: 00498553
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: Process$CountCurrentFreeLibraryMessageSendTerminateTick
      • String ID: Detected restart. Removing temporary directory.
      • API String ID: 1717587489-3199836293
      • Opcode ID: d2c555fe38475b9b270f0f71e2b89111a70a52469faa454ad7bc7e2f7a299849
      • Instruction ID: b3a6d679994dc37753ad002194f102b9241ba8c47aa29d79ad17e2efdf9342c2
      • Opcode Fuzzy Hash: d2c555fe38475b9b270f0f71e2b89111a70a52469faa454ad7bc7e2f7a299849
      • Instruction Fuzzy Hash: 2AE0E5726086407EDA1173BABC129177F6CDB863787A2887FF80882592D92D4808C53D
      Function 00455674 Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000001.00000002.2004151701.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.2004072506.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2004502208.000000000049A000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005667188.000000000049B000.00000008.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2005692508.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
      • Associated: 00000001.00000002.2006214767.00000000004AC000.00000002.00000001.01000000.00000004.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_1_2_400000_httrack_x64-3.jbxd
      Similarity
      • API ID: ErrorLastSleep
      • String ID:
      • API String ID: 1458359878-0
      • Opcode ID: e961e6e228940e55bd67ca7864a7284e72df75448fb2e05e98589adfe79b6d05
      • Instruction ID: f31041694d7e6b08a2ea33ec2b58b28b25921f40701f973673b956735a8b67d8
      • Opcode Fuzzy Hash: e961e6e228940e55bd67ca7864a7284e72df75448fb2e05e98589adfe79b6d05
      • Instruction Fuzzy Hash: 42F02B32705F58A78B21B56A889157FB2A8DB81366750012BFC0CD7313C878CC058BBC

      Execution Graph

      Execution Coverage:1.9%
      Dynamic/Decrypted Code Coverage:13.5%
      Signature Coverage:9.1%
      Total number of Nodes:1710
      Total number of Limit Nodes:124
      execution_graph 155671 665dd55c 155674 665dd5b4 155671->155674 155673 665dd59f 155683 66599d88 155674->155683 155676 665dd5f5 155699 66593aac 155676->155699 155678 665dd648 155678->155673 155681 66585044 __swprintf_l 43 API calls 155681->155678 155713 665904fc 155683->155713 155685 66599da1 155686 66599db5 memset 155685->155686 155687 66599dad 155685->155687 155688 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 155686->155688 155687->155676 155689 66599ddd 155688->155689 155692 66599e25 155689->155692 155723 66594854 54 API calls Concurrency::details::ExternalContextBase::~ExternalContextBase 155689->155723 155691 66599e4f 155694 66599e81 155691->155694 155725 66594854 54 API calls Concurrency::details::ExternalContextBase::~ExternalContextBase 155691->155725 155692->155691 155724 66594854 54 API calls Concurrency::details::ExternalContextBase::~ExternalContextBase 155692->155724 155696 66599eb3 155694->155696 155697 66599c4c 53 API calls 155694->155697 155696->155687 155718 66599c4c 155696->155718 155697->155696 155700 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 155699->155700 155701 66593b22 155700->155701 155707 66593b52 155701->155707 155802 66593924 155701->155802 155703 66593b67 155807 6659b6bc 155703->155807 155707->155678 155708 66585044 155707->155708 155709 6658507c malloc 155708->155709 155710 6658508a 155709->155710 155711 6658505c 155709->155711 155710->155681 155711->155709 155711->155710 155819 665905cc 155711->155819 155726 665913c8 155713->155726 155715 66590513 155717 6659053a 155715->155717 155740 66591590 155715->155740 155717->155685 155780 6666548c 155718->155780 155721 66599c83 LoadIconA 155722 66599c94 155721->155722 155723->155692 155724->155691 155725->155694 155727 665913f6 155726->155727 155728 66591445 EnterCriticalSection 155727->155728 155737 6659141e 155727->155737 155766 66590d2c TlsAlloc InitializeCriticalSection 155727->155766 155729 6659145d 155728->155729 155730 66591495 LeaveCriticalSection 155728->155730 155729->155730 155732 66591462 TlsGetValue 155729->155732 155739 665914a1 155730->155739 155734 66591489 LeaveCriticalSection 155732->155734 155735 66591470 155732->155735 155734->155739 155735->155734 155736 66591475 LeaveCriticalSection 155735->155736 155736->155739 155748 66590dfc EnterCriticalSection 155737->155748 155738 66591439 155738->155728 155739->155715 155741 665915b2 155740->155741 155742 665915d5 155740->155742 155769 665d33d0 155741->155769 155742->155717 155749 66590e2e 155748->155749 155750 66590f4a LeaveCriticalSection 155749->155750 155752 66590eaa GlobalHandle GlobalUnlock 155749->155752 155753 66590e7f 155749->155753 155750->155738 155755 66590ed8 GlobalReAlloc 155752->155755 155756 66590ecd 155752->155756 155754 66590e9b GlobalAlloc 155753->155754 155767 665839c4 43 API calls __swprintf_l 155753->155767 155758 66590eea 155754->155758 155755->155758 155768 665839c4 43 API calls __swprintf_l 155756->155768 155762 66590f17 GlobalLock memset 155758->155762 155763 66590ef8 GlobalHandle GlobalLock 155758->155763 155764 66590f07 LeaveCriticalSection 155758->155764 155760 66590e9a 155760->155754 155761 66590ed7 155761->155755 155762->155750 155763->155764 155765 66590f16 155764->155765 155765->155762 155766->155737 155767->155760 155768->155761 155771 665d33e2 155769->155771 155770 665d33f6 155773 665d3444 EnterCriticalSection 155770->155773 155774 665d3407 EnterCriticalSection 155770->155774 155771->155770 155777 665d3320 155771->155777 155775 665d341e InitializeCriticalSection 155774->155775 155776 665d3437 LeaveCriticalSection 155774->155776 155775->155776 155776->155773 155778 665d332e InitializeCriticalSection 155777->155778 155779 665d334b 155777->155779 155778->155779 155779->155770 155781 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 155780->155781 155782 666654ab 155781->155782 155783 666654d9 155782->155783 155784 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 155782->155784 155785 665d33d0 Concurrency::details::ExternalContextBase::~ExternalContextBase 5 API calls 155783->155785 155786 666654b9 FindResourceExA 155784->155786 155788 666654e0 155785->155788 155786->155783 155801 66599c6e LoadIconA 155786->155801 155787 66665528 LeaveCriticalSection 155789 66665541 FindResourceA 155787->155789 155792 66665559 155787->155792 155788->155787 155790 666654fb FindResourceA 155788->155790 155789->155792 155789->155801 155790->155788 155793 66665512 LeaveCriticalSection 155790->155793 155791 66665580 155794 665d33d0 Concurrency::details::ExternalContextBase::~ExternalContextBase 5 API calls 155791->155794 155792->155791 155795 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 155792->155795 155793->155801 155797 66665587 155794->155797 155796 66665564 FindResourceA 155795->155796 155796->155791 155796->155801 155798 666655bd LeaveCriticalSection 155797->155798 155800 666655a2 FindResourceExA 155797->155800 155799 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 155798->155799 155799->155801 155800->155793 155800->155797 155801->155721 155801->155722 155803 665913c8 Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 155802->155803 155804 66593944 155803->155804 155805 6659395f GetCurrentThreadId SetWindowsHookExA 155804->155805 155806 66593985 155804->155806 155805->155806 155806->155703 155808 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 155807->155808 155809 6659b6ee 155808->155809 155810 66593bdf 155809->155810 155811 6659b716 CreateWindowExA 155809->155811 155816 665939a0 155810->155816 155811->155810 155812 6659b795 155811->155812 155813 6659b7ab 155812->155813 155814 6659b7a1 GetLastError 155812->155814 155813->155810 155815 6659b7c6 SetLastError 155813->155815 155814->155813 155815->155810 155817 665913c8 Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 155816->155817 155818 665939b7 155817->155818 155818->155707 155820 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 155819->155820 155821 665905d5 155820->155821 155822 665913c8 Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 155821->155822 155823 665905e8 155822->155823 155823->155711 155824 89be00 155825 89be12 155824->155825 155828 89beb6 155825->155828 155829 841da0 33 API calls 155825->155829 155854 89be3e 155825->155854 155827 89c2ab 155860 841da0 155828->155860 155829->155828 155833 89bedc 155834 841da0 33 API calls 155833->155834 155835 89bef6 155834->155835 155837 89bf11 155835->155837 155874 89ce40 155835->155874 155838 89bf9a 155837->155838 155954 89b990 38 API calls 155837->155954 155840 841da0 33 API calls 155838->155840 155842 89c047 155838->155842 155840->155842 155844 89c17f 155842->155844 155955 8a2280 34 API calls 155842->155955 155956 8a24f0 33 API calls 155842->155956 155957 8a2280 34 API calls 155844->155957 155846 89c1fd 155958 8a24f0 33 API calls 155846->155958 155847 89c194 155847->155846 155848 841da0 33 API calls 155847->155848 155848->155846 155850 89c24e 155959 8a2590 34 API calls 155850->155959 155851 89c228 155851->155850 155853 841da0 33 API calls 155851->155853 155853->155850 155962 915b20 10 API calls 155854->155962 155855 89c258 155855->155854 155856 89c26b 155855->155856 155960 89eb00 34 API calls 155856->155960 155858 89c28a 155961 89ef20 34 API calls 155858->155961 155861 841dba 155860->155861 155862 841df9 155861->155862 155963 8413d0 33 API calls 155861->155963 155870 841600 155862->155870 155864 841ddc 155865 841de1 155864->155865 155866 841dfb 155864->155866 155964 8412d0 33 API calls 155865->155964 155965 841a40 29 API calls 155866->155965 155868 841e1b raise _exit 155868->155862 155871 84160c 155870->155871 155872 841646 GetCurrentThreadId 155871->155872 155873 841632 155871->155873 155872->155833 155873->155833 155966 932430 155874->155966 155876 89ce64 GetVersionExW LoadLibraryW LoadLibraryW LoadLibraryExW 155877 89ceef GetProcAddress GetProcAddressForCaller 155876->155877 155878 89cf15 155876->155878 155877->155878 155879 89cf97 155878->155879 155880 89cf23 NetStatisticsGet 155878->155880 155881 89cfad 155879->155881 155882 89cfa4 FreeLibrary 155879->155882 155884 89cf43 155880->155884 155885 89cf62 NetStatisticsGet 155880->155885 155883 89cfb2 GetProcAddress GetProcAddress GetProcAddress 155881->155883 155902 89cfed 155881->155902 155882->155881 155883->155902 155886 89c9e0 34 API calls 155884->155886 155885->155879 155887 89cf82 155885->155887 155889 89cf5a 155886->155889 155890 89c9e0 34 API calls 155887->155890 155888 89d0cf 155891 89d0f0 155888->155891 155892 89d0e7 FreeLibrary 155888->155892 155889->155885 155890->155879 155893 89d0fa 155891->155893 155894 89d107 LoadLibraryW 155891->155894 155892->155891 155982 8418b0 18 API calls 155893->155982 155896 89d1fe 155894->155896 155897 89d120 GetProcAddress GetProcAddress GetProcAddress 155894->155897 155900 89d709 155896->155900 155901 89d20c 12 API calls 155896->155901 155899 89d15e 155897->155899 155911 89d179 155897->155911 155898 89d0ff 155898->155894 155898->155896 155909 89c9e0 34 API calls 155899->155909 155972 89cb50 155900->155972 155904 89d33b 155901->155904 155905 89d6fe FreeLibrary 155901->155905 155902->155888 155913 89c9e0 34 API calls 155902->155913 155920 89d05b 155902->155920 155904->155905 155922 89d3a8 CreateToolhelp32Snapshot 155904->155922 155905->155900 155906 89d1cd 155908 89d1f5 FreeLibrary 155906->155908 155917 89c9e0 34 API calls 155906->155917 155908->155896 155909->155911 155910 89c9e0 34 API calls 155912 89d73a GetCurrentProcessId 155910->155912 155911->155906 155916 89c9e0 34 API calls 155911->155916 155914 89c9e0 34 API calls 155912->155914 155913->155920 155915 89d757 155914->155915 155983 915b20 10 API calls 155915->155983 155916->155906 155917->155908 155919 89d76c 155919->155837 155920->155888 155921 89c9e0 34 API calls 155920->155921 155921->155888 155922->155905 155923 89d3c5 155922->155923 155924 89d403 Heap32ListFirst 155923->155924 155925 89d3f7 GetTickCount 155923->155925 155926 89d569 155924->155926 155940 89d418 155924->155940 155925->155924 155927 89d57d GetTickCount 155926->155927 155928 89d585 Process32First 155926->155928 155927->155928 155930 89d5ef 155928->155930 155934 89d59e 155928->155934 155933 89d606 GetTickCount 155930->155933 155942 89d60e 155930->155942 155932 89c9e0 34 API calls 155932->155934 155933->155942 155934->155930 155934->155932 155945 89d5de GetTickCount 155934->155945 155935 89d53b Heap32ListNext 155935->155926 155935->155940 155936 89c9e0 34 API calls 155937 89d4d8 Heap32Next 155936->155937 155937->155940 155938 89d551 GetTickCount 155938->155926 155938->155940 155939 89d66e 155941 89d681 GetTickCount 155939->155941 155950 89d689 155939->155950 155940->155926 155940->155935 155940->155936 155940->155938 155944 89d4eb GetTickCount 155940->155944 155968 89c9e0 155940->155968 155941->155950 155942->155939 155943 89c9e0 34 API calls 155942->155943 155952 89d65f GetTickCount 155942->155952 155943->155942 155944->155940 155945->155934 155946 89d5ed 155945->155946 155946->155930 155947 89d6e1 155948 89d6ee 155947->155948 155949 89d6f5 CloseHandle 155947->155949 155948->155905 155949->155905 155950->155947 155951 89c9e0 34 API calls 155950->155951 155953 89d6d2 GetTickCount 155950->155953 155951->155950 155952->155939 155952->155942 155953->155947 155953->155950 155954->155837 155955->155842 155956->155842 155957->155847 155958->155851 155959->155855 155960->155858 155961->155854 155962->155827 155963->155864 155964->155862 155965->155868 155967 93245a 155966->155967 155967->155876 155967->155967 155969 89c9f0 155968->155969 155984 89c850 155969->155984 155971 89ca06 Heap32First 155971->155940 155973 89cb5a 155972->155973 155974 89cb99 GetTickCount 155973->155974 155975 89cb66 QueryPerformanceCounter 155973->155975 155978 89c9e0 34 API calls 155974->155978 155976 89cb7d 155975->155976 155977 89cb75 155975->155977 155979 89c9e0 34 API calls 155976->155979 155977->155974 155980 89cbb6 GlobalMemoryStatus 155978->155980 155981 89cb90 155979->155981 155980->155910 155981->155974 155981->155980 155982->155898 155983->155919 155985 89c85a 155984->155985 155986 89c897 155985->155986 155988 901b80 34 API calls 155985->155988 155986->155971 155988->155986 155990 665f2050 155991 665f20cb sprintf_s WritePrivateProfileStringA 155990->155991 155992 665f2081 155990->155992 155995 665f208e 155991->155995 155997 665f1b24 155992->155997 155996 665f2092 RegSetValueExA RegCloseKey 155996->155995 156002 665f1a18 RegOpenKeyExA 155997->156002 156000 665f1b8b 156000->155995 156000->155996 156001 665f1b44 RegCreateKeyExA RegCloseKey 156001->156000 156003 665f1a5f RegCreateKeyExA 156002->156003 156004 665f1aea 156002->156004 156003->156004 156007 665f1aa8 RegCreateKeyExA 156003->156007 156005 665f1afd 156004->156005 156006 665f1af7 RegCloseKey 156004->156006 156008 665f1b0a RegCloseKey 156005->156008 156009 665f1b10 156005->156009 156006->156005 156007->156004 156008->156009 156009->156000 156009->156001 156010 665b6094 SendMessageA 156011 665f2350 156012 665f235e 156011->156012 156013 665f236b 156011->156013 156015 665db170 156012->156015 156016 665db196 156015->156016 156018 665db1ab 156015->156018 156099 665f0e34 58 API calls 156016->156099 156019 665db214 156018->156019 156030 665bb81c 44 API calls 156018->156030 156075 665d82f0 156019->156075 156020 665db1a6 156020->156013 156022 665db1cc 156031 665bb9a4 156022->156031 156025 665db1fd 156100 665bb240 44 API calls Concurrency::details::ExternalContextBase::~ExternalContextBase 156025->156100 156026 665db216 156101 665bb240 44 API calls Concurrency::details::ExternalContextBase::~ExternalContextBase 156026->156101 156030->156022 156032 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 156031->156032 156033 665bb9d7 156032->156033 156034 665bba19 156033->156034 156035 6666548c 51 API calls 156033->156035 156036 665bba1e LockResource 156034->156036 156038 665bba2a 156034->156038 156037 665bb9f4 FindResourceA LoadResource 156035->156037 156036->156038 156037->156034 156039 665bba2f 156038->156039 156102 665bb8e0 156038->156102 156039->156025 156039->156026 156042 665939a0 43 API calls 156043 665bba4d 156042->156043 156044 665bbb00 156043->156044 156045 665bba76 GetDesktopWindow 156043->156045 156047 66593924 45 API calls 156044->156047 156045->156044 156046 665bba85 IsWindowEnabled 156045->156046 156046->156044 156048 665bba92 EnableWindow 156046->156048 156049 665bbb13 156047->156049 156050 665905cc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 156048->156050 156111 6659324c 156049->156111 156055 665bbaae 156050->156055 156055->156044 156172 665d4170 156055->156172 156056 665bbb84 156059 665bbbbe 156056->156059 156180 665d41a8 EnableWindow 156056->156180 156057 665bbb5b 156057->156056 156176 665d40bc 156057->156176 156060 665bbbc3 EnableWindow 156059->156060 156061 665bbbd1 156059->156061 156060->156061 156065 665bbbeb 156061->156065 156066 665bbbd6 GetActiveWindow 156061->156066 156166 66593fb4 156065->156166 156066->156065 156069 665bbbe2 SetActiveWindow 156066->156069 156069->156065 156076 665d8324 156075->156076 156077 665d832c 156076->156077 156078 665d8343 156076->156078 156440 665f0e34 58 API calls 156077->156440 156417 665d7990 memset 156078->156417 156081 665d8394 156083 665d8399 156081->156083 156084 665d83e3 156081->156084 156082 665d8370 156441 665f0e34 58 API calls 156082->156441 156421 665d8488 156083->156421 156086 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 156084->156086 156087 665d83e8 156086->156087 156088 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 156087->156088 156089 665d83ed 156088->156089 156092 665d842f 156089->156092 156093 665d8413 156089->156093 156090 665d83a8 156091 665d833c 156090->156091 156430 6659cd28 156090->156430 156091->156020 156443 6659b300 43 API calls Concurrency::details::ExternalContextBase::~ExternalContextBase 156092->156443 156442 6659b300 43 API calls Concurrency::details::ExternalContextBase::~ExternalContextBase 156093->156442 156099->156020 156103 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 156102->156103 156104 665bb8f2 156103->156104 156106 665bb901 156104->156106 156199 665f0bd0 43 API calls Concurrency::details::ExternalContextBase::~ExternalContextBase 156104->156199 156182 665f0ee4 156106->156182 156109 66593924 45 API calls 156110 665bb92b 156109->156110 156110->156042 156203 6659319c 156111->156203 156117 6659327f 156118 665bb52c 156117->156118 156119 665bb56c 156118->156119 156120 665bb567 156118->156120 156122 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 156119->156122 156121 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 156120->156121 156121->156119 156123 665bb575 156122->156123 156124 66599d88 65 API calls 156123->156124 156125 665bb598 156124->156125 156126 66599d88 65 API calls 156125->156126 156128 665bb5a2 156126->156128 156127 665bb5bc 156127->156056 156127->156057 156144 665d3cfc 156127->156144 156128->156127 156129 665bb666 156128->156129 156236 665c67bc GlobalAlloc GlobalLock memcpy_s GlobalUnlock wcslen 156128->156236 156131 66593924 45 API calls 156129->156131 156132 665bb679 CreateDialogIndirectParamA 156131->156132 156138 665bb6be 156132->156138 156133 665bb633 156237 665c6f38 14 API calls 156133->156237 156136 665bb646 156136->156129 156137 665bb65a GlobalLock 156136->156137 156137->156129 156139 665939a0 43 API calls 156138->156139 156140 665bb711 156139->156140 156141 665bb738 156140->156141 156142 665bb72c DestroyWindow 156140->156142 156141->156127 156143 665bb73d GlobalUnlock GlobalFree 156141->156143 156142->156141 156143->156127 156145 665bbb44 156144->156145 156146 665d3d0a GetWindowLongA 156144->156146 156147 66599a74 156145->156147 156146->156145 156148 66599aac GetParent 156147->156148 156149 66599aa7 156147->156149 156152 6658f9d0 43 API calls 156148->156152 156151 665d3cfc GetWindowLongA 156149->156151 156151->156148 156160 66599acf 156152->156160 156153 66599ad5 PeekMessageA 156153->156160 156155 66599bdb 156249 665eff3c 44 API calls Concurrency::details::ExternalContextBase::~ExternalContextBase 156155->156249 156157 66599b34 SendMessageA 156157->156160 156160->156153 156160->156155 156160->156157 156161 66599b19 SendMessageA 156160->156161 156162 665d4138 ShowWindow 156160->156162 156164 66599bcf 156160->156164 156165 66599bb3 PeekMessageA 156160->156165 156238 665d4138 156160->156238 156241 665edcc0 156160->156241 156161->156160 156163 66599b85 UpdateWindow 156162->156163 156163->156160 156164->156057 156165->156160 156167 66593fc9 156166->156167 156168 665905cc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 156167->156168 156169 66593fe1 156167->156169 156171 66593fd2 156167->156171 156168->156169 156170 66594018 DestroyWindow 156169->156170 156169->156171 156170->156171 156181 665bb940 45 API calls Concurrency::details::ExternalContextBase::~ExternalContextBase 156171->156181 156173 665d417e IsWindowEnabled 156172->156173 156174 665bbaf2 156172->156174 156173->156174 156174->156044 156175 665d41a8 EnableWindow 156174->156175 156175->156044 156177 665d40fe 156176->156177 156178 665d40ce SetWindowPos 156176->156178 156177->156056 156178->156177 156180->156059 156181->156039 156183 665f0f4a GetWindowLongA 156182->156183 156184 665f0f06 156182->156184 156185 665f0f5e GetParent 156183->156185 156198 665f0f3d 156183->156198 156200 6658f9d0 156184->156200 156185->156183 156185->156198 156187 665f0f8b 156191 665f0f95 GetLastActivePopup 156187->156191 156193 665f0fa1 156187->156193 156188 665f0f7a GetParent 156188->156187 156188->156188 156189 665f0f0b 156190 665f0f17 156189->156190 156192 665905cc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 156189->156192 156190->156183 156190->156198 156191->156193 156192->156190 156194 665bb920 156193->156194 156195 665f0fab IsWindowEnabled 156193->156195 156194->156109 156195->156194 156196 665f0fb8 156195->156196 156196->156194 156197 665f0fbd EnableWindow 156196->156197 156197->156194 156198->156187 156198->156188 156199->156106 156201 665913c8 Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 156200->156201 156202 6658f9e7 156201->156202 156202->156189 156204 665905cc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 156203->156204 156205 665931bc 156204->156205 156206 665905cc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 156205->156206 156213 6659322d 156205->156213 156207 665931d0 156206->156207 156208 66585044 __swprintf_l 43 API calls 156207->156208 156209 665931e9 156208->156209 156210 66593221 156209->156210 156226 665a4f18 free 156209->156226 156211 665905cc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 156210->156211 156211->156213 156214 665a5044 156213->156214 156215 665a5073 156214->156215 156221 66593271 156214->156221 156216 665905cc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 156215->156216 156215->156221 156217 665a50b6 156216->156217 156227 66591738 156217->156227 156219 665a50d2 156220 665905cc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 156219->156220 156220->156221 156222 665d435c 156221->156222 156223 665d4361 156222->156223 156225 665d4391 156222->156225 156224 665d437b GetParent 156223->156224 156223->156225 156224->156225 156225->156117 156226->156210 156228 66591748 156227->156228 156229 66591757 156227->156229 156231 6658eabc 156228->156231 156229->156219 156232 6658eaeb 156231->156232 156233 6658eaca 156231->156233 156233->156232 156234 66585044 __swprintf_l 43 API calls 156233->156234 156235 6658eadc 156234->156235 156235->156229 156236->156133 156237->156136 156239 665d4146 ShowWindow 156238->156239 156240 66599afe UpdateWindow 156238->156240 156239->156240 156240->156160 156242 665905cc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 156241->156242 156243 665edcc9 156242->156243 156244 665edcdd 156243->156244 156245 665edcd2 156243->156245 156246 665edc58 138 API calls 156244->156246 156250 665edc58 156245->156250 156247 665edcdb 156246->156247 156247->156160 156251 6658f9d0 43 API calls 156250->156251 156252 665edc67 GetMessageA 156251->156252 156253 665edcaa 156252->156253 156254 665edc80 156252->156254 156253->156247 156254->156253 156258 665ede1c 156254->156258 156257 665edc96 TranslateMessage DispatchMessageW 156257->156253 156259 665905cc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 156258->156259 156260 665ede2a 156259->156260 156261 665ede33 156260->156261 156262 665ede41 156260->156262 156266 665edd70 156261->156266 156263 665edd70 135 API calls 156262->156263 156264 665edc92 156263->156264 156264->156253 156264->156257 156267 665905cc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 156266->156267 156268 665edd82 156267->156268 156269 665905cc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 156268->156269 156274 665edd9d 156268->156274 156270 665edda9 156269->156270 156275 66596c9c 156270->156275 156273 6659324c 45 API calls 156273->156274 156274->156264 156278 66596cb7 156275->156278 156276 66596cf0 156276->156273 156276->156274 156278->156276 156279 66596cdf GetParent 156278->156279 156284 66593294 156278->156284 156287 665bf228 156278->156287 156304 665940e8 156278->156304 156308 665bb004 156278->156308 156322 665e3224 156278->156322 156279->156278 156285 665905cc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 156284->156285 156286 665932a2 156285->156286 156286->156278 156288 665bf25d GetPropA GlobalLock 156287->156288 156289 665bf254 156287->156289 156290 665bf27f 156288->156290 156291 665bf2e2 156288->156291 156332 665a40c0 156289->156332 156294 665bf2d9 GlobalUnlock 156290->156294 156295 665bf284 SendMessageA 156290->156295 156292 665bf2eb GetAsyncKeyState 156291->156292 156293 665bf32a 156291->156293 156292->156293 156296 665bf2fb 156292->156296 156395 66599a3c 156293->156395 156294->156291 156295->156294 156298 665bf29e GlobalUnlock RemovePropA 156295->156298 156296->156293 156299 665bf310 SendMessageA 156296->156299 156301 665bf2bd GlobalFree 156298->156301 156302 665bf2c6 156298->156302 156299->156293 156300 665bf2d2 156299->156300 156300->156278 156301->156302 156302->156300 156305 66594108 156304->156305 156306 665940ff 156304->156306 156305->156278 156307 665a40c0 104 API calls 156306->156307 156307->156305 156309 665bb03c 156308->156309 156310 665bb033 156308->156310 156399 66596190 156309->156399 156321 665a40c0 104 API calls 156310->156321 156312 665bb107 156313 66599a3c 44 API calls 156312->156313 156317 665bb052 156313->156317 156314 665bb078 GetWindowLongA 156314->156312 156316 665bb08a GetClassNameA CompareStringA 156314->156316 156316->156312 156318 665bb0cc GetDlgItem 156316->156318 156317->156278 156319 665bb0ea SendMessageA 156318->156319 156320 665bb0dd IsWindowEnabled 156318->156320 156319->156317 156320->156312 156320->156319 156321->156309 156323 665e3249 156322->156323 156324 66596190 46 API calls 156323->156324 156330 665e325a 156324->156330 156325 665e3268 156325->156278 156327 665e3295 GetWindow 156327->156325 156328 665e32a9 156327->156328 156329 66599a3c 44 API calls 156328->156329 156329->156325 156330->156325 156330->156327 156405 665a22c4 156330->156405 156412 66595f14 156330->156412 156333 665a40d4 156332->156333 156334 665a4136 GetKeyState 156333->156334 156336 665a4520 156333->156336 156335 665a4148 GetKeyState 156334->156335 156334->156336 156335->156336 156337 665a415d GetKeyState 156335->156337 156338 6659324c 45 API calls 156336->156338 156350 665a41b0 156336->156350 156337->156336 156339 665a4172 156337->156339 156341 665a4539 156338->156341 156340 665905cc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 156339->156340 156342 665a4177 156340->156342 156344 665a4549 GetParent 156341->156344 156348 665a4560 156341->156348 156343 6659324c 45 API calls 156342->156343 156345 665a4183 156343->156345 156347 6659324c 45 API calls 156344->156347 156346 665a41ab 156345->156346 156349 665a4194 GetParent 156345->156349 156346->156350 156352 66596074 47 API calls 156346->156352 156347->156341 156348->156350 156353 66594118 45 API calls 156348->156353 156351 6659324c 45 API calls 156349->156351 156350->156288 156351->156345 156354 665a41dc 156352->156354 156353->156350 156356 665a41ed 156354->156356 156357 665a41f4 GetParent 156354->156357 156361 665a41f2 156354->156361 156355 66585044 __swprintf_l 43 API calls 156359 665a423c 156355->156359 156360 6659324c 45 API calls 156356->156360 156358 6659324c 45 API calls 156357->156358 156358->156361 156362 665a4251 156359->156362 156363 665a34d4 43 API calls 156359->156363 156360->156361 156361->156355 156364 665a429a memset ScreenToClient memset 156361->156364 156394 665a353c 70 API calls 156362->156394 156363->156362 156367 665a4300 156364->156367 156365 665a426b 156365->156350 156366 665a4280 SendMessageA 156365->156366 156366->156364 156368 665a4387 156367->156368 156371 665a4325 156367->156371 156369 665a445c SendMessageA 156368->156369 156370 665a4391 memmove 156368->156370 156374 665a4473 156369->156374 156372 665a43c8 156370->156372 156373 665a43d4 SendMessageA 156370->156373 156375 665a436b 156371->156375 156376 665a432c GetCursorPos SendMessageA 156371->156376 156372->156373 156377 665a4402 SendMessageA 156373->156377 156378 665a43f6 156373->156378 156379 665a401c memmove SendMessageA ScreenToClient SendMessageA 156374->156379 156380 665a4380 156375->156380 156385 665a401c memmove SendMessageA ScreenToClient SendMessageA 156375->156385 156376->156380 156382 665a441c SendMessageA 156377->156382 156383 665a4436 SetWindowPos 156377->156383 156381 665960cc 47 API calls 156378->156381 156384 665a4480 156379->156384 156380->156350 156387 665a4515 free 156380->156387 156386 665a43fe 156381->156386 156382->156383 156383->156374 156388 665a44a4 156384->156388 156389 665a4492 SendMessageA 156384->156389 156385->156380 156386->156374 156386->156377 156387->156350 156390 665a44de 156388->156390 156391 66585044 __swprintf_l 43 API calls 156388->156391 156389->156388 156392 665a44e3 memmove 156390->156392 156393 665a44c8 memset 156391->156393 156392->156380 156393->156392 156394->156365 156396 66599a4a 156395->156396 156397 665d3cb0 44 API calls 156396->156397 156398 66599a64 156396->156398 156397->156398 156398->156300 156400 6659619e 156399->156400 156402 665961d7 156399->156402 156401 66595f14 46 API calls 156400->156401 156400->156402 156404 665961ba 156400->156404 156401->156404 156402->156312 156402->156314 156402->156317 156403 66595f14 46 API calls 156403->156404 156404->156402 156404->156403 156406 665a22e7 156405->156406 156407 665d37c4 9 API calls 156406->156407 156408 665a22f8 156406->156408 156407->156408 156409 665a2cf4 GetParent GetParent 156408->156409 156411 665a2355 156408->156411 156410 665a2341 TranslateAcceleratorA 156409->156410 156410->156411 156411->156330 156413 66595f28 156412->156413 156416 66595f1f 156412->156416 156413->156330 156414 66595f44 GetParent 156415 6659324c 45 API calls 156414->156415 156415->156416 156416->156413 156416->156414 156418 665d79e3 156417->156418 156419 665d79df 156417->156419 156418->156419 156444 665a25c0 156418->156444 156419->156081 156419->156082 156422 665d84c2 156421->156422 156423 665d84f1 sprintf_s strlen 156422->156423 156425 665d8530 156422->156425 156464 6659b3e0 46 API calls __swprintf_l 156423->156464 156427 665d852e 156425->156427 156465 665836b8 43 API calls __swprintf_l 156425->156465 156452 665d5b54 156427->156452 156428 665d8573 156428->156090 156431 6659cd58 156430->156431 156434 6659cd69 156430->156434 156510 66596278 49 API calls 156431->156510 156438 6659ce08 156434->156438 156481 66596328 GetTopWindow 156434->156481 156436 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 156437 6659cdde 156436->156437 156490 665a2a78 156437->156490 156440->156091 156441->156091 156442->156091 156443->156090 156445 665a2604 156444->156445 156449 665a26a2 156445->156449 156450 665836b8 43 API calls __swprintf_l 156445->156450 156447 665a2683 156447->156449 156451 665d228c 48 API calls __swprintf_l 156447->156451 156449->156419 156450->156447 156451->156449 156453 665d5b74 156452->156453 156454 665d5b8f IsWindowVisible 156453->156454 156455 66595f14 46 API calls 156453->156455 156458 665d5bbc 156453->156458 156454->156453 156455->156453 156456 665d5be5 IsWindowVisible 156456->156458 156457 665d5c96 156457->156428 156458->156456 156459 66595f14 46 API calls 156458->156459 156462 665d5c1c 156458->156462 156459->156458 156460 665d5c48 IsWindowVisible 156460->156462 156461 66595f14 46 API calls 156461->156462 156462->156457 156462->156460 156462->156461 156466 665a2d40 156462->156466 156464->156427 156465->156427 156480 665a2cf4 GetParent GetParent 156466->156480 156482 665963e2 156481->156482 156483 66596352 156481->156483 156482->156436 156484 66596388 SendMessageA 156483->156484 156485 66593294 43 API calls 156483->156485 156486 665963c8 GetWindow 156483->156486 156487 6659639e GetTopWindow 156483->156487 156489 66596328 222 API calls 156483->156489 156511 66592f6c 156483->156511 156484->156483 156485->156483 156486->156482 156486->156483 156487->156483 156487->156486 156489->156486 156491 665d3cfc GetWindowLongA 156490->156491 156492 665a2a96 156491->156492 157248 665a2cf4 GetParent GetParent 156492->157248 156510->156434 156512 665913c8 Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 156511->156512 156513 66592fb4 156512->156513 156514 66592fd3 memmove 156513->156514 156515 66593014 156514->156515 156516 6659303c GetWindowRect 156515->156516 156517 66593054 156515->156517 156518 665d3cfc GetWindowLongA 156516->156518 156525 66594e64 156517->156525 156530 665a5c78 156517->156530 156518->156517 156519 6659306c 156520 66593087 memmove 156519->156520 156544 66592da8 156519->156544 156520->156483 156556 66594ed8 156525->156556 156526 66594e9c 156527 66594ea0 DefMDIChildProcA 156526->156527 156528 66594eb6 156526->156528 156527->156528 156528->156519 156531 665a5db1 156530->156531 156532 665a5ca5 156530->156532 156533 66594e64 189 API calls 156531->156533 156532->156531 156536 665a5cc0 156532->156536 156534 665a5cde 156533->156534 156534->156519 156535 665a5d13 156537 665a5d29 156535->156537 156538 665a5d1c GetParent 156535->156538 156536->156534 156536->156535 156539 665a5cfc SendMessageA 156536->156539 156540 6659324c 45 API calls 156537->156540 156538->156537 156539->156534 156541 665a5d2e SendMessageA 156540->156541 156541->156534 156542 665a5d4d 156541->156542 156542->156534 156543 66594e64 189 API calls 156542->156543 156543->156534 156545 665d3cfc GetWindowLongA 156544->156545 156546 66592dbd 156545->156546 156547 66592e28 156546->156547 156548 66592dc4 GetWindowRect 156546->156548 156547->156520 156548->156547 156549 66592ddd 156548->156549 156549->156547 156550 66592de6 GetWindow 156549->156550 156551 6659324c 45 API calls 156550->156551 156552 66592dfd 156551->156552 156553 66592e0a 156552->156553 156554 665d4170 IsWindowEnabled 156552->156554 156553->156547 157211 665993e0 156553->157211 156554->156553 156557 66594f28 156556->156557 156558 66594f4c 156556->156558 156712 66595d30 156557->156712 156559 66594f7a 156558->156559 156560 66594f51 156558->156560 156561 66594f95 156559->156561 156562 6659324c 45 API calls 156559->156562 156621 66594f37 156560->156621 156720 665be5c8 156560->156720 156563 66594f9a 156561->156563 156568 66594fbe 156561->156568 156564 66594f87 156562->156564 156937 66592ee4 49 API calls 156563->156937 156732 66592e3c 156564->156732 156567 66594fb0 156567->156568 156569 66594fb4 156567->156569 156570 665d33d0 Concurrency::details::ExternalContextBase::~ExternalContextBase 5 API calls 156568->156570 156568->156621 156569->156621 156571 66595051 156570->156571 156573 66595068 156571->156573 156577 6659509c 156571->156577 156572 66595c9d 156941 665d3468 LeaveCriticalSection 156572->156941 156938 665d3468 LeaveCriticalSection 156573->156938 156576 66595140 156939 665d3468 LeaveCriticalSection 156576->156939 156577->156572 156577->156576 156583 66595c50 156577->156583 156940 665d3468 LeaveCriticalSection 156583->156940 156621->156526 156713 66595dd5 156712->156713 156717 66595d5c 156712->156717 156715 665913c8 Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 156713->156715 156714 66595d60 156714->156621 156716 66595de8 156715->156716 156716->156714 156950 66596d78 45 API calls Concurrency::details::ExternalContextBase::~ExternalContextBase 156716->156950 156717->156714 156942 665bb134 156717->156942 156721 665be5ea 156720->156721 156722 665be5fe GetParent 156721->156722 156723 665be611 156721->156723 156731 665be60a 156721->156731 156722->156723 156722->156731 156724 665be719 156723->156724 156725 665be640 156723->156725 156723->156731 156962 665be4d0 46 API calls 156724->156962 156726 665be64b 156725->156726 156727 665be6ff SendMessageA 156725->156727 156729 665be66b GetParent 156726->156729 156726->156731 156727->156731 156730 6659324c 45 API calls 156729->156730 156730->156731 156731->156621 156733 665d3cfc GetWindowLongA 156732->156733 156734 66592e5e 156733->156734 156735 66592ec9 156734->156735 156736 66592e79 IsWindow 156734->156736 156737 66592e87 156734->156737 156735->156561 156736->156737 156737->156735 156738 66592eb2 SendMessageA 156737->156738 156738->156735 156937->156567 156951 665d5190 156942->156951 156944 665bb16a 156944->156714 156946 665bb188 GetParent 156947 6659324c 45 API calls 156946->156947 156948 665bb19a 156947->156948 156948->156944 156949 665905cc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 156948->156949 156949->156944 156950->156717 156952 665d51fe 156951->156952 156953 665d51bb 156951->156953 156958 665d528c 156952->156958 156959 665d5208 156952->156959 156954 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 156953->156954 156955 665d51c0 156954->156955 156956 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 156955->156956 156957 665bb166 156956->156957 156957->156944 156957->156946 156958->156957 156960 665d5008 55 API calls 156958->156960 156959->156957 156961 665d524f memcmp 156959->156961 156960->156957 156961->156959 156962->156731 157212 665d3cfc GetWindowLongA 157211->157212 157213 665993fd 157212->157213 157214 66599404 157213->157214 157216 6659941c GetWindow 157213->157216 157217 66599414 GetParent 157213->157217 157215 6659944a GetWindowRect 157214->157215 157218 6659954a GetParent GetClientRect GetClientRect MapWindowPoints 157215->157218 157219 66599463 157215->157219 157220 66599427 157216->157220 157217->157220 157221 6659958a 157218->157221 157222 66599468 GetWindowLongA 157219->157222 157224 6659947c 157219->157224 157220->157215 157223 6659942f SendMessageA 157220->157223 157230 665d40bc SetWindowPos 157221->157230 157222->157224 157223->157215 157225 665994f9 GetWindowRect 157224->157225 157226 66599491 157224->157226 157246 66592148 7 API calls 157225->157246 157227 665905cc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 157226->157227 157229 66599496 157227->157229 157244 66592148 7 API calls 157229->157244 157232 66599640 157230->157232 157231 66599514 157233 66599528 GetMonitorInfoA 157231->157233 157234 66599530 157231->157234 157232->156547 157235 66599535 CopyRect 157233->157235 157247 66592218 SystemParametersInfoA GetSystemMetrics GetSystemMetrics strncpy_s 157234->157247 157235->157221 157239 665994c3 157240 665994df 157239->157240 157241 665994d7 GetMonitorInfoA 157239->157241 157245 66592218 SystemParametersInfoA GetSystemMetrics GetSystemMetrics strncpy_s 157240->157245 157243 665994e4 CopyRect 157241->157243 157243->157235 157244->157239 157245->157243 157246->157231 157247->157235 157249 80d210 157250 80d225 157249->157250 157251 80d265 157250->157251 157252 80d235 #252 157250->157252 157289 80de10 157251->157289 157254 80d26a 157255 80d2d1 #188 157254->157255 157256 80d26e #252 157254->157256 157257 80d290 #252 157255->157257 157258 80d2f0 memset 157255->157258 157256->157257 157259 80d2b2 157257->157259 157260 80d323 157258->157260 157261 80d2bf 157259->157261 157335 80adb0 31 API calls 157259->157335 157296 80def0 157260->157296 157264 80d3b3 157264->157257 157303 811ef0 157264->157303 157266 80d442 157267 80d6c1 #252 157266->157267 157268 80d454 #1654 157266->157268 157267->157259 157268->157267 157269 80d461 #3437 157268->157269 157269->157257 157270 80d476 #316 157269->157270 157271 80d4b3 #316 157270->157271 157272 80d48e #252 157270->157272 157273 80d4f0 #316 157271->157273 157274 80d4cb #252 157271->157274 157272->157259 157275 80d508 #252 157273->157275 157276 80d52d #2411 157273->157276 157274->157259 157275->157259 157276->157257 157277 80d542 #1027 157276->157277 157278 80d571 #2206 157277->157278 157279 80d565 157277->157279 157281 80d5c8 157278->157281 157282 80d59e #464 157278->157282 157336 812e10 8 API calls 157279->157336 157285 80d60b #188 157281->157285 157282->157281 157284 80d5b3 #464 157282->157284 157283 80d56a 157283->157278 157284->157281 157285->157257 157286 80d63c #188 157285->157286 157287 80d677 #181 157286->157287 157288 80d688 157286->157288 157287->157257 157337 81b320 157289->157337 157291 80de1a #187 157292 80decb #187 157291->157292 157293 80de4b #187 #187 157291->157293 157292->157254 157294 80de83 157293->157294 157295 80dea6 #187 157293->157295 157294->157295 157295->157254 157297 81b320 157296->157297 157298 80defc #188 157297->157298 157299 80df45 memset 157298->157299 157300 80df1d #252 157298->157300 157301 81a42e 157299->157301 157300->157264 157302 80df6b #333 #333 #333 157301->157302 157302->157264 157305 811f03 157303->157305 157304 812713 157304->157266 157305->157304 157339 810e90 #4320 #2478 #4383 #4320 #2478 157305->157339 157307 811f6f #188 157309 811f9a #252 157307->157309 157314 811fc1 157307->157314 157310 812586 157309->157310 157310->157266 157312 81267a #181 157316 812689 157312->157316 157313 812525 #188 157317 812554 #181 #252 157313->157317 157318 8125a6 157313->157318 157340 8116e0 #188 #252 memset #181 157314->157340 157315 8124b3 157315->157312 157315->157313 157319 8126ad #181 #903 157316->157319 157320 812699 #910 157316->157320 157317->157310 157323 8125dd strncmp 157318->157323 157321 8126c5 #905 157319->157321 157322 8126d4 157319->157322 157320->157316 157321->157322 157324 8126e1 157322->157324 157325 8126dc #905 157322->157325 157326 812610 157323->157326 157327 8125f7 157323->157327 157328 8126f1 #911 #1671 157324->157328 157329 8126ec #905 157324->157329 157325->157324 157331 812661 #181 157326->157331 157342 811880 8 API calls 157326->157342 157341 811880 8 API calls 157327->157341 157328->157304 157329->157328 157331->157312 157333 81266d #2411 157331->157333 157333->157312 157333->157316 157334 81265f 157334->157331 157335->157261 157336->157283 157338 81b34a 157337->157338 157338->157291 157338->157338 157339->157307 157340->157315 157341->157326 157342->157334 157343 80ddd0 157344 80ddda 157343->157344 157345 818d89 157344->157345 157346 818d7b #247 157344->157346 157346->157345 157347 665a5248 157348 665905cc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 157347->157348 157349 665a527a 157348->157349 157350 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 157349->157350 157351 665a5283 157350->157351 157360 665f0398 SetErrorMode SetErrorMode 157351->157360 157354 665a52ad 157357 665a52c2 157354->157357 157379 665ee508 157354->157379 157356 665a52fc 157386 665f0850 50 API calls Concurrency::details::ExternalContextBase::~ExternalContextBase 157357->157386 157361 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 157360->157361 157362 665f03ca 157361->157362 157387 6658fd64 157362->157387 157364 665f03da 157365 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 157364->157365 157366 665f03df 157365->157366 157367 665f0401 157366->157367 157401 665f0458 GetModuleFileNameA 157366->157401 157369 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 157367->157369 157370 665f0406 157369->157370 157371 665f0411 GetModuleHandleA 157370->157371 157429 665ee0ec 157370->157429 157373 665a5298 157371->157373 157374 665f0423 GetProcAddress 157371->157374 157373->157354 157373->157357 157375 665ef4c4 157373->157375 157374->157373 157376 665ef4db 157375->157376 157464 665ef394 157376->157464 157380 6658f9d0 43 API calls 157379->157380 157383 665ee529 157380->157383 157381 665ee535 PeekMessageA 157381->157383 157382 665ee5b5 157383->157381 157383->157382 157384 665ee597 PeekMessageA 157383->157384 157385 665edc58 138 API calls 157383->157385 157384->157383 157385->157383 157386->157356 157388 6658fd9a GetModuleHandleA 157387->157388 157389 6658fe21 GetModuleFileNameW 157387->157389 157390 6658fdb9 GetProcAddress GetProcAddress GetProcAddress GetProcAddress 157388->157390 157391 6658fdb3 157388->157391 157392 6658fe51 157389->157392 157393 6658ff10 157389->157393 157390->157389 157391->157390 157394 6658fe6b 157392->157394 157395 6658fe5b SetLastError 157392->157395 157393->157364 157396 6658fea3 CreateActCtxW 157394->157396 157397 6658feb6 157394->157397 157395->157393 157396->157397 157398 6658fee6 157397->157398 157399 6658fed3 CreateActCtxW 157397->157399 157398->157393 157400 6658ff07 CreateActCtxW 157398->157400 157399->157398 157400->157393 157402 665f04b9 157401->157402 157425 665f069a 157401->157425 157404 665f04c4 PathFindExtensionA 157402->157404 157402->157425 157405 665f04dc 157404->157405 157406 665f04d7 157404->157406 157435 665f06d4 PathFindFileNameA lstrlenA _mbsnbcpy_s 157405->157435 157456 665d0330 50 API calls 157406->157456 157407 665f06a5 157407->157367 157410 665f04f8 157411 665f0501 157410->157411 157457 665d0330 50 API calls 157410->157457 157413 665f0526 157411->157413 157414 665f050c _strdup 157411->157414 157415 665f0575 157413->157415 157436 666657f4 157413->157436 157414->157413 157416 665f0629 157415->157416 157418 665f05db strcpy_s 157415->157418 157419 665f05a4 strcpy_s 157415->157419 157416->157407 157420 665f063c strcat_s 157416->157420 157422 665f0612 _strdup 157418->157422 157426 665f05ec 157418->157426 157419->157422 157427 665f05b5 157419->157427 157423 665f0680 _strdup 157420->157423 157428 665f065a 157420->157428 157421 665f0550 _strdup 157421->157415 157422->157416 157423->157407 157423->157425 157458 665d0330 50 API calls 157425->157458 157426->157422 157427->157418 157427->157422 157428->157423 157430 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 157429->157430 157431 665ee0f7 157430->157431 157432 665ee125 157431->157432 157433 6658f9d0 43 API calls 157431->157433 157432->157371 157434 665ee102 GetCurrentThreadId SetWindowsHookExA 157433->157434 157434->157432 157435->157410 157437 66665817 157436->157437 157438 66665894 157436->157438 157437->157438 157441 6666581c 157437->157441 157439 666658b4 SetErrorMode SetErrorMode LocalAlloc 157438->157439 157446 6666590d 157438->157446 157442 666658e1 LocalFree 157439->157442 157453 66665907 157439->157453 157440 66665826 157440->157421 157441->157440 157459 665835f4 FindResourceA LoadResource LockResource SizeofResource 157441->157459 157443 665d3320 Concurrency::details::ExternalContextBase::~ExternalContextBase InitializeCriticalSection 157442->157443 157445 666658ef 157443->157445 157451 6658f9d0 43 API calls 157445->157451 157445->157453 157447 6666592b 157446->157447 157450 6658f79c 43 API calls 157446->157450 157446->157453 157463 665d3358 DeleteCriticalSection DeleteCriticalSection 157447->157463 157448 66665863 WideCharToMultiByte 157448->157440 157450->157447 157452 666658f8 157451->157452 157460 6658f79c 157452->157460 157453->157421 157455 6666584a 157455->157448 157459->157455 157461 665913c8 Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 157460->157461 157462 6658f7c5 157461->157462 157462->157453 157463->157453 157465 665ef48e 157464->157465 157466 665ef3d1 RegOpenKeyExA 157464->157466 157465->157354 157469 665ef3fc 157466->157469 157467 665ef46f RegCloseKey 157467->157469 157468 665ef402 RegQueryValueExA 157468->157469 157469->157465 157469->157466 157469->157467 157469->157468 157470 665a2388 157471 665a23bd 157470->157471 157473 665a23c2 157470->157473 157472 665905cc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 157471->157472 157472->157473 157474 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 157473->157474 157475 665a2443 157474->157475 157476 66593924 45 API calls 157475->157476 157481 665a2471 157475->157481 157477 665a24f0 SendMessageA 157476->157477 157478 665939a0 43 API calls 157477->157478 157479 665a2512 157478->157479 157480 665a2533 BringWindowToTop 157479->157480 157479->157481 157482 665a254b 157480->157482 157483 665a2544 157480->157483 157482->157483 157484 665d4138 ShowWindow 157483->157484 157485 665a2565 SendMessageA SendMessageA 157484->157485 157485->157481 157486 66605e38 157487 6658f9d0 43 API calls 157486->157487 157488 66605e51 157487->157488 157489 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 157488->157489 157490 66605e59 157489->157490 157491 66605e6c OleInitializeWOW 157490->157491 157492 66605e60 157490->157492 157491->157492 157493 66605e83 157491->157493 157494 665905cc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 157493->157494 157495 66605e92 157494->157495 157495->157492 157496 66585044 __swprintf_l 43 API calls 157495->157496 157497 66605eb4 157496->157497 157498 66605ec6 157497->157498 157505 6661b8cc 43 API calls 157497->157505 157500 665905cc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 157498->157500 157501 66605ed5 157500->157501 157503 6661b9ac CoRegisterMessageFilter 157501->157503 157504 6661b9c5 157503->157504 157504->157492 157505->157498 157506 665d8c04 157507 665d8c3a 157506->157507 157508 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 157507->157508 157509 665d8c65 157508->157509 157541 66586708 GetModuleFileNameA 157509->157541 157511 665d9c10 157512 665834a0 43 API calls 157513 665d8c73 _cwprintf_s_l 157512->157513 157513->157511 157513->157512 157514 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 157513->157514 157515 665d8d3e DestroyIcon 157513->157515 157518 665d90a3 strlen 157513->157518 157520 665d90cb strlen 157513->157520 157523 665d9503 strlen 157513->157523 157528 665d94b2 strlen 157513->157528 157530 665d9c05 157513->157530 157534 665d86cc 48 API calls 157513->157534 157538 665d9bfb 157513->157538 157539 665d99a5 _mbscmp 157513->157539 157555 6665fd24 157513->157555 157562 6659b3e0 46 API calls __swprintf_l 157513->157562 157563 66583520 43 API calls __swprintf_l 157513->157563 157571 66583940 157513->157571 157514->157513 157515->157513 157564 6659b3e0 46 API calls __swprintf_l 157518->157564 157565 6659b3e0 46 API calls __swprintf_l 157520->157565 157522 665d90eb strlen 157566 6659b3e0 46 API calls __swprintf_l 157522->157566 157570 6659b3e0 46 API calls __swprintf_l 157523->157570 157567 6659b3e0 46 API calls __swprintf_l 157528->157567 157578 665839c4 43 API calls __swprintf_l 157530->157578 157533 665d94d1 strlen 157568 6659b3e0 46 API calls __swprintf_l 157533->157568 157534->157513 157536 665d94e9 strlen 157569 6659b3e0 46 API calls __swprintf_l 157536->157569 157577 665839c4 43 API calls __swprintf_l 157538->157577 157539->157513 157542 6658675d GetShortPathNameA 157541->157542 157543 66586750 157541->157543 157545 6658678f 157542->157545 157546 66586775 strlen 157542->157546 157544 66583940 __swprintf_l 43 API calls 157543->157544 157544->157542 157548 6658679b strnlen 157545->157548 157549 66586797 157545->157549 157579 665833cc 157546->157579 157548->157549 157554 665867b1 157549->157554 157591 665839c4 43 API calls __swprintf_l 157549->157591 157551 665867e1 157552 665867fa strlen 157551->157552 157553 6658681e 157551->157553 157552->157553 157554->157513 157594 66668a8c 157555->157594 157557 6665fd50 157558 6665fdaf RegQueryValueA 157557->157558 157602 66583520 43 API calls __swprintf_l 157557->157602 157559 665d9940 strnlen 157558->157559 157559->157513 157559->157530 157561 6665fd87 157561->157558 157562->157513 157563->157513 157564->157513 157565->157522 157566->157513 157567->157533 157568->157536 157569->157513 157570->157513 157572 66583956 157571->157572 157575 6658395f 157571->157575 157604 6658383c 157572->157604 157574 6658395d 157574->157513 157575->157574 157612 665838ec 43 API calls __swprintf_l 157575->157612 157577->157530 157578->157511 157580 66583413 157579->157580 157581 665833f3 157579->157581 157582 66583422 157580->157582 157592 665839c4 43 API calls __swprintf_l 157580->157592 157581->157545 157584 6658344a 157582->157584 157587 66583940 __swprintf_l 41 API calls 157582->157587 157585 66583468 memcpy_s 157584->157585 157586 6658345c memmove_s 157584->157586 157588 66583471 157585->157588 157586->157588 157587->157584 157588->157581 157593 665839c4 43 API calls __swprintf_l 157588->157593 157590 66583496 157591->157551 157592->157582 157593->157590 157595 66668abb 157594->157595 157596 66668af9 157595->157596 157597 66668aef strlen 157595->157597 157600 66668ad0 157595->157600 157598 665833cc __swprintf_l 42 API calls 157596->157598 157597->157596 157599 66668aed 157598->157599 157599->157557 157600->157599 157603 665836b8 43 API calls __swprintf_l 157600->157603 157602->157561 157603->157599 157605 6658386a 157604->157605 157613 6658ee4c 157605->157613 157607 66583889 memcpy_s 157609 665838b9 157607->157609 157609->157574 157610 66583888 157610->157607 157612->157574 157614 6658387b 157613->157614 157615 6658ee63 malloc 157613->157615 157614->157607 157616 66586ae0 43 API calls __swprintf_l 157614->157616 157615->157614 157616->157610 157617 66614578 157624 665bbde4 157617->157624 157620 665d3cfc GetWindowLongA 157621 66614594 157620->157621 157622 666145a4 157621->157622 157623 665993e0 70 API calls 157621->157623 157623->157622 157625 665bbdf9 157624->157625 157626 665bbe00 157624->157626 157655 665996ec 157625->157655 157641 6659965c 157626->157641 157629 665bbdfe 157630 665bbe13 157629->157630 157650 66599330 157629->157650 157632 665bbc1c 2 API calls 157630->157632 157634 665bbe1b 157632->157634 157634->157620 157635 665bbe2d 157664 665d3a24 46 API calls 157635->157664 157637 665bbe37 157637->157634 157665 665bbd58 43 API calls Concurrency::details::ExternalContextBase::~ExternalContextBase 157637->157665 157639 665bbe44 157640 665d4138 ShowWindow 157639->157640 157640->157634 157642 6659967d 157641->157642 157643 665996c5 157641->157643 157644 6666548c 51 API calls 157642->157644 157645 665996ec 229 API calls 157643->157645 157646 6659968a FindResourceA 157644->157646 157647 665996b5 157645->157647 157646->157643 157648 665996a4 LoadResource 157646->157648 157647->157629 157648->157647 157649 665996b9 LockResource 157648->157649 157649->157643 157651 6658f9d0 43 API calls 157650->157651 157652 66599358 157651->157652 157666 665bc8c8 157652->157666 157656 6659983c 157655->157656 157663 6659971f 157655->157663 157657 66596328 226 API calls 157656->157657 157658 6659985f 157656->157658 157657->157658 157658->157629 157659 665997a4 memset 157660 66668a8c 43 API calls 157659->157660 157662 665997d2 SendDlgItemMessageA 157660->157662 157661 6659977e SendDlgItemMessageA 157661->157663 157662->157663 157663->157656 157663->157659 157663->157661 157664->157637 157665->157639 157688 665bc048 157666->157688 157668 665bc8e4 157691 665d3a64 157668->157691 157671 665bc9be SendMessageA 157675 6659938e 157671->157675 157676 665bc9d6 157671->157676 157672 665bc902 GetWindowTextLengthA 157673 665bc94f 157672->157673 157674 665bc914 157672->157674 157679 665bc935 GetWindowTextA 157673->157679 157682 66583940 __swprintf_l 43 API calls 157673->157682 157677 665bc92d 157674->157677 157681 66583940 __swprintf_l 43 API calls 157674->157681 157675->157630 157675->157635 157678 665d36c8 5 API calls 157676->157678 157677->157679 157694 665839c4 43 API calls __swprintf_l 157677->157694 157678->157675 157683 665bc98a 157679->157683 157684 665bc98e strnlen 157679->157684 157681->157677 157682->157679 157683->157675 157695 665839c4 43 API calls __swprintf_l 157683->157695 157684->157683 157687 665bc9bd 157687->157671 157689 665d3a64 GetDlgItem 157688->157689 157690 665bc065 157689->157690 157690->157668 157692 665d3a77 GetDlgItem 157691->157692 157693 665bc8f4 157691->157693 157692->157693 157693->157671 157693->157672 157694->157673 157695->157687 157696 6661abf8 157703 665d4f9c 157696->157703 157699 665d33d0 Concurrency::details::ExternalContextBase::~ExternalContextBase 5 API calls 157700 6661ac44 157699->157700 157701 6661acb7 LeaveCriticalSection 157700->157701 157702 6661ac4d GetProfileIntA GetProfileIntA GetPrivateProfileIntA 157700->157702 157702->157701 157704 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 157703->157704 157705 665d4faa 157704->157705 157705->157699 157706 665aa940 157709 665a5e40 DefWindowProcA 157706->157709 157710 665a5f8b 157709->157710 157711 665a5e7d GetWindowRect 157709->157711 157712 665a5ea8 157711->157712 157713 665a5f17 157711->157713 157712->157713 157714 665a5eb2 SetRect InvalidateRect SetRect InvalidateRect 157712->157714 157713->157710 157715 665a5f25 SetRect InvalidateRect SetRect InvalidateRect 157713->157715 157714->157713 157715->157710 157716 8a3d90 157717 8a3d9a 157716->157717 157737 8aba80 37 API calls 157717->157737 157738 665f15c4 157739 665f15ea 157738->157739 157753 665f16cf 157738->157753 157740 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 157739->157740 157739->157753 157741 665f1616 157740->157741 157742 66586708 48 API calls 157741->157742 157743 665f1624 PathFindFileNameA 157742->157743 157744 66668a8c 43 API calls 157743->157744 157746 665f163c 157744->157746 157745 665f165a PathRemoveExtensionA strnlen 157748 665f16fa 157745->157748 157749 665f1677 157745->157749 157746->157745 157747 6658383c __swprintf_l 43 API calls 157746->157747 157752 665f1655 157747->157752 157754 665839c4 43 API calls __swprintf_l 157748->157754 157749->157748 157751 665f1681 GlobalAddAtomW GlobalAddAtomA 157749->157751 157751->157753 157752->157745 157754->157753 157755 66593604 157756 665913c8 Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 157755->157756 157757 6659364f 157756->157757 157758 6659366e CallNextHookEx 157757->157758 157759 66593685 157757->157759 157760 665938f5 157758->157760 157761 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 157759->157761 157762 66593692 157761->157762 157763 665938e0 CallNextHookEx 157762->157763 157764 665936b8 GetClassLongA 157762->157764 157765 66593732 157762->157765 157763->157760 157764->157763 157766 665936d0 157764->157766 157767 6659373b 157765->157767 157768 665937d7 157765->157768 157772 665936dd GlobalGetAtomNameA 157766->157772 157773 66593705 CompareStringA 157766->157773 157789 6658f880 157767->157789 157770 6659385d GetClassLongPtrA 157768->157770 157771 665937e1 memset 157768->157771 157770->157763 157776 66593874 GetWindowLongPtrA 157770->157776 157795 6659b7f8 46 API calls Concurrency::details::ExternalContextBase::~ExternalContextBase 157771->157795 157772->157773 157773->157763 157773->157765 157776->157763 157779 6659388a GetPropA 157776->157779 157778 6659380c 157778->157770 157781 66593819 GetClassNameA 157778->157781 157779->157763 157782 665938a2 SetPropA GetPropA 157779->157782 157780 66593755 157786 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 157780->157786 157781->157776 157783 66593835 _mbscmp 157781->157783 157782->157763 157784 665938c2 GlobalAddAtomA SetWindowLongPtrA 157782->157784 157783->157763 157785 6659385b 157783->157785 157784->157763 157785->157776 157787 66593779 SetWindowLongPtrA 157786->157787 157788 66593793 157787->157788 157788->157763 157790 665913c8 Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 157789->157790 157792 6658f8a8 157790->157792 157791 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 157793 6658f8cc 157791->157793 157792->157791 157794 665932c8 45 API calls 157793->157794 157794->157780 157795->157778 157796 665d3dfc 157797 665d3e17 IsWindow 157796->157797 157798 665d3e11 157796->157798 157799 665d3e25 157797->157799 157798->157797 157800 665d3e3f SetWindowTextA 157799->157800 157801 665d3e4e 157799->157801 157800->157801 157802 665bff3c 157803 665bffa3 157802->157803 157804 665bff66 GetDlgItem 157802->157804 157806 665bffba GetDlgItem GetWindowRect 157803->157806 157807 665c0100 157803->157807 157804->157803 157805 665bff7b GetWindowLongA 157804->157805 157805->157803 157809 665bff98 SetWindowLongA 157805->157809 157810 665cf2e0 3 API calls 157806->157810 157808 66593144 43 API calls 157807->157808 157812 665c0108 157808->157812 157809->157803 157811 665bffe5 MapDialogRect 157810->157811 157811->157807 157813 665c001e SetWindowPos 157811->157813 157814 665c01c6 157812->157814 157817 665c0128 GetWindowRect GetDlgItem 157812->157817 157815 665c0058 GetDlgItem 157813->157815 157816 665d3cfc GetWindowLongA 157814->157816 157818 665c006c GetWindowRect 157815->157818 157819 665c00b1 157815->157819 157825 665c01ce 157816->157825 157820 665c014b GetWindowRect 157817->157820 157827 665c018c 157817->157827 157822 665cf2e0 3 API calls 157818->157822 157819->157815 157823 665c00bb GetWindowRect 157819->157823 157826 665d40bc SetWindowPos 157820->157826 157821 665c0191 GetDlgItem 157821->157827 157828 665c01a6 ShowWindow EnableWindow 157821->157828 157829 665c0087 SetWindowPos 157822->157829 157830 665d40bc SetWindowPos 157823->157830 157824 665c01de 157825->157824 157831 665993e0 70 API calls 157825->157831 157826->157827 157827->157814 157827->157821 157828->157827 157829->157819 157830->157807 157831->157824 157832 6661ad48 157833 6661ad69 157832->157833 157834 6661ad93 RegisterDragDrop 157833->157834 157835 6661ad80 157833->157835 157834->157835 157836 6666594c 157837 66665a3c 157836->157837 157840 6666596c 157836->157840 157838 66665a44 157837->157838 157839 66665acf 157837->157839 157841 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 157838->157841 157862 66665a29 157839->157862 157907 665ee134 48 API calls Concurrency::details::ExternalContextBase::~ExternalContextBase 157839->157907 157844 665f0398 85 API calls 157840->157844 157842 66665a49 157841->157842 157845 66665a58 FreeLibrary 157842->157845 157851 66665a66 157842->157851 157846 666659c5 157844->157846 157845->157851 157847 666659ce 157846->157847 157906 6661c750 47 API calls Concurrency::details::ExternalContextBase::~ExternalContextBase 157846->157906 157848 6658f9d0 43 API calls 157847->157848 157850 666659d3 157848->157850 157852 6658f79c 43 API calls 157850->157852 157853 6658f9d0 43 API calls 157851->157853 157854 666659dc 157852->157854 157855 66665a92 157853->157855 157856 66585044 __swprintf_l 43 API calls 157854->157856 157857 6658f79c 43 API calls 157855->157857 157858 666659e6 157856->157858 157857->157862 157859 66665a05 157858->157859 157865 666650a8 157858->157865 157870 665eecc0 GetModuleHandleA GetProcAddress 157859->157870 157863 66665a21 157864 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 157863->157864 157864->157862 157866 665d4f9c 43 API calls 157865->157866 157867 666650d3 157866->157867 157868 665d33d0 Concurrency::details::ExternalContextBase::~ExternalContextBase 5 API calls 157867->157868 157869 66665122 LeaveCriticalSection 157868->157869 157869->157859 157871 665eedbd GetModuleHandleA 157870->157871 157872 665eed33 ConvertDefaultLocale ConvertDefaultLocale GetProcAddress 157870->157872 157873 665eedcf EnumResourceLanguagesA 157871->157873 157874 665eee39 GetModuleFileNameA 157871->157874 157872->157874 157880 665eed86 ConvertDefaultLocale ConvertDefaultLocale 157872->157880 157873->157874 157875 665eee04 ConvertDefaultLocale ConvertDefaultLocale 157873->157875 157876 665eee80 memset 157874->157876 157885 665eee79 157874->157885 157875->157874 157878 665eeed8 157876->157878 157879 665eeee7 157876->157879 157908 665eeb84 6 API calls 157878->157908 157882 665eef11 157879->157882 157884 665eeef9 CreateActCtxA 157879->157884 157898 665eef3a 157879->157898 157880->157874 157889 665eef2a ActivateActCtx 157882->157889 157882->157898 157883 665eeee2 157883->157879 157884->157882 157884->157898 157885->157863 157887 665eef97 GetLocaleInfoA 157890 665eefb5 _errno _errno _snprintf_s _errno 157887->157890 157887->157898 157888 665eef55 strcpy_s 157888->157890 157888->157898 157889->157898 157894 665eeffc _errno 157890->157894 157895 665ef01d _errno 157890->157895 157891 665ef05e 157909 665839c4 43 API calls __swprintf_l 157891->157909 157892 665ef11e ReleaseActCtx 157892->157885 157893 665ef0db 157893->157885 157893->157892 157896 665ef108 DeactivateActCtx 157893->157896 157894->157898 157895->157898 157896->157892 157897 665ef032 LoadLibraryA 157897->157898 157898->157887 157898->157888 157898->157890 157898->157891 157898->157893 157898->157897 157902 665ef07a 157898->157902 157903 665ef085 157898->157903 157904 665ef090 157898->157904 157910 665839c4 43 API calls __swprintf_l 157902->157910 157911 665839c4 43 API calls __swprintf_l 157903->157911 157904->157885 157905 665ef0be DeactivateActCtx 157904->157905 157905->157885 157906->157847 157907->157862 157908->157883 157909->157902 157910->157903 157911->157904 157912 665a9d30 157915 665a9d54 157912->157915 157916 665d3cfc GetWindowLongA 157915->157916 157917 665a9d93 157916->157917 157918 66599d88 65 API calls 157917->157918 157919 665a9da7 SetRectEmpty 157918->157919 157922 66593c54 157919->157922 157923 66593c88 157922->157923 157925 66593aac 48 API calls 157923->157925 157924 66593cf6 157925->157924 157926 665b4670 SendMessageA 157927 665b46bc 157926->157927 157929 665b46c6 157926->157929 157928 66583940 __swprintf_l 43 API calls 157927->157928 157928->157929 157930 665b4741 157929->157930 157931 665b46d3 SendMessageA 157929->157931 157939 665839c4 43 API calls __swprintf_l 157930->157939 157934 665b46fb 157931->157934 157935 665b46ff strnlen 157931->157935 157933 665b474c 157936 665b4715 157934->157936 157938 665839c4 43 API calls __swprintf_l 157934->157938 157935->157934 157938->157930 157939->157933 157940 665bf630 157941 665bf642 157940->157941 157945 665bf659 157940->157945 157942 6658f9d0 43 API calls 157941->157942 157943 665bf647 157942->157943 157944 665bf65d VirtualProtect 157943->157944 157943->157945 157944->157945 157946 665e64f0 157947 665e6535 157946->157947 157948 665e6503 157946->157948 157952 665e1fa8 157947->157952 157950 66593144 43 API calls 157948->157950 157951 665e6533 157950->157951 157953 66593144 43 API calls 157952->157953 157954 665e1fb6 157953->157954 157956 665e1fc2 157954->157956 157957 665e2468 157954->157957 157956->157951 157958 665e2483 GetParent 157957->157958 157974 665e2547 157957->157974 157959 6659324c 45 API calls 157958->157959 157960 665e24a5 157959->157960 157961 665e24aa SendMessageA 157960->157961 157962 665e24f7 157960->157962 157961->157962 157964 665e24c5 157961->157964 158016 665e22d0 GetWindowLongA GetClientRect 157962->158016 158013 665e2248 157964->158013 157965 665e250f 157967 665e254c 157965->157967 157968 665e2513 GetClientRect 157965->157968 157988 665e2374 157967->157988 157970 665e252d 157968->157970 157968->157974 157972 66596588 2 API calls 157970->157972 157970->157974 157972->157974 157973 665e2588 157991 665e1c50 157973->157991 157974->157956 157989 665e2248 GetWindowLongA 157988->157989 157990 665e2393 157989->157990 157990->157973 158019 66596460 157991->158019 158014 665d3cfc GetWindowLongA 158013->158014 158015 665e2269 158014->158015 158015->157967 158016->157965 158020 66596478 GetScrollPos 158019->158020 158023 665a1cb4 DefFrameProcA 158024 66590428 158033 66590664 158024->158033 158026 6659045d 158027 6658f880 43 API calls 158026->158027 158028 6659046a 158027->158028 158036 665933c0 158028->158036 158031 665904ae 158032 665904a4 DeactivateActCtx 158032->158031 158034 66591590 Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 158033->158034 158035 66590674 158034->158035 158035->158026 158037 665933f3 158036->158037 158043 6659047b 158036->158043 158038 66593294 43 API calls 158037->158038 158039 665933f8 158038->158039 158040 6659341b DefWindowProcA 158039->158040 158041 66593403 158039->158041 158040->158043 158042 66592f6c 222 API calls 158041->158042 158042->158043 158043->158031 158043->158032 158044 665e2f2c 158045 66599d88 65 API calls 158044->158045 158046 665e2f58 158045->158046 158047 66599d88 65 API calls 158046->158047 158048 665e2f62 memset 158047->158048 158049 665e2f94 158048->158049 158063 665e2f98 158049->158063 158065 665bb49c 158049->158065 158052 665d3d74 3 API calls 158053 665e2fdd 158052->158053 158054 665d3db8 3 API calls 158053->158054 158055 665e2ff8 158054->158055 158094 665d402c 158055->158094 158058 665e3058 158059 6659965c 240 API calls 158058->158059 158060 665e3067 158059->158060 158061 665d40bc SetWindowPos 158060->158061 158060->158063 158062 665e30a4 158061->158062 158062->158063 158064 665d4138 ShowWindow 158062->158064 158064->158063 158066 6666548c 51 API calls 158065->158066 158067 665bb4cb FindResourceA LoadResource 158066->158067 158068 665bb4fb 158067->158068 158069 665bb4ef LockResource 158067->158069 158070 665bb56c 158068->158070 158071 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 158068->158071 158069->158068 158072 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 158070->158072 158071->158070 158073 665bb575 158072->158073 158074 66599d88 65 API calls 158073->158074 158075 665bb598 158074->158075 158076 66599d88 65 API calls 158075->158076 158078 665bb5a2 158076->158078 158077 665bb666 158080 66593924 45 API calls 158077->158080 158078->158077 158092 665bb5bc 158078->158092 158097 665c67bc GlobalAlloc GlobalLock memcpy_s GlobalUnlock wcslen 158078->158097 158081 665bb679 CreateDialogIndirectParamA 158080->158081 158087 665bb6be 158081->158087 158082 665bb633 158098 665c6f38 14 API calls 158082->158098 158085 665bb646 158085->158077 158086 665bb65a GlobalLock 158085->158086 158086->158077 158088 665939a0 43 API calls 158087->158088 158089 665bb711 158088->158089 158090 665bb738 158089->158090 158091 665bb72c DestroyWindow 158089->158091 158090->158092 158093 665bb73d GlobalUnlock GlobalFree 158090->158093 158091->158090 158092->158052 158092->158063 158093->158092 158095 665d404e GetWindowRect 158094->158095 158096 665d403a SetWindowLongA 158094->158096 158095->158058 158096->158095 158097->158082 158098->158085 158099 665bfae8 158100 665bfaf3 158099->158100 158101 665bfb00 SendMessageA 158099->158101 158101->158100 158102 665f1028 158103 665f116a 158102->158103 158105 665f1054 158102->158105 158104 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 158103->158104 158106 665f116f 158104->158106 158107 665f1105 158105->158107 158108 665f10c9 158105->158108 158109 665f106b 158105->158109 158115 665d5190 56 API calls 158106->158115 158107->158108 158110 665f112d 158107->158110 158111 665f1133 SendMessageA 158107->158111 158109->158108 158114 665f10a5 158109->158114 158116 665f0e34 58 API calls 158109->158116 158110->158111 158111->158108 158112 66585044 __swprintf_l 43 API calls 158112->158108 158114->158108 158114->158112 158115->158108 158116->158114 158117 66593460 GetPropA 158118 6659359a 158117->158118 158119 665934bf 158117->158119 158122 6659324c 45 API calls 158118->158122 158120 665934c8 158119->158120 158121 66593571 158119->158121 158124 66593538 SetWindowLongPtrA RemovePropA GlobalFindAtomA GlobalDeleteAtom 158120->158124 158125 665934cd 158120->158125 158123 6659324c 45 API calls 158121->158123 158126 665935a2 158122->158126 158128 66593579 158123->158128 158127 665935c4 CallWindowProcA 158124->158127 158125->158127 158129 665934d9 158125->158129 158130 6659324c 45 API calls 158126->158130 158142 66593533 158127->158142 158143 66592ee4 49 API calls 158128->158143 158132 6659324c 45 API calls 158129->158132 158133 665935ad 158130->158133 158136 665934e1 GetWindowRect 158132->158136 158134 66592e3c 3 API calls 158133->158134 158138 665935bb 158134->158138 158135 66593590 158135->158138 158137 665d3cfc GetWindowLongA 158136->158137 158139 665934fb CallWindowProcA 158137->158139 158138->158127 158138->158142 158140 66593526 158139->158140 158139->158142 158141 66592da8 75 API calls 158140->158141 158141->158142 158143->158135 158144 665dd7a0 memset 158145 665dd823 158144->158145 158146 665dd910 158145->158146 158147 665dd919 SendMessageA 158145->158147 158147->158146 158148 665ef620 158149 665ef69d 158148->158149 158150 665ef650 158148->158150 158167 665f1b9c 158149->158167 158150->158149 158152 66585044 __swprintf_l 43 API calls 158150->158152 158154 665ef65c 158152->158154 158155 665ef68a 158154->158155 158174 665f31d0 45 API calls __swprintf_l 158154->158174 158158 665f3cfc 158155->158158 158159 66585044 __swprintf_l 43 API calls 158158->158159 158160 665f3d36 158159->158160 158161 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 158160->158161 158166 665f3d3e 158161->158166 158162 665f3dbe free 158163 665f3d49 sprintf_s 158175 665f1c40 158163->158175 158166->158162 158166->158163 158199 66583520 43 API calls __swprintf_l 158166->158199 158168 665f1bbe 158167->158168 158169 665f1c13 GetPrivateProfileIntA 158167->158169 158170 665f1b24 7 API calls 158168->158170 158173 665ef6b6 158169->158173 158171 665f1bc3 158170->158171 158172 665f1bcf RegQueryValueExA RegCloseKey 158171->158172 158171->158173 158172->158173 158174->158155 158176 665f1c53 158175->158176 158177 665f1de6 GetPrivateProfileStringA 158176->158177 158178 665f1c95 158176->158178 158179 66668a8c 43 API calls 158177->158179 158180 665f1b24 7 API calls 158178->158180 158186 665f1cb0 158179->158186 158181 665f1c9d 158180->158181 158182 665f1cb8 RegQueryValueExA 158181->158182 158183 665f1ca5 158181->158183 158187 665f1d7b RegCloseKey 158182->158187 158188 665f1d07 158182->158188 158184 66668a8c 43 API calls 158183->158184 158184->158186 158186->158166 158190 665f1dba 158187->158190 158191 665f1d89 158187->158191 158189 665f1d29 RegQueryValueExA strnlen 158188->158189 158192 66583940 __swprintf_l 43 API calls 158188->158192 158194 665f1d60 158189->158194 158193 66668a8c 43 API calls 158190->158193 158201 665834a0 158191->158201 158196 665f1d24 158192->158196 158193->158186 158198 665f1d65 158194->158198 158200 665839c4 43 API calls __swprintf_l 158194->158200 158196->158189 158198->158187 158199->158166 158200->158198 158204 665834b6 158201->158204 158202 665834c4 158202->158186 158203 665834ea memcpy_s 158203->158202 158204->158202 158204->158203 158207 66586ae0 43 API calls __swprintf_l 158204->158207 158206 665834e9 158206->158203 158207->158206 158208 665a1ea4 158213 6659cab8 158208->158213 158211 665a1ec0 GetMenu 158212 665a1ed6 158211->158212 158215 6659cafa 158213->158215 158214 6659cb43 158217 66599d88 65 API calls 158214->158217 158215->158214 158244 665836b8 43 API calls __swprintf_l 158215->158244 158219 6659cb4d 158217->158219 158218 6659cb25 158218->158214 158245 665d228c 48 API calls __swprintf_l 158218->158245 158221 665834a0 43 API calls 158219->158221 158222 6659cb6e 158221->158222 158231 6659c704 158222->158231 158224 6659cc1c 158246 6659bba8 52 API calls 158224->158246 158225 6659cc10 GetMenu 158225->158224 158227 6659cc35 158228 6659cbbc 158227->158228 158229 66596328 226 API calls 158227->158229 158228->158211 158228->158212 158229->158228 158232 6659c769 158231->158232 158233 6659c737 158231->158233 158235 6659c76e 158232->158235 158236 6659c772 strlen 158232->158236 158234 6666548c 51 API calls 158233->158234 158237 6659c742 LoadMenuA 158234->158237 158238 665833cc __swprintf_l 43 API calls 158235->158238 158236->158235 158237->158232 158241 6659c756 158237->158241 158239 6659c78c 158238->158239 158243 66593aac 48 API calls 158239->158243 158240 6659c800 158240->158241 158242 6659c80d DestroyMenu 158240->158242 158241->158224 158241->158225 158241->158228 158242->158241 158243->158240 158244->158218 158245->158214 158246->158227 158247 665bf6a4 158248 665bf6d3 158247->158248 158249 6658f9d0 43 API calls 158248->158249 158250 665bf6de 158249->158250 158251 66599d88 65 API calls 158250->158251 158252 665bf70f 158251->158252 158253 66599d88 65 API calls 158252->158253 158254 665bf719 158253->158254 158269 665bf830 free 158254->158269 158255 665bf726 158256 66593924 45 API calls 158255->158256 158257 665bf764 158256->158257 158258 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 158257->158258 158259 665bf769 158258->158259 158277 665c05f8 158259->158277 158262 665939a0 43 API calls 158263 665bf787 GlobalAlloc GlobalLock 158262->158263 158265 665bf7b6 GlobalUnlock SetPropA 158263->158265 158267 665bf7f3 158263->158267 158266 665bf7dd GlobalFree 158265->158266 158265->158267 158266->158267 158270 665bf8ad malloc 158269->158270 158271 665bf874 158269->158271 158272 665bf8c4 158270->158272 158274 665bf8ca 158270->158274 158271->158270 158271->158274 158272->158274 158273 665bf948 memcpy_s 158273->158274 158274->158273 158276 665bf9db 158274->158276 158289 665be1e0 158274->158289 158276->158255 158278 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 158277->158278 158279 665c0618 158278->158279 158280 665bf77f 158279->158280 158281 665c064c 158279->158281 158285 665c0695 158279->158285 158280->158262 158282 665c067d GetProcAddress 158281->158282 158283 665c0653 GetModuleHandleA 158281->158283 158282->158285 158283->158282 158284 665c0666 LoadLibraryA 158283->158284 158284->158282 158285->158280 158286 665c06cc GetLastError 158285->158286 158287 665c06d6 158285->158287 158286->158287 158287->158280 158288 665c06f1 SetLastError 158287->158288 158288->158280 158290 665be203 158289->158290 158291 665be277 FindResourceA 158289->158291 158295 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 158290->158295 158292 665be290 158291->158292 158293 665be296 LoadResource 158291->158293 158328 665d0308 48 API calls 158292->158328 158296 665be2a8 158293->158296 158297 665be2ae LockResource 158293->158297 158299 665be20c 158295->158299 158329 665d0308 48 API calls 158296->158329 158297->158290 158301 665be2c3 158297->158301 158302 665be216 158299->158302 158303 665be224 158299->158303 158330 665d0308 48 API calls 158301->158330 158327 665be18c 44 API calls Concurrency::details::ExternalContextBase::~ExternalContextBase 158302->158327 158315 665bdfe8 158303->158315 158312 665be24b 158312->158274 158313 665be23d GlobalFree 158313->158312 158316 665be017 158315->158316 158331 665c638c 158316->158331 158318 665be032 158319 665be0c9 158318->158319 158321 665be0b2 _mbscmp 158318->158321 158326 665be036 158318->158326 158359 665839c4 43 API calls __swprintf_l 158318->158359 158319->158326 158360 665c67bc GlobalAlloc GlobalLock memcpy_s GlobalUnlock wcslen 158319->158360 158321->158319 158323 665be11e 158361 665c6d2c 7 API calls 158323->158361 158324 665be0b1 158324->158321 158326->158312 158326->158313 158332 66591590 Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 158331->158332 158333 665c63c0 158332->158333 158334 665c655b 158333->158334 158335 665904fc Concurrency::details::ExternalContextBase::~ExternalContextBase 43 API calls 158333->158335 158336 665c6568 strlen 158334->158336 158337 665c6564 158334->158337 158338 665c63df 158335->158338 158336->158337 158341 665833cc __swprintf_l 43 API calls 158337->158341 158339 665c63ef GetModuleHandleA 158338->158339 158340 665c6419 158338->158340 158339->158340 158342 665c6402 LoadLibraryA 158339->158342 158343 665c6426 GetModuleHandleA GetProcAddress 158340->158343 158344 665c64d7 158340->158344 158345 665c657e 158341->158345 158342->158340 158347 665c6448 158343->158347 158348 665c6494 FindResourceExA 158343->158348 158346 665c64f5 GlobalAlloc 158344->158346 158354 665c64c9 158344->158354 158345->158318 158350 665c650f 158346->158350 158351 665c6515 strcpy_s 158346->158351 158347->158348 158362 665c62a0 6 API calls 158347->158362 158348->158344 158352 665c64b8 LoadResource 158348->158352 158350->158351 158358 665c652c 158351->158358 158352->158344 158352->158354 158353 665c64f4 158353->158346 158354->158344 158363 665839c4 43 API calls __swprintf_l 158354->158363 158356 665c6464 158356->158348 158357 665c6468 FindResourceExA 158356->158357 158357->158348 158357->158352 158358->158334 158359->158324 158360->158323 158361->158326 158362->158356 158363->158353 158364 665bafa4 158365 665bafb0 158364->158365 158367 665bafb5 158364->158367 158366 66593294 43 API calls 158365->158366 158366->158367

      Executed Functions

      Function 0089CE40 Relevance: 137.0, APIs: 49, Strings: 29, Instructions: 505libraryloadermemoryCOMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 0 89ce40-89ceed call 932430 GetVersionExW LoadLibraryW * 2 LoadLibraryExW 3 89ceef-89cf12 GetProcAddress GetProcAddressForCaller 0->3 4 89cf15-89cf18 0->4 3->4 5 89cf9f-89cfa2 4->5 6 89cf1e-89cf21 4->6 8 89cfad-89cfb0 5->8 9 89cfa4-89cfa7 FreeLibrary 5->9 6->5 7 89cf23-89cf41 NetStatisticsGet 6->7 12 89cf43-89cf5a call 89c9e0 7->12 13 89cf62-89cf80 NetStatisticsGet 7->13 10 89cfed-89cff0 8->10 11 89cfb2-89cfeb GetProcAddress * 3 8->11 9->8 14 89cff3-89cff6 10->14 11->14 12->13 13->5 16 89cf82-89cf97 call 89c9e0 13->16 17 89cffc-89cfff 14->17 18 89d0e2-89d0e5 14->18 16->5 17->18 23 89d005-89d008 17->23 21 89d0f0-89d0f8 18->21 22 89d0e7-89d0ea FreeLibrary 18->22 25 89d0fa-89d101 call 8418b0 21->25 26 89d107-89d11a LoadLibraryW 21->26 22->21 23->18 27 89d00e-89d02b 23->27 25->26 29 89d1fe-89d206 25->29 26->29 30 89d120-89d15c GetProcAddress * 3 26->30 37 89d02d-89d046 27->37 38 89d070 27->38 35 89d709-89d735 call 89cb50 GlobalMemoryStatus call 89c9e0 29->35 36 89d20c-89d335 GetProcAddress * 12 29->36 32 89d179-89d17c 30->32 33 89d15e 30->33 40 89d17e-89d186 32->40 41 89d192-89d195 32->41 47 89d161-89d174 call 89c9e0 33->47 62 89d73a-89d797 GetCurrentProcessId call 89c9e0 call 915b20 35->62 42 89d33b-89d33e 36->42 43 89d6fe-89d703 FreeLibrary 36->43 60 89d048-89d060 call 89c9e0 37->60 61 89d064-89d06e 37->61 46 89d075-89d088 38->46 40->41 49 89d188-89d190 40->49 44 89d1cd-89d1d0 41->44 45 89d197-89d1af 41->45 42->43 50 89d344-89d347 42->50 43->35 51 89d1d2-89d1f0 call 89c9e0 44->51 52 89d1f5-89d1f8 FreeLibrary 44->52 45->44 64 89d1b1-89d1c8 call 89c9e0 45->64 59 89d090-89d092 46->59 47->32 49->41 49->44 50->43 56 89d34d-89d350 50->56 51->52 52->29 56->43 57 89d356-89d359 56->57 57->43 63 89d35f-89d367 57->63 59->18 65 89d094-89d0a8 59->65 60->61 61->46 63->43 71 89d36d-89d375 63->71 64->44 80 89d0d8-89d0da 65->80 81 89d0aa-89d0b6 65->81 71->43 76 89d37b-89d380 71->76 76->43 79 89d386-89d38e 76->79 79->43 82 89d394-89d399 79->82 80->18 83 89d0b8 81->83 84 89d0c0-89d0d4 call 89c9e0 81->84 82->43 85 89d39f-89d3a2 82->85 83->84 84->80 85->43 87 89d3a8-89d3bf CreateToolhelp32Snapshot 85->87 87->43 89 89d3c5-89d3f5 87->89 90 89d403-89d412 Heap32ListFirst 89->90 91 89d3f7-89d3ff GetTickCount 89->91 92 89d418-89d42b 90->92 93 89d56e-89d57b 90->93 91->90 94 89d430-89d4b3 call 89c9e0 Heap32First 92->94 95 89d57d-89d583 GetTickCount 93->95 96 89d585-89d59c Process32First 93->96 106 89d4b5-89d4be 94->106 107 89d504-89d54b Heap32ListNext 94->107 95->96 98 89d5ef 96->98 99 89d59e-89d5a6 96->99 101 89d5f7-89d604 98->101 100 89d5b0-89d5d8 call 89c9e0 99->100 100->101 122 89d5da-89d5dc 100->122 104 89d60e-89d61f 101->104 105 89d606-89d60c GetTickCount 101->105 119 89d621-89d629 104->119 120 89d672-89d67f 104->120 105->104 108 89d4c0-89d4e5 call 89c9e0 Heap32Next 106->108 112 89d569 107->112 113 89d54d-89d54f 107->113 108->107 121 89d4e7-89d4e9 108->121 112->93 117 89d551-89d55e GetTickCount 113->117 118 89d560-89d563 113->118 117->112 117->118 118->94 118->112 125 89d631-89d658 call 89c9e0 119->125 123 89d689-89d69a 120->123 124 89d681-89d687 GetTickCount 120->124 127 89d4eb-89d4f8 GetTickCount 121->127 128 89d4fa-89d502 121->128 122->100 129 89d5de-89d5eb GetTickCount 122->129 133 89d69c 123->133 134 89d6e1-89d6ec 123->134 124->123 139 89d65a-89d65d 125->139 140 89d66e 125->140 127->107 127->128 128->107 128->108 129->100 131 89d5ed 129->131 131->101 138 89d6a4-89d6cb call 89c9e0 133->138 136 89d6ee-89d6f3 134->136 137 89d6f5-89d6f8 CloseHandle 134->137 136->43 137->43 138->134 146 89d6cd-89d6d0 138->146 139->125 142 89d65f-89d66c GetTickCount 139->142 140->120 142->125 142->140 146->138 147 89d6d2-89d6df GetTickCount 146->147 147->134 147->138
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: AddressProc$Library$CountTick$FreeHeap32Load$First$ListNextStatistics$CallerCreateCurrentGlobalMemoryProcessProcess32SnapshotStatusToolhelp32Version
      • String ID: $8$ADVAPI32.DLL$CloseToolhelp32Snapshot$CreateToolhelp32Snapshot$CryptAcquireContextW$CryptGenRandom$CryptReleaseContext$GetCursorInfo$GetForegroundWindow$GetQueueStatus$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Intel Hardware Cryptographic Service Provider$KERNEL32.DLL$LanmanServer$LanmanWorkstation$Module32First$Module32Next$NETAPI32.DLL$NetApiBufferFree$NetStatisticsGet$Process32First$Process32Next$Thread32First$Thread32Next$USER32.DLL
      • API String ID: 2607417785-3355579026
      • Opcode ID: 8a76e312543d228e58e44406400e4a318c5f8a8e5853b72af48dd18093cd79f9
      • Instruction ID: 87a3aabb183d2739ce1ea9b829ec82b2e3f5e24d83bbe419a45f032be35c7cb9
      • Opcode Fuzzy Hash: 8a76e312543d228e58e44406400e4a318c5f8a8e5853b72af48dd18093cd79f9
      • Instruction Fuzzy Hash: FA224032215B8096EB25EF25F84039BB3A5FB94784F488225DE8E87769DF3DC645CB40
      Function 665D8C04 Relevance: 64.2, APIs: 20, Strings: 16, Instructions: 1159stringwindowCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 66586708: GetModuleFileNameA.KERNEL32 ref: 66586731
        • Part of subcall function 66586708: GetShortPathNameA.KERNEL32 ref: 6658676B
        • Part of subcall function 66586708: strlen.MSVCR90 ref: 6658677A
        • Part of subcall function 665834A0: memcpy_s.MSVCR90 ref: 66583503
      • _cwprintf_s_l.LIBCMT ref: 665D8D39
      • DestroyIcon.USER32 ref: 665D8D41
      • _cwprintf_s_l.LIBCMT ref: 665D8D58
      • _cwprintf_s_l.LIBCMT ref: 665D8F62
      • strlen.MSVCR90 ref: 665D90F2
      • strlen.MSVCR90 ref: 665D90D2
        • Part of subcall function 6659B3E0: strlen.MSVCR90 ref: 6659B42A
        • Part of subcall function 6659B3E0: strlen.MSVCR90 ref: 6659B4EE
      • strlen.MSVCR90 ref: 665D90AA
        • Part of subcall function 6659B3E0: memcpy_s.MSVCR90 ref: 6659B489
      • _cwprintf_s_l.LIBCMT ref: 665D912E
      • _cwprintf_s_l.LIBCMT ref: 665D9267
      • _cwprintf_s_l.LIBCMT ref: 665D9541
      • _cwprintf_s_l.LIBCMT ref: 665D9678
        • Part of subcall function 665D86CC: lstrlenA.KERNEL32 ref: 665D86F3
      • _cwprintf_s_l.LIBCMT ref: 665D97A7
      • strnlen.MSVCR90 ref: 665D994E
      • _mbscmp.MSVCR90 ref: 665D99A5
      • _cwprintf_s_l.LIBCMT ref: 665D9AE0
        • Part of subcall function 665D86CC: lstrlenA.KERNEL32 ref: 665D8737
        • Part of subcall function 665D86CC: RegSetValueExA.ADVAPI32 ref: 665D8759
        • Part of subcall function 665D86CC: RegCloseKey.ADVAPI32 ref: 665D8766
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: _cwprintf_s_l$strlen$Namelstrlenmemcpy_s$CloseDestroyFileIconModulePathShortValue_mbscmpstrnlen
      • String ID: "%1"$ /dde$ /p "%1"$ /pt "%1" "%2" "%3" "%4"$%s\DefaultIcon$%s\ShellNew$%s\shell\open\%s$%s\shell\print\%s$%s\shell\printto\%s$,%d$NullFile$[open("%1")]$[print("%1")]$[printto("%1","%2","%3","%4")]$command$ddeexec
      • API String ID: 3589127747-4043335175
      • Opcode ID: e48b2e17083788d889362e83315f8c45217aab86c7590317d8046ece2eb55665
      • Instruction ID: 8536329a3d1eaaa61f687b34ec0721fa7f9f801d5191296f1f0bb4863ecabbf0
      • Opcode Fuzzy Hash: e48b2e17083788d889362e83315f8c45217aab86c7590317d8046ece2eb55665
      • Instruction Fuzzy Hash: 2AA25CA3705A4582DB409F2DD85061E77A1FB82FB5B049312AA3DA37E4EF7CC895CB44
      Function 665EECC0 Relevance: 56.3, APIs: 27, Strings: 5, Instructions: 289libraryloaderstringCOMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 550 665eecc0-665eed2d GetModuleHandleA GetProcAddress 551 665eedbd-665eedcd GetModuleHandleA 550->551 552 665eed33-665eed80 ConvertDefaultLocale * 2 GetProcAddress 550->552 553 665eedcf-665eee02 EnumResourceLanguagesA 551->553 554 665eee39-665eee77 GetModuleFileNameA 551->554 552->554 562 665eed86-665eedbb ConvertDefaultLocale * 2 552->562 553->554 555 665eee04-665eee34 ConvertDefaultLocale * 2 553->555 556 665eee79-665eee7b 554->556 557 665eee80-665eeed6 memset 554->557 555->554 559 665ef126-665ef151 call 6666d880 556->559 560 665eeed8-665eeee2 call 665eeb84 557->560 561 665eeee7-665eeef1 557->561 560->561 564 665eeef3-665eeef7 561->564 565 665eef11-665eef1b 561->565 562->554 568 665eef3a-665eef43 564->568 569 665eeef9-665eef0f CreateActCtxA 564->569 565->568 571 665eef1d-665eef21 565->571 574 665eef49-665eef53 568->574 575 665ef0e0-665ef0ea 568->575 569->565 569->568 571->568 573 665eef23-665eef28 571->573 573->568 580 665eef2a-665eef35 ActivateActCtx 573->580 576 665eef97-665eefaf GetLocaleInfoA 574->576 577 665eef55-665eef6f strcpy_s 574->577 578 665ef0ec-665ef0f0 575->578 579 665ef124 575->579 581 665eefb5-665eeffa _errno * 2 _snprintf_s _errno 576->581 584 665ef04d-665ef053 576->584 577->581 582 665eef71-665eef74 577->582 578->579 583 665ef0f2-665ef0fc 578->583 579->559 580->568 591 665eeffc-665ef005 _errno 581->591 592 665ef01d-665ef023 _errno 581->592 585 665ef06a-665ef06f call 66581350 582->585 586 665eef7a-665eef7d 582->586 587 665ef11e-665ef121 ReleaseActCtx 583->587 588 665ef0fe-665ef106 583->588 589 665ef0db 584->589 590 665ef059 584->590 614 665ef070-665ef07a call 665839c4 585->614 593 665ef064-665ef069 call 665813a0 586->593 594 665eef83-665eef86 586->594 587->579 588->587 595 665ef108-665ef117 DeactivateActCtx 588->595 589->575 590->574 596 665ef007-665ef00a 591->596 597 665ef025-665ef028 591->597 592->597 593->585 594->593 601 665eef8c-665eef8f 594->601 595->587 603 665ef00c-665ef00f 596->603 604 665ef086-665ef090 call 665839c4 596->604 599 665ef02a-665ef030 597->599 600 665ef045 597->600 599->600 606 665ef032-665ef043 LoadLibraryA 599->606 607 665ef048-665ef04b 600->607 608 665ef05e-665ef063 call 665813a0 601->608 609 665eef95 601->609 612 665ef07b-665ef085 call 665839c4 603->612 613 665ef011-665ef014 603->613 617 665ef091-665ef09b 604->617 606->607 607->584 607->617 608->593 609->581 612->604 613->612 620 665ef016-665ef019 613->620 614->612 624 665ef09d-665ef0a6 617->624 625 665ef0d6-665ef0d9 617->625 620->614 626 665ef01b 620->626 624->625 627 665ef0a8-665ef0b2 624->627 625->559 626->597 628 665ef0d4 627->628 629 665ef0b4-665ef0bc 627->629 628->625 629->628 630 665ef0be-665ef0cd DeactivateActCtx 629->630 630->628
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Locale$ConvertDefault$_errno$Module$AddressDeactivateHandleProc$ActivateCreateEnumFileInfoLanguagesLibraryLoadNameReleaseResource_snprintf_smemsetstrcpy_s
      • String ID: GetSystemDefaultUILanguage$GetUserDefaultUILanguage$LOC$kernel32.dll$ntdll.dll
      • API String ID: 1153685260-1766055509
      • Opcode ID: 1cd2166c1292697a92b1761f1e2e8073910a4f14c6e7dcdc9850eb78609382c3
      • Instruction ID: 17d19789b12292b61a5da60aa51f17fefa19b2b48b8f667f0abe34178724e155
      • Opcode Fuzzy Hash: 1cd2166c1292697a92b1761f1e2e8073910a4f14c6e7dcdc9850eb78609382c3
      • Instruction Fuzzy Hash: 8BC19472615B8186DB10CF65F841369B362F7C47A4F500229EABA53BE4DF7EC895CB10
      Function 665A40C0 Relevance: 40.6, APIs: 22, Strings: 1, Instructions: 331windowkeyboardCOMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 631 665a40c0-665a4110 633 665a4112-665a4118 631->633 634 665a4136-665a4142 GetKeyState 631->634 633->634 635 665a411a-665a4120 633->635 636 665a4148-665a4157 GetKeyState 634->636 637 665a4520-665a452a 634->637 635->634 638 665a4122-665a4128 635->638 636->637 639 665a415d-665a416c GetKeyState 636->639 640 665a45fa-665a4614 637->640 641 665a4530-665a453c call 6659324c 637->641 638->634 642 665a412a-665a4130 638->642 639->637 644 665a4172-665a418c call 665905cc call 6659324c 639->644 647 665a453e-665a4541 641->647 648 665a4560-665a4563 641->648 642->634 642->637 657 665a41ab-665a41ae 644->657 658 665a418e-665a4192 644->658 650 665a4569-665a456f 647->650 651 665a4543-665a4547 647->651 648->640 648->650 655 665a4579-665a4582 650->655 656 665a4571-665a4577 650->656 651->648 653 665a4549-665a455e GetParent call 6659324c 651->653 653->647 653->648 660 665a4587-665a458c 655->660 661 665a4584 655->661 656->655 656->660 664 665a41cd-665a41e2 call 66596074 657->664 665 665a41b0-665a41b3 657->665 658->657 663 665a4194-665a41a9 GetParent call 6659324c 658->663 660->640 666 665a458e-665a4591 660->666 661->660 663->657 663->658 676 665a4232-665a4247 call 66585044 664->676 677 665a41e4-665a41eb 664->677 665->640 668 665a41b9-665a41c8 665->668 670 665a45f3-665a45f5 call 66594118 666->670 671 665a4593-665a4599 666->671 668->640 670->640 671->670 675 665a459b-665a45a1 671->675 675->670 678 665a45a3-665a45a9 675->678 689 665a4249-665a4254 call 665a34d4 676->689 690 665a4256 676->690 680 665a41ed-665a41f2 call 6659324c 677->680 681 665a41f4-665a4201 GetParent call 6659324c 677->681 678->670 682 665a45ab-665a45b1 678->682 687 665a4206-665a4209 680->687 681->687 682->670 686 665a45b3-665a45b9 682->686 686->670 688 665a45bb-665a45c1 686->688 693 665a420b-665a422a 687->693 694 665a422d-665a4230 687->694 688->670 692 665a45c3-665a45c9 688->692 696 665a4259-665a426e call 665a353c 689->696 690->696 692->670 697 665a45cb-665a45d1 692->697 693->694 694->676 698 665a429a-665a431a memset ScreenToClient memset 694->698 703 665a4280-665a4293 SendMessageA 696->703 704 665a4270-665a427b 696->704 697->670 701 665a45d3-665a45d9 697->701 709 665a431c-665a4323 698->709 710 665a4387-665a438b 698->710 701->670 705 665a45db-665a45e1 701->705 703->698 704->640 705->670 707 665a45e3-665a45e9 705->707 707->670 714 665a45eb-665a45f1 707->714 709->710 715 665a4325-665a432a 709->715 711 665a445c-665a4471 SendMessageA 710->711 712 665a4391-665a43c6 memmove 710->712 718 665a4475-665a447b call 665a401c 711->718 716 665a43c8-665a43cc 712->716 717 665a43d4-665a43f4 SendMessageA 712->717 714->640 714->670 719 665a436b-665a436f 715->719 720 665a432c-665a4366 GetCursorPos SendMessageA 715->720 716->717 721 665a4402-665a441a SendMessageA 717->721 722 665a43f6-665a43f9 call 665960cc 717->722 731 665a4480-665a448a 718->731 724 665a44f9 719->724 725 665a4375-665a437b call 665a401c 719->725 726 665a44fb-665a4504 720->726 729 665a441c-665a4430 SendMessageA 721->729 730 665a4436-665a445a SetWindowPos 721->730 733 665a43fe-665a4400 722->733 724->726 737 665a4380-665a4382 725->737 726->640 728 665a450a-665a450f 726->728 728->640 734 665a4515-665a451b free 728->734 729->730 730->718 735 665a448c-665a4490 731->735 736 665a44a4-665a44b9 731->736 733->721 741 665a4473 733->741 734->640 735->736 738 665a4492-665a449e SendMessageA 735->738 739 665a44bb-665a44dc call 66585044 memset 736->739 740 665a44de 736->740 737->726 738->736 743 665a44e3-665a44f7 memmove 739->743 740->743 741->718 743->726
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: MessageSend$ParentStatememset$memmove$ClientCursorScreenWindowfree
      • String ID: @
      • API String ID: 2642065416-2766056989
      • Opcode ID: a5d408e7deb63dabbf52f10307270baf8fe56187de2d6f8a8d456f7147d7f61c
      • Instruction ID: b6ffa3686da7d26b793632a66e6da2680c031f6b15968c9918da43193917fdab
      • Opcode Fuzzy Hash: a5d408e7deb63dabbf52f10307270baf8fe56187de2d6f8a8d456f7147d7f61c
      • Instruction Fuzzy Hash: AEC1D47170578082EB24CFA5E85635D77A1F389FA4F104625DFAA077A4CF7AC891CB42
      Function 665BFF3C Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169COMMON
      Download Yara Rule

      Control-flow Graph

      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Window$Rect$Item$Long$DialogEnableShow
      • String ID: $ $ 0
      • API String ID: 2156055747-2919528541
      • Opcode ID: 9b39929f94fdbe1a2b1bd8fc5ebd78840a48879fb2cdaa5b02903d6ef2c1eafe
      • Instruction ID: ddcd53ca5865a3147948b3481441269e28de1ece7cfa6d40d869217e99532694
      • Opcode Fuzzy Hash: 9b39929f94fdbe1a2b1bd8fc5ebd78840a48879fb2cdaa5b02903d6ef2c1eafe
      • Instruction Fuzzy Hash: D3716C76624A408BEB14CF66E85871AB7B1F7C9B99F144129EE4A03B18DF7EC845CF40
      Function 665BF228 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 76windowkeyboardCOMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 1143 665bf228-665bf252 1144 665bf25d-665bf27d GetPropA GlobalLock 1143->1144 1145 665bf254-665bf25a call 665a40c0 1143->1145 1146 665bf27f-665bf282 1144->1146 1147 665bf2e2-665bf2e9 1144->1147 1145->1144 1150 665bf2d9-665bf2dc GlobalUnlock 1146->1150 1151 665bf284-665bf29c SendMessageA 1146->1151 1148 665bf2eb-665bf2f9 GetAsyncKeyState 1147->1148 1149 665bf32a-665bf330 call 66599a3c 1147->1149 1148->1149 1152 665bf2fb-665bf300 1148->1152 1157 665bf335-665bf349 1149->1157 1150->1147 1151->1150 1154 665bf29e-665bf2bb GlobalUnlock RemovePropA 1151->1154 1155 665bf302-665bf307 1152->1155 1156 665bf310-665bf328 SendMessageA 1152->1156 1158 665bf2bd-665bf2c0 GlobalFree 1154->1158 1159 665bf2c6-665bf2c9 1154->1159 1155->1156 1160 665bf309-665bf30e 1155->1160 1156->1149 1161 665bf2d2-665bf2d7 1156->1161 1158->1159 1159->1161 1160->1149 1160->1156 1161->1157
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Global$MessagePropSendUnlock$AsyncFreeLockRemoveState
      • String ID: AfxClosePending
      • API String ID: 723318029-3670358930
      • Opcode ID: 13f46e1713c95a0d48fe3497fb3c08ac18c56b91ae677c7d5ff3b5f3e42d44ed
      • Instruction ID: d09ed0b32511bef2860aff5aa201d2fd019bcbc5c57b213112310c96263a1a00
      • Opcode Fuzzy Hash: 13f46e1713c95a0d48fe3497fb3c08ac18c56b91ae677c7d5ff3b5f3e42d44ed
      • Instruction Fuzzy Hash: 2B31BD39A04A81C6DB048F62F865359B332F389FC1F945025EF5A03B14DF3AC4A2CB11
      Function 66599A74 Relevance: 10.6, APIs: 7, Instructions: 120windowCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Message$Window$PeekSendUpdate$LongParent
      • String ID:
      • API String ID: 2853195852-0
      • Opcode ID: 2e32cc7061a57302a9bdd87b0afd4505fbcf2bfebe6151dad8cf17e06ae4edae
      • Instruction ID: 5a839afacaa28a020e96bdbb9d37005231f6fa59be0021c8c01bb24460e08d93
      • Opcode Fuzzy Hash: 2e32cc7061a57302a9bdd87b0afd4505fbcf2bfebe6151dad8cf17e06ae4edae
      • Instruction Fuzzy Hash: 7B41D432A18A918AE7048F36E81671A76B2FBD1F9DF088215DE5947768DF3DC452CB40
      Function 66594ED8 Relevance: 8.0, APIs: 2, Strings: 2, Instructions: 964COMMON
      Download Yara Rule
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID:
      • String ID: $8Dff
      • API String ID: 0-1465241679
      • Opcode ID: f21a0c85ba1cb60c9acd15b5ed566527c9df210654b0b10ca68326b1b2a526af
      • Instruction ID: a6464e68719a7895b773f42b64ca3645a28b35ea8c608fb9489f25451265a820
      • Opcode Fuzzy Hash: f21a0c85ba1cb60c9acd15b5ed566527c9df210654b0b10ca68326b1b2a526af
      • Instruction Fuzzy Hash: D452B571B2A7D486DE54DB2AA85532A63D5B796FC7F402E25DA4E4BB04DF7CC020CB80
      Function 665DF488 Relevance: 7.7, APIs: 5, Instructions: 234COMMON
      Download Yara Rule
      APIs
      • GetClientRect.USER32 ref: 665DF4A8
      • InflateRect.USER32 ref: 665DF4C5
      • BeginDeferWindowPos.USER32 ref: 665DF538
      • InvalidateRect.USER32 ref: 665DF5C3
      • EndDeferWindowPos.USER32 ref: 665DF84E
        • Part of subcall function 665D3A24: GetDlgItem.USER32 ref: 665D3A36
        • Part of subcall function 665DF3D8: GetClientRect.USER32 ref: 665DF3EE
        • Part of subcall function 665DF3D8: GetParent.USER32 ref: 665DF409
        • Part of subcall function 665DF3D8: GetClientRect.USER32 ref: 665DF437
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Rect$Client$DeferWindow$BeginInflateInvalidateItemParent
      • String ID:
      • API String ID: 939197390-0
      • Opcode ID: b64eff9927d6d3f35c1f8941d6e35ac35fb9bd01d4c1ffc4624b9217b700ead2
      • Instruction ID: 6ec3cebdda14ad7e5f17dc385427f1f74df4edb27d2c66cd11edacd8de282fe2
      • Opcode Fuzzy Hash: b64eff9927d6d3f35c1f8941d6e35ac35fb9bd01d4c1ffc4624b9217b700ead2
      • Instruction Fuzzy Hash: 8DA16A366142C19BD728CF29E940B9EBB61F3C9B88F008115DF5A17B48DB78E865CF54
      Function 665A2A78 Relevance: 6.1, APIs: 4, Instructions: 88windowCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 665D3CFC: GetWindowLongA.USER32 ref: 665D3D13
        • Part of subcall function 665A2CF4: GetParent.USER32 ref: 665A2CFC
        • Part of subcall function 665A2CF4: GetParent.USER32 ref: 665A2D05
      • SendMessageA.USER32 ref: 665A2B06
      • SendMessageA.USER32 ref: 665A2B3A
      • SendMessageA.USER32 ref: 665A2B56
      • SendMessageA.USER32 ref: 665A2B6B
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: MessageSend$Parent$LongWindow
      • String ID:
      • API String ID: 4191550487-0
      • Opcode ID: 945dd04767c28b9dfc559784fb17768525bc9a3cf6ba61644b775739dce012d7
      • Instruction ID: d4113b1c23516ad2554d10bfeaebf39a0065a7a228216a325b378b6a88fddeb7
      • Opcode Fuzzy Hash: 945dd04767c28b9dfc559784fb17768525bc9a3cf6ba61644b775739dce012d7
      • Instruction Fuzzy Hash: 1E318D32B2479582E7249F2AF863B5E3762E7C6B88F585031DF4A47B54DE39C8818B00
      Function 665DD7A0 Relevance: 3.1, APIs: 2, Instructions: 109windowCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: MessageSendmemset
      • String ID:
      • API String ID: 568519121-0
      • Opcode ID: 429c814327b811360b74210efd694c8d9f822fb8ff9483a35c19e5e7535719b5
      • Instruction ID: 3420adfdd3cd69ec3ca8009a5c91720ca261ca7f595b6e3f117fe4f7fe7e3702
      • Opcode Fuzzy Hash: 429c814327b811360b74210efd694c8d9f822fb8ff9483a35c19e5e7535719b5
      • Instruction Fuzzy Hash: 42418E36605B8086D720CF6AE440B4E7BA5F388BA4F15822AEF9D83B54DF39C445CF00
      Function 6659FC08 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: IconicVisibleWindow
      • String ID:
      • API String ID: 1797901696-0
      • Opcode ID: a3c199efbaeba62a8127b98dc4d0156fa2046b6d74399ecc6f7ea77e228a0a45
      • Instruction ID: 154e228418d22c371e2c5fa2dc67f970af955471f30b5dc92bc7373cc148f0cc
      • Opcode Fuzzy Hash: a3c199efbaeba62a8127b98dc4d0156fa2046b6d74399ecc6f7ea77e228a0a45
      • Instruction Fuzzy Hash: EBF05B21B1C54083D7049B76EAD533D63A2BBC9BD4F64C334EE29477A4DF25C8568740
      Function 0080D210 Relevance: 65.0, APIs: 22, Strings: 15, Instructions: 249COMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 148 80d210-80d233 call 81b320 151 80d265-80d26c call 80de10 148->151 152 80d235-80d264 #252 148->152 155 80d2d1-80d2ee #188 151->155 156 80d26e-80d28b #252 151->156 157 80d290-80d2ad #252 155->157 158 80d2f0-80d3bd memset call 80def0 155->158 156->157 159 80d2b2-80d2b5 157->159 158->157 166 80d3c3-80d400 call 81a728 158->166 161 80d2b7-80d2ba call 80adb0 159->161 162 80d2bf-80d2d0 159->162 161->162 166->157 169 80d406-80d412 call 81a722 166->169 169->157 172 80d418-80d44e call 811ef0 169->172 175 80d6c1-80d6e3 #252 172->175 176 80d454-80d45b #1654 172->176 175->159 176->175 177 80d461-80d470 #3437 176->177 177->157 178 80d476-80d48c #316 177->178 179 80d4b3-80d4c9 #316 178->179 180 80d48e-80d4ae #252 178->180 181 80d4f0-80d506 #316 179->181 182 80d4cb-80d4eb #252 179->182 180->159 183 80d508-80d528 #252 181->183 184 80d52d-80d53c #2411 181->184 182->159 183->159 184->157 185 80d542-80d563 #1027 184->185 186 80d571-80d59c #2206 185->186 187 80d565-80d56a call 812e10 185->187 189 80d5c8 186->189 190 80d59e-80d5b1 #464 186->190 187->186 191 80d5d2-80d636 call 819260 #188 189->191 190->189 193 80d5b3-80d5c6 #464 190->193 191->157 196 80d63c-80d675 #188 191->196 193->189 193->191 197 80d677-80d683 #181 196->197 198 80d688-80d6c0 196->198 197->157
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2899897741.00000000007E1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007E0000, based on PE: true
      • Associated: 00000006.00000002.2899874032.00000000007E0000.00000002.00000001.01000000.0000000D.sdmpDownload File
      • Associated: 00000006.00000002.2899960031.000000000081C000.00000002.00000001.01000000.0000000D.sdmpDownload File
      • Associated: 00000006.00000002.2899984901.0000000000826000.00000008.00000001.01000000.0000000D.sdmpDownload File
      • Associated: 00000006.00000002.2900010312.0000000000828000.00000004.00000001.01000000.0000000D.sdmpDownload File
      • Associated: 00000006.00000002.2900060989.000000000082E000.00000008.00000001.01000000.0000000D.sdmpDownload File
      • Associated: 00000006.00000002.2900087970.000000000082F000.00000004.00000001.01000000.0000000D.sdmpDownload File
      • Associated: 00000006.00000002.2900120356.0000000000830000.00000008.00000001.01000000.0000000D.sdmpDownload File
      • Associated: 00000006.00000002.2900155328.0000000000831000.00000004.00000001.01000000.0000000D.sdmpDownload File
      • Associated: 00000006.00000002.2900196065.0000000000832000.00000008.00000001.01000000.0000000D.sdmpDownload File
      • Associated: 00000006.00000002.2900230021.0000000000833000.00000004.00000001.01000000.0000000D.sdmpDownload File
      • Associated: 00000006.00000002.2900249507.0000000000836000.00000002.00000001.01000000.0000000D.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_7e0000_WinHTTrack.jbxd
      Similarity
      • API ID: #252
      • String ID: .\ssl\ssl_lib.c$.\ssl\ssl_lib.c$.\ssl\ssl_lib.c$.\ssl\ssl_lib.c$.\ssl\ssl_lib.c$.\ssl\ssl_lib.c$.\ssl\ssl_lib.c$.\ssl\ssl_lib.c$.\ssl\ssl_lib.c$.\ssl\ssl_lib.c$ALL:!aNULL:!eNULL:!SSLv2$SSLv2$ssl2-md5$ssl3-md5$ssl3-sha1
      • API String ID: 3737812228-4760644
      • Opcode ID: 2417c870c8dc70e642cb3cf04fe40661fce1cebaf3e72077dd095c21634a0356
      • Instruction ID: 4a37d5d57c1644fbbda1639d362854757dc2a1291f426f701d31b765dc376c4a
      • Opcode Fuzzy Hash: 2417c870c8dc70e642cb3cf04fe40661fce1cebaf3e72077dd095c21634a0356
      • Instruction Fuzzy Hash: 61C15432302B85AADB9CDF64EA503D8B3A8FB44740F844119DB9983791EF38E5B4C746
      Function 66593604 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 186COMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 779 66593604-66593661 call 665913c8 782 66593669-6659366c 779->782 783 66593663-66593668 call 665813a0 779->783 785 6659366e-66593680 CallNextHookEx 782->785 786 66593685-66593699 call 665904fc 782->786 783->782 788 665938f5-6659391b call 6666d880 785->788 793 6659369b-665936a0 786->793 794 665936af-665936b6 786->794 795 665938e0-665938ef CallNextHookEx 793->795 796 665936a6-665936a9 793->796 797 665936b8-665936ca GetClassLongA 794->797 798 66593732-66593735 794->798 795->788 796->794 796->795 797->795 799 665936d0-665936db 797->799 800 6659373b-66593791 call 6658f880 call 665932c8 call 665904fc SetWindowLongPtrA 798->800 801 665937d7-665937df 798->801 805 665936dd-665936fd GlobalGetAtomNameA 799->805 806 66593705-6659372c CompareStringA 799->806 823 66593793 800->823 824 66593797-665937a3 800->824 803 6659385d-66593872 GetClassLongPtrA 801->803 804 665937e1-66593817 memset call 6659b7f8 801->804 803->795 809 66593874-66593888 GetWindowLongPtrA 803->809 804->803 814 66593819-66593833 GetClassNameA 804->814 805->806 806->795 806->798 809->795 812 6659388a-665938a0 GetPropA 809->812 812->795 815 665938a2-665938c0 SetPropA GetPropA 812->815 814->809 816 66593835-66593855 _mbscmp 814->816 815->795 817 665938c2-665938da GlobalAddAtomA SetWindowLongPtrA 815->817 816->795 819 6659385b 816->819 817->795 819->809 823->824 825 665937ae-665937b3 824->825 826 665937a5-665937aa 824->826 825->795 827 665937b9-665937c3 825->827 826->825 827->795 828 665937c9-665937d2 827->828 828->795
      APIs
        • Part of subcall function 665913C8: EnterCriticalSection.KERNEL32 ref: 66591453
        • Part of subcall function 665913C8: TlsGetValue.KERNEL32 ref: 66591465
        • Part of subcall function 665913C8: LeaveCriticalSection.KERNEL32 ref: 66591481
      • CallNextHookEx.USER32 ref: 6659367A
        • Part of subcall function 665813A0: _CxxThrowException.MSVCR90 ref: 665813BC
      • GetClassLongA.USER32 ref: 665936C0
      • GlobalGetAtomNameA.KERNEL32 ref: 665936F7
      • CompareStringA.KERNEL32 ref: 66593723
      • SetWindowLongPtrA.USER32 ref: 66593788
      • memset.MSVCR90 ref: 665937F0
        • Part of subcall function 6659B7F8: GetClassInfoExA.USER32 ref: 6659B841
        • Part of subcall function 6659B7F8: GetLastError.KERNEL32 ref: 6659B85D
        • Part of subcall function 6659B7F8: SetLastError.KERNEL32 ref: 6659B884
      • GetClassNameA.USER32 ref: 6659382A
      • _mbscmp.MSVCR90 ref: 6659384C
      • GetClassLongPtrA.USER32 ref: 66593865
      • GetWindowLongPtrA.USER32 ref: 6659387C
      • GetPropA.USER32 ref: 66593897
      • SetPropA.USER32 ref: 665938AB
      • GetPropA.USER32 ref: 665938B7
      • GlobalAddAtomA.KERNEL32 ref: 665938C5
      • SetWindowLongPtrA.USER32 ref: 665938DA
      • CallNextHookEx.USER32 ref: 665938EF
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Long$Class$PropWindow$AtomCallCriticalErrorGlobalHookLastNameNextSection$CompareEnterExceptionInfoLeaveStringThrowValue_mbscmpmemset
      • String ID: #32768$AfxOldWndProc423$ime
      • API String ID: 3462882159-4034971020
      • Opcode ID: fe7a30c2ba1c1d48eea408121c3b40adf7d44eeb97d138a77ff34b9b30bc658f
      • Instruction ID: 35926898faf0491f700b06bb303834df68b76311dac563f3716e8620fe7e5c6a
      • Opcode Fuzzy Hash: fe7a30c2ba1c1d48eea408121c3b40adf7d44eeb97d138a77ff34b9b30bc658f
      • Instruction Fuzzy Hash: A371EF65615AC0C2DA249F26F8413AA7723F785BD8F500319EE6E47BA4CF3BC899C740
      Function 6658FD64 Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 99libraryloaderCOMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 830 6658fd64-6658fd94 831 6658fd9a-6658fdb1 GetModuleHandleA 830->831 832 6658fe21-6658fe4b GetModuleFileNameW 830->832 833 6658fdb9-6658fe1a GetProcAddress * 4 831->833 834 6658fdb3-6658fdb8 call 665813a0 831->834 835 6658fe51-6658fe59 832->835 836 6658ff26-6658ff4a call 6666d880 832->836 833->832 834->833 838 6658fe6b-6658fea1 835->838 839 6658fe5b-6658fe66 SetLastError 835->839 843 6658fea3-6658feb4 CreateActCtxW 838->843 844 6658feb6 838->844 839->836 845 6658feb9-6658fec3 843->845 844->845 846 6658fef0-6658fef7 845->846 847 6658fec5-6658fed1 845->847 846->836 848 6658fef9-6658ff05 846->848 849 6658fed3-6658fee4 CreateActCtxW 847->849 850 6658fee6 847->850 851 6658ff10 848->851 852 6658ff07-6658ff0e CreateActCtxW 848->852 853 6658fee9 849->853 850->853 854 6658ff13-6658ff1d 851->854 852->854 853->846 854->836 855 6658ff1f 854->855 855->836
      APIs
      • GetModuleHandleA.KERNEL32 ref: 6658FDA1
      • GetProcAddress.KERNEL32 ref: 6658FDC3
      • GetProcAddress.KERNEL32 ref: 6658FDDE
      • GetProcAddress.KERNEL32 ref: 6658FDF9
      • GetProcAddress.KERNEL32 ref: 6658FE14
      • GetModuleFileNameW.KERNEL32 ref: 6658FE43
      • SetLastError.KERNEL32 ref: 6658FE60
      • CreateActCtxW.KERNEL32 ref: 6658FEA8
      • CreateActCtxW.KERNEL32 ref: 6658FED8
      • CreateActCtxW.KERNEL32 ref: 6658FF0C
        • Part of subcall function 665813A0: _CxxThrowException.MSVCR90 ref: 665813BC
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: AddressProc$Create$Module$ErrorExceptionFileHandleLastNameThrow
      • String ID: 8$ActivateActCtx$CreateActCtxW$DeactivateActCtx$KERNEL32$ReleaseActCtx
      • API String ID: 347588597-791111119
      • Opcode ID: 5c459c6d0f9c806d691e7083e60013d9a9b46bca5d1b2c1728cd26780719092b
      • Instruction ID: 6cb5be269de2f30073226eab06b9a94bbd988b189a026eb9a4cd18373582f955
      • Opcode Fuzzy Hash: 5c459c6d0f9c806d691e7083e60013d9a9b46bca5d1b2c1728cd26780719092b
      • Instruction Fuzzy Hash: AA415B31609B5582EB20DF22F94538973A6F788BD0F400629E9AD07B65EFBEC5A5C740
      Function 665993E0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 166windowCOMMON
      Download Yara Rule

      Control-flow Graph

      APIs
        • Part of subcall function 665D3CFC: GetWindowLongA.USER32 ref: 665D3D13
      • GetParent.USER32 ref: 66599414
      • SendMessageA.USER32 ref: 6659943D
      • GetWindowRect.USER32 ref: 66599453
      • GetWindowLongA.USER32 ref: 66599470
      • GetMonitorInfoA.USER32 ref: 665994D7
      • CopyRect.USER32 ref: 665994F1
      • GetWindowRect.USER32 ref: 66599501
        • Part of subcall function 66592148: MonitorFromWindow.USER32 ref: 6659216C
      • GetMonitorInfoA.USER32 ref: 66599528
      • CopyRect.USER32 ref: 66599542
        • Part of subcall function 66592218: SystemParametersInfoA.USER32 ref: 66592241
        • Part of subcall function 66592218: GetSystemMetrics.USER32 ref: 66592255
        • Part of subcall function 66592218: GetSystemMetrics.USER32 ref: 66592263
        • Part of subcall function 66592218: strncpy_s.MSVCR90 ref: 66592298
      • GetParent.USER32 ref: 6659954E
      • GetClientRect.USER32 ref: 6659955F
      • GetClientRect.USER32 ref: 6659956D
      • MapWindowPoints.USER32 ref: 66599584
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: RectWindow$InfoMonitorSystem$ClientCopyLongMetricsParent$FromMessageParametersPointsSendstrncpy_s
      • String ID: (
      • API String ID: 647808826-3887548279
      • Opcode ID: 512a8ca4ba82496e28da06b05e124bae7e93386dab16eb6e6421aa23e427ed91
      • Instruction ID: 866b74a6a7b11b19355c697a76eb02fd064d2ca4249638485e9fe08873dbc65b
      • Opcode Fuzzy Hash: 512a8ca4ba82496e28da06b05e124bae7e93386dab16eb6e6421aa23e427ed91
      • Instruction Fuzzy Hash: 6861AF32318A818BDB15CB29F94570EB762FB85B81F544624EA9983B58DF3ED805CF40
      Function 665C638C Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 151librarystringmemoryCOMMON
      Download Yara Rule

      Control-flow Graph

      APIs
        • Part of subcall function 66591590: LeaveCriticalSection.KERNEL32 ref: 665915CF
      • GetModuleHandleA.KERNEL32 ref: 665C63F3
      • LoadLibraryA.KERNEL32 ref: 665C6406
      • GetModuleHandleA.KERNEL32 ref: 665C642D
      • GetProcAddress.KERNEL32 ref: 665C643D
      • FindResourceExA.KERNEL32 ref: 665C6489
      • FindResourceExA.KERNEL32 ref: 665C64AD
      • LoadResource.KERNEL32 ref: 665C64BE
      • GlobalAlloc.KERNEL32 ref: 665C64FD
      • strcpy_s.MSVCR90 ref: 665C6522
        • Part of subcall function 665813A0: _CxxThrowException.MSVCR90 ref: 665813BC
      • strlen.MSVCR90 ref: 665C656B
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Resource$FindHandleLoadModule$AddressAllocCriticalExceptionGlobalLeaveLibraryProcSectionThrowstrcpy_sstrlen
      • String ID: GetUserDefaultUILanguage$KERNEL32.DLL$MS UI Gothic
      • API String ID: 3426651864-1344381877
      • Opcode ID: cf4500ebf949b535f76c7770cda5656c5631c315415b33eb00caebd984c97acd
      • Instruction ID: a088634865fb284993c586161b82517575d4185049da14e6159ed16c602c4bc0
      • Opcode Fuzzy Hash: cf4500ebf949b535f76c7770cda5656c5631c315415b33eb00caebd984c97acd
      • Instruction Fuzzy Hash: BE51E561700B8186DB149FA7E99533C6362FB84BC4F54483DDB6A43B54DF39D994C701
      Function 665F0458 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 155stringCOMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 959 665f0458-665f04b3 GetModuleFileNameA 960 665f04b9-665f04be 959->960 961 665f06a0-665f06a5 call 665d0330 959->961 960->961 963 665f04c4-665f04d5 PathFindExtensionA 960->963 967 665f06a6-665f06ca call 6666d880 961->967 964 665f04dd-665f04fa call 665f06d4 963->964 965 665f04d7-665f04dc call 665d0330 963->965 973 665f04fc-665f0501 call 665d0330 964->973 974 665f0502-665f050a 964->974 965->964 973->974 977 665f052c-665f0536 974->977 978 665f050c-665f0524 _strdup 974->978 981 665f057b-665f0587 977->981 982 665f0538-665f054b call 666657f4 977->982 978->977 980 665f0526-665f052b call 66581350 978->980 980->977 983 665f058d-665f05a2 981->983 984 665f0632-665f063a 981->984 991 665f0550-665f055a 982->991 987 665f05db-665f05ea strcpy_s 983->987 988 665f05a4-665f05b3 strcpy_s 983->988 984->967 989 665f063c-665f0658 strcat_s 984->989 992 665f05ec-665f05ef 987->992 993 665f0612-665f0627 _strdup 987->993 988->993 994 665f05b5-665f05b8 988->994 995 665f065a-665f065d 989->995 996 665f0680-665f0698 _strdup 989->996 997 665f055c 991->997 998 665f0563-665f0573 _strdup 991->998 1002 665f060c-665f0611 call 66581350 992->1002 1003 665f05f1-665f05f4 992->1003 999 665f062f 993->999 1000 665f0629-665f062e call 66581350 993->1000 1004 665f05ba-665f05bd 994->1004 1005 665f05d5-665f05da call 66581350 994->1005 1006 665f065f-665f0662 995->1006 1007 665f067a-665f067f call 66581350 995->1007 996->967 1001 665f069a-665f069f call 66581350 996->1001 997->998 998->981 1008 665f0575-665f057a call 66581350 998->1008 999->984 1000->999 1001->961 1002->993 1013 665f0606-665f060b call 665813a0 1003->1013 1014 665f05f6-665f05f9 1003->1014 1015 665f05cf-665f05d4 call 665813a0 1004->1015 1016 665f05bf-665f05c2 1004->1016 1005->987 1018 665f0674-665f0679 call 665813a0 1006->1018 1019 665f0664-665f0667 1006->1019 1007->996 1008->981 1013->1002 1014->1013 1026 665f05fb-665f05fe 1014->1026 1015->1005 1016->1015 1027 665f05c4-665f05c7 1016->1027 1018->1007 1019->1018 1029 665f0669-665f066c 1019->1029 1026->993 1034 665f0600-665f0605 call 665813a0 1026->1034 1027->993 1035 665f05c9-665f05ce call 665813a0 1027->1035 1029->996 1036 665f066e-665f0673 call 665813a0 1029->1036 1034->1013 1035->1015 1036->1018
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: _strdup$ExceptionThrowstrcpy_s$ExtensionFileFindModuleNamePathstrcat_s
      • String ID: .CHM$.HLP$.INI
      • API String ID: 1300142090-4017452060
      • Opcode ID: 6263a97b6750710716a284841d5a321365846acc2387a69dfd4713f6f4426004
      • Instruction ID: 16ee2374d3d0a5bfa66113650a179b072eabbc32a19164479f73a0ab480ba1cb
      • Opcode Fuzzy Hash: 6263a97b6750710716a284841d5a321365846acc2387a69dfd4713f6f4426004
      • Instruction Fuzzy Hash: C851DD31625B8686EB248F24E86539D3361FBC4B84F580437DAAD83B54DF35C585CF90
      Function 0089D506 Relevance: 18.1, APIs: 12, Instructions: 144memoryCOMMON
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 1045 89d506-89d533 1046 89d53b-89d54b Heap32ListNext 1045->1046 1047 89d569-89d57b 1046->1047 1048 89d54d-89d54f 1046->1048 1053 89d57d-89d583 GetTickCount 1047->1053 1054 89d585-89d59c Process32First 1047->1054 1049 89d551-89d55e GetTickCount 1048->1049 1050 89d560-89d563 1048->1050 1049->1047 1049->1050 1050->1047 1052 89d430-89d4b3 call 89c9e0 Heap32First 1050->1052 1064 89d4b5-89d4be 1052->1064 1065 89d504 1052->1065 1053->1054 1056 89d5ef 1054->1056 1057 89d59e-89d5a6 1054->1057 1059 89d5f7-89d604 1056->1059 1058 89d5b0-89d5d8 call 89c9e0 1057->1058 1058->1059 1075 89d5da-89d5dc 1058->1075 1062 89d60e-89d61f 1059->1062 1063 89d606-89d60c GetTickCount 1059->1063 1072 89d621-89d629 1062->1072 1073 89d672-89d67f 1062->1073 1063->1062 1066 89d4c0-89d4e5 call 89c9e0 Heap32Next 1064->1066 1065->1046 1066->1065 1074 89d4e7-89d4e9 1066->1074 1078 89d631-89d658 call 89c9e0 1072->1078 1076 89d689-89d69a 1073->1076 1077 89d681-89d687 GetTickCount 1073->1077 1080 89d4eb-89d4f8 GetTickCount 1074->1080 1081 89d4fa-89d502 1074->1081 1075->1058 1082 89d5de-89d5eb GetTickCount 1075->1082 1086 89d69c 1076->1086 1087 89d6e1-89d6ec 1076->1087 1077->1076 1092 89d65a-89d65d 1078->1092 1093 89d66e 1078->1093 1080->1065 1080->1081 1081->1065 1081->1066 1082->1058 1084 89d5ed 1082->1084 1084->1059 1091 89d6a4-89d6cb call 89c9e0 1086->1091 1089 89d6ee-89d6f3 1087->1089 1090 89d6f5-89d6f8 CloseHandle 1087->1090 1094 89d6fe-89d797 FreeLibrary call 89cb50 GlobalMemoryStatus call 89c9e0 GetCurrentProcessId call 89c9e0 call 915b20 1089->1094 1090->1094 1091->1087 1103 89d6cd-89d6d0 1091->1103 1092->1078 1096 89d65f-89d66c GetTickCount 1092->1096 1093->1073 1096->1078 1096->1093 1103->1091 1105 89d6d2-89d6df GetTickCount 1103->1105 1105->1087 1105->1091
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: CountTick$CloseCurrentFirstFreeGlobalHandleHeap32LibraryListMemoryNextProcessProcess32Status
      • String ID:
      • API String ID: 3567301285-0
      • Opcode ID: c5093aadbe9895fe2b2cd2293dd8cc4c44f828e3b58e916ee53bbe61e35c60c7
      • Instruction ID: 205c3efc939014dd19062fa4b0338c1f34c267dd32fe88d6ee430f502d02d8b1
      • Opcode Fuzzy Hash: c5093aadbe9895fe2b2cd2293dd8cc4c44f828e3b58e916ee53bbe61e35c60c7
      • Instruction Fuzzy Hash: E6517F22204BC086DF21EF25E44439FB365FBD4B85F499212DE4E97668DF38C94ACB44
      Function 6659E924 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103stringCOMMON
      Download Yara Rule

      Control-flow Graph

      APIs
        • Part of subcall function 665D3CFC: GetWindowLongA.USER32 ref: 665D3D13
      • sprintf_s.MSVCR90 ref: 6659E9B7
      • strlen.MSVCR90 ref: 6659E9C2
        • Part of subcall function 6659B3E0: strlen.MSVCR90 ref: 6659B42A
        • Part of subcall function 6659B3E0: strlen.MSVCR90 ref: 6659B4EE
      • strlen.MSVCR90 ref: 6659E9E0
      • strlen.MSVCR90 ref: 6659E985
        • Part of subcall function 6659B3E0: memcpy_s.MSVCR90 ref: 6659B489
      • strlen.MSVCR90 ref: 6659EA34
      • strlen.MSVCR90 ref: 6659EA50
      • sprintf_s.MSVCR90 ref: 6659EA82
      • strlen.MSVCR90 ref: 6659EA8D
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: strlen$sprintf_s$LongWindowmemcpy_s
      • String ID: - $:%d
      • API String ID: 3984027744-2359489159
      • Opcode ID: d823e20a4ba7ecc9643ec9db59bb349bf701a01eeb8ca1c4c6d26fbde92047cf
      • Instruction ID: a0a526e5b64e613a2d634455ce7f2663d112cad11e59f2374b77b349c5d346d6
      • Opcode Fuzzy Hash: d823e20a4ba7ecc9643ec9db59bb349bf701a01eeb8ca1c4c6d26fbde92047cf
      • Instruction Fuzzy Hash: 2E41A522310AC092DF10DF26FC5175E6B21FBD5B98F405326EA9E47A78DF2AC555CB40
      Function 66590DFC Relevance: 16.6, APIs: 11, Instructions: 112memoryCOMMONLIBRARYCODE
      Download Yara Rule

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 1163 66590dfc-66590e2c EnterCriticalSection 1164 66590e2e-66590e3c 1163->1164 1165 66590e42-66590e4d 1163->1165 1164->1165 1166 66590f4a-66590f4d 1164->1166 1167 66590e6a-66590e6c 1165->1167 1168 66590e4f-66590e53 1165->1168 1170 66590f4f-66590f52 1166->1170 1171 66590f55-66590f8f LeaveCriticalSection 1166->1171 1167->1166 1169 66590e72-66590e7d 1167->1169 1172 66590e57-66590e5a 1168->1172 1174 66590eaa-66590ecb GlobalHandle GlobalUnlock 1169->1174 1175 66590e7f-66590e8e 1169->1175 1170->1171 1172->1167 1173 66590e5c-66590e68 1172->1173 1173->1167 1173->1172 1178 66590ed8-66590ee4 GlobalReAlloc 1174->1178 1179 66590ecd-66590ed7 call 665839c4 1174->1179 1176 66590e9b-66590ea8 GlobalAlloc 1175->1176 1177 66590e90-66590e9a call 665839c4 1175->1177 1181 66590eea-66590eed 1176->1181 1177->1176 1178->1181 1179->1178 1185 66590eef-66590ef6 1181->1185 1186 66590f17-66590f46 GlobalLock memset 1181->1186 1187 66590ef8-66590f01 GlobalHandle GlobalLock 1185->1187 1188 66590f07-66590f16 LeaveCriticalSection call 66581350 1185->1188 1186->1166 1187->1188 1188->1186
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlockmemset
      • String ID:
      • API String ID: 4203309205-0
      • Opcode ID: 80efd01ca257695a471ce0b39cf6a95cb16076b9fc6cefff51bba0c875d906fd
      • Instruction ID: a83b26503106ddc6b6d30b43d8b4a2612678b21b9fe0dda79eaec848e79084bb
      • Opcode Fuzzy Hash: 80efd01ca257695a471ce0b39cf6a95cb16076b9fc6cefff51bba0c875d906fd
      • Instruction Fuzzy Hash: E941907270179183EB08CF25E565318B361FB84B85F048A2ADB6A47B50DF39E8A2C740
      Function 66593460 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 109COMMON
      Download Yara Rule

      Control-flow Graph

      APIs
      • GetPropA.USER32 ref: 665934A0
      • GetWindowRect.USER32 ref: 665934ED
        • Part of subcall function 665D3CFC: GetWindowLongA.USER32 ref: 665D3D13
      • CallWindowProcA.USER32 ref: 66593513
        • Part of subcall function 66592DA8: GetWindowRect.USER32 ref: 66592DCD
        • Part of subcall function 66592DA8: GetWindow.USER32 ref: 66592DEF
      • SetWindowLongPtrA.USER32 ref: 66593543
      • RemovePropA.USER32 ref: 66593553
      • GlobalFindAtomA.KERNEL32 ref: 66593560
      • GlobalDeleteAtom.KERNEL32 ref: 66593569
      • CallWindowProcA.USER32 ref: 665935D5
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Window$AtomCallGlobalLongProcPropRect$DeleteFindRemove
      • String ID: AfxOldWndProc423
      • API String ID: 186092411-1060338832
      • Opcode ID: 42f6fc0506e36377afb0d855ac2fa42a0287237def2607ad90f96204188be4b9
      • Instruction ID: 95d920d0c5330a8ee0f954af5513b81dce1a4591b7ea40da2ea10d9dad630db5
      • Opcode Fuzzy Hash: 42f6fc0506e36377afb0d855ac2fa42a0287237def2607ad90f96204188be4b9
      • Instruction Fuzzy Hash: 4C31032271079082DA14DF2AFC5972A7791F78AFE4F011728AE6A0B7A4DF3EC945C750
      Function 665A5E40 Relevance: 15.1, APIs: 10, Instructions: 84COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Rect$Invalidate$Window$Proc
      • String ID:
      • API String ID: 570070710-0
      • Opcode ID: d18bb298a3c0f1bd18f97edde83a77d5b4c93033f0fb7ea591d5df23df4fca50
      • Instruction ID: 71f146dc86b1b8e0434555b60eeb12818e91c5981ae2dc2417e86b404a9304a9
      • Opcode Fuzzy Hash: d18bb298a3c0f1bd18f97edde83a77d5b4c93033f0fb7ea591d5df23df4fca50
      • Instruction Fuzzy Hash: 00412276625B948BD720CF26F544B5DBBA2F3C8B85F406109EE8A03B18DF7AD159CB40
      Function 6661ABF8 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 41COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 665D33D0: EnterCriticalSection.KERNEL32 ref: 665D340E
        • Part of subcall function 665D33D0: InitializeCriticalSection.KERNEL32 ref: 665D342A
        • Part of subcall function 665D33D0: LeaveCriticalSection.KERNEL32 ref: 665D343E
      • GetProfileIntA.KERNEL32 ref: 6661AC61
      • GetProfileIntA.KERNEL32 ref: 6661AC81
      • GetPrivateProfileIntA.KERNEL32 ref: 6661ACA1
      • LeaveCriticalSection.KERNEL32 ref: 6661ACBE
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: CriticalSection$Profile$Leave$EnterInitializePrivate
      • String ID: DragScrollDelay$DragScrollInset$DragScrollInterval$windows
      • API String ID: 3674788496-1024936294
      • Opcode ID: 479210b7f8bce7a6e8aafcbcc71ecb6750cbc3e672874b20f4fc5a832c40b079
      • Instruction ID: ae0e92f985ca5934f2b7a76f24e2d379f11dd25e5ac0e6a90a76992d77936e8c
      • Opcode Fuzzy Hash: 479210b7f8bce7a6e8aafcbcc71ecb6750cbc3e672874b20f4fc5a832c40b079
      • Instruction Fuzzy Hash: 89112570211B8296EB508F68F84436837A3F745B68F405229E929467F4EB7FD5A8CB90
      Function 665BB9A4 Relevance: 13.7, APIs: 9, Instructions: 156COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Window$Resource$ActiveEnableFind$DesktopEnabledLoadLock
      • String ID:
      • API String ID: 3140604540-0
      • Opcode ID: 9feb1fe58930fbe33aaea4e6b21d28475e96b3ba5e9bf4592b8d073f91234bec
      • Instruction ID: da8ac1a74eba27fb4f7d8c7cd80c9b71a453a626e56285e692a69ab69afa94c0
      • Opcode Fuzzy Hash: 9feb1fe58930fbe33aaea4e6b21d28475e96b3ba5e9bf4592b8d073f91234bec
      • Instruction Fuzzy Hash: 45519521605B8186EB14EF26E9E532E7792FBC5FE8F044224CD6A07B98DF79C456CB01
      Function 665A2D40 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 108stringCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 665A2CF4: GetParent.USER32 ref: 665A2CFC
        • Part of subcall function 665A2CF4: GetParent.USER32 ref: 665A2D05
        • Part of subcall function 665D3CFC: GetWindowLongA.USER32 ref: 665D3D13
      • _mbsnbcpy_s.MSVCR90 ref: 665A2DB8
        • Part of subcall function 665813A0: _CxxThrowException.MSVCR90 ref: 665813BC
      • _mbsnbcpy_s.MSVCR90 ref: 665A2DEC
      • sprintf_s.MSVCR90 ref: 665A2E39
      • lstrlenA.KERNEL32 ref: 665A2E44
      • lstrlenA.KERNEL32 ref: 665A2E51
      • strcat_s.MSVCR90 ref: 665A2E70
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Parent_mbsnbcpy_slstrlen$ExceptionLongThrowWindowsprintf_sstrcat_s
      • String ID: :%d
      • API String ID: 3853485493-1955712242
      • Opcode ID: 0318d94384afbe1970d2fe0b8de6772c7e635fdc03847df479a87139ef2f733b
      • Instruction ID: bcdbbabe385ebd9d2f0360f8459d16155c9b22a43f137c6ed63c56ede9254b27
      • Opcode Fuzzy Hash: 0318d94384afbe1970d2fe0b8de6772c7e635fdc03847df479a87139ef2f733b
      • Instruction Fuzzy Hash: ED31F320B00B4346EB249B73E88737D3761FB95B84F68082ADA7983E61CF25C894CB01
      Function 665BB004 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 74windowCOMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Window$ClassCompareEnabledItemLongMessageNameSendString
      • String ID: Edit
      • API String ID: 59314946-554135844
      • Opcode ID: b3b380559c811bb84c655c2c282452b4859cb47d6e38f1b487a77d0a5ec9b491
      • Instruction ID: 1e75d518b94197bdaba3788ea4c89d6c3268a1a46fc1c1107066270674011c4a
      • Opcode Fuzzy Hash: b3b380559c811bb84c655c2c282452b4859cb47d6e38f1b487a77d0a5ec9b491
      • Instruction Fuzzy Hash: A421D032704B8082EF10DB21F9A67697361F789BC8F544229DA6947B54CFBAC055CB50
      Function 665F1A18 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54registryCOMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: CloseCreate$Open
      • String ID: BarID$software
      • API String ID: 1740278721-2646848146
      • Opcode ID: 8bd921328138acdbd799f13c729c642030d0a3fad5c945636c56c3d2a6d706d3
      • Instruction ID: 9fa3b37dc05dbf8594da0274cf4a2c4284849264dafa9a624c34d29ba50285cc
      • Opcode Fuzzy Hash: 8bd921328138acdbd799f13c729c642030d0a3fad5c945636c56c3d2a6d706d3
      • Instruction Fuzzy Hash: CC21AF72228B8086EB608F50F49575AB3A5F788798F505225EB9D47B18DF7EC148CF40
      Function 66596848 Relevance: 12.1, APIs: 8, Instructions: 130windowCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Window$DeferRect$BeginClientCopyCtrlMessageSend
      • String ID:
      • API String ID: 1228040700-0
      • Opcode ID: ae29a63adf9e1b9ccac64681ea56fb1ef7fc07b2697dd45f08aa8f14dde5bdfc
      • Instruction ID: bf6f822f0f1c400aaf93013665d2d96bcbb73f932fdecbf868289f666c7434ee
      • Opcode Fuzzy Hash: ae29a63adf9e1b9ccac64681ea56fb1ef7fc07b2697dd45f08aa8f14dde5bdfc
      • Instruction Fuzzy Hash: 12518D326097C0C6EB20CF16E45176D7765F389BD4F448215EE8A17B14DF79C88ACB80
      Function 6666548C Relevance: 12.1, APIs: 8, Instructions: 90COMMON
      Download Yara Rule
      APIs
      • FindResourceExA.KERNEL32 ref: 666654C6
      • FindResourceA.KERNEL32 ref: 66665501
      • LeaveCriticalSection.KERNEL32(?,?,?,66599C6E), ref: 66665519
      • LeaveCriticalSection.KERNEL32(?,?,?,66599C6E), ref: 6666552F
      • FindResourceA.KERNEL32 ref: 6666554A
      • FindResourceA.KERNEL32 ref: 66665571
      • FindResourceExA.KERNEL32(?,?,?,66599C6E), ref: 666655A8
      • LeaveCriticalSection.KERNEL32(?,?,?,66599C6E), ref: 666655C4
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: FindResource$CriticalLeaveSection
      • String ID:
      • API String ID: 583477357-0
      • Opcode ID: 1aed42715f30bf1fca2c0d26800e1c701ad77f981e739e3449b977f073207478
      • Instruction ID: 219bd6de7ea652c4d7c46751d00b778281b612179ef6c01afd9398df1d4032c2
      • Opcode Fuzzy Hash: 1aed42715f30bf1fca2c0d26800e1c701ad77f981e739e3449b977f073207478
      • Instruction Fuzzy Hash: ED316771751B8082EF088F67F94A3986762FB55FC5F4C452A9E1A87726DF3AC460C381
      Function 66599D88 Relevance: 10.7, APIs: 1, Strings: 6, Instructions: 212COMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: memset
      • String ID: @$AfxControlBar90$AfxFrameOrView90$AfxMDIFrame90$AfxOleControl90$AfxWnd90
      • API String ID: 2221118986-1996455151
      • Opcode ID: 0f70cd37ea0ac2612f0efdc02a0970d6108c251400428164cf5ffce38d421917
      • Instruction ID: 898573b0d835e7ea179bc89d77cba8fb4c84680e94415c8ce932b901afab75e1
      • Opcode Fuzzy Hash: 0f70cd37ea0ac2612f0efdc02a0970d6108c251400428164cf5ffce38d421917
      • Instruction Fuzzy Hash: 9F918136A187C48AE730CF61E48239ABBA5F3C4359F848215D68D43B49DBBEC549CF52
      Function 665BF6A4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 96memoryCOMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Global$AllocExceptionFreeLockPropThrowUnlock
      • String ID: AfxClosePending
      • API String ID: 1351453212-3670358930
      • Opcode ID: ba6f14590afccdba1fa51d7b2a5904a23f2d38a5f5e26fab91c3d537d017e744
      • Instruction ID: 09f51cd65c9cdf2e046af0786e1651858934021d4aa93c332e67e3fb2ecd4d81
      • Opcode Fuzzy Hash: ba6f14590afccdba1fa51d7b2a5904a23f2d38a5f5e26fab91c3d537d017e744
      • Instruction Fuzzy Hash: E341AD39604B8186EB48DF26E9953AC3760FBC9BE4F148225DB6E47790DF79C861CB40
      Function 66593E18 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88windowCOMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: LongWindow$MessageSendmemset
      • String ID: @
      • API String ID: 3752869180-2766056989
      • Opcode ID: e81b195929da73bec1b957d954dcb05c72ca19bf1cddaa7068fee6e588005b8f
      • Instruction ID: 1f8e936fba3e393699dec964df7b180960be12856e981459c22afd327b8438e3
      • Opcode Fuzzy Hash: e81b195929da73bec1b957d954dcb05c72ca19bf1cddaa7068fee6e588005b8f
      • Instruction Fuzzy Hash: 45414732605A80C2EB15CF35D64536D7BA0FB88F98F18422ADB5D47794CF3AC8A4CB41
      Function 665F15C4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81stringCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 66586708: GetModuleFileNameA.KERNEL32 ref: 66586731
        • Part of subcall function 66586708: GetShortPathNameA.KERNEL32 ref: 6658676B
        • Part of subcall function 66586708: strlen.MSVCR90 ref: 6658677A
      • PathFindFileNameA.SHLWAPI ref: 665F1629
      • PathRemoveExtensionA.SHLWAPI ref: 665F165A
      • strnlen.MSVCR90 ref: 665F1669
      • GlobalAddAtomW.KERNEL32 ref: 665F1695
      • GlobalAddAtomA.KERNEL32 ref: 665F16A9
        • Part of subcall function 6658383C: memcpy_s.MSVCR90 ref: 665838A0
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: NamePath$AtomFileGlobal$ExtensionFindModuleRemoveShortmemcpy_sstrlenstrnlen
      • String ID: system
      • API String ID: 2142124621-3377271179
      • Opcode ID: 85d1ee7e8ce248c3192d875f899cec3424d434acce8ef70d3383e2dd8f449340
      • Instruction ID: 9653e7b1d651888e4a50919089f08e3fb7010a2419d42d5f0eb9600fabee708c
      • Opcode Fuzzy Hash: 85d1ee7e8ce248c3192d875f899cec3424d434acce8ef70d3383e2dd8f449340
      • Instruction Fuzzy Hash: E3316D72615A8082CB00CF69E89025DB731F7C5BA5F644326E77E877A4DF3AC856CB44
      Function 665C05F8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75libraryloaderCOMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: ErrorLast$AddressHandleLibraryLoadModuleProc
      • String ID: PropertySheetA
      • API String ID: 1454160851-465137969
      • Opcode ID: 5807d58d7c9c00576dee918255c30061a8a1b7289e98dfefc62818b24d6cd0c3
      • Instruction ID: 912770058fd9a620fe261735b376b3abf0020ddd0459e64fba5392e91f98acc1
      • Opcode Fuzzy Hash: 5807d58d7c9c00576dee918255c30061a8a1b7289e98dfefc62818b24d6cd0c3
      • Instruction Fuzzy Hash: FB318B72605F8182EB008FA5E44131962A1FB88BF8F04872ADA79477E8EF79C4D1C751
      Function 665F0398 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 43libraryloaderCOMMON
      Download Yara Rule
      APIs
      • SetErrorMode.KERNEL32(?,?,?,665A5298), ref: 665F03B2
      • SetErrorMode.KERNEL32(?,?,?,665A5298), ref: 665F03BF
        • Part of subcall function 6658FD64: GetModuleHandleA.KERNEL32 ref: 6658FDA1
        • Part of subcall function 6658FD64: GetProcAddress.KERNEL32 ref: 6658FDC3
        • Part of subcall function 6658FD64: GetProcAddress.KERNEL32 ref: 6658FDDE
        • Part of subcall function 6658FD64: GetProcAddress.KERNEL32 ref: 6658FDF9
        • Part of subcall function 6658FD64: GetProcAddress.KERNEL32 ref: 6658FE14
        • Part of subcall function 6658FD64: GetModuleFileNameW.KERNEL32 ref: 6658FE43
        • Part of subcall function 6658FD64: SetLastError.KERNEL32 ref: 6658FE60
      • GetModuleHandleA.KERNEL32 ref: 665F0418
      • GetProcAddress.KERNEL32 ref: 665F042D
        • Part of subcall function 665F0458: GetModuleFileNameA.KERNEL32 ref: 665F04AB
        • Part of subcall function 665F0458: PathFindExtensionA.SHLWAPI ref: 665F04C9
        • Part of subcall function 665F0458: _strdup.MSVCR90 ref: 665F0514
        • Part of subcall function 665F0458: _strdup.MSVCR90 ref: 665F0563
        • Part of subcall function 665F0458: strcpy_s.MSVCR90 ref: 665F05AB
        • Part of subcall function 665F0458: strcpy_s.MSVCR90 ref: 665F05E2
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: AddressProc$Module$Error$FileHandleModeName_strdupstrcpy_s$ExtensionFindLastPath
      • String ID: NotifyWinEvent$user32.dll
      • API String ID: 4063869280-597752486
      • Opcode ID: d6745cc37117ba161cf2c0c9a5470ef5839f0d0ffaaa947418416f851b3efd8a
      • Instruction ID: 4cd92a41976a46572cfb3b839cda2cca985c3c942291696a9f82aedd7590b1bb
      • Opcode Fuzzy Hash: d6745cc37117ba161cf2c0c9a5470ef5839f0d0ffaaa947418416f851b3efd8a
      • Instruction Fuzzy Hash: 5B11A131611B8181EB449F20F85531877A1FBD8B88F58453DEA9E47721CF3AC8A6CB40
      Function 665D37C4 Relevance: 9.0, APIs: 6, Instructions: 47windowCOMMON
      Download Yara Rule
      APIs
      • GetFocus.USER32(?,?,?,6659BC6E), ref: 665D37D1
      • GetParent.USER32 ref: 665D37F8
        • Part of subcall function 665D358C: GetWindowLongA.USER32 ref: 665D35BF
        • Part of subcall function 665D358C: GetClassNameA.USER32 ref: 665D35DA
        • Part of subcall function 665D358C: CompareStringA.KERNELBASE(?,?,?,?,?,?,?,?,?,665992D0), ref: 665D3603
      • GetWindowLongA.USER32 ref: 665D3824
      • GetParent.USER32 ref: 665D3833
      • GetDesktopWindow.USER32 ref: 665D383C
      • SendMessageA.USER32 ref: 665D3855
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Window$LongParent$ClassCompareDesktopFocusMessageNameSendString
      • String ID:
      • API String ID: 1233893325-0
      • Opcode ID: ef7497b7ac63c74d09bfa500c898df91759f5e097d2368e205965503b06a4b4b
      • Instruction ID: 0bdf4b7ae6b97aaa6e7e7651ef1055f343e570bb517d3fe8bfffc2408536e236
      • Opcode Fuzzy Hash: ef7497b7ac63c74d09bfa500c898df91759f5e097d2368e205965503b06a4b4b
      • Instruction Fuzzy Hash: 9001F710F0264282FE005B3AFD2672952929F96FD0F080438ED2A4BBC4EF3EC851C754
      Function 665BB52C Relevance: 7.7, APIs: 5, Instructions: 152COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Global$CreateDestroyDialogFreeIndirectLockParamUnlockWindow
      • String ID:
      • API String ID: 1794613203-0
      • Opcode ID: 9184ec6e37c77aca389bd3815795dc3bedc652922cf6aaa835ec57d04334a1db
      • Instruction ID: df1ddc9fb08520884f5bfdad86b0d24a49f099352e77553fc8e7d3ced50d1449
      • Opcode Fuzzy Hash: 9184ec6e37c77aca389bd3815795dc3bedc652922cf6aaa835ec57d04334a1db
      • Instruction Fuzzy Hash: 0E510532214B8082DB04EF66E8913AD77A0FB85FD4F44462AEF6A037A4CFB8C495C700
      Function 665F1C40 Relevance: 7.6, APIs: 5, Instructions: 140registrystringCOMMON
      Download Yara Rule
      APIs
      • GetPrivateProfileStringA.KERNEL32 ref: 665F1E13
        • Part of subcall function 665F1B24: RegCreateKeyExA.KERNEL32 ref: 665F1B77
        • Part of subcall function 665F1B24: RegCloseKey.ADVAPI32 ref: 665F1B80
      • RegQueryValueExA.KERNEL32 ref: 665F1CFA
      • RegQueryValueExA.ADVAPI32 ref: 665F1D46
      • strnlen.MSVCR90 ref: 665F1D56
      • RegCloseKey.ADVAPI32 ref: 665F1D7E
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: CloseQueryValue$CreatePrivateProfileStringstrnlen
      • String ID:
      • API String ID: 236897522-0
      • Opcode ID: 409d3518496fd5359943b515df677f7f1374740a9a1cbb43fbef8eb47fa58f00
      • Instruction ID: ef9263738261573d147f902a7565d0761bec31b67194ae31392638ee679aa254
      • Opcode Fuzzy Hash: 409d3518496fd5359943b515df677f7f1374740a9a1cbb43fbef8eb47fa58f00
      • Instruction Fuzzy Hash: 5651DF72725B8086EB10CF26F95439EB761F785BE8F405225EE5A87768EF38C446CB40
      Function 666657F4 Relevance: 7.6, APIs: 5, Instructions: 100memoryCOMMON
      Download Yara Rule
      APIs
      • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,6658129D), ref: 66665885
      • SetErrorMode.KERNEL32 ref: 666658B6
      • SetErrorMode.KERNEL32 ref: 666658C3
      • LocalAlloc.KERNEL32 ref: 666658D6
      • LocalFree.KERNEL32 ref: 666658E4
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: ErrorLocalMode$AllocByteCharFreeMultiWide
      • String ID:
      • API String ID: 450255513-0
      • Opcode ID: aa94f54dd12a42128446f2624813ce611adc8fa8ad11ef8fa309f29acb26e8bf
      • Instruction ID: 84f3bd6673c07fad5ea5f626210d82e5b912fdd028ea1389f44d8ca75c1e065e
      • Opcode Fuzzy Hash: aa94f54dd12a42128446f2624813ce611adc8fa8ad11ef8fa309f29acb26e8bf
      • Instruction Fuzzy Hash: B7310671A1479186EB14AF32F80231D7762F7C4798F14462DDAAA83B66DF3DC850C712
      Function 66586708 Relevance: 7.6, APIs: 5, Instructions: 88stringCOMMON
      Download Yara Rule
      APIs
      • GetModuleFileNameA.KERNEL32 ref: 66586731
      • GetShortPathNameA.KERNEL32 ref: 6658676B
      • strlen.MSVCR90 ref: 6658677A
      • strnlen.MSVCR90 ref: 6658679F
      • strlen.MSVCR90 ref: 66586801
        • Part of subcall function 665813A0: _CxxThrowException.MSVCR90 ref: 665813BC
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Namestrlen$ExceptionFileModulePathShortThrowstrnlen
      • String ID:
      • API String ID: 3135391887-0
      • Opcode ID: 645dcec8618013867923cfc90a8bdfe6e961df235ec9d42e496a245b5800ffc1
      • Instruction ID: d946bd0e5d42744fadd4538f560eb556dfd35e1dd7e09d4f94c30092f6d90b31
      • Opcode Fuzzy Hash: 645dcec8618013867923cfc90a8bdfe6e961df235ec9d42e496a245b5800ffc1
      • Instruction Fuzzy Hash: FD21D376710A4586EB14CF27E8A576D67A1B788FC8F144029CB5D87B18DF3DC942CB40
      Function 665BE1E0 Relevance: 7.6, APIs: 5, Instructions: 79COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Resource$FindFreeGlobalLoadLockParentmalloc
      • String ID:
      • API String ID: 3504621642-0
      • Opcode ID: 80bac1bb69f7ea2f0b29c34f3ab25a7fff420cb2b911757f63de0fe0ab6f907c
      • Instruction ID: 3d02a63de406a24be0683a66ee41e1ceeb987be4deece7b0448a55e5c0f28670
      • Opcode Fuzzy Hash: 80bac1bb69f7ea2f0b29c34f3ab25a7fff420cb2b911757f63de0fe0ab6f907c
      • Instruction Fuzzy Hash: F8219C25B12BC182EB189F22ED66359A7A1EB89FC8F188029DE5D07F58DF39C491C740
      Function 665A27C4 Relevance: 7.6, APIs: 5, Instructions: 72COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 665A2CF4: GetParent.USER32 ref: 665A2CFC
        • Part of subcall function 665A2CF4: GetParent.USER32 ref: 665A2D05
      • GetWindowLongA.USER32 ref: 665A2812
      • RedrawWindow.USER32 ref: 665A285F
      • SetWindowLongA.USER32 ref: 665A2874
      • SetWindowPos.USER32 ref: 665A289B
      • GetClientRect.USER32 ref: 665A28B0
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Window$LongParent$ClientRectRedraw
      • String ID:
      • API String ID: 556606033-0
      • Opcode ID: df192c28e4cb061e6f37b15074009b34b9288773884614c0773137f22d6e5708
      • Instruction ID: b0724d35730bbe3681335841d11e53e0209f6425ece1f5154aa1c73c7bf980cc
      • Opcode Fuzzy Hash: df192c28e4cb061e6f37b15074009b34b9288773884614c0773137f22d6e5708
      • Instruction Fuzzy Hash: 3821BD36B14B9186EB209F67E89275D3762F7C9B94F084429EF1947B18CF39C541CB80
      Function 6659C5C0 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: MessageSendWindow$DesktopLong
      • String ID:
      • API String ID: 2272707703-0
      • Opcode ID: 96a4f585a8e8c361c4394aeafaf8250bcaca3f5403cecf80c5331f87037f3a4b
      • Instruction ID: fcead240874fd3ef598c4380c936d17b8111f4b827d252d98da2ce019ce170d1
      • Opcode Fuzzy Hash: 96a4f585a8e8c361c4394aeafaf8250bcaca3f5403cecf80c5331f87037f3a4b
      • Instruction Fuzzy Hash: 3B21D220704A8182FB148B6AF61673A66A2FB85FC8F106224DF564BF54EF2AC410C740
      Function 665A6288 Relevance: 7.6, APIs: 5, Instructions: 56windowCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 665CFC2C: GetWindowDC.USER32(?,?,?,?,?,665A62A7), ref: 665CFC6B
      • GetClientRect.USER32 ref: 665A62B1
      • GetWindowRect.USER32 ref: 665A62C0
        • Part of subcall function 665CF2E0: ScreenToClient.USER32 ref: 665CF2F9
        • Part of subcall function 665CF2E0: ScreenToClient.USER32 ref: 665CF307
      • OffsetRect.USER32 ref: 665A62E6
        • Part of subcall function 665CEE40: ExcludeClipRect.GDI32 ref: 665CEE6D
        • Part of subcall function 665CEE40: ExcludeClipRect.GDI32 ref: 665CEE8D
      • OffsetRect.USER32 ref: 665A630E
        • Part of subcall function 665CEF20: IntersectClipRect.GDI32 ref: 665CEF4D
        • Part of subcall function 665CEF20: IntersectClipRect.GDI32 ref: 665CEF6D
      • SendMessageA.USER32 ref: 665A634A
        • Part of subcall function 665CFCD0: ReleaseDC.USER32 ref: 665CFCFC
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Rect$Clip$Client$ExcludeIntersectOffsetScreenWindow$MessageReleaseSend
      • String ID:
      • API String ID: 890540625-0
      • Opcode ID: 78c5f3c144dbcebcdac93dd5c08b8ce10a56d8d5cdf84d95b2b6ad3c4a2f0794
      • Instruction ID: 3107cbc0a5012c1c9ce3d5c8d471305b4014be71a0147e44cd8feafe91f6aad3
      • Opcode Fuzzy Hash: 78c5f3c144dbcebcdac93dd5c08b8ce10a56d8d5cdf84d95b2b6ad3c4a2f0794
      • Instruction Fuzzy Hash: C9217F32218A4291CB20CF64F85569E7B31F7C9BE9F145212EA5E47A78DF39C649CB40
      Function 665D36C8 Relevance: 7.6, APIs: 5, Instructions: 50stringCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: TextWindow$ExceptionThrowlstrcmplstrlenmemset
      • String ID:
      • API String ID: 4195465064-0
      • Opcode ID: a48a638781ead81acacc3de1a94378a80090f5178abca5dfe335ea06bacf99e3
      • Instruction ID: 16ef6faf08e5792e758ca04030291b44a2e04992515f490bb06f87f6ab5a72a6
      • Opcode Fuzzy Hash: a48a638781ead81acacc3de1a94378a80090f5178abca5dfe335ea06bacf99e3
      • Instruction Fuzzy Hash: D811E021708A8192EB34CB26F91435DA7A2FB8DBC4F844124DD9943B08DF2DCA55CB40
      Function 665A5C78 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 99windowCOMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: MessageSend$Parent
      • String ID: N
      • API String ID: 1020955656-1130791706
      • Opcode ID: bb549f55b4edd96c59cac4a108b990f2ceac9cb02d9c91c0ad07dbdd96a08fc5
      • Instruction ID: 8ae39dd0b71b14b68ffaf545ec6d477b0d876c912ee454ba6deb90110a14ef14
      • Opcode Fuzzy Hash: bb549f55b4edd96c59cac4a108b990f2ceac9cb02d9c91c0ad07dbdd96a08fc5
      • Instruction Fuzzy Hash: 3231CE32B14B80C2DB148B26E89AA5D7771F3C1FD0F144012EB4A57B68CF39DA90C741
      Function 665B4670 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85windowstringCOMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: MessageSend$strnlen
      • String ID: EDIT
      • API String ID: 1560097082-3080729518
      • Opcode ID: ec1611dd5775903bb86d6a143cbf62bacc7a24e2f7a6ff71a3c1f22b5853be37
      • Instruction ID: 25ead5ba62069567702f58330c6fe7726ea1368c4174b0d64beef7ea1e6f07f3
      • Opcode Fuzzy Hash: ec1611dd5775903bb86d6a143cbf62bacc7a24e2f7a6ff71a3c1f22b5853be37
      • Instruction Fuzzy Hash: AB316136714A848AD710CF69E8A471D77A1F789FC8F244119DB4D47B28DF3AC452CB00
      Function 665D358C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON
      Download Yara Rule
      APIs
      • GetWindowLongA.USER32 ref: 665D35BF
      • GetClassNameA.USER32 ref: 665D35DA
      • CompareStringA.KERNELBASE(?,?,?,?,?,?,?,?,?,665992D0), ref: 665D3603
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: ClassCompareLongNameStringWindow
      • String ID: combobox
      • API String ID: 1414938635-2240613097
      • Opcode ID: 31247a900fde20d44565857086250163242d9602d6b50e93d5aec20fc59aef57
      • Instruction ID: 661927d814d31bb263f57c640883a79d4505ed8e04f188dfabfede3fe32d013d
      • Opcode Fuzzy Hash: 31247a900fde20d44565857086250163242d9602d6b50e93d5aec20fc59aef57
      • Instruction Fuzzy Hash: 60019233618B4183EB10CB25F85130AB762F78A790F540615FAAA477A8DF3EC555CB84
      Function 665913C8 Relevance: 6.3, APIs: 5, Instructions: 78COMMONLIBRARYCODE
      Download Yara Rule
      APIs
      • EnterCriticalSection.KERNEL32 ref: 66591453
      • TlsGetValue.KERNEL32 ref: 66591465
      • LeaveCriticalSection.KERNEL32 ref: 66591481
        • Part of subcall function 665813A0: _CxxThrowException.MSVCR90 ref: 665813BC
      • LeaveCriticalSection.KERNEL32 ref: 6659148D
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: CriticalSection$Leave$EnterExceptionThrowValue
      • String ID:
      • API String ID: 1767600846-0
      • Opcode ID: 9084d7abd0107660466e1887e665dd528dbc3ea2372c1cdb4edfd7de15fab80f
      • Instruction ID: 90a1da79ef91b79cb8f6100fabcf13de10f9a78d1bfa32b7a09e8047b5b8f9e1
      • Opcode Fuzzy Hash: 9084d7abd0107660466e1887e665dd528dbc3ea2372c1cdb4edfd7de15fab80f
      • Instruction Fuzzy Hash: A631BF31600B9686EB20CF61F8413487776FB88BECF444629DA6D47B54EF3AC462CB40
      Function 665A2388 Relevance: 6.1, APIs: 4, Instructions: 130windowCOMMON
      Download Yara Rule
      APIs
      • SendMessageA.USER32 ref: 665A2504
      • BringWindowToTop.USER32 ref: 665A2536
      • SendMessageA.USER32 ref: 665A2578
      • SendMessageA.USER32 ref: 665A2590
        • Part of subcall function 665813A0: _CxxThrowException.MSVCR90 ref: 665813BC
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: MessageSend$BringExceptionThrowWindow
      • String ID:
      • API String ID: 1662648713-0
      • Opcode ID: 57ef21014af6e6aa925c0eea8da23a8ba194bb2503c87265b18d4196dd6663f3
      • Instruction ID: 149f507e986c456e519cee09dea4a1b61d2d8613cdd8d81181283da8585dd749
      • Opcode Fuzzy Hash: 57ef21014af6e6aa925c0eea8da23a8ba194bb2503c87265b18d4196dd6663f3
      • Instruction Fuzzy Hash: 31510536608B808BD724CF6AE45674EB7B1F789B94F14412AEB8D87B18DB39C455CF40
      Function 665BC8C8 Relevance: 6.1, APIs: 4, Instructions: 88stringwindowCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 665D3A64: GetDlgItem.USER32 ref: 665D3A7B
      • GetWindowTextLengthA.USER32 ref: 665BC902
      • GetWindowTextA.USER32 ref: 665BC97C
      • strnlen.MSVCR90 ref: 665BC992
      • SendMessageA.USER32 ref: 665BC9CA
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: TextWindow$ItemLengthMessageSendstrnlen
      • String ID:
      • API String ID: 1371657860-0
      • Opcode ID: df9fadd88fca352691abb683007259252c1b16662142ac5d3393d2693ab98f48
      • Instruction ID: 62fb058f07510640038a3b2cf973a9a2ce749ef97ed9eb48ac332b4e038bf43d
      • Opcode Fuzzy Hash: df9fadd88fca352691abb683007259252c1b16662142ac5d3393d2693ab98f48
      • Instruction Fuzzy Hash: EC31A432704A4186EB10CF6AE8A571DB761F785FA8F108629DBED87798CF39D841C784
      Function 66596328 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON
      Download Yara Rule
      APIs
      • GetTopWindow.USER32 ref: 66596340
      • SendMessageA.USER32 ref: 66596394
      • GetTopWindow.USER32 ref: 665963A1
      • GetWindow.USER32 ref: 665963D0
        • Part of subcall function 66592F6C: memmove.MSVCR90 ref: 66592FE5
        • Part of subcall function 66592F6C: GetWindowRect.USER32 ref: 66593046
        • Part of subcall function 66592F6C: memmove.MSVCR90 ref: 665930A6
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Window$memmove$MessageRectSend
      • String ID:
      • API String ID: 2288526498-0
      • Opcode ID: fac1edc2e0195ef360dfcc9bf833d5cc9ce9abbe046145d1f9c260be7c14d864
      • Instruction ID: 23fc31275aebcbf690a19ee0e180920fc3c85aff2c02ae8480540bdaa5590bfa
      • Opcode Fuzzy Hash: fac1edc2e0195ef360dfcc9bf833d5cc9ce9abbe046145d1f9c260be7c14d864
      • Instruction Fuzzy Hash: D7114C36605B8087EA018F26F41125EBB61FBC9B94F184629EE8917718DB3DD409CF90
      Function 665D86CC Relevance: 6.1, APIs: 4, Instructions: 55registrystringCOMMON
      Download Yara Rule
      APIs
      • lstrlenA.KERNEL32 ref: 665D86F3
        • Part of subcall function 6665FE00: RegSetValueA.ADVAPI32 ref: 6665FE9C
      • lstrlenA.KERNEL32 ref: 665D8737
      • RegSetValueExA.ADVAPI32 ref: 665D8759
      • RegCloseKey.ADVAPI32 ref: 665D8766
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Valuelstrlen$Close
      • String ID:
      • API String ID: 2686232974-0
      • Opcode ID: 76cf8e78686e44ba007fab6ffdb3ff8e2c2c1f168563f5b8de0bf87256898b76
      • Instruction ID: 177dd9f356828e13bfa13cab8a93b7c15a6fda84cd4cf8ef50579ca2a8b9d16d
      • Opcode Fuzzy Hash: 76cf8e78686e44ba007fab6ffdb3ff8e2c2c1f168563f5b8de0bf87256898b76
      • Instruction Fuzzy Hash: A811C476318A8096DB109F6AF880349B761F784BD4F545635EFA983B98DF7AC058CF08
      Function 665F2050 Relevance: 6.1, APIs: 4, Instructions: 54registryCOMMON
      Download Yara Rule
      APIs
      • RegSetValueExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,665AEDC5), ref: 665F20B0
      • RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,665AEDC5), ref: 665F20BB
      • sprintf_s.MSVCR90 ref: 665F20DC
      • WritePrivateProfileStringA.KERNEL32 ref: 665F20F4
        • Part of subcall function 665F1B24: RegCreateKeyExA.KERNEL32 ref: 665F1B77
        • Part of subcall function 665F1B24: RegCloseKey.ADVAPI32 ref: 665F1B80
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Close$CreatePrivateProfileStringValueWritesprintf_s
      • String ID:
      • API String ID: 1187789483-0
      • Opcode ID: 013d9c39dd77d51ce172e920c4a80f1af393b6fd5ed71ed63e5d99109633dbc8
      • Instruction ID: 4e45b4b4f6d444f5e7fe7162a435455f5c1d148fc14fe771ba605d0b33a476f0
      • Opcode Fuzzy Hash: 013d9c39dd77d51ce172e920c4a80f1af393b6fd5ed71ed63e5d99109633dbc8
      • Instruction Fuzzy Hash: 9C1106A3325B8486EB009B61FD55799A766E798FD4F441021FE4E07B24EF39C056CB40
      Function 665A401C Relevance: 6.0, APIs: 4, Instructions: 39windowCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: MessageSend$ClientScreenmemmove
      • String ID:
      • API String ID: 4210607455-0
      • Opcode ID: 564dd3b40a4aa38035ce5684949c6ca72312bc49830990e48f51a1fa33fc24b1
      • Instruction ID: 0c0b295781b0313fab284a95a47d5eb76d21027299ade4b76f28496a251c2e95
      • Opcode Fuzzy Hash: 564dd3b40a4aa38035ce5684949c6ca72312bc49830990e48f51a1fa33fc24b1
      • Instruction Fuzzy Hash: 54014C76604B9482DB14CB66F55036E73A6F789BC4F500226FB9907B58CF3AD164CB40
      Function 665BF830 Relevance: 4.6, APIs: 3, Instructions: 139COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: freemallocmemcpy_s
      • String ID:
      • API String ID: 3942326521-0
      • Opcode ID: 6184e3e7867bc58a1a38cbe1515a6070662baf9dd959ce9ffea09cfcba20e830
      • Instruction ID: a4b465c643cbc837948c748ed8b89c9e4d919407653bb2f4191a4c331725aad8
      • Opcode Fuzzy Hash: 6184e3e7867bc58a1a38cbe1515a6070662baf9dd959ce9ffea09cfcba20e830
      • Instruction Fuzzy Hash: F141B336701A898ADB288F22E8563AD7761F784FC8F14882ADF6957F14DF74C481CB50
      Function 665E2468 Relevance: 4.6, APIs: 3, Instructions: 130windowCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: ClientMessageParentRectSend
      • String ID:
      • API String ID: 608431981-0
      • Opcode ID: db2ba341de42b65fb617642c5805c0fda7900d686caf786243028f733415e3d2
      • Instruction ID: c67ba1fb1e903c80534462e06fbe4b2b8644149bb539b56f810bef43b6684b03
      • Opcode Fuzzy Hash: db2ba341de42b65fb617642c5805c0fda7900d686caf786243028f733415e3d2
      • Instruction Fuzzy Hash: B55168326183C68AEB20CF66EA0179EB761F7C5795F404225DA8927A1CDB7DD809CF41
      Function 665BE5C8 Relevance: 4.6, APIs: 3, Instructions: 114COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 66595E50: GetDlgCtrlID.USER32 ref: 66595E77
      • GetParent.USER32 ref: 665BE5FE
      • GetParent.USER32 ref: 665BE66F
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Parent$Ctrl
      • String ID:
      • API String ID: 2540549881-0
      • Opcode ID: 8b9255a32f4a8866cbda7a71b757bda9c522d07be0c7075fb7ecbf6bf07dde74
      • Instruction ID: 9c13fadc1a28b17769165d352244ba913a5b60c5a8ef2acc21fdc6ec8e1fcba0
      • Opcode Fuzzy Hash: 8b9255a32f4a8866cbda7a71b757bda9c522d07be0c7075fb7ecbf6bf07dde74
      • Instruction Fuzzy Hash: 0B419D36655EC582DB148F35E8A622C3760EB86FE4F184BB1EA2A873E5CF74C4518740
      Function 665996EC Relevance: 4.6, APIs: 3, Instructions: 106windowCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: ItemMessageSend$memset
      • String ID:
      • API String ID: 1267807406-0
      • Opcode ID: 4191d94578606190d95c4eb8088a9b7268280c3d37c6e2ad7aa350d6b2cb98c5
      • Instruction ID: 321544bf9de483e83299e1b8e6134aada938a58b592124e305ea3464ef743e7d
      • Opcode Fuzzy Hash: 4191d94578606190d95c4eb8088a9b7268280c3d37c6e2ad7aa350d6b2cb98c5
      • Instruction Fuzzy Hash: 4341F72AB046C086DB609F25F44064AB761F785BB8F884311DEB903BD8CF3DC596CB04
      Function 665D5B54 Relevance: 4.6, APIs: 3, Instructions: 91windowCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: VisibleWindow
      • String ID:
      • API String ID: 1208467747-0
      • Opcode ID: 3eb56bd146968f2715f32e298f3f9cd4951d154e770d1a086891931a38acdf8e
      • Instruction ID: 017318226f931ee76e22d3fb72c102a25650d980c050e7c8acc01e9b3531ba50
      • Opcode Fuzzy Hash: 3eb56bd146968f2715f32e298f3f9cd4951d154e770d1a086891931a38acdf8e
      • Instruction Fuzzy Hash: DF317932626B8086EF048B2AE44476D37A0FBC4F95F098135EE9E077A8DF38C044CB11
      Function 66592F6C Relevance: 4.6, APIs: 3, Instructions: 84COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 665913C8: EnterCriticalSection.KERNEL32 ref: 66591453
        • Part of subcall function 665913C8: TlsGetValue.KERNEL32 ref: 66591465
        • Part of subcall function 665913C8: LeaveCriticalSection.KERNEL32 ref: 66591481
      • memmove.MSVCR90 ref: 66592FE5
      • GetWindowRect.USER32 ref: 66593046
      • memmove.MSVCR90 ref: 665930A6
        • Part of subcall function 665813A0: _CxxThrowException.MSVCR90 ref: 665813BC
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: CriticalSectionmemmove$EnterExceptionLeaveRectThrowValueWindow
      • String ID:
      • API String ID: 3988268203-0
      • Opcode ID: 18828696df83f4ccf5d293c5f431400da3be93be94054f396e6569613fa058ce
      • Instruction ID: 7da128e80864982b7b72ec50b86e9fc474a815c1c34b25f0854d9827fab81e23
      • Opcode Fuzzy Hash: 18828696df83f4ccf5d293c5f431400da3be93be94054f396e6569613fa058ce
      • Instruction Fuzzy Hash: 8F31B136210B8491C724CF26E84578E7BA5F389FE8F959216DEAD03764CF39CA99C700
      Function 6659C704 Relevance: 4.6, APIs: 3, Instructions: 82windowstringCOMMON
      Download Yara Rule
      APIs
      • DestroyMenu.USER32 ref: 6659C810
        • Part of subcall function 6666548C: FindResourceExA.KERNEL32 ref: 666654C6
      • LoadMenuA.USER32 ref: 6659C748
      • strlen.MSVCR90 ref: 6659C775
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Menu$DestroyFindLoadResourcestrlen
      • String ID:
      • API String ID: 3928900347-0
      • Opcode ID: 96e533003024a3df98ecd02f310bf3880471a0222a0ccc960e6169bec30ddab3
      • Instruction ID: 358d86421772228521f64ded33ad3da37bd5f04a5d80c7d802fe974585f135bb
      • Opcode Fuzzy Hash: 96e533003024a3df98ecd02f310bf3880471a0222a0ccc960e6169bec30ddab3
      • Instruction Fuzzy Hash: 7E316A36314BC08AD754CF26E944A5EBBA4F789FD0F148229EE9947B18DF38C451CB40
      Function 6659B6BC Relevance: 4.6, APIs: 3, Instructions: 76COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: ErrorLast$CreateWindow
      • String ID:
      • API String ID: 2641168648-0
      • Opcode ID: 58c76d27b0aac46265e5f0686c7b6eee5a34e0be58c7d5a6e1df899fbb16a51a
      • Instruction ID: e703db7d39f2e901d64e13f1b0365cb6c487c42060a9e5582572db9decc2f24a
      • Opcode Fuzzy Hash: 58c76d27b0aac46265e5f0686c7b6eee5a34e0be58c7d5a6e1df899fbb16a51a
      • Instruction Fuzzy Hash: CB314876604BC486E760DB66F48174AB7E5F788BD0F14462AEE9D83B18DF39D445CB00
      Function 665EF394 Relevance: 4.6, APIs: 3, Instructions: 64registryCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: CloseOpenQueryValue
      • String ID:
      • API String ID: 3677997916-0
      • Opcode ID: d9da6868d3d78af1e0b94a1d6020c82dd402e5d5de3bf2bbe5cadd847b914064
      • Instruction ID: ca2eb103d9d7625ea9f5c3aa68b2aeff5394386b396aa4ae4e9b004a03acc5b2
      • Opcode Fuzzy Hash: d9da6868d3d78af1e0b94a1d6020c82dd402e5d5de3bf2bbe5cadd847b914064
      • Instruction Fuzzy Hash: 0B217FB3618B8087EB10CF11F54535AB7B1F3C47AAF004526EB9846A58DFBDD198CB40
      Function 665F1B9C Relevance: 4.5, APIs: 3, Instructions: 41registryCOMMON
      Download Yara Rule
      APIs
      • GetPrivateProfileIntA.KERNEL32 ref: 665F1C23
        • Part of subcall function 665F1B24: RegCreateKeyExA.KERNEL32 ref: 665F1B77
        • Part of subcall function 665F1B24: RegCloseKey.ADVAPI32 ref: 665F1B80
      • RegQueryValueExA.KERNEL32 ref: 665F1BF9
      • RegCloseKey.ADVAPI32 ref: 665F1C04
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Close$CreatePrivateProfileQueryValue
      • String ID:
      • API String ID: 2348111628-0
      • Opcode ID: 7d348e748d7715da3be449c17a16c9bb0e1ce8b54466b9daff81e0d449af5785
      • Instruction ID: 96eef52af1367f0d15799e5c29a0209f81a6582899983ea6083bedf8de66b588
      • Opcode Fuzzy Hash: 7d348e748d7715da3be449c17a16c9bb0e1ce8b54466b9daff81e0d449af5785
      • Instruction Fuzzy Hash: 340180B2729B8082EB10CF56F44534AA3A5F798BD4F444835EA8907B18EF7DC4568B40
      Function 66592CD0 Relevance: 4.5, APIs: 3, Instructions: 40COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Window$Long
      • String ID:
      • API String ID: 847901565-0
      • Opcode ID: c2a377b43a3da4e518ba3406ad59e2dc85bea44a4d1ce9386e9fa66611a6f6e7
      • Instruction ID: 7dcabc301cdc03fafb7bc8bdc1091d847ad15467f4a0b0d3c485f61db0e4a896
      • Opcode Fuzzy Hash: c2a377b43a3da4e518ba3406ad59e2dc85bea44a4d1ce9386e9fa66611a6f6e7
      • Instruction Fuzzy Hash: C401D432A3879087E3508F26F54071AB361F784BE5F045514FE8503B19CF3EC8558B80
      Function 6659965C Relevance: 4.5, APIs: 3, Instructions: 39COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 6666548C: FindResourceExA.KERNEL32 ref: 666654C6
      • FindResourceA.KERNEL32 ref: 66599699
      • LoadResource.KERNEL32 ref: 665996AA
      • LockResource.KERNEL32 ref: 665996BC
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Resource$Find$LoadLock
      • String ID:
      • API String ID: 1818207659-0
      • Opcode ID: 5fb9d5c0084e76384e82d477e0bc3ffe734813626a2371fb125592bee958bb6c
      • Instruction ID: e4e85fbf93c7f51a8e43fa650015853061e762704b49e767033610d3ac8055cd
      • Opcode Fuzzy Hash: 5fb9d5c0084e76384e82d477e0bc3ffe734813626a2371fb125592bee958bb6c
      • Instruction Fuzzy Hash: 6BF0C8117196C189EE409F53F90532AA661E789FC0F4C4538EF5E4BB19EE7DC451CB80
      Function 665BB49C Relevance: 4.5, APIs: 3, Instructions: 38COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 6666548C: FindResourceExA.KERNEL32 ref: 666654C6
      • FindResourceA.KERNEL32 ref: 665BB4D8
      • LoadResource.KERNEL32(?,?,?,665A9AF4), ref: 665BB4E4
      • LockResource.KERNEL32(?,?,?,665A9AF4), ref: 665BB4F2
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Resource$Find$LoadLock
      • String ID:
      • API String ID: 1818207659-0
      • Opcode ID: 5d9c992a131dfe9dc4dfa7d8ca011dd6b46462444280fbc183f8f1296596c462
      • Instruction ID: 97e234bfb2352030865626ca98628c2ec5da571334561fa1f83189a1552d70d1
      • Opcode Fuzzy Hash: 5d9c992a131dfe9dc4dfa7d8ca011dd6b46462444280fbc183f8f1296596c462
      • Instruction Fuzzy Hash: 06016932712B8086EA08DB53F944659B7A2F389FC0F488129EE6A07B18DF79E461C700
      Function 665BBB87 Relevance: 4.5, APIs: 3, Instructions: 37COMMON
      Download Yara Rule
      APIs
      • EnableWindow.USER32 ref: 665BBBCB
      • GetActiveWindow.USER32 ref: 665BBBD6
      • SetActiveWindow.USER32 ref: 665BBBE5
        • Part of subcall function 665D41A8: EnableWindow.USER32 ref: 665D41BA
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Window$ActiveEnable
      • String ID:
      • API String ID: 2134580210-0
      • Opcode ID: 99c8dc71177abe686e29642abce6f5b0954030f10673415af38025b318dee890
      • Instruction ID: e2835e4c85fa3491550d723869e32954191036cfd5aab598730e04e116508513
      • Opcode Fuzzy Hash: 99c8dc71177abe686e29642abce6f5b0954030f10673415af38025b318dee890
      • Instruction Fuzzy Hash: 2801C926704A9482EA25AF22E49236E6321FB85FA9F044025CE5A07B58CF7AC497C711
      Function 665EDC58 Relevance: 4.5, APIs: 3, Instructions: 27windowCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Message$DispatchTranslate
      • String ID:
      • API String ID: 1706434739-0
      • Opcode ID: 6594d1f5d4102f8109e9f9440db1750c202f8f8fbc8ccbf14048a3a665ee17d1
      • Instruction ID: be7609db267ca3c67bebab9685572a08499b0e6b1433f092e3e055ea2aa56220
      • Opcode Fuzzy Hash: 6594d1f5d4102f8109e9f9440db1750c202f8f8fbc8ccbf14048a3a665ee17d1
      • Instruction Fuzzy Hash: 05F08233B10A82A2EB00EF32F9857696361FBD4785F405125DA1AC3968DF76C9B5CB00
      Function 665E31C8 Relevance: 4.5, APIs: 3, Instructions: 21windowCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: ChildFocusWindow
      • String ID:
      • API String ID: 2221538744-0
      • Opcode ID: bae407ec174c00791dbb79e63f391a1e2407c7bf45f531284a24ba02ab9505b0
      • Instruction ID: 32043f784dcaf99dcca5e5c8191002f674a9fe9cb2f440b213d13e19c40e1673
      • Opcode Fuzzy Hash: bae407ec174c00791dbb79e63f391a1e2407c7bf45f531284a24ba02ab9505b0
      • Instruction Fuzzy Hash: CAE09222640543C2EF508F32EC553BD1320E7A8F84F195034CE2E8F224EF26C899D7A0
      Function 6666594C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 95COMMON
      Download Yara Rule
      APIs
      • FreeLibrary.KERNEL32 ref: 66665A58
        • Part of subcall function 665F0398: SetErrorMode.KERNEL32(?,?,?,665A5298), ref: 665F03B2
        • Part of subcall function 665F0398: SetErrorMode.KERNEL32(?,?,?,665A5298), ref: 665F03BF
        • Part of subcall function 665F0398: GetModuleHandleA.KERNEL32 ref: 665F0418
        • Part of subcall function 665F0398: GetProcAddress.KERNEL32 ref: 665F042D
        • Part of subcall function 6661C750: LeaveCriticalSection.KERNEL32 ref: 6661C7C3
        • Part of subcall function 6661C750: LeaveCriticalSection.KERNEL32 ref: 6661C832
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: CriticalErrorLeaveModeSection$AddressFreeHandleLibraryModuleProc
      • String ID: %sMFC90%s.DLL
      • API String ID: 3497953998-1421664912
      • Opcode ID: fb92c5bb67ded6067b4a1afc58f8e777ba2b524dd448b8f05ea0883da4581aeb
      • Instruction ID: c198b551b296d77dd9c6291f1f24c798c5036f14bda4522637e9a088c2c414bf
      • Opcode Fuzzy Hash: fb92c5bb67ded6067b4a1afc58f8e777ba2b524dd448b8f05ea0883da4581aeb
      • Instruction Fuzzy Hash: 7041B531711B8082EB00DB26FE9236D6763FBC4B98F14462AD91D87B66DF7AC864C351
      Function 6665FD24 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58registryCOMMON
      Download Yara Rule
      APIs
      • RegQueryValueA.ADVAPI32 ref: 6665FDBD
        • Part of subcall function 665F187C: strlen.MSVCR90 ref: 665F191C
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: QueryValuestrlen
      • String ID: Software\Classes\
      • API String ID: 1320985544-1121929649
      • Opcode ID: 05f549892ff60fcdfc6fa8b78c136877782511036d17ab5aa6d9077794d09271
      • Instruction ID: 10504363e6fef137cfd66b5cbeeddd56c141ce30dce49edaf03c1e912127f427
      • Opcode Fuzzy Hash: 05f549892ff60fcdfc6fa8b78c136877782511036d17ab5aa6d9077794d09271
      • Instruction Fuzzy Hash: 50116072615E8182CA148B2AF84024AB770FBC6BF5F544326EBB943BE8DF79C555CB04
      Function 6665FE00 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56registryCOMMON
      Download Yara Rule
      APIs
      • RegSetValueA.ADVAPI32 ref: 6665FE9C
        • Part of subcall function 665F187C: strlen.MSVCR90 ref: 665F191C
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Valuestrlen
      • String ID: Software\Classes\
      • API String ID: 4049598285-1121929649
      • Opcode ID: d5d0eb4a529c54e9b996f5610e8df7b9b40e2ae1390dc309c20678811d18b8fc
      • Instruction ID: add07068a7df234f12f22514db740bea52fee552cc85f44cefcf51f29654ff59
      • Opcode Fuzzy Hash: d5d0eb4a529c54e9b996f5610e8df7b9b40e2ae1390dc309c20678811d18b8fc
      • Instruction Fuzzy Hash: 93115172615E8183CB049B69E840649B760FB85BF4F005316EA7943BE9DFB9C455CB04
      Function 665A5FAC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54COMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Parent
      • String ID: REBAR
      • API String ID: 975332729-925029515
      • Opcode ID: 7487d4974d24935d93e9cde5d21db448d7f08e66f2ade16af604754baba4c1ee
      • Instruction ID: 14ac928a86b400c91c1dc7b9b77aaffb97c16d091e38d5b1d4046318d13bcdde
      • Opcode Fuzzy Hash: 7487d4974d24935d93e9cde5d21db448d7f08e66f2ade16af604754baba4c1ee
      • Instruction Fuzzy Hash: 09114C21610B8291EB048F7AE88535D3BA5F784BD8F448139CE59C7294EF35C494C751
      Function 665A1BE4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: BringWindow
      • String ID: mdiclient
      • API String ID: 1361440306-1999401180
      • Opcode ID: c55933cb749db2cf9526643dd88b9bb823086a679b0346b81a9cddd2b9bdef42
      • Instruction ID: b7cea67924f456e4bee73348fa63c03296938074e1fb7be83bf69ed57f23d1a8
      • Opcode Fuzzy Hash: c55933cb749db2cf9526643dd88b9bb823086a679b0346b81a9cddd2b9bdef42
      • Instruction Fuzzy Hash: 2A118C72618B8487E7208B14F49532EB7B1F798799F500528EB9907B59DF7DC464CF40
      Function 665A9D54 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 665D3CFC: GetWindowLongA.USER32 ref: 665D3D13
      • SetRectEmpty.USER32 ref: 665A9DAC
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: EmptyLongRectWindow
      • String ID: msctls_statusbar32
      • API String ID: 2293799620-4095915827
      • Opcode ID: 4ef5291075279a0be4fdea668398fcb9cfcb181569a412814687b4ddeb596bde
      • Instruction ID: 43d967e0db0e211db925faf9f70106384288a4aa00a931f138640984279ebd26
      • Opcode Fuzzy Hash: 4ef5291075279a0be4fdea668398fcb9cfcb181569a412814687b4ddeb596bde
      • Instruction Fuzzy Hash: 00018B32618BD086D7108B25F88238AB660F784BC4F584126EB8947B58CF3DC851CB00
      Function 665E2F2C Relevance: 3.1, APIs: 2, Instructions: 92COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 66599D88: memset.MSVCR90 ref: 66599DC7
      • memset.MSVCR90 ref: 665E2F6D
      • GetWindowRect.USER32 ref: 665E3010
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: memset$RectWindow
      • String ID:
      • API String ID: 295389028-0
      • Opcode ID: b6ac1ab52d9ef6e27370b0b035228c2104ec8d59ddd15226ab393affc47d3567
      • Instruction ID: a50bc43760d01a2bfeebe6340f96295e36522d21f579ab1829921a6b4290cfc8
      • Opcode Fuzzy Hash: b6ac1ab52d9ef6e27370b0b035228c2104ec8d59ddd15226ab393affc47d3567
      • Instruction Fuzzy Hash: 064169322146C18ADB64CF66E85179E7B61F7C5B88F448136DE8A47B48DF3DC8448F40
      Function 665A2ED8 Relevance: 3.1, APIs: 2, Instructions: 83windowCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 665A27C4: GetWindowLongA.USER32 ref: 665A2812
        • Part of subcall function 665A27C4: RedrawWindow.USER32 ref: 665A285F
        • Part of subcall function 665A27C4: SetWindowLongA.USER32 ref: 665A2874
        • Part of subcall function 665A27C4: SetWindowPos.USER32 ref: 665A289B
        • Part of subcall function 665A27C4: GetClientRect.USER32 ref: 665A28B0
      • GetActiveWindow.USER32 ref: 665A2F77
      • DrawMenuBar.USER32 ref: 665A2FD1
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Window$Long$ActiveClientDrawMenuRectRedraw
      • String ID:
      • API String ID: 2379617390-0
      • Opcode ID: b5d45084ae8265940d7fcd350ccc7b13c18c7bdc6ffd6bf46c391b0917ef0821
      • Instruction ID: 111a7292ca5504f1ab058a76d027a093ec79170518afe1f976d013055e2616f5
      • Opcode Fuzzy Hash: b5d45084ae8265940d7fcd350ccc7b13c18c7bdc6ffd6bf46c391b0917ef0821
      • Instruction Fuzzy Hash: EC214826709B8482EA08DF57E65736EB765FB99FC8F188029DF1A07B14DF79C5428700
      Function 665DFB74 Relevance: 3.1, APIs: 2, Instructions: 79COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 665CFD18: BeginPaint.USER32(?,?,?,?,?,665991C2), ref: 665CFD52
      • GetClientRect.USER32 ref: 665DFBB2
      • InflateRect.USER32 ref: 665DFBCF
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Rect$BeginClientInflatePaint
      • String ID:
      • API String ID: 2053112285-0
      • Opcode ID: a70d13b8c2aea1c636e662d5e4b36b75a354cc1962f94072dbfd7cc645de37af
      • Instruction ID: 46c01863fbc57c3667d46e7ad7b56c2dc57eabf9c6d0fc43e1279ab26b34d20c
      • Opcode Fuzzy Hash: a70d13b8c2aea1c636e662d5e4b36b75a354cc1962f94072dbfd7cc645de37af
      • Instruction Fuzzy Hash: F8412B36218785CBC710CF29E44079EB7B1F7C9B98F445226EA9A87B68DB38D545CF00
      Function 665D8488 Relevance: 3.1, APIs: 2, Instructions: 75stringCOMMON
      Download Yara Rule
      APIs
      • sprintf_s.MSVCR90 ref: 665D850C
      • strlen.MSVCR90 ref: 665D8517
        • Part of subcall function 6659B3E0: memcpy_s.MSVCR90 ref: 6659B489
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: memcpy_ssprintf_sstrlen
      • String ID:
      • API String ID: 1039640230-0
      • Opcode ID: 5dd4456c482c498b1ee43096d8c864a7b4e0bdc0568907caa7408272eb241e18
      • Instruction ID: 0c61636bab2f93cc8c36e2029f91efd05ad171d4d753493c655223b2817ffe50
      • Opcode Fuzzy Hash: 5dd4456c482c498b1ee43096d8c864a7b4e0bdc0568907caa7408272eb241e18
      • Instruction Fuzzy Hash: 4531C032714A8092DB148B2AF85035E7761FBC8BA4F405326EABE43BE8DF39C555CB40
      Function 665EE508 Relevance: 3.1, APIs: 2, Instructions: 60windowCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: MessagePeek
      • String ID:
      • API String ID: 2222842502-0
      • Opcode ID: 12861de529b6f589d5d9a3c74ff8b1abfaae463aab27217f7fa4e2248862d2ae
      • Instruction ID: 78bba97faddd727d172aaa32e4b43e8d80e827a00c2c89c453e21c8087ffe6a0
      • Opcode Fuzzy Hash: 12861de529b6f589d5d9a3c74ff8b1abfaae463aab27217f7fa4e2248862d2ae
      • Instruction Fuzzy Hash: 46118936720AA182EB00CB26E845B5E77A5F7C9F88F498026DE4943718EF38C046CB40
      Function 6659D50C Relevance: 3.1, APIs: 2, Instructions: 54windowCOMMON
      Download Yara Rule
      APIs
      • SendMessageA.USER32 ref: 6659D589
      • SendMessageA.USER32 ref: 6659D5A6
        • Part of subcall function 665813A0: _CxxThrowException.MSVCR90 ref: 665813BC
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: MessageSend$ExceptionThrow
      • String ID:
      • API String ID: 2575872247-0
      • Opcode ID: cb03f1da0f39998f261a2246fb29f229361beb49196b05fb065781016e338d2d
      • Instruction ID: f6b111c9a78d525a7fdda7a20e13f730139bbaf44e5469d0782451db591e8305
      • Opcode Fuzzy Hash: cb03f1da0f39998f261a2246fb29f229361beb49196b05fb065781016e338d2d
      • Instruction Fuzzy Hash: 32019672B15DC383FB288B74EB4A7641960EB8A78EF444338CB1587F89DE2AC541CB00
      Function 66592E3C Relevance: 3.0, APIs: 2, Instructions: 45windowCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 665D3CFC: GetWindowLongA.USER32 ref: 665D3D13
      • IsWindow.USER32 ref: 66592E7D
      • SendMessageA.USER32 ref: 66592EC3
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Window$LongMessageSend
      • String ID:
      • API String ID: 642794312-0
      • Opcode ID: 740c7f22c20e87cd80b5c2d8451cdeff6e16349d7e2e27b793c6e7294cd743ce
      • Instruction ID: 7fa7fa2c1ac7669d7a1abf2b0c1ce95c9df7c0e02909b0fa9e809dc62abc09fb
      • Opcode Fuzzy Hash: 740c7f22c20e87cd80b5c2d8451cdeff6e16349d7e2e27b793c6e7294cd743ce
      • Instruction Fuzzy Hash: 09016D26615B8282EE14DF26F481229A764FB89FC4F180625EF8C07B18EF39C550CB00
      Function 66594048 Relevance: 3.0, APIs: 2, Instructions: 40COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: ProcWindow$Call
      • String ID:
      • API String ID: 2316559721-0
      • Opcode ID: 5989d618a5d59badf18d07e38bcc91797bc8ef0279b2ef83f79c07d9ba9d0a6f
      • Instruction ID: 25a9fe0e88898cb2cfbc1dcc70fc96615de9eeff851a69cab217861542f51bd4
      • Opcode Fuzzy Hash: 5989d618a5d59badf18d07e38bcc91797bc8ef0279b2ef83f79c07d9ba9d0a6f
      • Instruction Fuzzy Hash: 60017826714B84C1EB048F56E854259B774F7A5FC4F288129EF9907B28CF3AC8128780
      Function 66592DA8 Relevance: 3.0, APIs: 2, Instructions: 40COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 665D3CFC: GetWindowLongA.USER32 ref: 665D3D13
      • GetWindowRect.USER32 ref: 66592DCD
      • GetWindow.USER32 ref: 66592DEF
        • Part of subcall function 665D4170: IsWindowEnabled.USER32 ref: 665D4182
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Window$EnabledLongRect
      • String ID:
      • API String ID: 3170195891-0
      • Opcode ID: c9b7d229e480f97c78dd3a3069b233e81a25acce5c49fa88898c3658f3e988e0
      • Instruction ID: 4aa9f7802d65fa5111dfc2f8a3fda411b1c19fbcdb2a34dd47ad5e99a55f3264
      • Opcode Fuzzy Hash: c9b7d229e480f97c78dd3a3069b233e81a25acce5c49fa88898c3658f3e988e0
      • Instruction Fuzzy Hash: BC017C2262468682DB04CF32F98132E6371FBC9F8AF449130DE4A47328EF39C850CB50
      Function 66594118 Relevance: 3.0, APIs: 2, Instructions: 36keyboardwindowCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: MessageSendState
      • String ID:
      • API String ID: 3919072728-0
      • Opcode ID: e544aca4b29fc0800201f23702cfdba747a580347dd3238442afbba156d6c70d
      • Instruction ID: 64f8d7be591c8bd68703d5a4a455de395318d587041770ee3661a3afb90e4d41
      • Opcode Fuzzy Hash: e544aca4b29fc0800201f23702cfdba747a580347dd3238442afbba156d6c70d
      • Instruction Fuzzy Hash: 8DF0A432711AD082EB509B66F85139D2665E394FB0F455325EB7907BC4DF79C8A1CB40
      Function 66593924 Relevance: 3.0, APIs: 2, Instructions: 32threadCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 665913C8: EnterCriticalSection.KERNEL32 ref: 66591453
        • Part of subcall function 665913C8: TlsGetValue.KERNEL32 ref: 66591465
        • Part of subcall function 665913C8: LeaveCriticalSection.KERNEL32 ref: 66591481
      • GetCurrentThreadId.KERNEL32 ref: 6659395F
      • SetWindowsHookExA.USER32 ref: 66593976
        • Part of subcall function 665813A0: _CxxThrowException.MSVCR90 ref: 665813BC
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: CriticalSection$CurrentEnterExceptionHookLeaveThreadThrowValueWindows
      • String ID:
      • API String ID: 1084294522-0
      • Opcode ID: a395cabc666ade4aa62da8aac4071596b1ea9db8fc650b7f65b0a4c30d1eb426
      • Instruction ID: 751e85f42e4206d8778df2c41fea26b7de15ea1db5e6c42f6fe1d8b053573fef
      • Opcode Fuzzy Hash: a395cabc666ade4aa62da8aac4071596b1ea9db8fc650b7f65b0a4c30d1eb426
      • Instruction Fuzzy Hash: 94F0C231711F81C1DB208FA5F44674866B1EB98B88F65212DCA2D03F14EF3ACCA4C700
      Function 665D3DFC Relevance: 3.0, APIs: 2, Instructions: 31COMMON
      Download Yara Rule
      APIs
      • IsWindow.USER32 ref: 665D3E1B
      • SetWindowTextA.USER32 ref: 665D3E46
        • Part of subcall function 665813A0: _CxxThrowException.MSVCR90 ref: 665813BC
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Window$ExceptionTextThrow
      • String ID:
      • API String ID: 1362392536-0
      • Opcode ID: 336612566d0e5282110760e455958d6572fec74bef298cb4fb250ebb5f3a293c
      • Instruction ID: d10c96611ecc7cc2ad2091f2cd2e3454a74d757dafb3b4090e8c9b83e35739ba
      • Opcode Fuzzy Hash: 336612566d0e5282110760e455958d6572fec74bef298cb4fb250ebb5f3a293c
      • Instruction Fuzzy Hash: 18F0B421B14A4585DB148F2AE84931D6331FB8AFC9F184035DF594BB98DF39CC50C711
      Function 665F1B24 Relevance: 3.0, APIs: 2, Instructions: 28registryCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 665F1A18: RegOpenKeyExA.KERNEL32 ref: 665F1A51
        • Part of subcall function 665F1A18: RegCreateKeyExA.KERNEL32 ref: 665F1A9E
        • Part of subcall function 665F1A18: RegCreateKeyExA.KERNEL32 ref: 665F1AE4
        • Part of subcall function 665F1A18: RegCloseKey.KERNEL32 ref: 665F1AF7
        • Part of subcall function 665F1A18: RegCloseKey.ADVAPI32 ref: 665F1B0A
      • RegCreateKeyExA.KERNEL32 ref: 665F1B77
      • RegCloseKey.ADVAPI32 ref: 665F1B80
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: CloseCreate$Open
      • String ID:
      • API String ID: 1740278721-0
      • Opcode ID: 4f488e63db5cddc551f042e31b5559c953099a563bf126cdc8074194a3eb4a23
      • Instruction ID: dde91266be26fd92f9bdab927cd9870b4503ee1aae385ddd903ffdff33d4844b
      • Opcode Fuzzy Hash: 4f488e63db5cddc551f042e31b5559c953099a563bf126cdc8074194a3eb4a23
      • Instruction Fuzzy Hash: 49F06D72618B4083EB108F25F59431AB7A1F788BD8F541224EB8D06B29DF3DC0588F00
      Function 665960CC Relevance: 3.0, APIs: 2, Instructions: 27COMMON
      Download Yara Rule
      APIs
      • GetForegroundWindow.USER32 ref: 665960F0
      • GetLastActivePopup.USER32 ref: 66596105
        • Part of subcall function 665813A0: _CxxThrowException.MSVCR90 ref: 665813BC
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: ActiveExceptionForegroundLastPopupThrowWindow
      • String ID:
      • API String ID: 1330097477-0
      • Opcode ID: 0d0e2a94172a309441fa7aef4d957caae7a755f1cfb69d7a1e25b2057a778b77
      • Instruction ID: 2f24e6602f02621bece85c433a66b84c0c1e746036992a3b9e628e3e99369445
      • Opcode Fuzzy Hash: 0d0e2a94172a309441fa7aef4d957caae7a755f1cfb69d7a1e25b2057a778b77
      • Instruction Fuzzy Hash: 90E0E531B0579182EE10DBB6F80921D6761EBC8FC0F541124EB9F03B04DF39C8948740
      Function 66599C4C Relevance: 3.0, APIs: 2, Instructions: 24windowCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 6666548C: FindResourceExA.KERNEL32 ref: 666654C6
      • LoadIconA.USER32 ref: 66599C74
      • LoadIconA.USER32 ref: 66599C8A
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: IconLoad$FindResource
      • String ID:
      • API String ID: 565192387-0
      • Opcode ID: 16fa4e079d83e228213de5b5f36f76a02d855c47df9fe1d3acab7d67d7598c67
      • Instruction ID: 2de487e1e2d4b352568d4b39f4e9afb55016446460d6c29f3ccc5d3c354a1b0e
      • Opcode Fuzzy Hash: 16fa4e079d83e228213de5b5f36f76a02d855c47df9fe1d3acab7d67d7598c67
      • Instruction Fuzzy Hash: D3E06D31705B8193DB188B22FD15329A2A1FB8CBC0F1442399A9D47B54FF3DC4718344
      Function 665EE0EC Relevance: 3.0, APIs: 2, Instructions: 17threadCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: CurrentHookThreadWindows
      • String ID:
      • API String ID: 1904029216-0
      • Opcode ID: 004f5ba76199284568e9742310d4c865f7c98feba5a8a0a300d351e057edee47
      • Instruction ID: c490c01cf79418a0563c8929164d9cc953e57acfa43c9448a04f1c98aef286bf
      • Opcode Fuzzy Hash: 004f5ba76199284568e9742310d4c865f7c98feba5a8a0a300d351e057edee47
      • Instruction Fuzzy Hash: 1CE0C260E20AD541EF206BB4A8467182BE2EB6DB68F142209DB7907690DB2B80E48721
      Function 6659CAB8 Relevance: 1.6, APIs: 1, Instructions: 139windowCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Menu
      • String ID:
      • API String ID: 3711407533-0
      • Opcode ID: 0d465ee20cf7bdd5a2e95452da1fcd3f8921cfa40b6b02ccb0ec86f9b39e51c3
      • Instruction ID: f5e004b474f2045305163c29c8df94f3da5c1f2528118a31a214de1a6f280f85
      • Opcode Fuzzy Hash: 0d465ee20cf7bdd5a2e95452da1fcd3f8921cfa40b6b02ccb0ec86f9b39e51c3
      • Instruction Fuzzy Hash: BF515C32705B8086DB149F6AE85134EB7A1F785BB4F444329DAAE87BA4DF39C845CB40
      Function 665BDFE8 Relevance: 1.6, APIs: 1, Instructions: 120COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 665C638C: GetModuleHandleA.KERNEL32 ref: 665C63F3
        • Part of subcall function 665C638C: LoadLibraryA.KERNEL32 ref: 665C6406
        • Part of subcall function 665C638C: GetModuleHandleA.KERNEL32 ref: 665C642D
        • Part of subcall function 665C638C: GetProcAddress.KERNEL32 ref: 665C643D
        • Part of subcall function 665C638C: FindResourceExA.KERNEL32 ref: 665C6489
        • Part of subcall function 665C638C: FindResourceExA.KERNEL32 ref: 665C64AD
        • Part of subcall function 665C638C: LoadResource.KERNEL32 ref: 665C64BE
        • Part of subcall function 665C638C: GlobalAlloc.KERNEL32 ref: 665C64FD
      • _mbscmp.MSVCR90 ref: 665BE0BA
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Resource$FindHandleLoadModule$AddressAllocGlobalLibraryProc_mbscmp
      • String ID:
      • API String ID: 2540161063-0
      • Opcode ID: 9c0d80f20ce1c60a10e970dfc67b221b0cf672a833b2bc8c7597b31aae8f685c
      • Instruction ID: e34d5435907deca5ca260bdc84676e54df938a7db0cebf451bbcd8a2b48e48e5
      • Opcode Fuzzy Hash: 9c0d80f20ce1c60a10e970dfc67b221b0cf672a833b2bc8c7597b31aae8f685c
      • Instruction Fuzzy Hash: C8418072704F8583DB109F69EC9120A67A1FB84BF4B184325AA7E837E4DF39C995CB40
      Function 665F1028 Relevance: 1.6, APIs: 1, Instructions: 106windowCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: MessageSend
      • String ID:
      • API String ID: 3850602802-0
      • Opcode ID: d2962904dddd8c4be50867e893e922bc728b7c80606dc530030dd388b8a8b765
      • Instruction ID: 76f8e1c5cdc9419dbbd430e4a2b18ce3faa832bddd3341f7a4d5279a37e34a71
      • Opcode Fuzzy Hash: d2962904dddd8c4be50867e893e922bc728b7c80606dc530030dd388b8a8b765
      • Instruction Fuzzy Hash: AA41B4B2B24A8582DB249F29D49669D7771F398F84F248535CB1D87724CF76C8A2CF80
      Function 6659D374 Relevance: 1.6, APIs: 1, Instructions: 98windowCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: MessageSend
      • String ID:
      • API String ID: 3850602802-0
      • Opcode ID: 10d378573608d4a807f209ead5510539a1dc0a39a28b87c84a89c646f4340f27
      • Instruction ID: c947e35e4bebf47e67ce87a779f24ba1ca22e63ebda719ad6d8292c4681ba807
      • Opcode Fuzzy Hash: 10d378573608d4a807f209ead5510539a1dc0a39a28b87c84a89c646f4340f27
      • Instruction Fuzzy Hash: 68318B22B04FC482D6059F26EA4636E6761FB85FD9F088329CE5A07B58DFA8D4418B40
      Function 665F3CFC Relevance: 1.6, APIs: 1, Instructions: 63COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 66585044: malloc.MSVCR90(?,?,666F1500,6661F69A,?,?,00000000,665839DB), ref: 6658507C
      • sprintf_s.MSVCR90 ref: 665F3D5A
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: mallocsprintf_s
      • String ID:
      • API String ID: 1938037902-0
      • Opcode ID: 920ba84504dbbfdbf15076fc20b6d9d85e4b6266b2630bbf52bd7627113fa843
      • Instruction ID: 842e395a6865a2ab8583eb5fcd157e1b802aced40224539d916439ca1c41d53f
      • Opcode Fuzzy Hash: 920ba84504dbbfdbf15076fc20b6d9d85e4b6266b2630bbf52bd7627113fa843
      • Instruction Fuzzy Hash: 5B217C72614B85C6EB00CF2AE84055AB761F785FE8F144316DFA947BA8DF38C852CB44
      Function 665BB134 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Parent
      • String ID:
      • API String ID: 975332729-0
      • Opcode ID: d3a1ab027135a29d505baa9464d89ad98c8b2b3334757c25aab47aee1f3ccacd
      • Instruction ID: 7d4552454851148719b8ded2e581abf26621d1a5356bb663b9dd709d4baa6414
      • Opcode Fuzzy Hash: d3a1ab027135a29d505baa9464d89ad98c8b2b3334757c25aab47aee1f3ccacd
      • Instruction Fuzzy Hash: BA118B36B15B4081DB10AF27E89261AB7A5FBC8F94F484529DF5D83724DFB8C850CB40
      Function 665BBC90 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: ItemNext
      • String ID:
      • API String ID: 4145397660-0
      • Opcode ID: 0167ef17d40a248c7a16aecfd5d5247fd83ae358decb961eb4071fe42f6576b4
      • Instruction ID: d47cf2e24c94ca352906e8b352deefe10461ceec406825900a43ef561ad805c3
      • Opcode Fuzzy Hash: 0167ef17d40a248c7a16aecfd5d5247fd83ae358decb961eb4071fe42f6576b4
      • Instruction Fuzzy Hash: D7111C22611B8581EF04EF6AE8A67AD2760EB85FD8F188136DE1E0B365DF79C444C750
      Function 6659D2AC Relevance: 1.6, APIs: 1, Instructions: 52windowCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: MessagePost
      • String ID:
      • API String ID: 410705778-0
      • Opcode ID: 9fd5d378c740dfd13a00ce2f15c3c4dae0a930041dd914760412016ed8182336
      • Instruction ID: a747547a4e36afc4bd1138fe96f5b271822fa6dd448d8e73903843b5c55462ef
      • Opcode Fuzzy Hash: 9fd5d378c740dfd13a00ce2f15c3c4dae0a930041dd914760412016ed8182336
      • Instruction Fuzzy Hash: 85113A23615ED082DB14DF66E89566D67A5F7C8FC4F899631DE1A47B18CF39C882CB00
      Function 6658383C Relevance: 1.6, APIs: 1, Instructions: 51COMMONLIBRARYCODE
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: memcpy_s
      • String ID:
      • API String ID: 1502251526-0
      • Opcode ID: d7234cfd3fba3e255640766799db18813ad283b42c226c838fa16efa2f394cbc
      • Instruction ID: b2a3b7aaa7cf36af359f1b8d6c8834f5d29f1dce5d3d010283a96d4e26d04690
      • Opcode Fuzzy Hash: d7234cfd3fba3e255640766799db18813ad283b42c226c838fa16efa2f394cbc
      • Instruction Fuzzy Hash: 01113676B01F5482D7049F6AE48811DBBA5FB88FD8B19801ADF5943B24DF35C881CB40
      Function 665A22C4 Relevance: 1.5, APIs: 1, Instructions: 49COMMON
      Download Yara Rule
      APIs
      • TranslateAcceleratorA.USER32 ref: 665A234B
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: AcceleratorTranslate
      • String ID:
      • API String ID: 303831878-0
      • Opcode ID: 46211de2456f262601d1be5effe45adc58f5709427eb0c31abc780091243704e
      • Instruction ID: eba5ad59702ac1d1ee0de69177403b535fff6b3b5902d88412ba5f37d499fd39
      • Opcode Fuzzy Hash: 46211de2456f262601d1be5effe45adc58f5709427eb0c31abc780091243704e
      • Instruction Fuzzy Hash: E61148626147808AEA148F57E48625DB6A0FB85FC1F08883ADBA947B54CB78C495CB00
      Function 665E3224 Relevance: 1.5, APIs: 1, Instructions: 49COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Window
      • String ID:
      • API String ID: 2353593579-0
      • Opcode ID: fbfdb742da50ec800f8a4d808437c606a5639411b5112d8d66f3f55054da1cd8
      • Instruction ID: 3504922814fece3233513aced75ed0be1595e36e27c7bc30a50e75be0b5b7d4d
      • Opcode Fuzzy Hash: fbfdb742da50ec800f8a4d808437c606a5639411b5112d8d66f3f55054da1cd8
      • Instruction Fuzzy Hash: 3801B12170978081EE04CB96AD423796661EB9AFC4F088435DE9E4BB64DF28C842C780
      Function 66605E38 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Initialize
      • String ID:
      • API String ID: 2538663250-0
      • Opcode ID: 53f4d8cb70f013f816b5d822a83528e02a1a999cc3999cbfaf4227946b4dd2e4
      • Instruction ID: 83e5c53c6278480e66b89562b911ba3f564bfbc5c8c5bd6a734b182bb86275b4
      • Opcode Fuzzy Hash: 53f4d8cb70f013f816b5d822a83528e02a1a999cc3999cbfaf4227946b4dd2e4
      • Instruction Fuzzy Hash: 07119A312057C182C7589F35FA1435CBB60F7817A8F144A39C7AA4B3A4DF36C465CB44
      Function 66590428 Relevance: 1.5, APIs: 1, Instructions: 42COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Deactivate
      • String ID:
      • API String ID: 2976632963-0
      • Opcode ID: 8158d4789d6b41fa4cc58e62fc387c64f0f6b4836830db82e769be0fc5c63a5d
      • Instruction ID: ac0ba3d8f37c06041bb12dee153bb5a5a599fae6078afcbeb3753bfe825fbaf2
      • Opcode Fuzzy Hash: 8158d4789d6b41fa4cc58e62fc387c64f0f6b4836830db82e769be0fc5c63a5d
      • Instruction Fuzzy Hash: 53014032614B8081CA108F16F44125AB765FBD9FE0F58472AAFED47BA9CF38C491CB40
      Function 66593FB4 Relevance: 1.5, APIs: 1, Instructions: 40COMMONLIBRARYCODE
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: DestroyWindow
      • String ID:
      • API String ID: 3375834691-0
      • Opcode ID: a176203d987b6f44fe14ad0953b90a84cc8672a0d5d9879aff1c8079bbbbbb59
      • Instruction ID: 5e1af30e745b334168e325513b3939ddbdcda7d2dc3e72f917ad030a264a673a
      • Opcode Fuzzy Hash: a176203d987b6f44fe14ad0953b90a84cc8672a0d5d9879aff1c8079bbbbbb59
      • Instruction Fuzzy Hash: ED017C22B16AC0C6CB14DF69D15232967B0F794B88F540A36C76987A00DF35C8B1C701
      Function 6661AD48 Relevance: 1.5, APIs: 1, Instructions: 39registryCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: DragDropRegister
      • String ID:
      • API String ID: 1555377906-0
      • Opcode ID: bdd0bd6301257515203cd966c7744cdc0f815ae447c53a93a938878bd70af6e5
      • Instruction ID: f50c26b8fcfa666f0d6f16ad15129af78eefa77dc322b3515d8acf89ee8122ae
      • Opcode Fuzzy Hash: bdd0bd6301257515203cd966c7744cdc0f815ae447c53a93a938878bd70af6e5
      • Instruction Fuzzy Hash: 56018B21B18B5083EB54CF3AF85035A6762FB89BC4F449524EE5D87B18DF3AC068C740
      Function 665933C0 Relevance: 1.5, APIs: 1, Instructions: 36COMMON
      Download Yara Rule
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 19d6dbc5e276a55a3c2a2df3b4f8a9a3294d40bd41146f94e09f1031cc003288
      • Instruction ID: 5305f96055c7edf51b4b92209ac8c7b77bd40e92cb10f91a64a3de654849ef3e
      • Opcode Fuzzy Hash: 19d6dbc5e276a55a3c2a2df3b4f8a9a3294d40bd41146f94e09f1031cc003288
      • Instruction Fuzzy Hash: 1EF0AF21A18B80C6EA008B16F80534AA6A4F7D5FC0F588635EF8C03B19DF3AC9528B40
      Function 665BF630 Relevance: 1.5, APIs: 1, Instructions: 35memoryCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: ProtectVirtual
      • String ID:
      • API String ID: 544645111-0
      • Opcode ID: 9d84de9f62882d070bef56637a369fae22188c034441b46adc24614e95088597
      • Instruction ID: 4926385ba315b175662ec709c0d87ac4cf1a4d009930ede73bc751cf7143577c
      • Opcode Fuzzy Hash: 9d84de9f62882d070bef56637a369fae22188c034441b46adc24614e95088597
      • Instruction Fuzzy Hash: E9F08C76A141459BD384CF25E29165977A1E788784F149029EB65877A4C734D8B0CB40
      Function 66596C9C Relevance: 1.5, APIs: 1, Instructions: 34COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Parent
      • String ID:
      • API String ID: 975332729-0
      • Opcode ID: 9dc8a105f9932f7364b05471dc8d6939f94d35fa712fca1e255e3f869777f516
      • Instruction ID: 6aeaa4cecd0f686d480ad1f9a6c45c324549378e3f5c00c4766dba9ce816ddea
      • Opcode Fuzzy Hash: 9dc8a105f9932f7364b05471dc8d6939f94d35fa712fca1e255e3f869777f516
      • Instruction Fuzzy Hash: 3BF05461715BC681FE04CB57F9152556654EB49FC4F088635EE1E47B04EE3CC495C790
      Function 6659C96C Relevance: 1.5, APIs: 1, Instructions: 34windowCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: MessagePost
      • String ID:
      • API String ID: 410705778-0
      • Opcode ID: a317346f345a2e357807b432f7b863d4cd02071aca5c585f67861f2721a8faf8
      • Instruction ID: 617af41456e3d84358ad8c6cb3647b9e5e4abd230234ea04908eafbdccd9c0eb
      • Opcode Fuzzy Hash: a317346f345a2e357807b432f7b863d4cd02071aca5c585f67861f2721a8faf8
      • Instruction Fuzzy Hash: C2F06221714AC181E7508F37F85865A6764FB89FE8F149231DE6947B98CF39C4818700
      Function 66594E64 Relevance: 1.5, APIs: 1, Instructions: 32COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: ChildProc
      • String ID:
      • API String ID: 2769581038-0
      • Opcode ID: b9a0f85f85ed7d62bb58b7b8be5bfdd4e70a4db5c4af0b786787996b6ce0a6fa
      • Instruction ID: 7f3b87f2c934d8d244d8bf6858d807953f17906b607979cc0897d944911a88bb
      • Opcode Fuzzy Hash: b9a0f85f85ed7d62bb58b7b8be5bfdd4e70a4db5c4af0b786787996b6ce0a6fa
      • Instruction Fuzzy Hash: 76F04926704B94C2D700CF56E488659B378F798FC0F698135DF6807714CF79C9968780
      Function 66596588 Relevance: 1.5, APIs: 1, Instructions: 31COMMON
      Download Yara Rule
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: ScrollShow
      • String ID:
      • API String ID: 3611344627-0
      • Opcode ID: 857ddc913bc5bfd3a9f3f1953f707a0c768c82aec27daf653cf3954b32edde94
      • Instruction ID: 823f67459bb585ae30597db9ae44fce43e7e614111931cc2c932b43377453711
      • Opcode Fuzzy Hash: 857ddc913bc5bfd3a9f3f1953f707a0c768c82aec27daf653cf3954b32edde94
      • Instruction Fuzzy Hash: A8F05E21B1479083EB148B27B49121EA662EBD9B80F98C525DA8D07B1DCF3DC8978780
      Function 665965F4 Relevance: 1.5, APIs: 1, Instructions: 30COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: InfoScroll
      • String ID:
      • API String ID: 629608716-0
      • Opcode ID: db7520367113ac7ed0d728a7797ff9c380a513be7190243d6017fae568b2307c
      • Instruction ID: 738689de8e1949acd7b42c38a87659788e9eb070e3601e7b8da20e454fac53a6
      • Opcode Fuzzy Hash: db7520367113ac7ed0d728a7797ff9c380a513be7190243d6017fae568b2307c
      • Instruction Fuzzy Hash: 66F03A32714B8082E7108F16F58175EBB61F798FC0F689025EF8917B59DE39C886CB40
      Function 665D40BC Relevance: 1.5, APIs: 1, Instructions: 29COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Window
      • String ID:
      • API String ID: 2353593579-0
      • Opcode ID: 123cc1a06e6c7786c04c4b0355972a500e221329183b4fe0884ba6029bb6be8b
      • Instruction ID: 37a2cdafed0997b81192ebd5b8d80da40770b0adffc26d27db4d1498362eb86d
      • Opcode Fuzzy Hash: 123cc1a06e6c7786c04c4b0355972a500e221329183b4fe0884ba6029bb6be8b
      • Instruction Fuzzy Hash: 7001A8B6A18680CBD750CF2DE48474AB7A0F398788F104125EB8887B28DB3AC456CF04
      Function 66595F14 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Parent
      • String ID:
      • API String ID: 975332729-0
      • Opcode ID: db5bb3143ad74c231568e487c729169a87b56f636010efba58e73d79e26a1ded
      • Instruction ID: d62d84fbbdcc8011a35e2d211fd2d12fa0313b0ff917ec726d32127fe6f8667d
      • Opcode Fuzzy Hash: db5bb3143ad74c231568e487c729169a87b56f636010efba58e73d79e26a1ded
      • Instruction Fuzzy Hash: 98E012F176668581EE09CB6698663292260AF45FAFF441A35DE0E47300FE29C0658740
      Function 665CFD18 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
      Download Yara Rule
      APIs
      • BeginPaint.USER32(?,?,?,?,?,665991C2), ref: 665CFD52
        • Part of subcall function 665D0308: _CxxThrowException.MSVCR90 ref: 665D0324
        • Part of subcall function 665D0308: _CxxThrowException.MSVCR90 ref: 665D034C
        • Part of subcall function 665D0308: GetSysColor.USER32 ref: 665D03CE
        • Part of subcall function 665D0308: GetSysColor.USER32 ref: 665D03E8
        • Part of subcall function 665D0308: CreateCompatibleDC.GDI32 ref: 665D0400
        • Part of subcall function 665D0308: CreateCompatibleDC.GDI32 ref: 665D041E
        • Part of subcall function 665D0308: GetObjectA.GDI32 ref: 665D044A
        • Part of subcall function 665D0308: CreateBitmap.GDI32 ref: 665D0477
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Create$ColorCompatibleExceptionThrow$BeginBitmapObjectPaint
      • String ID:
      • API String ID: 111344865-0
      • Opcode ID: 995a6417a87f66094f997b0d87192b66da3abc055880192c8dd141f880192ae0
      • Instruction ID: d39527588ac19b8e8bb6c6de67a65ab055c11a6fbae37d91d0b092a1dca91846
      • Opcode Fuzzy Hash: 995a6417a87f66094f997b0d87192b66da3abc055880192c8dd141f880192ae0
      • Instruction Fuzzy Hash: 5EF058B2621B4486DB108F29E8453597364F788BB9F244328CEA8463E4EF7DD5AAC344
      Function 665B6190 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: MessageSend
      • String ID:
      • API String ID: 3850602802-0
      • Opcode ID: 52ab7a8673989647b0b6061a97a2760c19cd3a2018b6026517afc6b26e71b17a
      • Instruction ID: 563593848f334161e00081c9a1e47d4f6c6c37ed48fc5fad8f91c20055be48c9
      • Opcode Fuzzy Hash: 52ab7a8673989647b0b6061a97a2760c19cd3a2018b6026517afc6b26e71b17a
      • Instruction Fuzzy Hash: D8F0C476619B848AD7A0CF18E48478EB7F4F389780F51412AEB9C87B18DB3AC855CF00
      Function 665B6094 Relevance: 1.5, APIs: 1, Instructions: 22windowCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: MessageSend
      • String ID:
      • API String ID: 3850602802-0
      • Opcode ID: ddbafa989870587c934004c434e043ffcbeb785d378e58c94620ab33382e0b2e
      • Instruction ID: f55207c371e03f46dd4ddaaf04090b3003c721871777927ae372f519a644eaf6
      • Opcode Fuzzy Hash: ddbafa989870587c934004c434e043ffcbeb785d378e58c94620ab33382e0b2e
      • Instruction Fuzzy Hash: 76F042766187848AC760CF68E48578E77A4F789780F911129EB9C87B14DB3AC855CF00
      Function 665A30D0 Relevance: 1.5, APIs: 1, Instructions: 21COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: LongWindow
      • String ID:
      • API String ID: 1378638983-0
      • Opcode ID: 48d8ae3ea24957f00564bd857cc58d00dfd6d40e23ab80796ebdaa92e6435bd0
      • Instruction ID: 9d2b5dd8a8313fa57f9e98ef4aac8f6d68fbe1823cf132e50c43c38af2ad5555
      • Opcode Fuzzy Hash: 48d8ae3ea24957f00564bd857cc58d00dfd6d40e23ab80796ebdaa92e6435bd0
      • Instruction Fuzzy Hash: 7AE0DF22300B4082DB008B27F94422AA324FB88FD4F048030EE2947768CF3AC8908700
      Function 0080DDD0 Relevance: 1.5, APIs: 1, Instructions: 21COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2899897741.00000000007E1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007E0000, based on PE: true
      • Associated: 00000006.00000002.2899874032.00000000007E0000.00000002.00000001.01000000.0000000D.sdmpDownload File
      • Associated: 00000006.00000002.2899960031.000000000081C000.00000002.00000001.01000000.0000000D.sdmpDownload File
      • Associated: 00000006.00000002.2899984901.0000000000826000.00000008.00000001.01000000.0000000D.sdmpDownload File
      • Associated: 00000006.00000002.2900010312.0000000000828000.00000004.00000001.01000000.0000000D.sdmpDownload File
      • Associated: 00000006.00000002.2900060989.000000000082E000.00000008.00000001.01000000.0000000D.sdmpDownload File
      • Associated: 00000006.00000002.2900087970.000000000082F000.00000004.00000001.01000000.0000000D.sdmpDownload File
      • Associated: 00000006.00000002.2900120356.0000000000830000.00000008.00000001.01000000.0000000D.sdmpDownload File
      • Associated: 00000006.00000002.2900155328.0000000000831000.00000004.00000001.01000000.0000000D.sdmpDownload File
      • Associated: 00000006.00000002.2900196065.0000000000832000.00000008.00000001.01000000.0000000D.sdmpDownload File
      • Associated: 00000006.00000002.2900230021.0000000000833000.00000004.00000001.01000000.0000000D.sdmpDownload File
      • Associated: 00000006.00000002.2900249507.0000000000836000.00000002.00000001.01000000.0000000D.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_7e0000_WinHTTrack.jbxd
      Similarity
      • API ID: #247
      • String ID:
      • API String ID: 3082533066-0
      • Opcode ID: 2f7eddf14b06fd0e4b1b48238584bb4047dd44a8ea9991e5b9cdca7638aded42
      • Instruction ID: 66758a75b639d976a68055bf1ad0f5a12b53d45eff352f5caa5e5e17e1759ec5
      • Opcode Fuzzy Hash: 2f7eddf14b06fd0e4b1b48238584bb4047dd44a8ea9991e5b9cdca7638aded42
      • Instruction Fuzzy Hash: FEE04F65F1370082DA0C737CE85B3A851AAFF68744FC18426A05DC6396EE2C8AD94703
      Function 665D3CB0 Relevance: 1.5, APIs: 1, Instructions: 20windowCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: DialogMessage
      • String ID:
      • API String ID: 547518314-0
      • Opcode ID: 7e106194559aa1ff02201cbb30946e1fa5e45461ceb3e03365e42d4942ea2b81
      • Instruction ID: 9626f71377ae9a337cfb369f1f319743227820e40eab76c8362a1ce802997ca4
      • Opcode Fuzzy Hash: 7e106194559aa1ff02201cbb30946e1fa5e45461ceb3e03365e42d4942ea2b81
      • Instruction Fuzzy Hash: 0BE01A62354A8082DA008B6EE98922CA760FB89FC9F548035DF5E47776CE26C895C704
      Function 665DD754 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Parent
      • String ID:
      • API String ID: 975332729-0
      • Opcode ID: 67515684a143bd1d81e77931708cfba84f290b884e6186c9cab787885f9a7b1e
      • Instruction ID: baa0557bd9a9b1a5a844e973a95136d0691fd3c535d6d8b33efcfb426d0ed57d
      • Opcode Fuzzy Hash: 67515684a143bd1d81e77931708cfba84f290b884e6186c9cab787885f9a7b1e
      • Instruction Fuzzy Hash: 8DD05E55B1024182FF146BB6AC5A72A07148BDAF85F4020308C1D8B791EE2ACC958B94
      Function 6659BF40 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
      Download Yara Rule
      APIs
      • SetCursor.USER32 ref: 6659BF69
        • Part of subcall function 665813A0: _CxxThrowException.MSVCR90 ref: 665813BC
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: CursorExceptionThrow
      • String ID:
      • API String ID: 4182991951-0
      • Opcode ID: 0a5a7049402083e79b19fb5599141a7b3c682d7409bc15551b22f61070e1492e
      • Instruction ID: feedcd38d306ae823f1406946900ec50406d306518f42186ec9f7235ea482b19
      • Opcode Fuzzy Hash: 0a5a7049402083e79b19fb5599141a7b3c682d7409bc15551b22f61070e1492e
      • Instruction Fuzzy Hash: CEE02B20B01281C2FA146B62FD87369172057D9789F0C11749A2806360DF398CD4CB00
      Function 665A1EA4 Relevance: 1.5, APIs: 1, Instructions: 15windowCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Menu
      • String ID:
      • API String ID: 3711407533-0
      • Opcode ID: 3bc581632062b92203e6977993b6984672f40f952792f8aca943ce6b64508cab
      • Instruction ID: 5655f6d014af298599381e181377029f44b91f0be24bfafa7271ddffae61806a
      • Opcode Fuzzy Hash: 3bc581632062b92203e6977993b6984672f40f952792f8aca943ce6b64508cab
      • Instruction Fuzzy Hash: C6D05E76A14B89C3EB009B22F80135973A8F798B45F040124DE8C87314FF29C0608710
      Function 6661B9AC Relevance: 1.5, APIs: 1, Instructions: 15windowCOMMON
      Download Yara Rule
      APIs
      • CoRegisterMessageFilter.OLE32 ref: 6661B9BB
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: FilterMessageRegister
      • String ID:
      • API String ID: 523350258-0
      • Opcode ID: 1d637290e457f496a28a17c8ffbc3fd1eb5eb7c9db1c2d65f2ebb9e519d5cbc3
      • Instruction ID: fb73cce638e1091d735adf21ee53272ce08a285cb295d1296162d23686d21134
      • Opcode Fuzzy Hash: 1d637290e457f496a28a17c8ffbc3fd1eb5eb7c9db1c2d65f2ebb9e519d5cbc3
      • Instruction Fuzzy Hash: 59D01292F6C14583F7185BB7F8603A55153AB69755F044C30C90189300E62E80E74750
      Function 66599C18 Relevance: 1.5, APIs: 1, Instructions: 14windowCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: MessagePost
      • String ID:
      • API String ID: 410705778-0
      • Opcode ID: fc6f5e53d7d1eaeb1436634865278d524ec46094c0b718fc147576d6d2a3553f
      • Instruction ID: 4d7dc9f4b79006b58367eaafa4ee0561d20d17e2fdcc14687764ab6e7dbae1c7
      • Opcode Fuzzy Hash: fc6f5e53d7d1eaeb1436634865278d524ec46094c0b718fc147576d6d2a3553f
      • Instruction Fuzzy Hash: 69D05EB6F116418AE3449F3DD892B1837E0FBD9B58FA45120D658866B0CA3780A3CB00
      Function 665D41E0 Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: Focus
      • String ID:
      • API String ID: 2734777837-0
      • Opcode ID: d62babf4c2cfb34bb1097052b017a7ba18697fe50556502af0b44f4adef31fde
      • Instruction ID: 1a131f3a008cbdd90ff1da4ee0a35bb35ca991dbb9c34e18a835bd024d7d877b
      • Opcode Fuzzy Hash: d62babf4c2cfb34bb1097052b017a7ba18697fe50556502af0b44f4adef31fde
      • Instruction Fuzzy Hash: 90D01725A02A44C1CA009B2ED84A36C23B0FB85F89F900032CA4E47320CF3684568301
      Function 665BFAE8 Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: MessageSend
      • String ID:
      • API String ID: 3850602802-0
      • Opcode ID: e0d4e0bcfad1f527cb6fa8d95f90864ec59b650738e5716d64c8fefc0f51052f
      • Instruction ID: bf11a2f2e88fab0e62ab0bfc8be2d879cbd03039bdfb291c5f10bcc993a64a56
      • Opcode Fuzzy Hash: e0d4e0bcfad1f527cb6fa8d95f90864ec59b650738e5716d64c8fefc0f51052f
      • Instruction Fuzzy Hash: 48D0A9A1E00A8083EB148B9DE4B274527A0F3C1BCAF308026C7084B220DF3B80978701
      Function 665D4138 Relevance: 1.5, APIs: 1, Instructions: 11COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: ShowWindow
      • String ID:
      • API String ID: 1268545403-0
      • Opcode ID: a68ebbafcf2ae711b3bf91973db5ff14c16c8efcc579d71212e4af7bc27e391a
      • Instruction ID: d3445c7e814ef07f61a5063e88d3ac6df4299ffdeac94a796c069d14c4ea79b1
      • Opcode Fuzzy Hash: a68ebbafcf2ae711b3bf91973db5ff14c16c8efcc579d71212e4af7bc27e391a
      • Instruction Fuzzy Hash: 47D09222A11A84C5DA04AB5EC88939C23B1FBE5F89FA44071C6594B360CF26846A8705
      Function 665A1CB4 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: FrameProc
      • String ID:
      • API String ID: 3341528880-0
      • Opcode ID: f70ed1748d43cb0ee8493ca6ce22fba4500c0574ff61578a09ac8ed2e2b1e2e1
      • Instruction ID: c28cc6df6b3dad888707358f2ea78cd03b770cf2480c414515c0e2a1d61db4e3
      • Opcode Fuzzy Hash: f70ed1748d43cb0ee8493ca6ce22fba4500c0574ff61578a09ac8ed2e2b1e2e1
      • Instruction Fuzzy Hash: F8C01231A10A8086C6109B1AE844648A721F7AAFC8FA00024DE4D17730CA2BC123CB00
      Function 665D5190 Relevance: 1.4, APIs: 1, Instructions: 128COMMON
      Download Yara Rule
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: ExceptionThrow
      • String ID:
      • API String ID: 432778473-0
      • Opcode ID: 8dd8208054d69c6cf6ef7b1d747ca4acef6b6676b8732472398207364d07d102
      • Instruction ID: 392581a8eeea1dfb58f75fc01f60fdfa1c01e081e1f3f7b86827db1b8d8be75a
      • Opcode Fuzzy Hash: 8dd8208054d69c6cf6ef7b1d747ca4acef6b6676b8732472398207364d07d102
      • Instruction Fuzzy Hash: 2641C032A14B9487DB21CF5ED80270E7760F782B9DF404526EE9847B94DF34C488CB89
      Function 666650A8 Relevance: 1.3, APIs: 1, Instructions: 43COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 665D33D0: EnterCriticalSection.KERNEL32 ref: 665D340E
        • Part of subcall function 665D33D0: InitializeCriticalSection.KERNEL32 ref: 665D342A
        • Part of subcall function 665D33D0: LeaveCriticalSection.KERNEL32 ref: 665D343E
      • LeaveCriticalSection.KERNEL32 ref: 66665146
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: CriticalSection$Leave$EnterInitialize
      • String ID:
      • API String ID: 3864236774-0
      • Opcode ID: 8ca615ba5eedf9d8c7e37b13eb21c5b2266e3dc2332bb28c8a89ab1d56a550a9
      • Instruction ID: 8329d0b2343606cd9602c58bcaeef003e25a561aca5937257fef7de612a4d343
      • Opcode Fuzzy Hash: 8ca615ba5eedf9d8c7e37b13eb21c5b2266e3dc2332bb28c8a89ab1d56a550a9
      • Instruction Fuzzy Hash: 2F11A436211F9486D7608F26F84434AB3B8F348BA4F614225DBEE83BA4DF7AD461C740
      Function 665D7990 Relevance: 1.3, APIs: 1, Instructions: 41COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: memset
      • String ID:
      • API String ID: 2221118986-0
      • Opcode ID: 609b4aeea78ae240a91f8bd26c6506fe3ed6ed6da6f03be0a0483f3264b3d3ee
      • Instruction ID: 73dd68fb8ee7184f9fd429271acf19346165e09c17664d726a49fb176c76a7da
      • Opcode Fuzzy Hash: 609b4aeea78ae240a91f8bd26c6506fe3ed6ed6da6f03be0a0483f3264b3d3ee
      • Instruction Fuzzy Hash: C5016532729B8583DE50CB26F44165AB7A0FB88BC4F588125EB9E83B18DF38D051CB00
      Function 66585044 Relevance: 1.3, APIs: 1, Instructions: 28COMMONLIBRARYCODE
      Download Yara Rule
      APIs
      • malloc.MSVCR90(?,?,666F1500,6661F69A,?,?,00000000,665839DB), ref: 6658507C
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: malloc
      • String ID:
      • API String ID: 2803490479-0
      • Opcode ID: 32a9f45a0b3dce9178ce965eb9248c43807514b3f7a798dedb68719abe058466
      • Instruction ID: 370e99c69be15a39fb78475b54a4ea910fb41768f64d9538ad393609c20b6f1a
      • Opcode Fuzzy Hash: 32a9f45a0b3dce9178ce965eb9248c43807514b3f7a798dedb68719abe058466
      • Instruction Fuzzy Hash: D0F03731B0AF61C1AA448726B91151D6750F744FF4B155729DE7A07FC8DF25C052CB85
      Function 66591590 Relevance: 1.3, APIs: 1, Instructions: 25COMMONLIBRARYCODE
      Download Yara Rule
      APIs
        • Part of subcall function 665D33D0: EnterCriticalSection.KERNEL32 ref: 665D340E
        • Part of subcall function 665D33D0: InitializeCriticalSection.KERNEL32 ref: 665D342A
        • Part of subcall function 665D33D0: LeaveCriticalSection.KERNEL32 ref: 665D343E
      • LeaveCriticalSection.KERNEL32 ref: 665915CF
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: CriticalSection$Leave$EnterInitialize
      • String ID:
      • API String ID: 3864236774-0
      • Opcode ID: 6bf050ee1917e7561245dee32bb4e0292e3b15c1fffb9b96648ce8986c144474
      • Instruction ID: bad831e258fe939a177b6cb0391594602ecf78b0fcf8e544b29bb903f34b24f0
      • Opcode Fuzzy Hash: 6bf050ee1917e7561245dee32bb4e0292e3b15c1fffb9b96648ce8986c144474
      • Instruction Fuzzy Hash: 12F01C21215B8481DB109F29F950609B370BB89FB8F644725DA7D033E8EF39C411CA00
      Function 6658EE4C Relevance: 1.3, APIs: 1, Instructions: 24COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2901303342.0000000066581000.00000020.00000001.01000000.0000000B.sdmp, Offset: 66580000, based on PE: true
      • Associated: 00000006.00000002.2901287578.0000000066580000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901380810.0000000066681000.00000002.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901423747.00000000666EB000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901441924.00000000666EF000.00000008.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901461179.00000000666F0000.00000004.00000001.01000000.0000000B.sdmpDownload File
      • Associated: 00000006.00000002.2901478245.00000000666F6000.00000002.00000001.01000000.0000000B.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_66580000_WinHTTrack.jbxd
      Similarity
      • API ID: malloc
      • String ID:
      • API String ID: 2803490479-0
      • Opcode ID: 591234c70966585510f3c06750ff05dcb005b644c28a38bc82a5027844c69468
      • Instruction ID: be9fc9424603ca86b43a1db8e9f864aaea3a635b09a65414fdbb4a599e036558
      • Opcode Fuzzy Hash: 591234c70966585510f3c06750ff05dcb005b644c28a38bc82a5027844c69468
      • Instruction Fuzzy Hash: 18E0ED3261468283EB04CF55E181328B6B1FB98BA0F59C828C60447B10EB38C090CB00

      Non-executed Functions

      Function 0086E550 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 289COMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: memset
      • String ID: @
      • API String ID: 2221118986-2766056989
      • Opcode ID: dd7c531bc8a5e4b9ce91c7ea7c717a0962c03c1d09a56013bad303a5c040b723
      • Instruction ID: d3b5688945d01dc991859fb037bdf9d7181ae284f6e742ba51b566077b9b0796
      • Opcode Fuzzy Hash: dd7c531bc8a5e4b9ce91c7ea7c717a0962c03c1d09a56013bad303a5c040b723
      • Instruction Fuzzy Hash: EEA1F276315F8886CA10DF5AE44466EB7A5FBD9FD4B1A8126EE8D87B04EF38C440C740
      Function 008943E0 Relevance: 4.5, APIs: 3, Instructions: 49networkCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: ErrorLast$recv
      • String ID:
      • API String ID: 316788870-0
      • Opcode ID: 14bdaae5164ebbc7e4e9c23fdacef8a5f0867330d448ebcff4e4f85aa92fd274
      • Instruction ID: b1aa6b27dd2810f626af41b2ebbea5ea3d7b4459708ec2a2894dd3aa2d55bd2b
      • Opcode Fuzzy Hash: 14bdaae5164ebbc7e4e9c23fdacef8a5f0867330d448ebcff4e4f85aa92fd274
      • Instruction Fuzzy Hash: 1D01282171564042EF64A766B588B2D5251FB48BE0F5C6531FF6DC7F66DA2CC8924700
      Function 008EA680 Relevance: 96.5, APIs: 6, Strings: 58, Instructions: 476stringCOMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: memcpystrncmp
      • String ID: ,name:$,name:$,name:$,name:$,name:$,name:$,name:$,name:$,name:$,name:$,name:$,name:$,value:$,value:$,value:$,value:$,value:$,value:$,value:$,value:$,value:$,value:$,value:$,value:$.\crypto\x509v3\v3_pci.c$.\crypto\x509v3\v3_pci.c$.\crypto\x509v3\v3_pci.c$.\crypto\x509v3\v3_pci.c$.\crypto\x509v3\v3_pci.c$.\crypto\x509v3\v3_pci.c$.\crypto\x509v3\v3_pci.c$.\crypto\x509v3\v3_pci.c$.\crypto\x509v3\v3_pci.c$.\crypto\x509v3\v3_pci.c$.\crypto\x509v3\v3_pci.c$.\crypto\x509v3\v3_pci.c$.\crypto\x509v3\v3_pci.c$.\crypto\x509v3\v3_pci.c$.\crypto\x509v3\v3_pci.c$file:$hex:$language$pathlen$policy$section:$section:$section:$section:$section:$section:$section:$section:$section:$section:$section:$section:$text:$x
      • API String ID: 3412684233-2330196022
      • Opcode ID: 19ed1ea0e98cbbfcc90b571028f374d38679d283bc00549b57c126ef0b025789
      • Instruction ID: be02b39c553ed28f761be91f94133b0d25c6288122e6cfb78d81a7c6c92926ee
      • Opcode Fuzzy Hash: 19ed1ea0e98cbbfcc90b571028f374d38679d283bc00549b57c126ef0b025789
      • Instruction Fuzzy Hash: CF22D236300F8AC6DB24DF26E49079A77B0F78AB88F448516DA8D47729EF38D515C782
      Function 008DE080 Relevance: 24.8, APIs: 1, Strings: 13, Instructions: 280COMMON
      Download Yara Rule
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID:
      • String ID: %s%c%08lx.%s%d$.\crypto\x509\by_dir.c$.\crypto\x509\by_dir.c$.\crypto\x509\by_dir.c$.\crypto\x509\by_dir.c$.\crypto\x509\by_dir.c$.\crypto\x509\by_dir.c$.\crypto\x509\by_dir.c$.\crypto\x509\by_dir.c$.\crypto\x509\by_dir.c$.\crypto\x509\by_dir.c$.\crypto\x509\by_dir.c$/
      • API String ID: 0-2332397704
      • Opcode ID: 42e04eed98f00477fcd41f11718f06b8990497ccca0baca5f6c4ae7de7849bce
      • Instruction ID: 0a2dda2e9ec1eb8f3fed8b521b7a941c8c147f79200bb50e876d5c6f84804547
      • Opcode Fuzzy Hash: 42e04eed98f00477fcd41f11718f06b8990497ccca0baca5f6c4ae7de7849bce
      • Instruction Fuzzy Hash: CBC1B072304B84CADB20EF19E44079E77A5F789BD8F544526EE498BB19EF38C541CB82
      Function 009085E0 Relevance: 24.7, APIs: 7, Strings: 7, Instructions: 157COMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: isspace
      • String ID: ,Reason=$.\crypto\ocsp\ocsp_ht.c$.\crypto\ocsp\ocsp_ht.c$.\crypto\ocsp\ocsp_ht.c$.\crypto\ocsp\ocsp_ht.c$Code=$Code=
      • API String ID: 3785662208-3030792821
      • Opcode ID: c58bd6327c26b8395fcf16c87b197704483cc7a93c39c425e16bbb49e59e13f2
      • Instruction ID: 73828f86da8cf49670aa1a5474aea5005b0d39eaf7214a30e1eaacf39d1a62e6
      • Opcode Fuzzy Hash: c58bd6327c26b8395fcf16c87b197704483cc7a93c39c425e16bbb49e59e13f2
      • Instruction Fuzzy Hash: 895133727086C18AEB218F21E50036E7BA4F341B94F588156EBC6437DADF7DCA96CB11
      Function 0090C5B0 Relevance: 18.1, APIs: 2, Strings: 10, Instructions: 143stringCOMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: strchr
      • String ID: characters$ characters$ to $ to $.\crypto\ui\ui_lib.c$.\crypto\ui\ui_lib.c$.\crypto\ui\ui_lib.c$.\crypto\ui\ui_lib.c$You must type in $You must type in
      • API String ID: 2830005266-27312809
      • Opcode ID: 0aee46392cb4b3cc02324cb3e19e71d381dcc8dbc864d3eac2587ae5d019f778
      • Instruction ID: a11f17d906f3d4e9a9b7db91679566ce4188cb494f9e2fef5f0c897ad4c6ddec
      • Opcode Fuzzy Hash: 0aee46392cb4b3cc02324cb3e19e71d381dcc8dbc864d3eac2587ae5d019f778
      • Instruction Fuzzy Hash: D15101B2204B85DAEB20CF25E5403A93775F348BA8F544216EB8E43B95CF3CD659CB11
      Function 00902320 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 150stringCOMMON
      Download Yara Rule
      APIs
      Strings
      • .\crypto\engine\eng_ctrl.c, xrefs: 009023F3
      • .\crypto\engine\eng_ctrl.c, xrefs: 0090247A
      • .\crypto\engine\eng_ctrl.c, xrefs: 009023D9
      • /usr/local/ssl/lib/engines, xrefs: 00902322
      • .\crypto\engine\eng_ctrl.c, xrefs: 009024E6
      • .\crypto\engine\eng_ctrl.c, xrefs: 0090243E
      • .\crypto\engine\eng_ctrl.c, xrefs: 0090254B
      • .\crypto\engine\eng_ctrl.c, xrefs: 00902522
      • .\crypto\engine\eng_ctrl.c, xrefs: 00902397
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: strtol
      • String ID: .\crypto\engine\eng_ctrl.c$.\crypto\engine\eng_ctrl.c$.\crypto\engine\eng_ctrl.c$.\crypto\engine\eng_ctrl.c$.\crypto\engine\eng_ctrl.c$.\crypto\engine\eng_ctrl.c$.\crypto\engine\eng_ctrl.c$.\crypto\engine\eng_ctrl.c$/usr/local/ssl/lib/engines
      • API String ID: 76114499-1801032525
      • Opcode ID: 195a45688f381e07e0c32b15d99327ec978401dc60f213577558ec9a7f3fd763
      • Instruction ID: 26b3f017bb70fff11cc4af10a8065f9a339a8d4301cf25cc6afbdc05b8b6a64b
      • Opcode Fuzzy Hash: 195a45688f381e07e0c32b15d99327ec978401dc60f213577558ec9a7f3fd763
      • Instruction Fuzzy Hash: 255112313182518EE720DF65E91C79B77A9F789798F840921EE8A83AD5DF3CC905CB01
      Function 008B44F0 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 178COMMON
      Download Yara Rule
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID:
      • String ID: .\crypto\asn1\a_set.c$.\crypto\asn1\a_set.c$.\crypto\asn1\a_set.c$.\crypto\asn1\a_set.c$~
      • API String ID: 0-571922896
      • Opcode ID: 7ee1578c3a6d53276caa46108f90967d63f39151fa125bc2b35b2f166944beba
      • Instruction ID: eec5091e6d48e18dd856b30ba3c3f8b84f66e75e3273a8191889813d664ff663
      • Opcode Fuzzy Hash: 7ee1578c3a6d53276caa46108f90967d63f39151fa125bc2b35b2f166944beba
      • Instruction Fuzzy Hash: AE51AC22714B8582DE24EF2AA4427AA7790F786BC4F555135EE9AC7716EF3CC801CB42
      Function 0088E260 Relevance: 13.7, APIs: 2, Strings: 7, Instructions: 212COMMON
      Download Yara Rule
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID:
      • String ID: .\crypto\ec\ecp_oct.c$.\crypto\ec\ecp_oct.c$.\crypto\ec\ecp_oct.c$.\crypto\ec\ecp_oct.c$.\crypto\ec\ecp_oct.c$.\crypto\ec\ecp_oct.c$.\crypto\ec\ecp_oct.c
      • API String ID: 0-2297178171
      • Opcode ID: 5cfb42aa6e9a3d777ac141e8c4b1d806b7d91e891e5102f82e2ec4414ba7db19
      • Instruction ID: 6c35c4542a9262eafdb38456b5fab4cdc402b5967cdf600870fa026c568975f7
      • Opcode Fuzzy Hash: 5cfb42aa6e9a3d777ac141e8c4b1d806b7d91e891e5102f82e2ec4414ba7db19
      • Instruction Fuzzy Hash: 2E713672315A8486DB24FF15E8097AE6351FB85B88F498921EE4EC7B05EF3DC945C701
      Function 008C817A Relevance: 13.6, APIs: 4, Strings: 5, Instructions: 57stringCOMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: strncmp
      • String ID: .\crypto\asn1\asn1_gen.c$ASCII$BITLIST$HEX$UTF8
      • API String ID: 1114863663-3760858344
      • Opcode ID: 4a83896cd150736b1a6f4361d46899c7a3bca6ba9d9c173590a8a416835138de
      • Instruction ID: 58bc4ddfae78e4512748be77ee107c0993fe1b4db8fd747a4c5b3c43e75e75ff
      • Opcode Fuzzy Hash: 4a83896cd150736b1a6f4361d46899c7a3bca6ba9d9c173590a8a416835138de
      • Instruction Fuzzy Hash: A5119A66354600D6FB018F26E805B9A73A4F345FA9F88C01BDE058A695DF7DC38ADB12
      Function 008CA660 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 96stringCOMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: strncmpstrtoul
      • String ID: MASK:$default$nombstr$pkix$utf8only
      • API String ID: 3007069910-3483942737
      • Opcode ID: dabe1a19317358ea43922a1b7afa84f9b4ad020658cad389db7c5c566c06a754
      • Instruction ID: 8ee0471a0e6fa8686df292f2ec8ffec990c8e8f5872fe556db7c686e9eefd278
      • Opcode Fuzzy Hash: dabe1a19317358ea43922a1b7afa84f9b4ad020658cad389db7c5c566c06a754
      • Instruction Fuzzy Hash: 713156B270478845DF194F799454BB43BB0F7A1B4CF4C912AEA96C2256FA38C695CB01
      Function 0089A2A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 87COMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: perror$_ftime64getsockoptsetsockopt
      • String ID: getsockopt$setsockopt
      • API String ID: 1698738581-3142024770
      • Opcode ID: 454371ac841a0619f3a735f76cfc5095d6a7d1a40655577e377b78c844a88ec2
      • Instruction ID: 2e6e3d7c928c562110581ddf76fd85d87173ad8f193dc3f23f820a853e76a2b4
      • Opcode Fuzzy Hash: 454371ac841a0619f3a735f76cfc5095d6a7d1a40655577e377b78c844a88ec2
      • Instruction Fuzzy Hash: 7D3104323146818BDB5CDF28E58432DB765F3C4749F58912AEA4AC6BA8DB7CCA44CF41
      Function 008946A9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 81networkCOMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: ErrorLasthtonlhtonssocket
      • String ID: .\crypto\bio\bss_conn.c$.\crypto\bio\bss_conn.c$host=
      • API String ID: 1512735218-4123152767
      • Opcode ID: 55e71d05194e74c778f40510c563af39c5b3455582591b9a35713d5826ec3227
      • Instruction ID: a57603454049818279d10347aedcffe044fb73438230293c44cd140bf43a7861
      • Opcode Fuzzy Hash: 55e71d05194e74c778f40510c563af39c5b3455582591b9a35713d5826ec3227
      • Instruction Fuzzy Hash: A4312572600265DBDB24EF29E110B2D37E0F349744F08422ADB5A93B95DB3CD676CB54
      Function 00894723 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81networkCOMMON
      Download Yara Rule
      APIs
        • Part of subcall function 00897AA0: ioctlsocket.WS2_32 ref: 00897AC0
        • Part of subcall function 00897AA0: WSAGetLastError.WS2_32(?,00894733), ref: 00897ACC
      • setsockopt.WS2_32 ref: 00894765
      • WSAGetLastError.WS2_32 ref: 00894777
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: ErrorLast$ioctlsocketsetsockopt
      • String ID: .\crypto\bio\bss_conn.c$.\crypto\bio\bss_conn.c$.\crypto\bio\bss_conn.c$host=$host=
      • API String ID: 3658877094-2019878726
      • Opcode ID: e263cf3255a4300ed2a5a3e52a29ace76e6a14fb8ec10eae60989f93f83993dc
      • Instruction ID: 2b6c57c970129765a4e68a4678fb1fb2f1429582cd948da61bd87d67ef7cefc9
      • Opcode Fuzzy Hash: e263cf3255a4300ed2a5a3e52a29ace76e6a14fb8ec10eae60989f93f83993dc
      • Instruction Fuzzy Hash: 7331E172204656CAEB20EF25E000B5E7BA0F384348F48451AEF5993B58DB3DD65ACB44
      Function 008AA670 Relevance: 10.8, APIs: 3, Strings: 4, Instructions: 336COMMON
      Download Yara Rule
      APIs
      Strings
      • .\crypto\evp\bio_b64.c, xrefs: 008AA71E
      • ctx->buf_len >= ctx->buf_off, xrefs: 008AA717
      • ctx->buf_off+i < (int)sizeof(ctx->buf), xrefs: 008AA751
      • .\crypto\evp\bio_b64.c, xrefs: 008AA758
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: memcpy
      • String ID: .\crypto\evp\bio_b64.c$.\crypto\evp\bio_b64.c$ctx->buf_len >= ctx->buf_off$ctx->buf_off+i < (int)sizeof(ctx->buf)
      • API String ID: 3510742995-1248982848
      • Opcode ID: b4b6ee5744375710a65735db29eee8ee805887ae63815f839a05fcccc2159428
      • Instruction ID: 83b00ad78ee7697961c9e5fe7509dc080ec65e47610e2a77f163be28c0d4ad95
      • Opcode Fuzzy Hash: b4b6ee5744375710a65735db29eee8ee805887ae63815f839a05fcccc2159428
      • Instruction Fuzzy Hash: 8BD1E1732047C49BEB289F15D68036AB7A1F346798F148025DB5A83F45DB78D8BACB02
      Function 008747D0 Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 152COMMON
      Download Yara Rule
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID:
      • String ID: .\crypto\rsa\rsa_oaep.c$.\crypto\rsa\rsa_oaep.c$.\crypto\rsa\rsa_oaep.c$.\crypto\rsa\rsa_oaep.c$M
      • API String ID: 0-2404209671
      • Opcode ID: ca5f71306626498dcf0aaef6f5853b61c77cdaa6e5fd18e7f9e264146d7eddb6
      • Instruction ID: 40f9b3acc49092ea43464093213c44b1f27df383ae7aec83ed764665aeeaee16
      • Opcode Fuzzy Hash: ca5f71306626498dcf0aaef6f5853b61c77cdaa6e5fd18e7f9e264146d7eddb6
      • Instruction Fuzzy Hash: C85135323182C985EB10DF35E40579EBB61F785B88F858126EB8D87B5ADB3CC649C711
      Function 00874350 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 101COMMON
      Download Yara Rule
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID:
      • String ID: .\crypto\rsa\rsa_ssl.c$.\crypto\rsa\rsa_ssl.c$.\crypto\rsa\rsa_ssl.c$.\crypto\rsa\rsa_ssl.c$.\crypto\rsa\rsa_ssl.c$w
      • API String ID: 0-3890212635
      • Opcode ID: 0d2b2cc10a96c7aa7e0b9ba8588ea9c9c658a773da9272ecd655e6f2723bfb77
      • Instruction ID: bb2d8ef430d227993316581e83196085a323e40abae46ac4013c6ed1c114e14e
      • Opcode Fuzzy Hash: 0d2b2cc10a96c7aa7e0b9ba8588ea9c9c658a773da9272ecd655e6f2723bfb77
      • Instruction Fuzzy Hash: 5A410C72614585C6CB20DF29D444B8C3B60F381734F889714E67E87ADADB38C62ACB01
      Function 0089C6C0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 97COMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: getenv
      • String ID: .rnd$.rnd$HOME$RANDFILE
      • API String ID: 498649692-1580354995
      • Opcode ID: c2d1f033c0c72bf343ff69ea0e079ae62ba71c90a0108241f0b83ebbe7903fc3
      • Instruction ID: 254d45a12cec6e605a1e9e21aba1c85f99af334e008180bfdb1732c31dbba172
      • Opcode Fuzzy Hash: c2d1f033c0c72bf343ff69ea0e079ae62ba71c90a0108241f0b83ebbe7903fc3
      • Instruction Fuzzy Hash: C031F6A12197C469EF04FBADA8903687A52F715FC0F9C4028EA4BC3757EB2AC585CB14
      Function 0089A400 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90networkCOMMON
      Download Yara Rule
      APIs
      • WSASetLastError.WS2_32 ref: 0089A44D
        • Part of subcall function 0089A2A0: getsockopt.WS2_32 ref: 0089A2F9
        • Part of subcall function 0089A2A0: perror.MSVCR90 ref: 0089A30A
        • Part of subcall function 0089A2A0: _ftime64.MSVCR90 ref: 0089A340
        • Part of subcall function 0089A2A0: setsockopt.WS2_32 ref: 0089A3D0
        • Part of subcall function 0089A2A0: perror.MSVCR90 ref: 0089A3E1
      • recvfrom.WS2_32 ref: 0089A4A2
      • WSAGetLastError.WS2_32 ref: 0089A505
      • WSAGetLastError.WS2_32 ref: 0089A529
        • Part of subcall function 00841D10: raise.MSVCR90 ref: 00841D37
        • Part of subcall function 00841D10: _exit.MSVCR90 ref: 00841D42
        • Part of subcall function 00841D10: __iob_func.MSVCR90 ref: 00841D5D
      Strings
      • sa.len.s<=sizeof(sa.peer), xrefs: 0089A4B9
      • .\crypto\bio\bss_dgram.c, xrefs: 0089A4C0
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: ErrorLast$perror$__iob_func_exit_ftime64getsockoptraiserecvfromsetsockopt
      • String ID: .\crypto\bio\bss_dgram.c$sa.len.s<=sizeof(sa.peer)
      • API String ID: 2449940235-1402264599
      • Opcode ID: 32f7ce9957474bd77ab23e24d15765ed95c2decbc0bac8d00e2308c105668a12
      • Instruction ID: c6a979c829569b9c8b29d4486c209004cda0a5961ce1295117d03a776e404693
      • Opcode Fuzzy Hash: 32f7ce9957474bd77ab23e24d15765ed95c2decbc0bac8d00e2308c105668a12
      • Instruction Fuzzy Hash: 9331BE72224A4086DF64AF64F45435AB7A1F7847D4F685125FE8E83B64EF3DC980CB41
      Function 0089C560 Relevance: 10.6, APIs: 7, Instructions: 85fileCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: _chmod_fdopen_open_stat64i32fclosefopenfwrite
      • String ID:
      • API String ID: 3941276426-0
      • Opcode ID: 14968f64e10c36efd85f3db85d91bbe81c4505a7131758ad26401bc2750e6f71
      • Instruction ID: 0e72e0cf6f80866e92fd86d78d774ece0c2ddfd850e4759c34df2a989680fa76
      • Opcode Fuzzy Hash: 14968f64e10c36efd85f3db85d91bbe81c4505a7131758ad26401bc2750e6f71
      • Instruction Fuzzy Hash: A631F766700B8096EB11AB26FC0039B6395FBC9B94FC48125DE5A87755EF3DC609C700
      Function 00874050 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 149COMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: memcpymemset
      • String ID: .\crypto\rsa\rsa_pk1.c$.\crypto\rsa\rsa_pk1.c$.\crypto\rsa\rsa_pk1.c
      • API String ID: 1297977491-4177232801
      • Opcode ID: 481b2b46e9cb67f55b68a24f8898ecb7cfe260f73c963e3941ce0adf1b36dc99
      • Instruction ID: 7b33d8057ba3a7cb2f877157b56f6869e02ff61ae253737615424075a7f8a54c
      • Opcode Fuzzy Hash: 481b2b46e9cb67f55b68a24f8898ecb7cfe260f73c963e3941ce0adf1b36dc99
      • Instruction Fuzzy Hash: 23416637324A6046DB08DF3A98406A97651F384754F88A325FFAACBB89EF3CE141C700
      Function 008947E6 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 73networkCOMMON
      Download Yara Rule
      APIs
      • connect.WS2_32 ref: 00894801
        • Part of subcall function 008943A0: WSAGetLastError.WS2_32 ref: 008943B6
      • WSAGetLastError.WS2_32 ref: 0089499B
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: ErrorLast$connect
      • String ID: .\crypto\bio\bss_conn.c$.\crypto\bio\bss_conn.c$host=
      • API String ID: 375857812-4123152767
      • Opcode ID: 91982fc97f0f0aef8404353e54756729c17a4a1a427580aaef7acbe9270d84c0
      • Instruction ID: 89c42e7937df99cd60ce4903fe259d07e431091c2366986eb57e69d504db39ec
      • Opcode Fuzzy Hash: 91982fc97f0f0aef8404353e54756729c17a4a1a427580aaef7acbe9270d84c0
      • Instruction Fuzzy Hash: 5221B2727045568BDF20FF25E010B5A23A1F349788F085416EF0987758DB79D966C784
      Function 008D42E0 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 261stringCOMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: memcpystrncpy
      • String ID: .\crypto\x509\x509_obj.c$0123456789ABCDEF$NO X509_NAME
      • API String ID: 1306114417-784439511
      • Opcode ID: 5d4884073d42abac22a9418618a8c879851bdeaeb10d4910aceaf1ada07c2e40
      • Instruction ID: d5ee5e36985e919d13d12378d4edc3167a62ef4695a2392a1991f8f6ecc956c1
      • Opcode Fuzzy Hash: 5d4884073d42abac22a9418618a8c879851bdeaeb10d4910aceaf1ada07c2e40
      • Instruction Fuzzy Hash: E891E2726156C487DB15DF1AE48436EBBA1F785BC8F48A226EF8A87705DB38C485CB01
      Function 008EC600 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 211COMMON
      Download Yara Rule
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID:
      • String ID: $.\crypto\x509v3\pcy_tree.c$.\crypto\x509v3\pcy_tree.c$.\crypto\x509v3\pcy_tree.c
      • API String ID: 0-1272917118
      • Opcode ID: f95b6c474affa804dad524f2a3d09da3365a7c521c03bb9a0bd67a20245e5f60
      • Instruction ID: 264ccd672b9c136b1f8a71e39057e25f5d181f4a4a9b710db4a2b66b3148677b
      • Opcode Fuzzy Hash: f95b6c474affa804dad524f2a3d09da3365a7c521c03bb9a0bd67a20245e5f60
      • Instruction Fuzzy Hash: 91714732A047E48ADF24DF2BD84576A2B95F757B88F614038EE5AC7751EB38C842C741
      Function 008B2360 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 136COMMON
      Download Yara Rule
      APIs
      Strings
      • .\crypto\asn1\a_object.c, xrefs: 008B246B
      • .\crypto\asn1\a_object.c, xrefs: 008B2487
      • .\crypto\asn1\a_object.c, xrefs: 008B2513
      • .\crypto\asn1\a_object.c, xrefs: 008B2407
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: memcpy
      • String ID: .\crypto\asn1\a_object.c$.\crypto\asn1\a_object.c$.\crypto\asn1\a_object.c$.\crypto\asn1\a_object.c
      • API String ID: 3510742995-1062993845
      • Opcode ID: 37605019eec4ade39a1caaa94c5406c2941731a37c495b2d0683797b288618e0
      • Instruction ID: 68e8585c8498ceccdf8da0b8e70d6fdfa308a8ececc85cd1df5b1aced9541dae
      • Opcode Fuzzy Hash: 37605019eec4ade39a1caaa94c5406c2941731a37c495b2d0683797b288618e0
      • Instruction Fuzzy Hash: 6B412632211B44C6DB25DF29F4107DEB794FB88BA4F584529EF4983BA9DB38C896C710
      Function 008A26D0 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 129COMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: memcpy
      • String ID: .\crypto\evp\digest.c$.\crypto\evp\digest.c$.\crypto\evp\digest.c$.\crypto\evp\digest.c
      • API String ID: 3510742995-1873865882
      • Opcode ID: dad4494bb6a94c713e25a6f2638265f0fe9fa9a05fac895ba3460a3ba90614a0
      • Instruction ID: ce0b9d4dc3911c914312ec6c11ad7f49a935be14df6f6b801155a9519520e371
      • Opcode Fuzzy Hash: dad4494bb6a94c713e25a6f2638265f0fe9fa9a05fac895ba3460a3ba90614a0
      • Instruction Fuzzy Hash: 78516776205B0486EB24DF2AE54035D77B0F789F88F584526EF4C87B29EB38DAA1C740
      Function 008CC180 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 127COMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: memcpy
      • String ID: .\crypto\pem\pem_seal.c$.\crypto\pem\pem_seal.c$.\crypto\pem\pem_seal.c$S
      • API String ID: 3510742995-350361195
      • Opcode ID: 458f11a56f344a95c1fbf752a5497abd52110ca74a5a1efa55684e3ad1e50ea2
      • Instruction ID: 10e5f5c5db17499bc7b2cfa2c440f6372ff408da0a24478e97f02df66f95b118
      • Opcode Fuzzy Hash: 458f11a56f344a95c1fbf752a5497abd52110ca74a5a1efa55684e3ad1e50ea2
      • Instruction Fuzzy Hash: 6441D432314B848ADB20EF6AE94179AB7B0F789BD8F440115EE8D87B19EF38D505CB01
      Function 008C47B0 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 86stringCOMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: strncmp
      • String ID: .\crypto\asn1\n_pkey.c$.\crypto\asn1\n_pkey.c$.\crypto\asn1\n_pkey.c$private-key
      • API String ID: 1114863663-1521443059
      • Opcode ID: cce36e6e030f91c977a841860d84e96458138dedc168a4e7ddb0c47c61e11721
      • Instruction ID: 888a80b176044ad2a834c2f4b36471a375cb2f9c8cb7403acca4efc99cdf201b
      • Opcode Fuzzy Hash: cce36e6e030f91c977a841860d84e96458138dedc168a4e7ddb0c47c61e11721
      • Instruction Fuzzy Hash: 2B319E76300B8486EB10DF1AE850B997770F789BC8F849426EE4E87B59DF38C589C751
      Function 0089A560 Relevance: 7.6, APIs: 5, Instructions: 64networkCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: ErrorLast$sendsendto
      • String ID:
      • API String ID: 3676581841-0
      • Opcode ID: f88c6d17ab096a9425342098bffb480130753203ed2be7f9819689f600d9292e
      • Instruction ID: 16123a5a744db3317fc13f5defab23abd84abbdc5cf586e53aab8a7c0e6ebc94
      • Opcode Fuzzy Hash: f88c6d17ab096a9425342098bffb480130753203ed2be7f9819689f600d9292e
      • Instruction Fuzzy Hash: CF21D27170460087EF34AB69B4843297661F759BD0F5C8525EB89C3B65CB3CC9808B42
      Function 0091639C Relevance: 7.5, APIs: 5, Instructions: 39timethreadCOMMONLIBRARYCODE
      Download Yara Rule
      APIs
      • GetSystemTimeAsFileTime.KERNEL32 ref: 009163D3
      • GetCurrentProcessId.KERNEL32 ref: 009163DE
      • GetCurrentThreadId.KERNEL32 ref: 009163EA
      • GetTickCount.KERNEL32 ref: 009163F6
      • QueryPerformanceCounter.KERNEL32 ref: 00916407
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
      • String ID:
      • API String ID: 1445889803-0
      • Opcode ID: 2227346c05dea3f755fd0e276e59b74079adeeb20dd676ca441642df81ab8120
      • Instruction ID: 5433ea9079272ad04da9a507c2c9bc3b05308a35208bec912b7ed71cece1cbba
      • Opcode Fuzzy Hash: 2227346c05dea3f755fd0e276e59b74079adeeb20dd676ca441642df81ab8120
      • Instruction Fuzzy Hash: 7601B121365B0486EB40CF22F9843957365F749BA1F44A620EE9E477B5CB3CCAD98700
      Function 00898370 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 160COMMON
      Download Yara Rule
      APIs
        • Part of subcall function 00897760: accept.WS2_32 ref: 008977C0
      • closesocket.WS2_32 ref: 00898568
      Strings
      • .\crypto\bio\bss_acpt.c, xrefs: 00898511
      • .\crypto\bio\bss_acpt.c, xrefs: 00898488
      • .\crypto\bio\bss_acpt.c, xrefs: 00898573
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: acceptclosesocket
      • String ID: .\crypto\bio\bss_acpt.c$.\crypto\bio\bss_acpt.c$.\crypto\bio\bss_acpt.c
      • API String ID: 635517647-2413697644
      • Opcode ID: d330d20353d3299c6ecf590b9d8bed7573d08676bda16c4406bb8223f86c273d
      • Instruction ID: 6bbddf0be72ddefaf9e0cbc477ed152523c2eca8910bee92214c048d20457d63
      • Opcode Fuzzy Hash: d330d20353d3299c6ecf590b9d8bed7573d08676bda16c4406bb8223f86c273d
      • Instruction Fuzzy Hash: F351C071714612CADF20FF29E50432D7760FB85B94F180625EE0987B99EF78D982CB05
      Function 00892780 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON
      Download Yara Rule
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID:
      • String ID: BIO[%08lX]:$bio callback - unknown type (%d)
      • API String ID: 0-1975743315
      • Opcode ID: 0d9e0a7f9a319603085234999e621ad09752237f06eced328a8eb02731a4de57
      • Instruction ID: 600757a23037b7ae1c525a32e8e72281d158dc1f0fbc5a6e000b53ccac88f1d3
      • Opcode Fuzzy Hash: 0d9e0a7f9a319603085234999e621ad09752237f06eced328a8eb02731a4de57
      • Instruction Fuzzy Hash: 4C212573319984A6EF21AB54F801BEA3721F789785F984015EF4E47A55DB3CC945CB00
      Function 008CA030 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 110COMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: memcpy
      • String ID: .\crypto\asn1\a_bytes.c$.\crypto\asn1\a_bytes.c$}
      • API String ID: 3510742995-2289944451
      • Opcode ID: 6a7ca57f3639fe17890291903c1601bb91177078d00468c76b953d4716b0dc8e
      • Instruction ID: fda009ab61341cf5b84f4d6ddaa1be32a2b5b666c856146ab1aa387037b2d319
      • Opcode Fuzzy Hash: 6a7ca57f3639fe17890291903c1601bb91177078d00468c76b953d4716b0dc8e
      • Instruction Fuzzy Hash: CF416232619B49C5DB199F15E450B5AB770F784BC8F48402AFB8A87B19DF3CC451CB02
      Function 0089C440 Relevance: 6.1, APIs: 4, Instructions: 76fileCOMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: _stat64i32fclosefopenfread
      • String ID:
      • API String ID: 3814902997-0
      • Opcode ID: b3c964c4f4592b42fb044ec2096eb233c9c2e3ae5da5d33cd53d5eb7f34004ab
      • Instruction ID: 6ad53fd17f3eb4e45e9f9753f44aa2e4e2bf9b3a57007261a8a700876db7b23a
      • Opcode Fuzzy Hash: b3c964c4f4592b42fb044ec2096eb233c9c2e3ae5da5d33cd53d5eb7f34004ab
      • Instruction Fuzzy Hash: 88213652309B8482EE20BB66E9503676355FBD4BC9F884034AF4DC375AEF79C605C718
      Function 008E0880 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 54COMMON
      Download Yara Rule
      Strings
      • .\crypto\x509v3\v3_lib.c, xrefs: 008E08A4
      • .\crypto\x509v3\v3_lib.c, xrefs: 008E08F2
      • .\crypto\x509v3\v3_lib.c, xrefs: 008E08D5
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID:
      • String ID: .\crypto\x509v3\v3_lib.c$.\crypto\x509v3\v3_lib.c$.\crypto\x509v3\v3_lib.c
      • API String ID: 0-1244901236
      • Opcode ID: b0f5eea5be073555c2b6ef65938ea8da67e7ed59ba28f82d6ba17e3f40d939fa
      • Instruction ID: 0cf4993cd2d3a1f425b14cadde1f9cd4a431a6b3858ca68e5a8938508f38d498
      • Opcode Fuzzy Hash: b0f5eea5be073555c2b6ef65938ea8da67e7ed59ba28f82d6ba17e3f40d939fa
      • Instruction Fuzzy Hash: B411D0323196548ADB14DF59E40034DBBB0F789B88F484A25EB4D47B1AEF39D649CF41
      Function 008E01B0 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 44COMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: memcpy
      • String ID: .\crypto\x509v3\v3_ia5.c$.\crypto\x509v3\v3_ia5.c$V
      • API String ID: 3510742995-1003695214
      • Opcode ID: 9f5822f19283a9364e88dcf7ee598fe6af9bb948749665a1fb9e460b29fe5cdd
      • Instruction ID: 8153973af44ea547541c02c900e673898f24f5febc97070360ffb903231fb026
      • Opcode Fuzzy Hash: 9f5822f19283a9364e88dcf7ee598fe6af9bb948749665a1fb9e460b29fe5cdd
      • Instruction Fuzzy Hash: 17012FB2315A8682EF16CF22D01435A63A1FB85B88F884420DF4C8B749EB3DC9C6CB01
      Function 00874560 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 39COMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: memcpymemset
      • String ID: .\crypto\rsa\rsa_none.c$Z
      • API String ID: 1297977491-283679226
      • Opcode ID: 98d9f85035fab99111c58a146d932a700f583de3a7994d6f9668997a7e6fb6bd
      • Instruction ID: 1263ea80b44bbb5d0445eb5e75fc0f46e1220e47bbbd61dc2152e0ce83c5d156
      • Opcode Fuzzy Hash: 98d9f85035fab99111c58a146d932a700f583de3a7994d6f9668997a7e6fb6bd
      • Instruction Fuzzy Hash: 7501A23171864486CA10DF6AE984259B765F7C5BD4F598630BB5897B5ACF38C2118B00
      Function 008744E0 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 31COMMON
      Download Yara Rule
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID:
      • String ID: .\crypto\rsa\rsa_none.c$.\crypto\rsa\rsa_none.c$L
      • API String ID: 0-2117879465
      • Opcode ID: 5592e6eb7d57b061f5e3e9b655eef379dface56f243bb6700deb3534249b4826
      • Instruction ID: 57ee8bc0e34f40212281c3a86ccaac65fdd7764795e50a2598603c1042fb8627
      • Opcode Fuzzy Hash: 5592e6eb7d57b061f5e3e9b655eef379dface56f243bb6700deb3534249b4826
      • Instruction Fuzzy Hash: BEF0E2B1710085C7EB10EB69E40AB8A7790F390748FC08524AB0D87B55DF7DC6AACF01
      Function 008C6230 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON
      Download Yara Rule
      APIs
      Strings
      • .\crypto\asn1\asn_mime.c, xrefs: 008C62C0
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: isuppertolower
      • String ID: .\crypto\asn1\asn_mime.c
      • API String ID: 2435887076-538127707
      • Opcode ID: a87d7181df5a9b6736bba46cda75f7eaf7fd96d747b0c9b36aa929197c5552b7
      • Instruction ID: f8d1fa505452d2e4e378a6a593232673743dd094aac06e0ed8c17863d7421911
      • Opcode Fuzzy Hash: a87d7181df5a9b6736bba46cda75f7eaf7fd96d747b0c9b36aa929197c5552b7
      • Instruction Fuzzy Hash: ED119322709B9585EE16AB56A41472A67B1FB86FC4F4C843CEE4987746EE3CC811D311
      Function 0089A0CC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: getsockoptperror
      • String ID: getsockopt
      • API String ID: 2965403756-3272894102
      • Opcode ID: 2aae57d07f073521f577950c9caf0d30ccedf56e254a94082cf83aba973abbbb
      • Instruction ID: a62a7c3bc0233cdd7837acf06af43e157060edcea197ffa3c08037d5297c4bb7
      • Opcode Fuzzy Hash: 2aae57d07f073521f577950c9caf0d30ccedf56e254a94082cf83aba973abbbb
      • Instruction Fuzzy Hash: 0901B13270468187E7198F58E54035DE755F3C8365F448235EB8D87BE8CB78C658CB00
      Function 0089A061 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON
      Download Yara Rule
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: perrorsetsockopt
      • String ID: setsockopt
      • API String ID: 1637780026-3981526788
      • Opcode ID: 06126af1e47dea33d719027bd9cfecc8d0d3f78b44d71b469d2eda45ad9aee86
      • Instruction ID: e7f0af33cab6e8a08584a82b14b0b4494698783c67b924cc3b04fc779143b492
      • Opcode Fuzzy Hash: 06126af1e47dea33d719027bd9cfecc8d0d3f78b44d71b469d2eda45ad9aee86
      • Instruction Fuzzy Hash: DAF04F73B0458187E7518F6EE880359B391F7C8765F884231EB5DC6BE5EA38D6948B04
      Function 0084A370 Relevance: 5.0, APIs: 4, Instructions: 45COMMON
      Download Yara Rule
      APIs
      Memory Dump Source
      • Source File: 00000006.00000002.2900293802.0000000000841000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00840000, based on PE: true
      • Associated: 00000006.00000002.2900268599.0000000000840000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900373724.0000000000933000.00000002.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900409081.0000000000983000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900428721.0000000000993000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900446466.000000000099C000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900471572.00000000009A3000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900487866.00000000009A4000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900506065.00000000009AF000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900522453.00000000009B0000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900542287.00000000009B5000.00000008.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900557574.00000000009B6000.00000004.00000001.01000000.0000000E.sdmpDownload File
      • Associated: 00000006.00000002.2900573788.00000000009C2000.00000002.00000001.01000000.0000000E.sdmpDownload File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_6_2_840000_WinHTTrack.jbxd
      Similarity
      • API ID: memcpy
      • String ID:
      • API String ID: 3510742995-0
      • Opcode ID: ae6695e39328624b23c581d8f38cc4a5c075ef4843bf0809a3bcec4bf2eb3d3e
      • Instruction ID: 15f01b7b591fd2259473487763828fa3d33c0689fa2adef34df2af4c978aca71
      • Opcode Fuzzy Hash: ae6695e39328624b23c581d8f38cc4a5c075ef4843bf0809a3bcec4bf2eb3d3e
      • Instruction Fuzzy Hash: 06118EB2365BC592CA18DF25E5403CDA320F7997C0F855621BFAB97785EB34D6A1C700