Edit tour

Windows Analysis Report
7z2408-x64.exe

Overview

General Information

Sample name:	7z2408-x64.exe
Analysis ID:	1541328
MD5:	0330d0bd7341a9afe5b6d161b1ff4aa1
SHA1:	86918e72f2e43c9c664c246e62b41452d662fbf3
SHA256:	67cb9d3452c9dd974b04f4a5fd842dbcba8184f2344ff72e3662d7cdb68b099b
Infos:

Detection

Score:	19
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Infects executable files (exe, dll, sys, html)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found dropped PE file which has not been started or loaded

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

7z2408-x64.exe (PID: 6184 cmdline: "C:\Users\user\Desktop\7z2408-x64.exe" MD5: 0330D0BD7341A9AFE5B6D161B1FF4AA1)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: 7z2408-x64.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7-zip.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7z.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7z.exe	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7-zip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7zG.exe	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7zFM.exe	Jump to behavior

Source: 7z2408-x64.exe, 00000000.00000003.1756539856.0000000002740000.00000004.00000020.00020000.00000000.sdmp, License.txt.0.dr	String found in binary or memory: http://www.gnu.org/
Source: 7z2408-x64.exe, 00000000.00000003.1756539856.0000000002740000.00000004.00000020.00020000.00000000.sdmp, History.txt.0.dr	String found in binary or memory: https://7-zip.org/history.txt
Source: 7z2408-x64.exe, 00000000.00000003.1759096947.00000000045AF000.00000004.00000020.00020000.00000000.sdmp, 7zFM.exe.0.dr	String found in binary or memory: https://www.7-zip.org/

Source: C:\Users\user\Desktop\7z2408-x64.exe

Code function: 0_2_004017DE GetModuleFileNameW,GetDlgItemTextW,lstrlenW,ShowWindow,ShowWindow,ShowWindow,SendMessageW,PeekMessageW,PeekMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,SendMessageW,PeekMessageW,PeekMessageW,SetWindowTextW,lstrcpyW,lstrcpyW,lstrlenW,GetFileAttributesW,SetFileAttributesW,lstrcatW,lstrlenW,MessageBoxW,SetFileTime,SetFileAttributesW,MoveFileExW,GetLastError,SendMessageW,SetWindowTextW,MessageBoxW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,

0_2_004017DE

Source: C:\Users\user\Desktop\7z2408-x64.exe	Code function: 0_2_00405F40	0_2_00405F40
Source: C:\Users\user\Desktop\7z2408-x64.exe	Code function: 0_2_00404061	0_2_00404061
Source: C:\Users\user\Desktop\7z2408-x64.exe	Code function: 0_2_00407430	0_2_00407430
Source: C:\Users\user\Desktop\7z2408-x64.exe	Code function: 0_2_00406A85	0_2_00406A85
Source: C:\Users\user\Desktop\7z2408-x64.exe	Code function: 0_2_00405692	0_2_00405692

Source: Joe Sandbox View	Dropped File: C:\Program Files\7-Zip\7z.dll E79DDFB6319DBF9BAC6382035D23597DAD979DB5E71A605D81A61EE817C1E812
Source: Joe Sandbox View	Dropped File: C:\Program Files\7-Zip\7z.exe 707F415D7D581EDD9BCE99A0429AD4629D3BE0316C329E8B9EBD576F7AB50B71

Source: 7z2408-x64.exe, 00000000.00000002.2968372960.0000000000197000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7zipInstall.exe, vs 7z2408-x64.exe
Source: 7z2408-x64.exe, 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename7zipInstall.exe, vs 7z2408-x64.exe
Source: 7z2408-x64.exe, 00000000.00000003.1759096947.00000000045AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7-zip.dll, vs 7z2408-x64.exe
Source: 7z2408-x64.exe, 00000000.00000003.1759096947.00000000045AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs 7z2408-x64.exe
Source: 7z2408-x64.exe, 00000000.00000003.1759096947.00000000045AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FileVersionFileDescriptionOriginalFilename_winzip_.rsrcCOFF_SYMBOLSCERTIFICATE.pdata.reloc vs 7z2408-x64.exe
Source: 7z2408-x64.exe, 00000000.00000003.1759096947.00000000045AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7z.dll, vs 7z2408-x64.exe
Source: 7z2408-x64.exe, 00000000.00000003.1759096947.00000000045AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7z.exe, vs 7z2408-x64.exe
Source: 7z2408-x64.exe, 00000000.00000003.1759096947.00000000045AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7z.sfx.exe, vs 7z2408-x64.exe
Source: 7z2408-x64.exe, 00000000.00000003.1759096947.00000000045AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7zFM.exe, vs 7z2408-x64.exe
Source: 7z2408-x64.exe, 00000000.00000003.1759096947.00000000045AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7zg.exe, vs 7z2408-x64.exe
Source: 7z2408-x64.exe, 00000000.00000003.1759096947.00000000045AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUninstall.exe, vs 7z2408-x64.exe
Source: 7z2408-x64.exe	Binary or memory string: OriginalFilename7zipInstall.exe, vs 7z2408-x64.exe

Source: 7z2408-x64.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: clean19.spre.winEXE@1/109@0/0

Source: C:\Users\user\Desktop\7z2408-x64.exe

0_2_004017DE

Source: C:\Users\user\Desktop\7z2408-x64.exe

Code function: 0_2_004025C5 CoCreateInstance,

0_2_004025C5

Source: 7z2408-x64.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\7z2408-x64.exe

File read: C:\Program Files\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\7z2408-x64.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\7z2408-x64.exe

File read: C:\Users\user\Desktop\7z2408-x64.exe

Jump to behavior

Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: playtodevice.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: devdispitemprovider.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: portabledeviceapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: networkexplorer.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior

Source: C:\Users\user\Desktop\7z2408-x64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00021401-0000-0000-C000-000000000046}\InProcServer32

Jump to behavior

Source: 7-Zip File Manager.lnk.0.dr	LNK file: ..\..\..\..\..\..\Program Files\7-Zip\7zFM.exe
Source: 7-Zip Help.lnk.0.dr	LNK file: ..\..\..\..\..\..\Program Files\7-Zip\7-zip.chm

Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: Install
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 7z2408-x64.exe

Static file information: File size 1624144 > 1048576

Source: C:\Users\user\Desktop\7z2408-x64.exe

Code function: 0_2_00401FB1 GetSystemDirectoryW,lstrlenW,lstrcpyW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,malloc,free,

0_2_00401FB1

Source: 7-zip32.dll.0.dr	Static PE information: section name: .sxdata
Source: 7z.sfx.0.dr	Static PE information: section name: .sxdata
Source: 7zCon.sfx.0.dr	Static PE information: section name: .sxdata

Source: C:\Users\user\Desktop\7z2408-x64.exe

Code function: 0_2_004071E0 push eax; ret

0_2_0040720E

Persistence and Installation Behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7-zip.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7z.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7z.exe	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7-zip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7zG.exe	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7zFM.exe	Jump to behavior

Source: C:\Users\user\Desktop\7z2408-x64.exe	File created: C:\Program Files\7-Zip\7-zip.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	File created: C:\Program Files\7-Zip\7z.sfx	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	File created: C:\Program Files\7-Zip\7z.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	File created: C:\Program Files\7-Zip\7z.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	File created: C:\Program Files\7-Zip\7-zip32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	File created: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	File created: C:\Program Files\7-Zip\7zCon.sfx	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	File created: C:\Program Files\7-Zip\7zG.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	File created: C:\Program Files\7-Zip\7zFM.exe	Jump to dropped file

Source: C:\Users\user\Desktop\7z2408-x64.exe	File created: C:\Program Files\7-Zip\7z.sfx			Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	File created: C:\Program Files\7-Zip\7zCon.sfx			Jump to dropped file

Source: C:\Users\user\Desktop\7z2408-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7-zip.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7z.sfx	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7z.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7z.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7-zip32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7zCon.sfx	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7zG.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7zFM.exe	Jump to dropped file

Source: C:\Users\user\Desktop\7z2408-x64.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: 7z2408-x64.exe, 00000000.00000003.2644291325.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Qdc
Source: 7z2408-x64.exe, 00000000.00000003.2087105031.0000000000668000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\PROGRA~1_VMware_SATA_CD0^']
Source: 7z2408-x64.exe, 00000000.00000003.2062199390.00000000006A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gSTORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}ef&&
Source: 7z2408-x64.exe, 00000000.00000002.2970058084.000000000A330000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:T
Source: 7z2408-x64.exe, 00000000.00000003.1979640351.000000000069D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dSTORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.1978887267.000000000069D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gSTORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2333268101.000000000065B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _VMware_SATA_CD0^'\
Source: 7z2408-x64.exe, 00000000.00000003.2393903090.000000000A34B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Tjh
Source: 7z2408-x64.exe, 00000000.00000003.2561954201.000000000A34A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}^ff
Source: 7z2408-x64.exe, 00000000.00000003.2311360135.000000000A2AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA{']
Source: 7z2408-x64.exe, 00000000.00000002.2970058084.000000000A330000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:h
Source: 7z2408-x64.exe, 00000000.00000003.2724562565.000000000A346000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: E#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2644936228.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2561954201.000000000A34A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}~QG
Source: 7z2408-x64.exe, 00000000.00000003.2394625067.000000000A34B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Tjh
Source: 7z2408-x64.exe, 00000000.00000003.2394625067.000000000A34B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Qdc
Source: 7z2408-x64.exe, 00000000.00000003.2644936228.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}2-00a0c91efb8b}\\?\STORAG6~
Source: 7z2408-x64.exe, 00000000.00000003.2171636830.000000000A2A9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 4f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA{']
Source: 7z2408-x64.exe, 00000000.00000003.2725173354.000000000A33D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b})
Source: 7z2408-x64.exe, 00000000.00000003.2888976790.000000000A2A6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: }\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2480395971.000000000A34A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}^ff
Source: 7z2408-x64.exe, 00000000.00000003.2749161396.000000000A34D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:e\CLX]
Source: 7z2408-x64.exe, 00000000.00000002.2969841456.000000000A2A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}!
Source: 7z2408-x64.exe, 00000000.00000003.2724791506.000000000A330000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: 7z2408-x64.exe, 00000000.00000002.2969841456.000000000A2A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2644936228.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2888709824.000000000A351000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94@]
Source: 7z2408-x64.exe, 00000000.00000003.2889013936.000000000A348000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Qjc
Source: 7z2408-x64.exe, 00000000.00000003.2644936228.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2644291325.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}11ee-8c18-806e6f6e6963}#00
Source: 7z2408-x64.exe, 00000000.00000003.2725173354.000000000A33D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}C
Source: 7z2408-x64.exe, 00000000.00000003.2311246255.000000000065B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}uu
Source: 7z2408-x64.exe, 00000000.00000003.2229433583.00000000006A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gSTORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}&&
Source: 7z2408-x64.exe, 00000000.00000003.2061434167.0000000000668000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}--
Source: 7z2408-x64.exe, 00000000.00000003.2644291325.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}a33c735c-61ca-11ee-8c18-80
Source: 7z2408-x64.exe, 00000000.00000003.2725173354.000000000A33D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}6f6e6963}#0000000006500000^
Source: 7z2408-x64.exe, 00000000.00000003.2644936228.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2644936228.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000002.2969841456.000000000A2A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000002.2968725040.000000000060A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0uWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: 7z2408-x64.exe, 00000000.00000003.2061506490.00000000006A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: wgSTORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}ef&&
Source: 7z2408-x64.exe, 00000000.00000003.2644291325.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}7f
Source: 7z2408-x64.exe, 00000000.00000003.2725173354.000000000A33D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2644291325.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2644824463.000000000065B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000007
Source: 7z2408-x64.exe, 00000000.00000003.1978887267.000000000069D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}$$
Source: 7z2408-x64.exe, 00000000.00000003.2724562565.000000000A346000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}}\\?\STORAGE#Volume#{a33crcG
Source: 7z2408-x64.exe, 00000000.00000003.2562065555.000000000A34E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.1900346230.000000000069D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j8ycSTORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2394494523.000000000A2A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA{']
Source: 7z2408-x64.exe, 00000000.00000003.2480395971.000000000A34A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}OhU
Source: 7z2408-x64.exe, 00000000.00000003.2644291325.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2561954201.000000000A34A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}OhU
Source: 7z2408-x64.exe, 00000000.00000003.2561954201.000000000A34A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Tjh

Source: C:\Users\user\Desktop\7z2408-x64.exe

Code function: 0_2_00401FB1 GetSystemDirectoryW,lstrlenW,lstrcpyW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,malloc,free,

0_2_00401FB1

Source: C:\Users\user\Desktop\7z2408-x64.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\7z2408-x64.exe

Code function: 0_2_004059FD GetVersion,GetModuleHandleW,GetProcAddress,GetSystemDirectoryW,LoadLibraryExW,

0_2_004059FD

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	1 Taint Shared Content	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Access Token Manipulation	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	13 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
7z2408-x64.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Program Files\7-Zip\7-zip.dll	0%	ReversingLabs
C:\Program Files\7-Zip\7-zip32.dll	0%	ReversingLabs
C:\Program Files\7-Zip\7z.dll	0%	ReversingLabs
C:\Program Files\7-Zip\7z.exe	0%	ReversingLabs
C:\Program Files\7-Zip\7z.sfx	0%	ReversingLabs
C:\Program Files\7-Zip\7zCon.sfx	0%	ReversingLabs
C:\Program Files\7-Zip\7zFM.exe	0%	ReversingLabs
C:\Program Files\7-Zip\7zG.exe	0%	ReversingLabs
C:\Program Files\7-Zip\Uninstall.exe	0%	ReversingLabs

Name	Source	Malicious	Reputation
http://www.gnu.org/	7z2408-x64.exe, 00000000.00000003.1756539856.0000000002740000.00000004.00000020.00020000.00000000.sdmp, License.txt.0.dr	false	unknown
https://www.7-zip.org/	7z2408-x64.exe, 00000000.00000003.1759096947.00000000045AF000.00000004.00000020.00020000.00000000.sdmp, 7zFM.exe.0.dr	false	unknown
https://7-zip.org/history.txt	7z2408-x64.exe, 00000000.00000003.1756539856.0000000002740000.00000004.00000020.00020000.00000000.sdmp, History.txt.0.dr	false	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541328
Start date and time:	2024-10-24 17:35:44 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	7z2408-x64.exe
Detection:	CLEAN
Classification:	clean19.spre.winEXE@1/109@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 25 Number of non-executed functions: 10
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 7z2408-x64.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files\7-Zip\7z.dll	6rxVO117yJ.exe	Get hash	malicious	RHADAMANTHYS	Browse
	6rxVO117yJ.exe	Get hash	malicious	RHADAMANTHYS	Browse
	O1cd60GrHb.exe	Get hash	malicious	RHADAMANTHYS	Browse
	O1cd60GrHb.exe	Get hash	malicious	RHADAMANTHYS	Browse
C:\Program Files\7-Zip\7z.exe	6rxVO117yJ.exe	Get hash	malicious	RHADAMANTHYS	Browse
	6rxVO117yJ.exe	Get hash	malicious	RHADAMANTHYS	Browse
	O1cd60GrHb.exe	Get hash	malicious	RHADAMANTHYS	Browse
	O1cd60GrHb.exe	Get hash	malicious	RHADAMANTHYS	Browse

Created / dropped Files

C:\Program Files\7-Zip\7-zip.chm

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	120396
Entropy (8bit):	7.886177960928617
Encrypted:	false
SSDEEP:	3072:LbVXJ5WfBbkivVIdgKd07cleTTsM7YISV0ifmMz7:fZeBb1V0gZ7cloz+d
MD5:	99B88F4D6D13713053DB06B449ED6A9F
SHA1:	F718E09A42E9EC49DB060589D24135CA6929E8E0
SHA-256:	F830DDC5280D00E1CB160F9E5DD114292D5EFEF66C23C3C03C224894250BAC2F
SHA-512:	9F1CB9AD8023B340C82E987BAB33CDDD817E3ECE892ACA7350650343396D4DC5D00CFD99C0718A862280C81D7D525C5E870390E1CDFDB4987B6663B1394CF1FC
Malicious:	false
Reputation:	low
Preview:	ITSF....`.........#;.......\|.{.......".....\|.{......."..`.......(...............T ......................L.......................,...................j..].!......."..T.....................U.n.c.o.m.p.r.e.s.s.e.d.....M.S.C.o.m.p.r.e.s.s.e.d...{.7.F.C.2.8.9.4.0.-.9.D.3.1.-.1.1.D.0.<...........LZXC......................`N..A.`#.._.....HM.a.Zk5..$$...BQ.+C....^z..79w....?wJ.^...UT5.N%w..ff.h......W..z.F..;S..7....f{.0.?t3W.....i..+v.....E.>d,..k......t..ib.....XHB"....#.<.,="b..C..$..6..FC..$.:....t.`........7..rR[H....2.#.G.A... ..>..Q.....U.(..B....................w..]..x.....w]...y.V..N... ....@.....n.cl!ija..\............ml,^m6$\..k..1k.....'.q.o,D..T.!m.`3.-N.~.`.\.-.m.....N..i.;x..Uu....Ks..m...'.6...,.~.d..KY.....v_...Y.&......`..g.[6 .9.....}U..,...[.8.t....Z.Dw.....+.r\|ge.rw...n.s.D.8...N?;.V....B'7.[.D..._'.c~..{..D[q.7k..l."..\.?...~W.=.......9L....d]\|.....X~..o.....:/tk.....]..e......{.;u+...v........2....1...[...(...d.n...]..fa......q...u.};..

C:\Program Files\7-Zip\7-zip.dll

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	101376
Entropy (8bit):	5.7561086564963295
Encrypted:	false
SSDEEP:	1536:mCkXPxYbAVFYytdtXD571K8XQui+aFBZxH3OwenyrKm5GDES575Y+NPyFG:dmxDF5tGVFBZxHeB46VYdG
MD5:	D346530E648E15887AE88EA34C82EFC9
SHA1:	5644D95910852E50A4B42375BDDFEF05F6B3490F
SHA-256:	F972B164D9A90821BE0EA2F46DA84DD65F85CD0F29CD1ABBA0C8E9A7D0140902
SHA-512:	62DB21717F79702CBDD805109F30F51A7F7FF5F751DC115F4C95D052C5405EB34D5E8C5A83F426D73875591B7D463F00F686C182EF3850DB2E25989AE2D83673
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Y.L.8...8...8.......8...8..X8.......8.......8......8.......8.......8.......8.......8..Rich.8..................PE..d.....f.........." ......................................................................`......................................... Z.......O..........P....p..................l....................................................................................text...\........................... ..`.rdata...j.......l..................@..@.data........`.......P..............@....pdata.......p.......R..............@..@.rsrc...P............j..............@..@.reloc..z...........................@..B................................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\7-zip32.dll

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	67072
Entropy (8bit):	5.857396301110831
Encrypted:	false
SSDEEP:	1536:Cx241Eg3LbDGNmS+FVsaWsEx7ce3RQQd/YsJy:k2Bg3LGNmSSsaWsuz/Ysw
MD5:	82E994D93BD2EED9EC406E81C27542B7
SHA1:	F7B4A033BAA1CDB812D8D606535BC04ACA264BEB
SHA-256:	96313194A8ACE0D6FBE037DDE8C85D1430A5FB1D8CC62E68BDF41FE2E838F440
SHA-512:	993F86492114029186656CEE385B9639EFDE6F3C3D6AD853413A7F187F65C938A44665AEE98F01E206388FF1F68979F16CF0EDEBC298CB34BBB183AD048741B4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C&Z`.G43.G43.G43hX?3.G43.[:3.G43hX>3.G43hX03.G43.Ok3.G43.G53.G43.Oi3.G43.OT3.G431a?3.G43..02.G43..3.G43.A23.G43.g03.G43Rich.G43........PE..L.....f...........!.........h......q........................................P............@.........................`.......t...........P....................0..........................................................d............................text...>........................... ..`.rdata...3.......4..................@..@.data...<...........................@....sxdata.............................@....rsrc...P...........................@..@.reloc..T....0......................@..B........................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\7z.dll

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1892864
Entropy (8bit):	6.297746733916259
Encrypted:	false
SSDEEP:	24576:tezTxNGDd6nCtpzxTuh8WpkPpz6ylzGlvGkw7:gzTxMtpzpDBGyo
MD5:	1143C4905BBA16D8CC02C6BA8F37F365
SHA1:	DB38AC221275ACD087CF87EBAD393EF7F6E04656
SHA-256:	E79DDFB6319DBF9BAC6382035D23597DAD979DB5E71A605D81A61EE817C1E812
SHA-512:	B918AE107C179D0B96C8FB14C2D5F019CAD381BA4DCDC760C918DFCD5429D1C9FB6CE23F4648823A0449CB8A842AF47F25EDE425A4E37A7B67EB291CE8CCE894
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 6rxVO117yJ.exe, Detection: malicious, Browse Filename: 6rxVO117yJ.exe, Detection: malicious, Browse Filename: O1cd60GrHb.exe, Detection: malicious, Browse Filename: O1cd60GrHb.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{..................................L...............2h.......................Rich............................PE..d.....f.........." .....8...~............................................................`.....................................................x.......p........=..............."...................................................P...............................text...-7.......8.................. ..`.rdata..q....P.......<..............@..@.data...............................@....pdata...=.......>..................@..@.rsrc...p...........................@..@.reloc...5.......6..................@..B................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\7z.exe

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	562176
Entropy (8bit):	6.198630490927859
Encrypted:	false
SSDEEP:	6144:vXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ82g4zrr8:vXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
MD5:	0B24892597DCB0257CDB78B5ED165218
SHA1:	5FE5D446406FF1E34D2FE3EE347769941636E323
SHA-256:	707F415D7D581EDD9BCE99A0429AD4629D3BE0316C329E8B9EBD576F7AB50B71
SHA-512:	24EA9E0F10A283E67850070976C81AE4B2D4D9BB92C6EB41B2557AD3AE02990287531A619CF57CD257011C6770D4C25DD19C3C0E46447EB4D0984D50D869E56F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 6rxVO117yJ.exe, Detection: malicious, Browse Filename: 6rxVO117yJ.exe, Detection: malicious, Browse Filename: O1cd60GrHb.exe, Detection: malicious, Browse Filename: O1cd60GrHb.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............aX.aX.aX...X.aX...X.aX.`X~.aX...X..aX..eY.aX...X..aX~.bY.aX...X.aX...X.aXRich.aX........PE..d.....f..........".................`.........@...........................................`.....................................................x............P..lr..............(.......................................................P............................text............................... ..`.rdata..L...........................@..@.data....=..........................@....pdata..lr...P...t..................@..@.rsrc................~..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\7z.sfx

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	215552
Entropy (8bit):	6.473724899007663
Encrypted:	false
SSDEEP:	6144:oCtXnzXsyLVkjCFA3Kc6Gy33LaP4OSWA2:oCdzXsyLVkP56J33+4T2
MD5:	2DA1E169833D1AC3697DED688D0C5A11
SHA1:	59937A1F6C4C2B67870A9D5EFF222FEF230994CC
SHA-256:	6B57604755BD4410A4F1ADBCE90498E205F4255C5786D5C4DDB34327C161B125
SHA-512:	9324E6428CC92EF928CCC730EDA904559C1E6DFECFB79E5E6961B4F129E9EA3ACCAD96E725CB9EDAD05ED82467C5C72CBA7F284D295DE19854B711C89F6AD94F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)" .mCN.mCN.mCN..\E.nCN.._@.eCN..\D.fCN..\J.oCN..K..nCN.mCO..CN..K..`CN.[eE.1CN.x.J.lCN.[eD.oCN.v..}CN..1M.nCN..EH.lCN.RichmCN.........................PE..L.....f........../.................,.............@.........................................................................T............&..............................................................................h............................text...u........................... ..`.rdata...h.......j..................@..@.data....U...0......................@....sxdata.............. ..............@....rsrc....&.......(..."..............@..@................................................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\7zCon.sfx

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194048
Entropy (8bit):	6.549166394360702
Encrypted:	false
SSDEEP:	3072:yzkUY17sFJxZt0rDvKTkafhGCvUkmmdB6JVFonVk4AOnLyiH2DddP:p6tGLqkOhdvUkmmv6JVFsTLyiHGd9
MD5:	DD69F1774B4A3FEEF30E5923F846FBA7
SHA1:	9C31DC7109A1051FAA0253E0B666FAA0EBBFA66F
SHA-256:	062C989AC695CFAFDB4C83A8517B2F6716E1A8A1255360F01A49216C4A21884B
SHA-512:	6AFA3746630CA882BCE8410E76CD3E3E0ACC5662D48BE6C8D54577A0A3D836446B041B1293567DBB357389967C9FA3A02BDF2BE0DBB0142FBFA74D1BE565CDCC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S"1..C_W.C_W.C_Wx\TW.C_W._QW.C_Wx\UW.C_Wx\[W.C_W.K.W.C_W.C^WmC_W.K.W.C_W!eTWEC_W..[V.C_W!eUW.C_W...W.C_W.1\V.C_W.EYW.C_WRich.C_W........PE..L.....f........../......x..........L^............@.............................................................................d....p...............................................................................................................text....v.......x.................. ..`.rdata..Ze.......f...\|..............@..@.data....V..........................@....sxdata......`......................@....rsrc........p......................@..@................................................................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\7zFM.exe

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	986624
Entropy (8bit):	6.16278240217402
Encrypted:	false
SSDEEP:	12288:O8vaa81soeyezSC6v/ciLKK3kg5aqghpSy1TIPxTmqCLwKzu/:7a7/ezSC6vUyD/aqgrvWx6q8wyu
MD5:	004D7851F74F86704152ECAAA147F0CE
SHA1:	45A9765C26EB0B1372CB711120D90B5F111123B3
SHA-256:	028CF2158DF45889E9A565C9CE3C6648FB05C286B97F39C33317163E35D6F6BE
SHA-512:	16EBDA34803977A324F5592F947B32F5BB2362DD520DC2E97088D12729024498DDFA6800694D37F2E6E5C6FC8D4C6F603414F0C033DF9288EFC66A2C39B5EC29
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'[.F5..F5..F5.e1[..F5...N..F5..F4..G5...H..F5...[..F5...1..F5...X..F5...I..F5...M..F5.Rich.F5.........................PE..d.....f.........."..........b................@..............................`............`..................................................6.......p.......................@..T.......................................................p....5..@....................text...n........................... ..`.rdata..^...........................@..@.data........`.......D..............@....pdata...............F..............@..@.rsrc........p.......(..............@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\7zG.exe

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	708608
Entropy (8bit):	6.142357219206753
Encrypted:	false
SSDEEP:	12288:9VJjBq33vb5O8M+l1D0hwsEBoW/lx4Zf0Im98:9VbqPb88hv/l+7
MD5:	4159FF3F09B72E504E25A5F3C7ED3A5B
SHA1:	B79AB2C83803E1D6DA1DCD902F41E45D6CD26346
SHA-256:	0163EC83208B4902A2846DE998A915DE1B9E72ABA33D98D5C8A14A8FBF0F6101
SHA-512:	48F54F0AB96BE620DB392B4C459A49A0FA8FBE95B1C1B7DF932DE565CF5F77ADFAAE98EF1E5998F326172B5AE4FFA9896AEAC0F7B98568FCDE6F7B1480DF4E2D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................~......c...~.....~.....g.....~...........~.....~....Rich...................PE..d.....f.........."......6...........2........@..............................P............`..............................................................i... ..d............0.......................................................P...............................text...L4.......6.................. ..`.rdata...z...P...\|...:..............@..@.data...pC..........................@....pdata..d.... ......................@..@.rsrc....i.......j...T..............@..@.reloc.. ....0......................@..B................................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\History.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7079
Entropy (8bit):	4.898866595340762
Encrypted:	false
SSDEEP:	96:J5EFUuqUScE5UToWWioSwhbULfTvm4/qxzfN:fFcKUToWx1wSfTd/YzfN
MD5:	86D07103FB8D487D17D33974C0BDC0C2
SHA1:	D0318DD9296B5FD92A190329FAF5F16F9CC131C3
SHA-256:	EE3D0EB585DA90D0BB36A2F3D2A7FB5FDCE5336141EA8F779D7450D8A4B16C42
SHA-512:	367EDB4E86C904D73078AD0CAB8C627AB123BDE3D647AA21ED695BD54146F7669791E9F38DEE27070BC9608332CB0FB6D85798E22E05C505624CB7B6D4ACE3AF
Malicious:	false
Preview:	HISTORY of the 7-Zip..--------------------....This file contains information about changes for latest versions of 7-Zip...The full changelog file can be downloaded here:..https://7-zip.org/history.txt......24.08 2024-08-11..-------------------------..- The bug in 7-Zip 24.00-24.07 was fixed:.. For creating a zip archive: 7-Zip could write extra zero bytes after the end of the archive,.. if a file included to archive cannot be compressed to a size smaller than original... The created zip archive is correct except for the useless zero bytes after the end of the archive... When unpacking such a zip archive, 7-Zip displays a warning:.. "WARNING: There are data after the end of archive"...- The bug was fixed: there was a leak of GDI objects (internal resources in Windows).. in "Confirm File Replace" window, causing problems after 1600 displays of "Confirm File Replace".. window from same running 7-Zip process...- Some optimizations for displaying file icons in 7-Zip File M

C:\Program Files\7-Zip\Lang\af.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	4621
Entropy (8bit):	4.969434576878072
Encrypted:	false
SSDEEP:	96:bdDW+Wz9my7MIlXq2sQqpxjOsgEGh4YdVDpZfir99v7+bv:sfwy7XlXq2sfpxjOsRGhfVDpZfCji
MD5:	DF216FAE5B13D3C3AFE87E405FD34B97
SHA1:	787CCB4E18FC2F12A6528ADBB7D428397FC4678A
SHA-256:	9CF684EA88EA5A479F510750E4089AEE60BBB2452AA85285312BAFCC02C10A34
SHA-512:	A6EEE3D60B88F9676200B40CA9C44CC4E64CF555D9B8788D4FDE05E05B8CA5DA1D2C7A72114A18358829858D10F2BEFF094AFD3BC12B370460800040537CFF68
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 4.09 : Petri Jooste.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Afrikaans.Afrikaans.401.OK.Kanselleer....&Ja.&Nee.A&fsluit.Hulp..&Gaan voort.440.Ja vir &almal.Nee vir a&lmal.Stop.Herbegin.&Agtergrond.&Voorgrond.&Wag.Wagtend.Is u seker dat u wil kanselleer?.500.&L.er.R&edigeer.&Vertoon.G&unstelinge.&Gereedskap.&Hulp.540.&Open.Open &Binne.Open B&uite.&Wys.R&edigeer.Her&noem.&Kopieer na....&Verskuif na....Ve&rwyder.Ver&deel l.er....Kom&bineer l.ers....E&ienskappe.Komme&ntaar...Maak gids.Maak l.er.A&fsluit.600.Selekteer &alles.Deselekteer a&lles.Keer &seleksie om.Selekteer....Deselekteer....Selekteer op Soort.Deselekteer op Soort.700.&Groot ikone.&Klein ikone.&Lys.&Detail.730.Ongesorteer..&2 Panele.&Nutsbalke.Maak wortelgids oop.Een vlak ho.r.Gidse geskiedenis....&Verfris.750.Argiveernutsbalk.Standaardnutsbalk.Groot knoppies.Wys teks op knoppies.800.Voeg gids by gunstelinge &as.Boekmerk.900.&Opsies....&Normtoetsing.960.&Inhoud....&Aangaande 7-Zip....1003.Pad.Naam.Uitgang.Gids.G

C:\Program Files\7-Zip\Lang\an.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	7372
Entropy (8bit):	4.909894601165032
Encrypted:	false
SSDEEP:	96:/iCx+nicrSC2WgvUZ8I/MbcGr74hjN8H7+UeT5xMWcZlFi6lCg6l+Rl2NIqpClH5:/OnVInvQ5kN74nK+febFi6Yg62I7bPFI
MD5:	F16218139E027338A16C3199091D0600
SHA1:	DA48140A4C033EEA217E97118F595394195A15D5
SHA-256:	3AB9F7AACD38C4CDE814F86BC37EEC2B9DF8D0DDDB95FC1D09A5F5BCB11F0EEB
SHA-512:	B2E99D70D1A7A2A1BFA2FFB61F3CA2D1B18591C4707E4C6C5EFB9BECDD205D646B3BAA0E8CBD28CE297D7830D3DFB8F737266C66E53A83BDBE58B117F8E3AE14
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; : Feliciano Mart.nez Tur.; 9.07 : Juan Pablo Mart.nez.;.;.;.;.;.;.;.;.;.0.7-Zip.Aragonese.Aragon.s.401.Acceptar.Cancelar....&S..&No.&Zarrar.Aduya..&Continar.440.S. a &tot.No a t&ot.Aturar.Tornar a empecipiar.Se&gundo plano.P&rimer plano.&Pausa.Aturau.Yes seguro que quiers cancelar?.500.&Fichero.&Editar.&Veyer.&Favoritos.&Ferramientas.Ad&uya.540.&Ubrir.Ubrir &adintro.Ubrir &difuera.&Veyer.&Editar.Re&nombrar.&Copiar en....&Mover ta....&Borrar.Di&vidir o fichero....C&ombinar os fichers....&Propiedatz.Comen&tario.Calcular a suma de comprebaci.n.Diff.Creyar carpeta.Creyar fichero.&Salir.600.Seleccionar-lo &tot.Deseleccionar-lo tot.&Invertir selecci.n.Seleccionar....Deseleccionar....Seleccionar por tipo.Deseleccionar por tipo.700.Iconos g&rans.&Iconos chicotz.&Lista.&Detalles.730.Desordenau.Anvista plana.&2 panels.&Barras de ferramientas.Ubrir a carpeta radiz.Carpeta mai.Historial de carpetas....&Esviellar.750.Barra de ferramientas d'archivo.Barras de ferr

C:\Program Files\7-Zip\Lang\ar.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	12299
Entropy (8bit):	4.279828923149653
Encrypted:	false
SSDEEP:	384:Z/YybL3XSV+HYFBLRTRZgZCjWg6IvLDlaJQZmbghr0MhI05z:F3XIBLRMZCjWgfvLpGQZcghrvIC
MD5:	5747381DC970306051432B18FB2236F2
SHA1:	20C65850073308E498B63E5937AF68B2E21C66F3
SHA-256:	85A26C7B59D6D9932F71518CCD03ECEEBA42043CB1707719B72BFC348C1C1D72
SHA-512:	3306E15B2C9BB2751B626F6F726DE0BCAFDC41487BA11FABFCEF0A6A798572B29F2EE95384FF347B3B83B310444AAEEC23E12BB3DDD7567222A0DD275B0180FF
Malicious:	false
Preview:	;!@Lang2@!UTF-8!.; 9.07 :............:... ..-.... ........; 9.07 : Awadh A Al-Ghaamdi.;.; 15.00 : 2016-08-28 : ..... ...... .......: ... .... .......; 15.00 : 2016-08-28 : Saif H Al-asadi (edited and corrected).; 20.00 : 2020-04-01 : Ammar Kurd (Edits and corrections).;.;.;.;.;.0.7-Zip.Arabic......401............ .........&....&...&................&........440.... ....... ................ .........&..........&.....&..... .......... ......... ... ..... .. .........500.&....&......&........&......&......&.......540.&....&.... .........&... .......&....&.........&.. ...........&.. .......&.. ....&....&..... ...........&. ..............&..........&..... .... ..........

C:\Program Files\7-Zip\Lang\ast.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	4967
Entropy (8bit):	5.026921958239907
Encrypted:	false
SSDEEP:	96:FlZTprnge/nJYeoPyWxx6aXaNpx4pRfOvFE5Z2k3z7DWdyy/kYZTsJ:FnZ/n2eoPlxxRqNpx4jfOvFE5Ykq/o
MD5:	1CF6411FF9154A34AFB512901BA3EE02
SHA1:	958F7FF322475F16CA44728349934BC2F7309423
SHA-256:	F5F2174DAF36E65790C7F0E9A4496B12E14816DAD2EE5B1D48A52307076BE35F
SHA-512:	B554C1AB165A6344982533CCEED316D7F73B5B94CE483B5DC6FB1F492C6B1914773027D31C35D60AB9408669520EA0785DC0D934D3B2EB4D78570FF7CCBFCF9C
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 4.07 : Dinamiteru.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Asturian.Asturianu.401.Val.Torgar....&Si.&Non.&Zarrar.Axuda..&Siguir.440.Si a &Too.Non a T&oo.Parar.Reentamar.&De fondu.&En primer planu.&Posar.Posao..Tas fixu que quies paralo?.500.F&icheru.&Remanar.&Ver.F&avoritos.&Ferramientes.A&xuda.540.&Abrir.Abrir &Dientro.Abrir F&uera.&Ver.&Remanar.Reno&mar.&Copiar a....&Mover a....&Borrar.&Partir ficheru....Com&binar ficheros....P&ropiedaes.Come&ntariu...Crear carpeta.Crear ficheru.Co&lar.600.Seleicionar &Too.Deseleicionar too.&Invertir seleici.n.Seleicionar....Deseleicionar....Seleicionar por Tipu.Deseleicionar por Tipu.700.Miniatures &Grandes.&Miniatures Peque.es.&Llista.&Detalles.730.Ens.n Ordenar..&2 Paneles.&Barres de Ferramientes.Abrir Carpeta Raiz.Xubir Un Nivel.Hestorial de Carpetes....Actualiza&r.750.Barra Ferramientes d.Archivu.Barra Ferramientes Normal.Botones Grandes.Amosar Testu nos Botones.800.&A.edir carpeta a Favoritos como.Marca.900.&Opciones....&Bancu d

C:\Program Files\7-Zip\Lang\az.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	10289
Entropy (8bit):	5.3548219718992724
Encrypted:	false
SSDEEP:	192:3Fr7FND8Bavrw291BB5wSKS27xcf4G05gASSvtggPnTInmm4Et:3N3D8Borf5pm7xcfXALggPT0f
MD5:	9CD3A23CA6F66F570607F63BE6AA0001
SHA1:	912837C29C0E07470E257C21775B7513E9AF4475
SHA-256:	1DA941116E20E69F61A4A68481797E302C11FCF462CA7203A565588B26011615
SHA-512:	C90EAD15096009B626B06F9EAE1B004F4ADBA5D18CCDB5C7D92694D36903760541F8AA7352BE96466F2B0775C69F850605988FA4EF86F3DE4FCA34F7B645457E
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 9.07 : F@rhad.; 24.07 : 2024-07-23 : User.;.;.;.;.;.;.;.;.;.0.7-Zip.Azerbaijani.Az.rbaycanca.401.OLDU..mtina....&B.li.&Xeyr.&Ba.lamaq.K.m.k..&Davam.440.&Ham.s.na B.li.Ha&m.s.na Xeyr.Dayand.rmaq.Yenid.n ba.lamaq.&Arxa planda..&nd..F&asil..Fasil.d...m.liyyat dayand.r.ls.n?.500.&Fayl.&D.z.li..&G.r.n...S&e.ilmi.l.r.&Vasit.l.r.&Aray...540.&A.maq.&Daxild. A.maq.K&.narda A.maq.&Bax...&D.z.li..Ye&nid.n Adland.rmaq.&N.sx.l.m.k....&K...rm.k....&Silm.k.Fayl. &B.lm.k....Fayllar. B&irl..dirm.k....X&.susiyy.tl.r...r&h....Yoxlama C.mi.M.qayis..Qovluq Yaratmaq.Fayl Yaratmaq..&.x....stinad.&.v.zedici Ax.nlar.600.&Ham.s.n. Se.m.k.Se.imin L..vi.&Se.imi .evirm.k.Se.m.k....Se.imin L..vi....N.v.n. G.r. Se.m.k.N.v.n. G.r. Se.imin L..vi.700.&B.y.k ..ar.l.r.K&i.ik ..ar.l.r.&Siyah..&C.dv.l.730..e.idsiz.M.st.vi G.r.n...&2 L.vh..&Al.tl.r L.vh.l.ri.K.

C:\Program Files\7-Zip\Lang\ba.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	10837
Entropy (8bit):	4.643195839265694
Encrypted:	false
SSDEEP:	192:EG9NeKlSU9fV6kPtwusVom5DvB4UlBFXCsMu:EG9FlSU9fV6kPt+hvBPLFXCE
MD5:	387FF78CF5F524FC44640F3025746145
SHA1:	8480E549D00003DE262B54BC342AF66049C43D3B
SHA-256:	8A85C3FCB5F81157490971EE4F5E6B9E4F80BE69A802EBED04E6724CE859713F
SHA-512:	7851633EE62C00FA2C68F6F59220A836307E6DDE37EAE5E5DCA3CA254D167E305FE1EB342F93112032DADAFE9E9608C97036AC489761F7BDC776A98337152344
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 9.20 : Haqmar.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Bashkir...........401........... ......&....&...&..........&......440......... .. .&.....&...... .. ............... ......&..... ........&... .......&........ ............... .... ....... .. ...... ............?.500.&.......&.....&.........&...........&.......&........540.&.......&...... .......&..... .........&....&..............&...... ............&................&...........&............. &.............. ...&...............&.........&................ .....Diff.... ............ &.........&.......600.&....... .. ............&..... .... .

C:\Program Files\7-Zip\Lang\be.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	11457
Entropy (8bit):	4.3994562592493125
Encrypted:	false
SSDEEP:	192:voiIwxssHdMMybRMIc++NBGC4ci/4f/iv1GBSHlzdRCU39ixod9t:voJ4s8SKs+NBDkA/m1GBSHlzdvMEX
MD5:	B1DD654E9D8C8C1B001F7B3A15D7B5D3
SHA1:	5A933AE8204163C90C00D97BA0C589F4D9F3F532
SHA-256:	32071222AF04465A3D98BB30E253579AA4BECEAEB6B21AC7C15B25F46620BF30
SHA-512:	0137900AEB21F53E4AF4027EA15EED7696ED0156577FE6194C2B2097F5FB9D201E7E9D52A51A26AE9A426F8137692154D80676F8705F335FED9AE7E0E1D0A10E
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; : Kirill Gulyakevitch.; 9.07 : 2011-03-15 : Drive DRKA.;.;.;.;.;.;.;.;.;.0.7-Zip.Belarusian............401.OK...........&....&...&...................&...........440.... ... &....... ... .&....................&......&.. ....... .....&........ ........ ........ ....... .......... ........?.500.&.....&.......&.......&.........&......&........540.&............... &.................. .&..............&...............&........&......... .....&........... .....&...........&..... .........&.'...... ............&..........&................ .....Diff.&........ .........&..... ......&.....600......

C:\Program Files\7-Zip\Lang\bg.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	17574
Entropy (8bit):	4.148567429680087
Encrypted:	false
SSDEEP:	384:MZ2tO2YSwozmsZ9mFL7AsbjftmxprJ4kgy0j7u4ybq:dCz7lbjaVgyCufq
MD5:	2D0C8197D84A083EF904F8F5608AFE46
SHA1:	5AE918D2BB3E9337538EF204342C5A1D690C7B02
SHA-256:	62C6F410D011A109ABECB79CAA24D8AEB98B0046D329D611A4D07E66460EEF3F
SHA-512:	3243D24BC9FDB59E1964E4BE353C10B6E9D4229EF903A5ACE9C0CB6E1689403173B11DB022CA2244C1EF0F568BE95F21915083A8C5B016F07752026D332878A4
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; : chavv.; : icobgr.; 4.65: Vassia Atanassova.; 23.01: Dimitar Mihaylov.;.;.;.;.;.;.;.0.7-Zip.Bulgarian...........401.OK..........&...&...&...................&.......440... .. &......... .. &.............. .......&..... ......&........ ......&........ .............. .. ....... .. ..........?.500.&.....&............&..........&.......&............&......540.&................. &.......... &......&..........&................&.........&........ ........&........ .......&.........&........ .. .........&.......... .. ...........&............&................. .. ......... ...................... .

C:\Program Files\7-Zip\Lang\bn.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	14633
Entropy (8bit):	3.957046613501519
Encrypted:	false
SSDEEP:	192:haD8h70Oi+7V+y+FJNgquLCnt/SD4mKYGn940nWXmJTQOdLrRMs:hKm5f7V+y+FJNgquIt/64tnSmJciLNMs
MD5:	771C8B73A374CB30DF4DF682D9C40EDF
SHA1:	46AA892C3553BDDC159A2C470BD317D1F7B8AF2A
SHA-256:	3F55B2EC5033C39C159593C6F5ECE667B92F32938B38FCAF58B4B2A98176C1FC
SHA-512:	8DCC9CC13322C4504EE49111E1F674809892900709290E58A4E219053B1F78747780E1266E1F4128C0C526C8C37B1A5D1A452EEFBA2890E3A5190EEBE30657BA
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 4.46 : Team Oruddho (Fahad Mohammad Shaon, Mahmud Hassan).;.;.;.;.;.;.;.;.;.;.0.7-Zip.Bangla.......401.... .............&......&...&.... .............&...... ......440.&....... .... .......&...... .... ............ .....&.......& ......&............. .............. ..... .... ......?.500.&.....&.................&.&......&.......&.......540.&........ ....7-zip-. ........ .......... ........ ....&.........&............ .........&....... ...............

C:\Program Files\7-Zip\Lang\br.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	4953
Entropy (8bit):	5.026642087390098
Encrypted:	false
SSDEEP:	96:uyzeGsp9Qb9PzXHsRu2aPm68ZMvpZkul6Wg1AQQYBgJ0ZQBGBl6agPNH20qIvUkw:FzeGsbSu9y8WvpZR6W+AQQYG8LgFW01S
MD5:	07504A4EDAB058C2F67C8BCB95C605DD
SHA1:	3E2AE05865FB474F10B396BFEFD453C074F822FA
SHA-256:	432BDB3EAA9953B084EE14EEE8FE0ABBC1B384CBDD984CCF35F0415D45AABBA8
SHA-512:	B3F54D695C2A12E97C93AF4DF09CE1800B49E40302BEC7071A151F13866EDFDFAFC56F70DE07686650A46A8664608D8D3EA38C2939F2F1630CE0BF968D669CCC
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 3.12 : KAD-Korvigello. An Drouizig.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Breton.Brezhoneg.401.Mat eo.Nulla.....&Ya.&Ket.&Serri..Skoazell..&Kenderc'hel.440.Ya be&pred.Ket &bepred.Paouez.Adloc'ha..&Drekleur.&Rakleur.&Ehan.Ehanet.Ha fellout a ra deoc'h nulla. ?.500.&Restr.&Aoza..&Gwelout.Di&babo..&Ostilho..&Skoazell.540.&Digeri..Digeri. a-zia&barzh.Digeri. a-zia&vaez.&Gwelout.&Aoza..Adenv&el.&Kopia. diwar....&Dilec'hia. diwar....D&ilemel.&Troc'ha. restr....&Kendeuzi. restro.....P&erzhio..Evezhia&denn...Sevel un teul.Sevel ur restr.&Kuitaat.600.Diuz pep &tra.Diziuz pe tra.Lakaat an &diuzad war an tu gin.Diuz....Diziuz....Diuz diouzh ar rizh.Diziuz diouzh ar rizh.700.Arlunio. &bras.Arlunio. &bihan.&Roll.&Munudo..730.Dirummet..&2 brenestr.&Barrenno. ostilho..Digeri. an teul gwrizienn.Teul kerent.Roll istor an teul....Fresk&aat.750.Barrenn ziell.Barrenn skouerek.Meudellio. bras.Diskouez an destenn.800.&Ouzhpenna. ar c'havlec'h d'ar sinedo..Sined.900.&Di

C:\Program Files\7-Zip\Lang\ca.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	8803
Entropy (8bit):	4.986977159662758
Encrypted:	false
SSDEEP:	192:3nw9pDahG/twoHcW5W3PpCPa5zRHKDBZ0EeKIl3d10aeKY8FDiM:yDGG/twoHJ5Wf9i0EpTAiM
MD5:	264FB4B86BCFB77DE221E063BEEBD832
SHA1:	A2EB0A43EA4002C2D8B5817A207EB24296336A20
SHA-256:	07B5C0AC13D62882BF59DB528168B6F0FFDF921D5442FAE46319E84C90BE3203
SHA-512:	8D1A73E902C50FD390B9372483EBD2EC58D588BACF0A3B8C8B9474657C67705B6A284BB16BBA4326D314C7A3CC11CAF320DA38D5ACB42E685ED2F8A8B6F411F4
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 9.07 : Josep Casals, Marc Folch.;.17.01.: Benet..BennyBeat..R..i.Camps.;.;.;.;.;.;.;.;.;.0.7-Zip.Catalan.Catal..401.D'acord.Cancel.la....&S..&No.Tan&ca.Ajuda..&Continua.440.S. a &tot.No a t&ot.Atura.Re&inicia.Rere&fons.Prim&er pla.&Pausa.Pausat.Segur que voleu cancel.lar?.500.&Fitxer.&Edita.&Visualitza.&Preferits.E&ines.Aj&uda.540.&Obre.Obre d&ins.Obre &fora.&Visualitza.&Edita.Reanom&ena.&Copia a....&Mou a....&Suprimeix.&Divideix el fitxer....Com&bina el fitxer....P&ropietats.Come&ntari.Calcula la suma de verificaci..Compara.Crea una carpeta.Crea un fitxer.S&urt.Enlla&..Flux &alternatiu.600.Seleccion&a-ho tot.No seleccionis res.&Inverteix la selecci..Selecciona....Desselecciona....Selecciona per tipus.Desselecciona per tipus.700.Icones g&rans.Icones petites.&Llista.&Detalls.730.No ordenat.Vista plana.&2 Panells.&Barres d'eines.Obre la carpeta arrel.Carpeta pare.Historial de carpetes....&Actualitza.Actualitza autom.ticament.750.Barra d'eines afege

C:\Program Files\7-Zip\Lang\co.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	11444
Entropy (8bit):	4.995289206779897
Encrypted:	false
SSDEEP:	192:arUs6wOYcVCr1oX7A18zsuX/Y0Nf+6X5gOiAKNWw9BfpN5uc7Fd5:arWwzTr1oM1fuPJNf+26ORwAYH
MD5:	DE64842F09051E3AF6792930A0456B16
SHA1:	498B92A35F2A14101183EBE8A22C381610794465
SHA-256:	DCFB95B47A4435EB7504B804DA47302D8A62BBE450DADF1A34BAEA51C7F60C77
SHA-512:	5DABEED739A753FD20807400DFC84F7BF1EB544704660A74AFCF4E0205B7C71F1DDCF9F79AC2F7B63579735A38E224685B0125C49568CBDE2D9D6ADD4C7D0ED8
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 24.04 : 2024-04-06 : Patriccollu di Santa Maria . Sich. (Latest Update).; 22.00 : 2022-06-21 : Patriccollu di Santa Maria . Sich. (Update).; 15.00 : 2015-04-26 : Patriccollu di Santa Maria . Sich. (Update).; 9.20 : 2010-12-12 : Patriccollu di Santa Maria . Sich. (Creation).;.;.;.;.;.;.;.0.7-Zip.Corsican.Corsu.401.Vai.Abbandun.....&S..&N..&Chjode.Aiutu..&Cuntinu..440.S. per &tutti.N. per t&utti.Piant..Rilanci..Tacca di &fondu.&Primu pianu.&Pausa.In pausa.Vulete veramente annull..?.500.&Schedariu.&Mudific..&Affiss..&Favuriti.A&ttrezzi.Ai&utu.540.&Apre.Apre in &7-Zip.Apre in l.espluratore Windows.&Fighj. (esad.).&Mudific..&Rinumin..&Cupi. versu..&Dispiazz. versu..S&quass..&Sparte u schedariu..&Unisce i schedarii..&Prupriet..Cumme&ntu..Calcul. a somma di cuntrollu.Paragun. e sfarenze (Diff).Cre. un cartulare.Cre. un schedariu.&Esce.Liame.Flussi a&lternativi.600.&Tuttu selezziun...n selezziun. &nunda.&Arritrus. a selezzi

C:\Program Files\7-Zip\Lang\cs.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	9597
Entropy (8bit):	5.372211824470281
Encrypted:	false
SSDEEP:	192:iqJoMyxE8vGIrd+ic1OT1o+SXhbStCBJjSvcQKiw:iEXYBeIrQiEOT1o+SXotsJjmK7
MD5:	DBDCFC996677513EA17C583511A5323B
SHA1:	D655664BC98389ED916BED719203F286BAB79D3C
SHA-256:	A6E329F37ACA346EF64F2C08CC36568D5383D5B325C0CAF758857ED3FF3953F2
SHA-512:	DF495A8E8D50D7EC24ABB55CE66B7E9B8118AF63DB3EB2153A321792D809F7559E41DE3A9C16800347623AB10292AAC2E1761B716CB5080E99A5C8726F7CC113
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 4.30 : Milan Hrub...; 4.33 : Michal Molhanec..; 9.07 : Ji.. Mal.k..; 15.00 : Kry.tof .ern...; 23.01 : 2023-06-20 : Patrik (Pa4k) .pa.o..;..;..;..;..;..;..;..0..7-Zip..Czech...e.tina..401..OK..Storno........&Ano..&Ne..Zav..&t..N.pov.da....Po&kra.ovat..440..Ano na &v.echno..N&e na v.echno..Zastavit..Spustit znovu..&Pozad...P&op.ed...Po&zastavit..Pozastaveno..Jste si jist., .e to chcete stornovat?..500..&Soubor...pr&avy..&Zobrazen...&Obl.ben...&N.stroje..N.po&v.da..540..&Otev..t..Otev..t u&vnit...Otev..t &mimo..&Zobrazit..&Upravit..&P.ejmenovat..Kop.rovat &do.....P.&esunout do.....Vymaza&t..&Rozd.lit soubor.....&Slou.it soubory.....Vlast&nosti..Pozn.mk&a..Vypo..tat kontroln. sou.et..Porovnat soubory..Vytvo.it slo.ku..Vytvo.it soubor..&Konec..Odk.zat..&Alternativn. toky..600..Vybrat &v.e..Zru.it v.b.r v.e..&Invertovat v.b.r..Vybrat.....Zru.it v.b.r.....Vybrat podle typu..Zru.it v.b.r podle typu..700.

C:\Program Files\7-Zip\Lang\cy.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	4812
Entropy (8bit):	5.061169016847165
Encrypted:	false
SSDEEP:	96:8VTu+i2nCrWTXAwQGjC6IF5/uNXlziug14+UFxmeeqYgzf7Edm+8VR:8VTTCqTRC6Iv/uzg14+UFxJYgzTR
MD5:	6BDF25354B531370754506223B146600
SHA1:	C2487C59EEEAA5C0BDB19D826FB1E926D691358E
SHA-256:	470EAF5E67F5EAD5B8C3ECC1B5B21B29D16C73591EB0047B681660346E25B3FB
SHA-512:	C357B07C176175CC36A85C42D91B0CADA79DBFB584BDF57F22A6CB11898F88AECF4392037D5CEA3E1BC02DF7493BB27B9509226F810F1875105BBC33C6AE3F20
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 4.37 : Owain Lewis.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Welsh.Cymraeg.401.Iawn.Canslo....&Iawn.&Na.&Cau.Cymorth..P&arhau.440.Iawn i'r &Cwbwl.Na i'r C&wbwl.Stopio.Ailgychwyn.&Cefndir.&Blaendir.&Pwyllo.Pwyllo.Ydych chi am canslo?.500.&Ffeil.&Golygu.Gwe&ld.Ff&efrynnau.&Offer.&Cymorth.540.&Agor.Agor tu &Mewn.Agor tu &Fas.Gwe&ld.&Golygu.A&ilenwi.&Cop.o i....&Symud i....&Dileu.&Hollti ffeil....Cy&funo ffeilau....&Priodweddau.Syl&wad.Cyfrifo swm-gwirio..Creu Ffolder.Creu Ffeil.Alla&n.600.Dewis y C&yfan.Dad-ddewis y Cyfan.Gwrt&hdroi'r Dewis.Dewis....Dad-ddewis....Dewis trwy Math.Dad-ddewis trwy Math.700.Eiconau &Mawr.Eiconau &Bach.&Rhestr.Ma&nylion.730.Dad-dosbarthu.Golwg Flat.&2 Paneli.Bariau &Offer.Agor Ffolder Gwraidd.Lan Un Lefel.Hanes Ffolderi....&Adnewyddu.750.Bar Offer Archif.Bar Offer Arferol.Botwmau Fawr.Dangos Testun Botwmau.800.&Ychwanegu ffolder i Ffefrynnau fel.Llyfrnod.900.&Dewisiadau....&Meincnod.960.&Cynnwys....&Manylion 7-Zip....1003.Llwybr.Enw.Estyniad.Ffolder.

C:\Program Files\7-Zip\Lang\da.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	7870
Entropy (8bit):	5.005099076386227
Encrypted:	false
SSDEEP:	192:3vn3kbZyZSXQVPLCXiG8gYnJYZDAHZE9xM7T9kur4Yc6Fw9KHl:3v3tSAVPG8gYnJYZk+g7T9kur4PUwG
MD5:	C397E8AC4B966E1476ADBCE006BB49E4
SHA1:	3E473E3BC11BD828A1E60225273D47C8121F3F2C
SHA-256:	5CCD481367F7D8C544DE6177187AFF53F1143AE451AE755CE9ED9B52C5F5D478
SHA-512:	CBBECE415D16B9984C82BD8FA4C03DBD1FEC58ED04E9EF0A860B74D451D03D1C7E07B23B3E652374A3B9128A7987414074C2A281087F24A77873CC45EC5AADD2
Malicious:	false
Preview:	;!@Lang2@!UTF-8!.; : Jakob Schmidt.; 9.07 : Kian Andersen, J.rgen Rasmussen.; 15.00 : 2016-11-25 : scootergrisen.;.;.;.;.;.;.;.;.0.7-Zip.Danish.Dansk.401.OK.Annuller....&Ja.&Nej.&Luk.Hj.lp..&Forts.t.440.Ja til &alle.Nej til a&lle.Stop.Genstart.&Baggrund.&Forgrund.&Pause.Sat p. pause.Er du sikker p., at du vil annullere?.500.&Filer.R&ediger.&Vis.F&avoritter.Funk&tioner.&Hj.lp.540.&.bn..bn &inden i..bn &uden for.&Vis.&Rediger.O&md.b.&Kopier til....&Flyt til....S&let.&Opdel fil....Kom&biner filer....&Egenskaber.Komme&ntar....Udregn checksum.Sammenlign.Opret mappe.Opret fil.&Afslut.Opret/rediger henvisning.&Alternative str.mme.600.V.lg &alle.Frav.lg alle.&Omvendt markering.V.lg....Frav.lg....V.lg efter type.Frav.lg efter type.700.Sto&re ikoner.S&m. ikoner.&Liste.&Detaljer.730.Usorteret.Flad visning.&2 paneler.&V.rkt.jslinjer..bn rodmappe.Et niveau op.Mappehistorik....&Opdater.Opdater automatisk.750.Arkivlinje.Standardlinje.Store knapper.Vis knappernes tekst.800.

C:\Program Files\7-Zip\Lang\de.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	10040
Entropy (8bit):	5.05587204070323
Encrypted:	false
SSDEEP:	192:AOIdBgDuDCfSGltxkRtDgfglyLCoMUGfZsDZIXl7OuKtgAZOKY3gTFFGFe6muWxW:/GgD9Si+bDgfgly4vZ3l7OuKOTgbGFkg
MD5:	1E30A705DA680AAECEAEC26DCF2981DE
SHA1:	965C8ED225FB3A914F63164E0DF2D5A24255C3D0
SHA-256:	895F76BFA4B1165E4C5A11BDAB70A774E7D05D4BBDAEC0230F29DCC85D5D3563
SHA-512:	FF96E6578A1EE38DB309E72A33F5DE7960EDCC260CA1F5D899A822C78595CC761FEDBDCDD10050378C02D8A36718D76C18C6796498E2574501011F9D988DA701
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 2.30 : Soeren Finster.; 4.07 : JAK-Software.DE.; 9.07 : Joachim Henke.; 23.01 : Ren. Gennes.; 24.04 : Sandro Giallella.;.;.;.;.;.;.0.7-Zip.German.Deutsch.401.OK.Abbrechen....&Ja.&Nein.&Schlie.en.Hilfe..&Fortsetzen.440.Ja f.r &alle.Nein f.r a&lle.Stopp.Neustart.&Hintergrund.&Vordergrund.&Pause.Pause.M.chten Sie wirklich abbrechen?.500.&Datei.&Bearbeiten.&Ansicht.&Favoriten.&Extras.&Hilfe.540..&ffnen.I&ntern .ffnen.E&xtern .ffnen.&Ansehen.&Bearbeiten.&Umbenennen.&Kopieren nach....&Verschieben nach....&L.schen.Datei auf&splitten....Dateien &zusammenf.gen....E&igenschaften.K&ommentieren.&Pr.fsumme berechnen.Ver&gleichen.Ordner erstellen.Datei erstellen.Be&enden.Verkn.pfung....&Alternative Datenstr.me.600.Alles &markieren.Alles abw.hlen.Markierung &umkehren.Ausw.hlen....Auswahl aufheben....Nach Typ ausw.hlen.Nach Typ abw.hlen.700.&Gro.e Symbole.&Kleine Symbole.&Liste.&Details.730.Unsortiert.Alles in einer &Ebene.&Zweigeteiltes Fenster.&Symbolleiste

C:\Program Files\7-Zip\Lang\el.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	18214
Entropy (8bit):	4.4284329818199835
Encrypted:	false
SSDEEP:	384:WkmihmxWquSsgldTiXtY5FxrbM/7uo6txGZ+r6GjuXxQlzHd:tmlwyidYnxrU7u/xk+r6GjuXxQdHd
MD5:	5894A446DF1321FBDDA52A11FF402295
SHA1:	A08BF21D20F8EC0FC305C87C71E2C94B98A075A4
SHA-256:	2DD2130F94D31262B12680C080C96B38AD55C1007F9E610EC8473D4BB13D2908
SHA-512:	0A2C3D24E7E9ADD3CA583C09A63BA130D0088ED36947B9F7B02BB48BE4D30EF8DC6B8D788535A941F74A7992566B969ADF3BD729665E61BFE22B67075766F8DE
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; : Vasileios Karakoidas, Jacaranda Bill, Vasilis Kosmidis.; 9.07 : SkyHi [HDManiacs Team].; 15.00 : 2015-05-07: Pete D.; 24.04 : 2024-04-05: John Stamatakis.;.;.;.;.;.;.;.0.7-Zip.Greek..........401.OK..........&.....&...&..................&.........440.... .. &....... .. .&...&...................... &.............. &..........&................... ........ ... ...... .. .........;.500.&.......&.............&..........&...........&.....&........540...&............. ... &.... ................ .. &... ..........&..........&...........&..............&.............&................&...&.......... ...........&........ ...........&......

C:\Program Files\7-Zip\Lang\en.ttt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	7881
Entropy (8bit):	4.99700551664194
Encrypted:	false
SSDEEP:	192:TsTdB9OFKAgBCChWEZECopxnJSZo3QPiJeOAe:641oNhZZECixJSZ+Qc
MD5:	BF2E140E9D30D6C51D372638BA7F4BD9
SHA1:	A4358379A21A050252D738F6987DF587C0BD373D
SHA-256:	C218145BB039E1FD042FB1F5425B634A4BDC1F40B13801E33ED36CFDBDA063ED
SHA-512:	B524388F7476C9A43E841746764FF59BDB1F8A1B4299353156081A854EE4435B94B34B1A87C299EC23F8909E0652222595B3177EE0392E3B8C0FF0A818DB7F9A
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 24.04 : 2024-04-05 : Igor Pavlov.;.;.;.;.;.;.;.;.;.;.0.7-Zip.English.English.401.OK.Cancel....&Yes.&No.&Close.Help..&Continue.440.Yes to &All.No to A&ll.Stop.Restart.&Background.&Foreground.&Pause.Paused.Are you sure you want to cancel?.500.&File.&Edit.&View.F&avorites.&Tools.&Help.540.&Open.Open &Inside.Open O&utside.&View.&Edit.Rena&me.&Copy To....&Move To....&Delete.&Split file....Com&bine files....P&roperties.Comme&nt....Calculate checksum.Diff.Create Folder.Create File.E&xit.Link.&Alternate Streams.600.Select &All.Deselect All.&Invert Selection.Select....Deselect....Select by Type.Deselect by Type.700.Lar&ge Icons.S&mall Icons.&List.&Details.730.Unsorted.Flat View.&2 Panels.&Toolbars.Open Root Folder.Up One Level.Folders History....&Refresh.Auto Refresh.750.Archive Toolbar.Standard Toolbar.Large Buttons.Show Buttons Text.800.&Add folder to Favorites as.Bookmark.900.&Options....&Benchmark.910.Delete Temporary Files....960.&Contents....&About 7-Zip....1003.Path

C:\Program Files\7-Zip\Lang\eo.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	4848
Entropy (8bit):	5.0398900363287105
Encrypted:	false
SSDEEP:	96:lcIh395xVDLRNvtj7ZjuJowdlKoF+M/LMtYUQs0xM3Hj8bH8fC:eg3Px9zt+d5ohGs0sHj88C
MD5:	29CAAD3B73F6557F0306F4F6C6338235
SHA1:	D4B3147F23C75DE84287AD501E7403E0FCE69921
SHA-256:	A6EF5A5A1E28D406FD78079D9CACF819B047A296ADC7083D34F2BFB3D071E5AF
SHA-512:	77618995D9CF90603C5D4AD60262832D8AD64C91A5E6944EFD447A5CC082A381666D986BB294D7982C8721B0113F867B86490CA11BB3D46980132C9E4DF1BD92
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 4.37 : Dmitri Gabinski.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Esperanto.Esperanto.401.B&one.Nuligu....&Jes.&Ne.&Fermu.Helpo..&Da.rigu.440.Jes por .&iuj.Ne por .i&uj.&Haltu.Restartigu.&Fono.&Malfono.&Pa.zo.Pa.zita..u vi vere volas nuligi?.500.&Dosiero.&Redakto.&Vido.&Favoritaj.&Agordoj.&Helpo.540.&Malfermu.Malfermu &ene.Malfermu ek&stere.&Vidigu.&Redaktu..&an.u nomon.&Kopiu en....M&ovu en....&Forigu.&Erigu dosierojn....Komb&inu dosierojn....A&tributoj.Ko&mentu.Kalkulu kontrolsumon..Kreu &dosierujon.Kre&u dos&ieron.E&liru.600.M&arku .iun.Ma&lmarku .iun.&Inversigu markon.Marku....Malmarku....Marku la. tipo.Malmarku la. tipo.700.&Grandaj bildetoj.&Malgrandaj bildetoj.&Listo.&Detale.730.&Neordigite.Ununivela vido.&2 paneloj.&Ilobretoj.Malfermu radikan dosierujon.Supren je unu nivelo.Dosierujhistorio.....&isdatigu.750.Ar.ivo-ilobreto.Norma ilobreto.Grandaj bildetoj.Montru butontekston.800.&Aldonu dosierujon al favorataj kiel.Legosigno.900.&Agordoj....&Etalono.960.&E

C:\Program Files\7-Zip\Lang\es.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	10597
Entropy (8bit):	4.894357872419177
Encrypted:	false
SSDEEP:	192:5JD5oUEhpto75qEisSDlmED/UJ8Wn3bFEmL4FHjwjdBZ2QvcGFpo2ZI3v:5JtvEzG75qcSDlmcDw+EJBZFchFv
MD5:	ED230F9F52EF20A79C4BED8A9FEFDF21
SHA1:	EC0153260B58438AD17FAF1A506B22AD0FEC1BDC
SHA-256:	7199B362F43E9DCA2049C0EEB8B1BB443488CA87E12D7DDA0F717B2ADBDB7F95
SHA-512:	32F0E954235420A535291CF58B823BAACF4A84723231A8636C093061A8C64FCD0952C414FC5BC7080FD8E93F050505D308E834FEA44B8AB84802D8449F076BC9
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; : Pablo Rodriguez.; : Jbc25.; : 2007-09-05 : Guillermo Gabrielli.; 9.07 : 2010-06-10 : Purgossu.; 2010-10-23 : Sergi Medina (corrected).; 18.00 : 2018-01-10 : Agust.n Bou (updated).; 22.00 : 2023-05-13 : To.o Calo (updated and minor fixes).; 24.04 : 2024-04-25 : MELERIX (updated and various fixes).;.;.;.0.7-Zip.Spanish.Espa.ol.401.Aceptar.Cancelar....&S..&No.&Cerrar.Ayuda..&Continuar.440.S. a &todo.No a t&odo.Detener.Reiniciar.&Segundo plano.&Primer plano.&Pausar.Pausado..Est.s seguro de querer cancelar?.500.&Archivo.&Editar.&Ver.F&avoritos.&Herramientas.&Ayuda.540.&Abrir.Abrir &dentro.Abrir f&uera.&Ver.&Editar.Reno&mbrar.&Copiar a....&Mover a....&Borrar.&Dividir archivo....Com&binar archivos....P&ropiedades.Come&ntario.Calcular suma de verificaci.n.Diferencia.Crear carpeta.Crear archivo.S&alir.Enlazar.Flujos &alternativos.600.Seleccionar &todo.Deseleccionar todo.&Invertir selecci.n.Seleccionar....Desel

C:\Program Files\7-Zip\Lang\et.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	6667
Entropy (8bit):	4.975280640991647
Encrypted:	false
SSDEEP:	192:P2ecDQC5HNYvLSjKJCNdnziL1xWKvjgeNH:uecb82ICNFWL1xWKvseNH
MD5:	D6A50C4139D0973776FC294EE775C2AC
SHA1:	1881D68AE10D7EB53291B80BD527A856304078A0
SHA-256:	6B2718882BB47E905F1FDD7B75ECE5CC233904203C1407C6F0DCDC5E08E276DA
SHA-512:	0FD14B4FD9B613D04EF8747DCD6A47F6F7777AC35C847387C0EA4B217F198AA8AC54EA1698419D4122B808F852E9110D1780EDCB61A4057C1E2774AA5382E727
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 3.09 : Kaupo Suviste.; 9.07 : Mihkel T.nnov.;.;.;.;.;.;.;.;.;.0.7-Zip.Estonian.eesti keel.401.OK.Loobu....&Jah.&Ei.&Sulge.Abi..&J.tka.440.K.igile j&ah.K.igile e&i.Seiska.Restardi.&Taustal.&Esiplaanile.&Paus.Pausiks peatatud.Kas soovite kindlasti loobuda?.500.&Fail.&Redigeeri.&Vaade.&Lemmikud.&T..riistad.&Abi.540.&Ava.Ava s&ees.Ava v.ljasp&ool.Vaat&ur.&Redigeeri.&Nimeta .mber.&Kopeeri asukohta....&Teisalda asukohta....Ku&stuta.T.kel&da fail.....&henda failid....Atri&buudid.Ko&mmentaar....Arvuta kontrollsumma.V.rdle.Loo kaust.Loo fail.&V.lju.600.V&ali k.ik.T.hista k.ik valikud.&P..ra valik.Vali....T.hista valik....Vali t..bi j.rgi.T.hista t..bi j.rgi valik.700.&Suured ikoonid.V.ik&esed ikoonid.&Loend..ksikasja&d.730.Sortimata.Lame vaade.&Kaks paani.&T..riistaribad.Ava juurkaust.Taseme v.rra .les.Kaustaajalugu....&V.rskenda.750.Arhiiviriistariba.Standardnupuriba.Suured nupud.Kuva nupusildid.800.&Lisa kaust lemmikute hulka j.rjehoidj

C:\Program Files\7-Zip\Lang\eu.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	8399
Entropy (8bit):	4.743579226754701
Encrypted:	false
SSDEEP:	192:ChNzKhWj2NvAG/UkpyRFJHbskP/jZKMOdp6EAEPW:ChNXj2uG/Ukpe/DEMOdp6Em
MD5:	C90CD9F1E3D05B80ABA527EB765CBF13
SHA1:	66D1E1B250E2288F1E81322EDC3A272FC4D0FFFC
SHA-256:	A1C9D46B0639878951538F531BBA69AEDDD61E6AD5229E3BF9C458196851C7D8
SHA-512:	439375D01799DA3500DFA48C54EB46F7B971A299DFEBFF31492F39887D53ED83DF284EF196EB8BC07D99D0EC92BE08A1BF1A7DBF0CE9823C85449CC6F948F24C
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 15.12 : 2015-12-04 : Xabier Aramendi.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Basque.Euskara.401.&Ongi.E&zeztatu....&Bai.&Ez.It&xi.&Laguntza..&Jarraitu.440.Bai &Guztiari.Ez G&uztiari.Gelditu.Berrabiarazi.Ba&rrenean.&Gainean.&Pausatu.Pausatuta.Zihur zaude ezeztatzea nahi duzula?.500.&Agiria.&Editatu.&Ikusi.&Gogokoenak.&Tresnak.&Laguntza.540.&Ireki.Ireki &Barnean.Ireki &Kanpoan.Ik&usi.&Editatu.Berrize&ndatu.Kopiatu &Hona....&Mugitu Hona....E&zabatu.Banan&du agiria....Nahas&tu agiriak....Ezau&garriak.&Aipamena....Ka&lkulatu egiaztapen-batura.Ezber.Sortu Agiritegia.S&ortu Agiria.I&rten.Lotura.&Aldikatu Jarioak.600.Hautatu &Guztiak.Deshatutau G&uztiak.&Alderantzizkatu Hautapena.&Hautatu....&Deshautatu....Hautatu &Motaz.Deshautatu M&otaz.700.Ikur &Handiak.Ikur Txi&kiak.&Zerrenda.&Xehetasunak.730.Ant&olatugabe.Ik&uspegi Laua.&2 Panel.&Tresnabarrak.Ireki &Erro Agiritegia.Maila Bat &Gora.Agiritegi &Historia....&Berritu.Be&rez Berritu.750.Artxibo Tresnabarra.Tresnabarra Estandarra.Boto

C:\Program Files\7-Zip\Lang\ext.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	7317
Entropy (8bit):	4.9782970287172175
Encrypted:	false
SSDEEP:	192:OpSxVzpOmch2EFMaoK1ibQuXgmDjExNxI/kudt+0/aqppl6jiapd9jpp:P5OtMEFMRDHMuKeaqpAic
MD5:	459B9C72A423304FFBC7901F81588337
SHA1:	0BA0A0D9668C53F0184C99E9580B90FF308D79BE
SHA-256:	8075FD31B4EBB54603F69ABB59D383DCEF2F5B66A9F63BB9554027FD2949671C
SHA-512:	033CED457609563E0F98C66493F665B557DDD26FAB9A603E9DE97978D9F28465C5AC09E96F5F8E0ECD502D73DF29305A7E2B8A0AD4EE50777A75D6AB8D996D7F
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; : Miguel Angel.; 9.07 : Purgossu.;.;.;.;.;.;.;.;.;.0.7-Zip.Extremaduran.Estreme.u.401.Acetal.Cancelal....&S..&Nu.&Fechal.Ayua..A&continal.440.S. &a t..Nu a &t..Paral.Reinicial.Se&gundu pranu.&Primel pranu.&Paral.Parau.De siguru que quieri cancelal la operaci.n?.500.&Archivu.&Eital.&Vel.A&tihus.&Herramientas.A&yua.540.&Abril.Abril &dentru.Abril &huera.&Vel.&Eital.Renom&bral.&Copial a....&Movel pa....&Eliminal.De&sapartal ficheru....Com&binal ficherus....P&ropieais.Come&ntariu.Calculal suma e verificaci.n.Diff.Creal diret.riu.Creal ficheru.&Salil.600.Selecional &t..Deselecional t..&Invertil seleci.n.Selecional....Deselecional....Selecional pol tipu.Deselecional pol tipu.700.Iconus g&randis.Iconus caquerus.&Listau.&Detallis.730.Nu soportau.Vista prana.&2 panelis.Barra e herramien&tas.Abril diret.riu ra..Subil un nivel.Estorial de diret.rius....&Atualizal.750.Barra e herramientas 'archivu'.Barra e herramientas est.ndal.Botonis grandis.Muestral te

C:\Program Files\7-Zip\Lang\fa.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	13282
Entropy (8bit):	4.417819769318221
Encrypted:	false
SSDEEP:	384:WDvyYrnbU6Eyx9Vx8f1gJNOaSgIPukCC3NaxktY7:WD9px8f1gJss2CCsxkK7
MD5:	741E0235C771E803C1B2A0B0549EAC9D
SHA1:	7839AE307E2690721AD11143E076C77D3B699A3C
SHA-256:	657F2ACEB60D557F907603568B0096F9D94143FF5A624262BBFEB019D45D06D7
SHA-512:	F8662732464FA6A20F35EDCCE066048A6BA6811F5E56E9CA3D9AA0D198FC9517642B4F659A46D8CB8C87E890ADC055433FA71380FB50189BC103D7FBB87E0BE5
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 3.12 : Edris Naderan.; 4.53 : Mehdi Farhadi.; 9.22 : Hessam Mohamadi.; 22.00: Mohammad Ali Sohrabi.;.;.;.;.;.;.;.0.7-Zip.Farsi.......401.................&.&.......................440.... ... ...... ... ................... ......... .................... ........ ...... .. ... ........500..................................................540................ .. ............ .. ............................... ............ ............... ............... .............................. ..... ...... ......... ........ .......... ..........&........&......... ........600....... ....... ....... ......... .... .

C:\Program Files\7-Zip\Lang\fi.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	8517
Entropy (8bit):	4.822359737427984
Encrypted:	false
SSDEEP:	96:2dUdnzkcjnQjB54SpQzLFA2WFYicDA1MiV2ehLHq2MQvQM03jgoBHpbYqMeMioHQ:cUtkcjnsZARHicM32UhMeWcoZpcYMivv
MD5:	A04B6A55F112679C7004226B6298F885
SHA1:	06C2377AC6A288FE9EDD42DF0C52F63DCE968312
SHA-256:	12CC4A2CEF76045E07DAFC7AEC7CF6F16A646C0BB80873EC89A5AE0B4844443B
SHA-512:	88C7ED08B35558D6D2CD8713B5D045FBA366010B8C7A4A7E315C0073CD510D3DA41B0438F277D2E0E9043B6FCB87E8417EB5698AB18B3C3D24BE7FF64B038E38
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 3.08 : Ari Ryynanen.; 4.30 : Jarko P..; 4.42 : Juhani Valtasalmi.; 9.35 : T.Sakkara.; 15.05 : 2015-08-07 : Lauri Kentt..; 19.00 : 2020-12-28 : Sampo Hippel.inen.;.;.;.;.;.0.7-Zip.Finnish.Suomi.401.OK.Peruuta....&Kyll..&Ei.&Sulje.Ohje..&Jatka.440.Kyll. k&aikkiin.E&i kaikkiin.Pys.yt..Aloita uudelleen.&Tausta.&Edusta.&Tauko.Tauolla.Peruutetaanko toiminto?.500.&Tiedosto.&Muokkaa.&N.yt..&Suosikit.Ty.&kalut.&Ohje.540.&Avaa.Avaa s&is.isesti.Avaa ulkoisesti.&N.yt..&Muokkaa.Nime. &uudelleen.&Kopioi....&Siirr.....&Poista.&Jaa osiin....&Yhdist. tiedostoja....&Ominaisuudet.Komme&nttti....Laske tarkiste.Ero.Luo kansio.Luo tiedosto.&Lopeta.Linkit..Vaihtoehtoiset virrat.600.V&alitse kaikki.Poista &valinnat.&K..nteinen valinta.Valitse....Poista valinta....Valitse tyypeitt.in.Poista valinta tyypeitt.in.700.Suu&ret kuvakkeet.&Pienet kuvakkeet.&Luettelo.&Tiedot.730.Alkuper.inen j.rjestys.Tasainen n.kym..&Kaksi paneelia.&Ty.kalupalkit.Avaa p..kansio.Yks

C:\Program Files\7-Zip\Lang\fr.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	10868
Entropy (8bit):	4.914669990065981
Encrypted:	false
SSDEEP:	192:Uk/px4B42mykLxrIppKQoYEgHVxX39tJzo2NXIWdE4hNvuaVkP51EUt:L/462mykLxkpp3odgHVxdtd5da4nvuSy
MD5:	A49801879184C9200B408375FC4408D7
SHA1:	763231BD9B883692C0E5127207CBFC6A2A29BC7D
SHA-256:	397A3AF716EB7F0084F3AA04AD36EAB82AAB881589A359E7D6D4BE673E1789A8
SHA-512:	F408203907594AFA116A2003D0B65D77C9BCA47663F7F6B26E9158B91DAD40569E92851BF788A39105298561F854264A8DC57611637745E04E68585B837702F2
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 4.07 : Nicolas Sierro.; 9.07 : Philippe Berthault.; 15.14 : Sylvain St-Amand (SSTSylvain).; 22.00 : 2022-06-09 : Lolo S..; 23.01 : 2023-12-20 : Denis G (Need74).; 24.04 : 2024-04-29 : Lolo S..;.;.;.;.;.0.7-Zip.French.Fran.ais.401.OK.Annuler....&Oui.&Non.&Fermer.Aide..&Continuer.440.Oui pour &tous.Non pour t&ous.Arr.ter.Red.marrer.&Arri.re-plan.P&remier plan.&Pause.En pause..tes-vous sur de vouloir annuler ?.500.&Fichier.&.dition.Affic&hage.Fa&voris.&Outils.&Aide.540.&Ouvrir.Ouvrir dans le gestionnaire &7-Zip.Ouvrir dans l'Explorateur Windows.&Voir (hexa).&.dition.Reno&mmer.&Copier vers....&D.placer vers....S&upprimer.Diviser le &fichier....&Fusionner les fichiers....P&ropri.t.s.Comme&ntaire....Somme de contr.le.Comparaison des diff.rences (Diff).Cr.er un dossier.Cr.er un fichier.&Quitter.Connexion.Flux &alternatif.600.S.lectionner &tout.D.s.lectionner to&ut.&Inverser la s.lection.S.lectionner....D.s.lectionner....S.lectionner par type.D.s.

C:\Program Files\7-Zip\Lang\fur.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	7113
Entropy (8bit):	4.969992127036655
Encrypted:	false
SSDEEP:	192:M7Bz8oq24hcsQzhPDu1FnweRCV2RnnfI9Mw2yzryIclVXPWMcg:M7Bz7wcse7uvFFnQMw2yzryIgXP3cg
MD5:	06B08FE12C0F075D317CF9A2A1DD96BC
SHA1:	0062BA87B9207536B9088E94505D765268069F63
SHA-256:	6BA88938C468E7217BD300B607D7A730530E63D1F97562604EC0BB00D66A06C9
SHA-512:	9F9FB1C045D92C1F8035D547554457E3466AE861A04F1CD3F57965E4A92F0FC433B2A7B3E9E1E71588E97F8C73D5914A750DEDED5D3056E327D7EFE19A220198
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 4.60 : Andrea Decorte (Klenje) : secont l'ortografie ufici.l de Provincie di Udin.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Friulian.Furlan.401.Va ben.Scancele....&S..&No.&Siare.&Jutori..&Continue.440.S. &a ducj.No a &ducj.Ferme.Torne a invi..&Sfont.P&rin plan.&Pause.In pause.S.stu sig.r di vol. scancel.?.500.&File.&Modifiche.&Viodude.&Prefer.ts.&Imprescj.&Jutori.540.&Viar..Viar. dentri 7-&Zip.V&iar. f.r di 7-Zip.&Mostre.M&odifiche.Gambie &non.&Copie in....M.&f in....&Elimine.&Div.t file....Torne a &un. files....P&ropiet.ts.Comen&t.Calcole so&me di control..Cree cartele.Cree file.V&a f.r.600.Selezione d&ut.&Deselezione dut.&Invert.s selezion.Selezione....Deselezione....Selezione par gjenar.Deselezione par gjenar.700.Iconis &grandis.Iconis &pi.ulis.&Liste.&Detais.730.Cence ordin.Viodude plane.&2 panei.Sbaris dai impresc&j.Viar. cartele princip.l.Parsore di un nivel.Storic des cartelis....&Atualize.750.Sbare dai imprescj par l'archivi.Sbare dai imprescj sta

C:\Program Files\7-Zip\Lang\fy.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	6029
Entropy (8bit):	4.993685353064603
Encrypted:	false
SSDEEP:	96:TqjTBrLVXTzyIu8alVMSv5FbPtnG5kSksLzJ94KoD0vL0L5nsseiF3F3NPYrAE6g:Y1HyOmX5pPtnMzkYJ9HoD00xNPEAErS8
MD5:	03D38F09189799A0D927727D071C54B6
SHA1:	17FF3A2C83E6A0B0733F2A9A8CE6B83AF4F1B137
SHA-256:	C1C050ED6FE2F8FBC048FD7D82944B8ADA784415B6E62316D590C3C7AA45E112
SHA-512:	E511C1A271A3D78CB7F6111759EEC4D7CFC2D46F71F87AA3C4AC1BB11CD4E55E7D4DBE54F9C5107025FFE8C5FCADAD4359DC673BC802B82388E74A8F2FA60FF7
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 4.53 : Berend Ytsma.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Frisian.Frysk.401.Okee.Ofbrekke....&Jawis.&Nee.&Slute.Help..&Ferfetsje.440.Jawis foar &Alles.Nee foar A&lles.Stopje.Opnij begjinne.&Eftergr.n.&Foargr.n.&Skoftsje.Skoft.Binne jo wis dat jo .fbrekke wolle?.500.&Triem.&Bewurkje.&Byld.B&l.dwizers.&Ark.&Help.540.&Iepenje.Iepenje &yn.Iepenje b.&ten.&Byld.&Bewurkje.Omne&ame.&Kopiearje nei....&Ferpleats nei....&Wiskje.Triemmen &spjalte....Triemmen Kom&binearje....E&igenskippen.Komme&ntaar.Kontr.lesom berekenje..Map meitsje.Triem meitsje.U&tgong.600.&Alles selektearje.Alles net selektearje.&Seleksje omdraaien.Selektearje....Net selektearje....Selektearje neffens type.Net selektearje neffens type.700.Gru&tte Ikoanen.L&ytse Ikoanen.&List.&Details.730.Net Sortearre.Platte werjefte.&2 Panielen.&Arkbalke.Haadmap iepenje.Ien nivo omheech.Maphistoarje....&Ferfarskje.750.Argyf arkbalke.Standert arkbalke.Grutte knoppen.Knoptekst sjen litte.800.Map oan bl.dwizers &taheakje as.

C:\Program Files\7-Zip\Lang\ga.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	7906
Entropy (8bit):	4.861128874829787
Encrypted:	false
SSDEEP:	192:ggtTHAKaGSwSssr6JRiCJHAnJVsNO1vjGlXl58jmFsjGJZv:gM0j56fuXjol
MD5:	236CFC435288002763C68C4BBEE7B39D
SHA1:	E74A2402C2CB744DBED8AC1C2154FB1DE38148F9
SHA-256:	B18730124208D26E5E88B76BB99985BF61938D7A994B626B2DE5230557D2D8DD
SHA-512:	FA6941594454CDA55E081F15F367F430559849D218895B0B157A2204E8B30AE95DB99C62981A9C30A152A63D1BDB8EDD975BF06EE5ADF1F31B42A2C10CF11580
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 9.07 : Sean.n . Coist.n.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Irish.Gaeilge.401.T. go maith.Cealaigh....&T..&N.l.&D.n.Cabhair..&Lean ar aghaidh.440.T. do gach ceann.N.l go gach ceann.Stad.Atosaigh.&C.lra.&Tulra.&Cuir ar sos.Ar sos.An bhfuil t. cinnte gur mian leat . a cheal.?.500.&Comhad.&Leagan.Am&harc.Cean.in.&Uirlis..&Cabhair.540.&Oscail.Oscail &istigh.Oscail &lasamuigh.&Amharc.&Eagar.Athainmnigh.&Macasamhlaigh go....&Bog go....S&crios.Scar an comhad....Cumascaigh na comhaid....Air.onna.N.ta tr.chta.R.omh an tsuim sheice.la.Diff.Cruthaigh fillte.n.Cruthaigh comhad.&Scoir.600.Roghnaigh &uile.D.roghnaigh uile.&Aisiompaigh an roghn.ch.n.Roghnaigh....D.roghnaigh....Roghnaigh de r.ir cine.l.D.roghnaigh de r.ir cine.l.700.&Deilbh.n. m.ra.&Deilbh.n. beaga.&Liosta.&Sonra..730.Neamhaicmithe.Gach rud in aon chiseal.&2 fhuinneog.&Barra. na n-uirlis..Oscail an fr.amhfhillte.n.Suas fillte.n amh.in.Oireas na bhfillte.n....Athnuaigh.750.Barra

C:\Program Files\7-Zip\Lang\gl.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	9099
Entropy (8bit):	4.918696837936453
Encrypted:	false
SSDEEP:	192:1W7Uw+zTCaVpRBbpgoeCb4wdHSYz2NufjbJTQewnpy:14N+zNpbbpgw4wdHxtXlipy
MD5:	6CD7C2B4D6BBA163B1623035FEB4297D
SHA1:	5DF07BCFD1EDBD448B566AEA5789EF251303DE69
SHA-256:	9280AB90261B0C8F206EEF7196D7531E4E4932C9174AB899CEE4F8ED97CC87C6
SHA-512:	7ED13085EBC2545B434F5671F958F7A5FAA1BC29F7C10721A972AFD2C886FC39F0A6E290E70F1F8EA798199CA26974257EAF9B8445652C9B02C789E198191A3E
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 3.12 : 2007-11-22 : Xos. Calvo.; 9.20 : 2014-11-26 : enfeitizador.; 15.00 : 2016-02-01 : enfeitizador.; 22.00 : 2023-05-13 : enfeitizador.;.;.;.;.;.;.;.0.7-Zip.Galician.Galego.401.De acordo.Cancelar....&Si.&Non.Pe&char.Axuda..&Continuar.440.Si &a todo.Non a &todo.Parar.Reiniciar.Po.er por de&baixo.Traer ao &fronte.&Pausa.Pausado.Queres cancelar?.500.&Ficheiro.&Editar.&Ver.F&avoritos.Ferramen&tas.A&xuda.540.&Abrir.Abr&ir dentro.Abrir &f.ra.&Ver.&Editar.Cambiar no&me.&Copiar a....&Mover a....&Eliminar.&Dividir ficheiro....Com&binar ficheiros....P&ropiedades.Come&ntario....Calcular suma de verificaci.n.Diferenzas.Crear cartafol.Crear ficheiro.Sa&.r.Ligaz.n.&Alternar fluxos.600.Seleccion&ar todo.Desmarcar todo.&Inverter selecci.n.Seleccionar....Desmarcar....Seleccionar por tipo.Desmarcar por tipo.700.Iconas lon&gas.Iconas &mi.das.&Lista.&Detalles.730.Sen orde.Vista plana.&2 paneis.Barras de ferramen&tas.Abrir cartafol ra.z.Subir un nivel.Hist.rico de carta

C:\Program Files\7-Zip\Lang\gu.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	17365
Entropy (8bit):	3.8616190133381947
Encrypted:	false
SSDEEP:	384:OOt7VWp6MKgd259LNca7DK2Br5Pyl2/2Z/2oVXBH1K2xSGK/v2eHOv2E2lgJVOqc:OQ15KZeGK/nJ
MD5:	93CDC8832328A22E198920630D597268
SHA1:	315E5B1C77FB4E2D0C3CC1F48B6DB4C79CE9488A
SHA-256:	C6E54E2A93B821BC974209CD7E2D10E9FBC4FF07D238AE84F552E4ADE271702C
SHA-512:	E8355A42F3A3B5F21D5D4C7A21324433C997AD39412B3BCDCF26EDBD5EF882179168B2B5618F9FE631B88407608AB1A83BF139DB05C09B608FDDF01694B710DF
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 9.07 : Vinayy Sharrma : .... ..... ...... .........;.;.;.;.;.;.;.;.;.;.0.7-Zip.Gujarati, Indian, ....................401...............&....&...&... .........&.... .....440.&... .... ....&... .... ............ .... ....&...........&........(.........).&.................... .... .... .... ... ... .... .... ..?.500.&......&.......&......&.......&.....&....540.&.....&.... .....&.... .....&......&.......&...: .......&... ... .........&... .. ...

C:\Program Files\7-Zip\Lang\he.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	10909
Entropy (8bit):	3.91308688355158
Encrypted:	false
SSDEEP:	192:v4MfocCqKNXU9shxj5fLniD65MfiZNUsQWzrSt3v+YGqzCoy8aMN:vzo5qK1U9sZfLiD65Mfip8vJzCoGu
MD5:	0771F160D56B1890A1CDC2CA040D2616
SHA1:	36E69202682BF6993273B521424EC082998F6CA9
SHA-256:	03B4EA89CCE3AA4193A7E3E1E6180DAB8359388DF3B574379935EA39D7B8D723
SHA-512:	B452C75292C7D365AA5759FB3F49DE674255E839CAA687436474B782F615B2AD86A11A58809A5BB60115B070C9B738A461DB24E70502598A3BFECCF373220DBB
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; : peterg.; : Gal Brill.; 9.13 : 2010-04-30 : Jonathan Lahav.; 19.00 : 2020-05-01 : ION.;.;.;.;.;.;.;.0.7-Zip.Hebrew.......401............&...&...&...........&.....440... .&..... &............. .....&....&......&...........?.. ... .... .... .... .....500.&.....&......&......&........&......&....540..&...... .&........ .&....&....&.....&... .......&. ......&.. ...&.......&. ......&... ......&............&...... ..... ................. .......... .....&..........&..... ........600.... &....... ..... ....&.... ............... ......... ... ....... ..... ... ....700........ &.............. &....

C:\Program Files\7-Zip\Lang\hi.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	17467
Entropy (8bit):	3.84721481389097
Encrypted:	false
SSDEEP:	384:wNAsf6IflsHX7q4IqKz+QCzaRDuAlTz8tw2+xE3ZAXsF:wjDGGeF
MD5:	18D9C82F12E07B71E03D6086DEBA0DC3
SHA1:	C6C11C6F1FC00A25DD53E1C78F207F6C8C8B8B13
SHA-256:	5F79AE167A917860F95F73E5ED007FE250F30AF794BCFCE17941F9EF87D22A05
SHA-512:	196A859D52A1A742B98460EAF113552DCE2CFC63378B19D2902BEABC1E66CBD9E26BF37FC26453832AA10929AAF0196ED9211332E63C830B0E5946013C82BDC1
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 9.07 : Vinayy Sharrma : ...... .... ......;.;.;.;.;.;.;.;.;.;.0.7-Zip.Hindi, Indian, ...................401.... ...........&....&.....&... .........&.... ....440.&... .. .... ....&... .. .... .............. .... .....&...........&........(.........).&..................... .... .... ..... ... ....... .... .. ....?.500.&.....&.......&......&.......&.....&....540.&.....&.... .....&.... .....&......&.......&...: .......&... ... .........&... ..

C:\Program Files\7-Zip\Lang\hr.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	8122
Entropy (8bit):	5.01235026127091
Encrypted:	false
SSDEEP:	192:rhhdCkj7itccEuzIS1xTXiV8JBLRsusqrKhI:Vh/jfLupi+l1sqrKhI
MD5:	9D8216183493AC2190A4D6E142ECAB9A
SHA1:	E534EBB714DBAE2A9E12ACCBE96C6F2568B814C4
SHA-256:	210AF273246D30CFDE87295CD5F4FF135B0BDFB04FE7173BB60F935E685B8E10
SHA-512:	5B56560AD70652C9C6287F939B25676D8149C000C2388365197354DBE38C5CBA5C25F0A3A529F0601A5B5D964B7278AB3A668E8469CF0EC718821FDABCF044BC
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 3.12 : Alan .imek.; 4.53 : Hasan Osmanagi..; 9.07 :.; 15.05 : 2015-06-15 : Stjepan Treger.;.;.;.;.;.;.;.0.7-Zip.Croatian.Hrvatski.401.U redu.Odustani....&Da.&Ne.&Zatvori.Pomo...Nastavi.440.Da za &Sve.Ne za Sv&e.&Stani.Ponovi.U pozadini.U prvom planu.&Pauza.Pauzirano.Poni.titi?.500.&Datoteke.&Ure.ivanje.&Izgled.Omiljene mape.&Alati.&Pomo..540.&Otvori.Ot&vori mapu.Otvori u &sustavu.Iz&gled.&Ure.ivanje.Prei&menuj.&Kopiraj u....Premje&sti u....O&bri.i.Podije&li datoteku....Spo&ji datoteke....Svojs&tva.Komentar.Izra.un kontrolnog zbroja.Uspore.ivanje.Stvo&ri mapu.Stvori &datoteku.&Izlaz.Poveznica.&Alternativni tokovi.600.Odaberi &sve.Poni.ti odabir.&Obrni odabir.Odaberi....Poni.ti odabir....Odabir po tipu.Poni.ti odabir tipa.700.&Velike ikone.&Male ikone.&Popis.&Detalji.730.Neso&rtirano.Sadr.aj mapa.&2 okna.Alatne &trake.&Korijen.&Nadmapa.Pro.&le mape....O&svje.i.Automatski osvje.i.750.Alatna traka arhiva.Standardna alatna traka.Velike tipke.Prika.

C:\Program Files\7-Zip\Lang\hu.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	10373
Entropy (8bit):	5.237599190210729
Encrypted:	false
SSDEEP:	192:KnufEtXpRc/oaLZ8VK8Am3+JHSacVeRU6i1M2YqpXn6StxERV/NIlLPNJxv:+VXpbavxJHSaqeRUd1vYqpXnxtSRV/2b
MD5:	A41E4D16C3B29603832FFD1BBB82283E
SHA1:	15695A0BD98D429E9AB191CECB185B70CC492668
SHA-256:	486A382483096E9A86CCF6CA02123E48025DE5055F1880AF7F001C5C3FA25114
SHA-512:	413DD8C87015EDE7868F992C25D568DE66E1BD765C7A43066D8DA8CF350F3620C77091F075020862FF6BF7C980C6091E92C5C843B3D57957C7516F5B0F51BCA0
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; : Jozsef Tamas Herczeg.; 9.16 : Nyilas MISY.; 15.00 : 2021-11-09 : Barnabas Kovacs.; 22.01 : 2022-07-15 : John Fowler.; 24.05 : 2024-05-16 : John Fowler.;.;.;.;.;.;.0.7-Zip.Hungarian.Magyar.401.OK.M.gsem....&Igen.&Nem.&Bez.r.s.S.g...&Folytat.s.440.I&gen, mindre.N&em, mindre.Le.ll.t.s..jraind.t.s.&H.tt.rben.&El.t.rben.&Sz.net.Sz.neteltetve.Biztos, hogy megszak.tja a folyamatot?.500.&F.jl.S&zerkeszt.s.&N.zet.Ked&vencek.&Eszk.z.k.&S.g..540.M&egnyit.s.Megnyit.s &bel.l.Megnyit.s k.&v.l.&F.jl megtekint.se.S&zerkeszt.s..tn&evez.s.M.s&ol.s mapp.ba.....t&helyez.s mapp.ba....&T.rl.s.F.jl&darabol.s....F.jl&egyes.t.s....T&ulajdons.gok.&Megjegyz.s.Checksum sz.mol.sa.K.l.nbs.g.Mappa l.trehoz.sa.F.jl l.trehoz.sa.&Kil.p.s.Link.Alternat.v adatfolyam.600.Min&d kijel.l.se.Kijel.l.s megsz.ntet.se.Kijel.l.s &megford.t.sa.Kijel.l.s....Megsz.ntet.s....Kijel.l.s t.pus alapj.n.Megsz.ntet.s t.pus a

C:\Program Files\7-Zip\Lang\hy.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	13636
Entropy (8bit):	4.268145853042887
Encrypted:	false
SSDEEP:	192:jdJl7z7sBsCD6dowOkSMVBVm6WymLJaOQjKOMI:jdJl/7NC2oofVmGoJBQjiI
MD5:	FE73C2AACF07D5120AEDD08792CB8268
SHA1:	2C6E7D2FF42C5F65EF5F4C27600819354CAA03B0
SHA-256:	91AAC9368BD116AB11FDA0B70EE4D75911A65713A272A3BA55D1435C33250F5A
SHA-512:	79DBD84FE71888B7C9FDBCD23F2D4735F731E3C2C7724FBD531C3CA531B1992E756B13B66889AF30EC46770D350FCFAEF2D7ABE607594A2B4B92F60ED326D537
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; : Gevorg Papikyan.; 15.00 : Hrant Ohanyan.;.;.;.;.;.;.;.;.;.0.7-Zip.Armenian.........401.................&....&...&..................&...........440.... ...... &........ ...... &..........................&..............&........&............ ... ............500.&.....&.........&.....&............&.........&...........540.&........... &............. ...&...........&............&........&............&.............&............& ..........&....... ...............&................&..................................&....... ..............&... ........&.........&.............. ......

C:\Program Files\7-Zip\Lang\id.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	8739
Entropy (8bit):	4.85314782964051
Encrypted:	false
SSDEEP:	192:oO2E+zHrES/JnUR4TZnN627GyZbrstpaX+XTCsn:T2E+zHrESxURKZnNh91stpaPsn
MD5:	BA3591CCF26438CBE93E9C1D56BD1818
SHA1:	758619A702D5A0794E4412AA6AE93FC46EA3DFB9
SHA-256:	90308689870AD079E1206A877157F7389BC4351A6B104FFA2BD9311409D6D92D
SHA-512:	2E9066BD733CAAA9CEDDE2346BE543D4360BD796E01BCB669602C9E6450CA5A2718CB67613469C11A4D2AA8C458D7FE9C59AB8EB9BDE39846C195CE2CC22686B
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 24.04 : 2024-05-13 : FranZo.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Indonesian.Bahasa Indonesia.401.Oke.Batal....&Ya.&Tidak.&Tutup.Bantuan..&Lanjut.440.Ya untuk Semu&anya.Tidak untuk S&emuanya.Stop.Start Ulang.Latar &Belakang.Latar &Depan.&Jeda.Dijeda.Anda yakin ingin membatalkan?.500.&Berkas.&Edit.&Tilik.&Favorit.&Peralatan.Bant&uan.540.B&uka.Buka di &Dalam.Buka di &Luar.&Tilik.&Edit.&Nama Ulang.&Salin Ke....&Pindah Ke....&Hapus.Be&lah Berkas....&Gabung Berkas....P&roperti.K&omentar....Hitung checksum.Beda.Buat Folder.Buat Berkas.&Keluar.Tautan.Aliran Alternati&f Aliran.600.Pilih Semu&a.Batal Pilih Semua.P&ilih Sebaliknya.Pilih....Batal Pilih....Pilih berdasarkan Tipe.Batal Pilih berdasarkan Tipe.700.Ikon &Besar.Ikon &Kecil.Da&ftar.&Detail.730.Tidak Diurutkan.Tilik Datar.&2 Panel.Bilah Perala&tan.Buka Folder Akar.Naik Satu Tingkat.Riwayat Folder....&Segarkan.Segarkan Otomatis.750.Bilah Alat Arsip.Bilah Alat Standar.Tombol Besar.Perlihatkan Teks Tombol.800.&Tambah folder ke F

C:\Program Files\7-Zip\Lang\io.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	4604
Entropy (8bit):	4.906610885989285
Encrypted:	false
SSDEEP:	96:PkmgliBaKNUnQpg1uw7okwiPJ3npCW+71SwHel5Lt/8QNjyaKfO:PzBaF/1ukoMPZwn7gwHelNt/8QNjya+O
MD5:	0861AE63DA2D00590369BB11B3857551
SHA1:	8272F4761A3F2ACA2BFAEC6FCF08C82A9F36A65A
SHA-256:	B87A4FCA8A0024A915AE86E36951CB7CEA442948D9982D4247E49492445BA664
SHA-512:	70997D6775E1C91D021FDA2143C831FE8396094E50337DA3C4897DA70636B7F10B363F35B997213A462B467FE6754D2C33E009E84363063ECED871A2591CCE88
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 4.08 : iZoom.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Ido.Ido.401.B&one.Abandonar....&Yes.&No.&Klozez.Helpo..&Durez.440.Yes por &omni.No por o&mni.Haltez.Ristartez.&Fono.&Avanajo.&Pauzo.Pauzita.Kad vu ya volas abortar?.500.&Dosiero.&Redakto.&Aspekto.&Favoraji.&Utensili.&Helpo.540.&Apertigar.Apertigar int&erne.Apertigar e&xter.&Vidigar.&Redaktar.Ch&anjar nomo.Ko&piar aden....Transp&ozar aden....E&facar.F&endar dosiero....Komb&inar dosieri....In&heraji.Ko&mentar...Krear &dosieruyo.Krear dos&iero.E&kirar.600.Merk&ar omno.Des&merkar omno.&Inversigar merko.Merkar....Desmerkar....Merkar segun tipo.Desmerkar segun tipo.700.&Granda ikoneti.&Mikra ikoneti.&Listo.&Tabelo.730.&Nearanjite..&2 paneli.Utens&ila paneli.Apertigar radika dosieruyo.Ad-supre ye un nivelo.Dosieruya historio....R&inovigar.750.Utensila panelo di arkivo.Norma utensila panelo.Granda ikoneti.Videbla butontexto.800.&Adjuntar dosieruyo ad la favorata quale.Lektomerkajo.900.&Ajusti....&Experienco dil rapideso.960.&Konte

C:\Program Files\7-Zip\Lang\is.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	8251
Entropy (8bit):	5.19488137916907
Encrypted:	false
SSDEEP:	192:IHrcQOp6UkYC3kMQVtxXYrqYlMtiMeQIFTYENLlr7mAzNtcjpuqd/WWQse:IH3OpXBUMeQIFTYGr9NtycmW
MD5:	C8F31D6ADEE368CA0AA00350DF0D82DF
SHA1:	4146C7C62DD46B2C43C92CDF33E45FA7E2272D04
SHA-256:	DC61090369E1269A68C75E472D863AAF42207F702B3D3E12CA48D2852E1478E3
SHA-512:	758AF54A33DC243992324974F01707C8027BE7BDC7D07187A28038F4C9D8F7681D989B66F56A13B86E99C8BC74D80A70FA44BD5DD9532C99B78DF7985B397ED8
Malicious:	false
Preview:	;!@Lang2@!UTF-8!.; 19.02 : 2019-11-12 : Stef.n .rvar Sigmundsson.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Icelandic..slenska.401.. lagi.H.tta vi.....&J..&Nei.&Loka.Hj.lp..&Halda .fram.440.&J. vi. .llu.&Nei vi. .llu.St..va.Endurr.sa.&Bakgrunnur.&Forgrunnur.&Gera hl... hl.i.Ert .. viss um a. .. viljir h.tta vi.?.500.&Skr..&Breyta.&Sko.a.&Upp.hald.&Verkf.ri.&Hj.lp.540.&Opna.&Opna a. innanver.u.&Opna a. utanver.u.&Sko.a.&Breyta.&Endurnefna.&Afrita .....&F.ra .....&Ey.a.&Klj.fa skr.....&Sameina skr.r....&Eiginleikar.&Gera athugasemd....Reikna samt.lu.Mismunur.Skapa m.ppu.Skapa skr..&H.tta.Tengill.&V.xlstraumar.600.&Velja allt.&Afvelja allt.&Umsn.a vali.Velja....Afvelja....Velja eftir tegund.Afvelja eftir tegund.700.&St.rar t.knmyndir.&Sm.ar t.knmyndir.&Listi.&Sm.atri.i.730..flokka..Flats.n.&2 spj.ld.&Verkf.rastikur.Opna r.tarm.ppu.Upp um eitt stig.M.ppusaga....&Endurgl..a.Sj.lfendurgl..un.750.Safnverkf.rastika.St..lu. verkf.rastik

C:\Program Files\7-Zip\Lang\it.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	9906
Entropy (8bit):	4.823682778375202
Encrypted:	false
SSDEEP:	192:0uk7PN270x4ndKLWwjJ8Y1+rUtOGj10KRuNnoyYe4Y8nEkglgSgZDaOIgmHqJ4V:GIwyeWtY1+AtOGRZyYe98EkglgSgZDaZ
MD5:	AA7B46B6DDD673BC06BD90187E552743
SHA1:	2C11A1E5F97AC1415073C2C953CD92018CF3EB93
SHA-256:	EFB1AED5C52AF731A733C720B6F5479898C9DE28367A5DE4C80F697FB745546A
SHA-512:	10C262122417B081D0403F9C917A4BEBA34078CA52E88478EBD2C0B6956AA6B61B34511FAC71E87578D56AE1F5ACDC265CDDAC8C92B9F14757DAA75042DFC7AA
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 4.07 : Leandro Spagnol.; : Vincenzo Reale (some corrections).; 15.05 : 2015-06-17 : TJL73.; 17.00 : 2017-02-01 : Massimo Castiglia.; 18.03 : 2018-01-15 : POLAR.; 24.04 : 2024-04-05 : TJL73.;.;.;.;.;.0.7-Zip.Italian.Italiano.401.OK.Annulla....&S..&No.&Chiudi.Aiuto..&Continua.440.S. per &tutti.No per t&utti.Arresta.Riavvia.&In background.&In primo piano.&Pausa.In pausa.Sei sicuro di voler annullare?.500.&File.&Modifica.&Visualizza.&Preferiti.&Strumenti.&Aiuto.540.&Apri.Apri in &7-Zip File Manager.Apri in E&xplorer.&Visualizza.Modifica con l'&editor predefinito.Rino&mina.&Copia in....&Sposta in....&Elimina.Sud&dividi il file....&Unisci i file....&Propriet..Comme&nto....Calcola chec&ksum.Comparazione differenze (Diff).Crea cartella.Crea file.E&sci.Collegamento.&Alternate Data Streams.600.&Seleziona tutto.&Deseleziona tutto.In&verti selezione.Seleziona....Deseleziona....Seleziona per tipo.Deseleziona per tipo.700.Icone &grandi.Icone &piccole.&Elenco.&Dettagli

C:\Program Files\7-Zip\Lang\ja.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	12387
Entropy (8bit):	5.313192066737636
Encrypted:	false
SSDEEP:	192:n4fuupdoCXs+8WFml8HKp2yj99UfdECKU/Gh6o:n4fuofsjrW5KmGh6o
MD5:	A0C7EB5D5A5DD7AB6F4C1E4FEF092256
SHA1:	F121129211DBEDBA3C440267FD9BD1C636E263C2
SHA-256:	9F70F1943A8E0A9B9040D1F769CA2494C2B83CEB8DC55B08DB1FC3E6973AD835
SHA-512:	F864C9AC99EDC97968FECA96919A412E87C27457F5E0A8956DCECF37351CE7AEAF0E745343A649743D665B46BE108B3CC5BAFD92029D25D5A5D9BF6C390E5149
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; : : Komuro.; : : Mick.; : : 2chBBS-software.; : : Crus Mitsuaki.; 9.23 : 2011-06-22 : nabeshin.; 22.00 : 2022-06-20 : Rukoto Luther.; 24.06 : 2024-06-15 : Stepanushkin Dmitry.;.;.;.;.0.7-Zip.Japanese.....401.OK............(&Y)....(&N)....(&C)........(&C).440......(&A).......(&L)................(&B).........(&F).....(&P)....................?.500.....(&F)...(&E)...(&V)......(&A)....(&T)....(&H).540...(&O).7-Zip ...(&I)........(&U)...(&V)...(&E)......(&M)....(&C)......(&M)......(&D).......(&S)..........(&B).........(&R).....(&N)..................................

C:\Program Files\7-Zip\Lang\ka.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	17799
Entropy (8bit):	3.496980139147961
Encrypted:	false
SSDEEP:	384:E1OSMW33zMcaSwOgS6YQ9g/t+25rTHTIa5OVBUPSIqGA:EttJhq
MD5:	C99E6572F5638599DBCA2CEAC337A320
SHA1:	73C64554A00C6D5A3DAB8A2E7BD50426D6C7B6F4
SHA-256:	8DD6073B585DD2E9D8CDD8E0FCE7DFEAF2F5A2D8BFC3059F67EAA3D8B5EB2D9E
SHA-512:	CDE3D44793D1ABAB3B8D0BA71D1AF85C7CA49B37F4331B43D546D1F2022FC9CEDD1188869ACEE5BF9B74046788DAF26F4E4658AF86663065339103D2A602F7AA
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 9.23 : 2011-09-25 : Translated by Giorgi Maghlakelidze, original translation by Dimitri Gogelia.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Georgian.........401.OK.............&.....&....&...................&...........440..... &............... ...&..........................&........&.... .......&.........&.................... ..... .......... ........?.500.&......&...........&......&........&............&..........540.&............. &............. ..&......&.............&......

C:\Program Files\7-Zip\Lang\kaa.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	7698
Entropy (8bit):	5.071278892240066
Encrypted:	false
SSDEEP:	192:KoAZ/jQKbqhsAdNrd6FBf9vQqiQw9aBhbHTYJsVOxTSv:KoANnYsgLqi+BBHMJssxWv
MD5:	FFC17520FB68FE464650B2F78E15AB5D
SHA1:	2B83034AC04640160DDAA8E797FAA5D8C80F956B
SHA-256:	24F7325271DD7AD2B63E977841D2F06ED0194BD9257F0DB460DF32BAEEEC4746
SHA-512:	4F1483796A8EF95B2BE61811A6566EA2E19564F37733647B6EB4E1C82A8DA8FA927AFDF024A247FC7E70088F63133A7843FE6129B77B2ADA01E39A1E814429C7
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 9.07 : Atabek Murtazaev.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Karakalpak - Latin.Qaraqalpaqsha - Lat.n.401.OK.Biykar etiw....&Awa.&Yaq.&Jab.w.Ja'rdem..&Dawam etiw.440.&Barl.g'.na awa.Ba&rl.g'.na yaq.Toqtat.w.Qaytadan baslaw.&Artq. fong'a.Ald.ng'. &fong'a.&Pauza.Pauza q.l.ng'an.An.q biykar etiwdi qa'leysizbe?.500.&Fayl.&Du'zetiw.&Ko'rinis.&Sayland.lar.A's&baplar.&Ja'rdem.540.&Ash.w.&.shinde ash.w.&S.rt.nda ash.w.&Ko'riw.&Du'zetiw.At.n o'&zgertiw.Bul jerge &nusqas.n al.w....Bul jerge ko'shiriw....O'shiriw.&Fayld. bo'liw....Fayllard. &biriktiriw....Sazlawla&r.Kom&mentariy....Qadag'alaw summas..Diff.Papka jarat.w.Fayl jarat.w.Sh&.g'.w.600.Barl.g'.n &saylaw.Saylawd. al.p taslaw.Saylawd. &teris awdar.w.Saylaw....Saylawd. al.p taslaw....Tu'ri boy.nsha saylaw.Tu'ri boy.nsha saylawd. al.p taslaw.700.U'&lken ikonalar.Kishi &ikonalar.&Dizim.&Keste.730.Ta'rtipsiz.Tegis ko'rinis.&2 panel.&A'sbaplar paneli.Derek papkas.n ash.w.Bir da'reje joqa

C:\Program Files\7-Zip\Lang\kab.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	8094
Entropy (8bit):	5.214957275203997
Encrypted:	false
SSDEEP:	96:C0DkhCKSxkMAluUHPTe9Dt2cVM9sefce+gELJvocyn01m6ptYMk0iLEkei2EW8pR:Ceod1y9DtX+9xVUJy05zk3f31D
MD5:	5AF10C5616E0487D236C8CBE2F23A7A4
SHA1:	2049E1A82A0AF13A8ED2CF9E4EB51F1DFD377480
SHA-256:	F249930089C374EAB59078CF16B8652D443CF2A47485D737AE5A9FCA2957D6B9
SHA-512:	8E2DB2769D8C9D4AF435986BC58F66F570C4D85BF7C8A2B9369F546CF45C0848A07986582E8E7F76A9AED569DA2774E5B19706EC77BFD41BB6B4AF86ABCFCEFE
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 15.00 : 2018-02-27 : Belkacem Mohammed.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Kabyle.Taqbaylit.401.IH.Sefsex....&Ih.&Uhu.&Mdel.Tallelt..&Kemmel.440.Ih i &Me..a.Uhu i M&e..a.Se.bes.Ales tanekra.&Agilal.&A.awas Amezwaru.&R.u.I.bes.Teb.i. ad tsefsxe.?.500.A&faylu.&.reg.&Sken.I&nurifen.&Ifecka.&Tallelt.540.&Ldi.Ldi deg &ugensu.Ldi di B&erra.&Sken.&..eg.Snif&el Isem.&N.el .er....&Senkez .er....&Kkes.&B.u Afaylu....Sdu&kkel ifuyla....A&ylan.Awenn&it....Timernit n Usenqed.Ice..iq.Snulfu-d Akaram.Snulfu-d Afaylu.F&fe..Ase.wen.&Alternate Streams.600.Fren &Me..a.Kkes Afran i Me..a.&Tti Afran.Fren....Kkes Afran....Fren s Tawsit.Kkes Afran s Tawsit.700.Tig&nitin Timeqranin.T&ignitin Time.yanin.&Tabdart.&Talqayt.730.Ur Yettwafren ara.Askan Imlebbe..&2 Igalisen.&Ifeggagen n Ifecka.Ldi Akaram Agejdan.Yiwen Uswir d Asawen.Amazray n Ikaramen....&Smiren.Asmiren Awurman.750.Afeggag n Ifecka U.ba..Afeggag n Ifecka Alugen.Tiqeffalin Tihrawanin.S

C:\Program Files\7-Zip\Lang\kk.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	10328
Entropy (8bit):	4.601143849904046
Encrypted:	false
SSDEEP:	192:y/vuZGpufsiAAsiNSFT5JD7HahEPpBwwKOAmiyUSbD0A:y/vuZGMfjzRNGGhEP8DXyUSX0A
MD5:	407130A212CFAC68FA4873B0381B2CB1
SHA1:	C0C9B84CC79619D27536E9F50F25D81237B234D3
SHA-256:	F813EAC0B284EDCE156DD1E6B7EA75B027F4342E04D8B8DB1131894A227A4562
SHA-512:	E80AFDF726CCC5D495F62A9B289EE31703F151EA01EBA32AD7D2DA306C2C07DE2F9049DC6592C3C962B7CC2CBE352B8B7A19E9DBCF7B3C6B61DCC4026B70C151
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 9.07 : Arslan Beisenov, Arman Beisenov.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Kazakh.........401......................&...&....&...............&...........440....... &......... &................. .... .....&......&....... .........&.......................... ....... ..... ..?.500.&.....&......&........&..........&......&.........540.&.......... &............ ..........&........... .....&..........&...........&.......... ................... ...........................&................. .......Diff.&..... .......... ...........600...... ..................... ........&........... ...................

C:\Program Files\7-Zip\Lang\ko.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	10267
Entropy (8bit):	5.605372926696787
Encrypted:	false
SSDEEP:	192:X4S/0htQjcT2DFzg6Whd4FV6SLRVLrbqvTp4kCs1qeb:P/0ht0cT2DNyh2FJFVLPW4+ok
MD5:	E85AE412871344211D00326D3DF2534D
SHA1:	4A770EEE2EF9F302B8190C8BBE3988A5D7C90E5E
SHA-256:	3EA103FFD2FF97E211C7ADE3A79A882B494FE416BC56BD05F42F2E82158A7A03
SHA-512:	09EABFA3997F201F8402DC803319EE0DDC4007EF268AD44309FE78F9E2710D1A10930F2E89F2C0B201D1094C53F5CB7783E492503EB4737B2E3FDC1F39B69EF6
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; : ZannyLim (...).; : bzImage.; 4.52 : Hyeong il Kim (kurt Sawyer).; 9.07 : Dong-yoon Han (...).; 15.12 : Winterscenery (Ji-yong BAE).; 24.05 : Winterscenery (Ji-yong BAE).;.;.;.;.;.0.7-Zip.Korean.....401...........(&Y)....(&N)...(&C)........(&C).440... .(&A)... ...(&L)...... .........(&B)... ...(&F).....(&P).......... ........?.500...(&F)...(&E)...(&V).....(&A)...(&T)....(&H).540...(&O)... ..(&I)... ..(&U)... ..(&V)...(&E)... ...(&M)...(&C)......(&M)......(&D)... ..(&S)...... ..(&B)......(&R)...(&N)....... ........ ...... ......(&X)...... ...(&A).600... ..(&A)... .. ..... ..(&I)......... ......... .....

C:\Program Files\7-Zip\Lang\ku-ckb.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	11933
Entropy (8bit):	4.4743589010781175
Encrypted:	false
SSDEEP:	192:FxV9LYmQ441Ye2LFuoWSD8T+srvk2VWpfLEwAcADwoA2FwP8PCsucC6LvS4tKs4f:Qml14LThvcpf+A2Fpg7Gip
MD5:	8C3F9AD9C824DCF74A09C9D406DB22E7
SHA1:	0C683BB56A13C3FBCA664F1E4C6C98D0F7AEC8BC
SHA-256:	B8B7DB8C139B19D414CEF35AE96D854D5A8364C32B0C3FDC4CAC331B5AF44C16
SHA-512:	DA33D4098679A14D2F434221EF968951407727126B12404C8B6C3E2AD6FA346D9D515DEA940F9109D5D196E648583124F31A1D27CF518AB19E3DCAD673C027CF
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; : Ara Bakhtiar.; 4.66 : Ara Qadir.;.;.;.;.;.;.;.;.;.0.7-Zip.Kurdish - Sorani.......401.......................&.....&......&................&.............440..... .. &........... .. ..&...........................&...........&.........&....................... .. ...............500.&.....&.........&.......&..........&...........&........540.&............... ..&... ............ .. &.......&......&.........&.........&............ ......&......... ......&........&........ .........&...... ....... ............&..................&............. checksum............ ................ .......

C:\Program Files\7-Zip\Lang\ku.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	5370
Entropy (8bit):	5.1403349462862655
Encrypted:	false
SSDEEP:	96:TF4kLCz94zsWXCgceerMLYVX0r/TL9PWE8OLBMTUgJiRNJ5zBD0N+VrmifAAec1T:94m3CjrMLY+LNPwOJgJiRj0tgAXc1jv
MD5:	28E69DD6E397FA98C07088E4CDBEF1F4
SHA1:	56E4A46B5C7360F609683562E617C75C28CD447C
SHA-256:	57AE544F3F9E8BF5D96CE1F9CFE5648EB6C1E2F5604DA6EB0C80AE24BC1A40D7
SHA-512:	6BDE04F3BBD42E73EA3E0A93E8EF69149F25DAE491051D1655A85718AF4D51F5247C610D87C20227F94BEEEBA038D54F7B213B0443382D080E87722485941AAE
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 4.37 : Rizoy. Xerz..;.;.;.;.;.;.;.;.;.;.0.7-Zip.Kurdish.Kurd..401.Temam.Betal....&Er..&Na.Bi&gire.Al.kar...Bi&dom.ne.440.&Ji Bo Hem.y. Er..Ji &Bo Hem.y. Na.Raweste.D.sa Destp.ke.L%i Pi.t.Li &P...&Rawest.ne.Rawestiya -.Ma bila betal bibe?.500.&Dosya.&Bipergal.ne.&N..an Bide.Bi&jare.&Am.r.A&l.kar..540.&Veke.&Di Panel. De Veke.Di &Pacey. De Veke.&N..an Bide.&Sererast bike.&Navek. N. Bid..&Ji Ber Bigire.B&ar Bike.J. B&ibe.Par.e Bi&ke....Bike &Yek....&Taybet..Da&xuyan..checksum heseb bike..Pe&ldankeke N..Do&siyeke N..De&rkeve.600.&Hem.y. hilbij.re.He&m. hilijartin. rake.Be&revaj. w. hilbij.re.&Hilbij.re....Hilbijarti&n. Rake....V. curey. hilbij.re.Hilbijartina cure rake.700.&Daw.r.n Mezin.D&aw.r.n Bi..k.&L.ste.&H.ragah..730.B. Dor.xuyakirina sade.&2 Panelan veke.Da&rik. am.ran.Peldanka Kok Veke.Astek. Berjor.D.roka Peldank.....&N. Bike.750.Darik. ar..v..Darik. standart.Bi.kojk.n mezin.Bila niv.s

C:\Program Files\7-Zip\Lang\ky.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	12052
Entropy (8bit):	4.593559236039092
Encrypted:	false
SSDEEP:	192:EVt6Fm0NMfdCluobJcX4/xBjnBmeevaMHYXk8ogjES+UntpdLCKmYcBp7a:EVSm0NMfdClucJcX4/xBVmKM4Xk8oJSj
MD5:	E50C04D913DC92251AA6781C02E0BD45
SHA1:	57E68C80B23A9B1BD689CCD81CBCD91E0CAE6AAC
SHA-256:	9A9E4DDACC494EAAA386F1220837020F332A49E7FFF7F0BF8C38C847390DAB18
SHA-512:	C428CAF314F79D533246CEE4015411102ED836D0173F67F3B2F4C61C3F3F81BE7FB2FFF7D3E863E999617BA05FD6F7FEF4B67CFF8557E1D0C86035ED29DAA2CE
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 9.20 : Kalil uulu Bolot.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Kyrgyz..........401.OK..........&.....&....&..............&........440..... &........... .&...... ................ ........&......&....... .......&..................... ... ... .......... ........... ..... ......?.500.&.....&......&.....&...........&......&.......540.&........&... ..........&... ...........&................& .........&.... ...........&.... ..... ...........&.........&... ...............&........ ............&..........&................. .........Diff.&...... ...........&. .........&.....600....... .&..............

C:\Program Files\7-Zip\Lang\lij.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	7471
Entropy (8bit):	4.976709314177123
Encrypted:	false
SSDEEP:	192:21Oo14rh/0lXjPqDp2h+O0k2r/2T7tQpl:21OoqUDureT7tQpl
MD5:	58FF044FE195453F797DD1AC6903ABF9
SHA1:	4B8DAE21DD14AC6DAA1DECF804336A1AAE169AA9
SHA-256:	D9BB6BFC127938C47B43290241378887085314AD1326095934A362CD9836B560
SHA-512:	861300FE39FF0DACA00B4CB56C4075AFBA2BB3A1654BCF35713251237630206F06BC63D7F339ECFF040C9EA1F5B7094A11FE57C5848E91DB9000F48D166AB1BE
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 9.07 : GENOVES.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Ligurian.Zeneize.401.D'ac.rdio.Anulla....&Sci.&No.S.&ra.Agiutto..&Continoa.440.Sci pe &Tutti.No pe T&utti.Ferma.Inandia torna.Into &sfondo.&In primmo cian.&Paoza.In paoza.Ti . seguo de voei anul.?.500.&Archivio.&Modifica.&Vixoalizza.&Preferii.&Strumenti.A&giutto.540.&Arvi.Arvi into Manezat. d'archivi 7-Zip.Arvi inte Explorer.&Vixoalizza.&Modifica.Ri&nomina.&C.pia inte....&Sp.sta inte....Scancel&la.&Dividi l'archivio....&Unisci i archivi....P&ropiet..Comen&ta....Calcola somma de contr.llo.Dif.Crea cartella.Crea archivio.Sc&i.rti.600.Sele.ionn-a &tutto.Desele.ionn-a tutto.In&verti sele.ion.Sele.ionn-a....Desele.ionn-a....Sele.ionn-a pe tipo.Desele.ionn-a pe tipo.700.Figue &grende.Figue picinn-e.&Listin.&D.ti.730.Nisciun ordine.Vista ciatta.&2 barco.n.Bare di &Strumenti.Arvi cartella prin.ip..Livello supei..Cronologia....&Agiorna.750.Bara di strumenti Archivio.Bara di strumenti Normali.Figue grende.Mos

C:\Program Files\7-Zip\Lang\lt.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	9030
Entropy (8bit):	5.086332956902943
Encrypted:	false
SSDEEP:	192:3Lr7I2B5SmXxKKB7X47iyaljy7Peu1T96mo:3Lr1LBKKa7ipjy6ux96mo
MD5:	B8056CBA4EDEB98D298D16EDBC34D678
SHA1:	A4D39C3EDA31F8CE72C62E1DB91DEEABC884CEB0
SHA-256:	9C15DB408E32DC699F598AAB30F539F91A212E5FBAEE2095022E24B3F1F09ECD
SHA-512:	5C3FB76A5502C7C0312A32CFF38F99C303225C31C3E5C6041765BC2BEB0E9D5AC9CB4F543B80ECA969D54723A52122601B2074AFA8991AD64B92CFDA91104DC6
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 2.30 : Marius Navickas.; 4.57 : Domas Jokubauskis.; 15.05 : Vaidas777.;.;.;.;.;.;.;.;.0.7-Zip.Lithuanian.Lietuvi..401.Gerai.At.aukti....&Taip.&Ne.&U.daryti.Elektroninis .inynas..&T.sti.440.T&aip Visiems.Ne v&isiems.Sustabdyti.I. naujo.&Fone.&Pirminis procesas.&Laikinai sustabdyti.Laikinai sustabdyta.Ar j.s esate tikri, kad norite at.aukti?.500.&Failas.K&eisti.&Rodyti.M.gi&amiausi..ran&kiai.&Elektroninis .inynas.540.&Atverti.Atverti v&iduje.Atverti i.&or.je.&Rodyti.K&eisti.Pervadi&nti.&Kopijuoti .....&Perkelti ......alin&ti.&Skaidyti fail.....Jungti &failus....Savy&b.s.Kome&ntuoti.Skai.iuoti kontrolin. sum..Sulyginti.Sukurti aplank..Sukurti fail..I.ei&ti.Nuoroda.&Alternatyv.s srautai.600.Pa.ym.ti &visk..Nu.ym.ti visk..Atv&irk.tinis .ym.jimas.Parinkti....At.ym.ti....Pasirinkti pagal tip..At.ym.ti pagal tip..700.Did&el.s piktogramos.&Ma.os piktogramos.&S.ra.as.&I.samiai.730.Ner..iuotos.Nepaisyti aplank..&2 skydeliai.&

C:\Program Files\7-Zip\Lang\lv.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	5016
Entropy (8bit):	5.202718875099834
Encrypted:	false
SSDEEP:	96:UnbIMLOcn+2YYrzNOw/tglixPmncrwQMpp7urX:5MBQs9encsQCps
MD5:	056327042B9CFD5FCB5F788F22112D62
SHA1:	FAE6324417DC88E9A9BB0FBAC9B4D4CE61C1980E
SHA-256:	533F9FF016E7BB36216665CCA1065139A35D8DA71651678814415FF457A9BE7D
SHA-512:	FE853C2042251B3987C169F8241E0B3B0F1C3AE039DC7786B07E0DB07E8A6B0F89E1D478F27D3C8DFD69473E6C6118CE13A39D7DE84A22A3C2A660652B852660
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 4.10 : Armands Radzu.ka.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Latvian.Latvie.u.401.&Labi.&Atcelt....&J..&N..Aiz&v.rt.&Rokasgr.mata..&Turpin.t.440.J. &visiem.N. v&isiem.Stop.P.rstart.t.&Fon..&Priek.pl.n..Pa&uze.Pauz.ts.Vai piekr.tat p.rtraukt .o darb.bu?.500.&Fails.&Labo.ana.&Izskats.Ie&cien.t.s.&R.ki.&Pal.dz.ba.540.&Atv.rt.Atv.rt &iek.pus..Atv.rt .rp&us..Ap&skate.&Labot.P.&rd.v.t.&Kop.t uz....P.r&vietot uz....&Dz.st.&Sadal.t failu....Ap&vienot failus.....pa..&bas.&Piez.mes...Izveidot &mapi.Izveidot &failu.&Beigt.600.Iez.m.t &visu.Atcelt vis&u.I&nvert.t iez.m.jumu.Ie&z.m.t....&Atcelt....I&ez.m.t p.c tipa.A&tcelt p.c tipa.700.&Lielas ikonas.&Mazas ikonas.&Saraksts.S.&k.k.730.&Ne..irot..&2 pane.i.&R.ku joslas.&Atv.rt saknes mapi.L.meni &uz aug.u.Mapju &v.sture....&P.rlas.t.750.Arh.va r.ku josla.Standarta r.ku josla.Lielas pogas.Par.d.t pogu tekstu.800.&Pievienot mapi iecien.taj.m k..Iecien.t.s.900.&U

C:\Program Files\7-Zip\Lang\mk.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	8352
Entropy (8bit):	4.184447797063497
Encrypted:	false
SSDEEP:	192:6Bs6ZfGCRhROvyepYP3abUeXUlWDyos3d8K/FAK1MbNH1hjg:6BPrhRyfpYP3wCl+E8K/FAK1Mbl12
MD5:	C16E6946F912B49963BFA7E44BE2F7A0
SHA1:	496922AD3E59737AC64289EE685F2FADAA942755
SHA-256:	90EFCA5F6B8E37B963F7E42F700938440171942E0DE0AB8BAEB08912C0952957
SHA-512:	55FEEA50104ED2249E6F5018B6883F89ACBCC0396E80349653356F40329C4A420584B29734CD1CA8930E9A383DA427EC979815CC3DA3F6F59AD8948B2262E874
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 4.09 : Gabriel Stojanoski.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Macedonian............401..............&...&...&................&........440... &....... .&.........................&.......&.......&.................... ....... ...... .. ........?.500.&.........&......&.......&........&.......&......540.&............. &............. &.......&.......&......&............&....... ......&........ ......&........&...... ...............&....... ............&................&................. ................... .........&.......600........... &............... ...&....... ............................

C:\Program Files\7-Zip\Lang\mn.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	8069
Entropy (8bit):	4.491280092053577
Encrypted:	false
SSDEEP:	192:4NYic61W9cfCzaAhqbMUrJt6klXVUatQT+0V2sS14/g1Pa7fC:Uc2nFrJ8IXBQCG7Qam
MD5:	1088565A362EBAD250975F46F8A94328
SHA1:	406593AC2E74B8911DDA720952B7AFF6C4B5C145
SHA-256:	C6A6CC400EE7420BFB680D71B43A9BE1FBC75D7B98AE2B6FFE98229D5EEFADCA
SHA-512:	500093986EF49C23829D99251F0ADCD20A6D348A91C74362E95E6D8E73B83F7AD665CB49DA3E47DA1EC671842ABCC2D824850D243EE8D39C41E3568F9C2C89C4
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 3.12 : Bayar.; : Bayarsaikhan.;.;.;.;.;.;.;.;.;.0.7-Zip.Mongolian....... ....401.............&.....&.....&..............&...........440....&. ......... .&.............. ........&.. .....&.... ....&... ........ .......... ....... ..... ... ..... ..?.500.&.....&......&.........&..... .....&...........&........540.&.......... &.......... &.....&......&............. .&........... &................ &........&.......&.... ................... ...........&........ ........&............. ........... .........&....600........ ..&............. ......&......... ..................................... .

C:\Program Files\7-Zip\Lang\mng.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	19786
Entropy (8bit):	3.4834684083480845
Encrypted:	false
SSDEEP:	384:CcI/ZsPpGl9ZjeWe4vt/lx5qI4qwRXoFYvNCrSFbF7FdF+pIAZMijZdcdap4daBj:OUGxjeWe4vt/lvPIXTaGF+pPZZ7Ro/50
MD5:	A10D62CB5875CC96D53E4BC02724F366
SHA1:	BB8D2F73109084A9A11246733E5DA148D964D6EA
SHA-256:	2E488EF05895B93ACA2B5F72EA08DA887722215D1B4CB85B12942EA32641DA2B
SHA-512:	B01FCFA48883431BA98522C74A8AE9511BD6F122613E80A0439A049B8F509D689B89A59F280335532AF284A351C52F44313A4961EA5ACBFAF7EA2617AF75E797
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 9.20:.; Saqirilatu Mongolqileb.; last updated: 2014-1-1.;.;.;.;.;.;.;.;.0.7-Zip.Mongolian (Unicode)....... .....401...................... (&Y)..... (&N)....... (&C)..................... (&C).440....... .... (&A)....... .... (&L)................ ........... ..... (&B)....... ..... (&F).......... (&P)........ .......... ...... ........ .. ..500...... (&F)............ (&E)...... (&V)........... (&A)....... (&T)........... (&H).540......... (&O)...... ..... ... ........ (&I)...... ..... ..

C:\Program Files\7-Zip\Lang\mng2.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	21169
Entropy (8bit):	3.6500180773175783
Encrypted:	false
SSDEEP:	192:NSzhkx60rKSu1t5tO2lV6rxhA/1bRRsMQSJNg4T4H84zQ9gZGvlLk2+ZuYbzw:Kkx6MqVUSJNVCw
MD5:	2BE2F9C77556CA413B590B8477DF5499
SHA1:	DD5CE617642C977470AA20C6DC6815728C779245
SHA-256:	5A85CC532F802DA683374C3F4C98E3F37425CF304D6772BA554D2C49BAC7BE0B
SHA-512:	3BA82549752E6BFE6C1F1706B205747D70F2F3106C49EA08D35E82047166C3D5B26457D6BF00FBBD0E9CAC4AE8EC38123F533DE3F68ED466F219C551B5417C40
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 9.20:.; Saqirilatu Mongolqileb.; last updated: 2013-12-11.; Update and Spelling corrected Bayarsaikhan.;.;.;.;.;.;.;.0.7-Zip.Mongolian (MenkCode)......... .....401............................ (&Y)..... (&N)......... (&C)........................ (&C).440........ ..... (&A)........ .... (&L)................... ............ .... (&B)...... ... (&F).......... (&P)........ ............ ........ ............ .. ..500...... (&F).............. (&E)........ (&V)............. (&A)........ (&T)........... (&H).540..

C:\Program Files\7-Zip\Lang\mr.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	10395
Entropy (8bit):	3.978171082486284
Encrypted:	false
SSDEEP:	192:HosRVPp67cdE3hwwQtbgUaecHQFyMce+VWLeKhJHZgr:1RNphG3IRBwHoJbLeYJHi
MD5:	B681F52BC54B1B340A3184CDE7FF59C2
SHA1:	BA8D38155C0C81416233A360F7387EAF48C57DB2
SHA-256:	F6D67CE2EAE4C125BBF54C04AC783005BDDC07007398CABD3B9603020AF67BFD
SHA-512:	82FDB75B2F2A06E3CBBEAF1DFE84B196908286B9518194485DBBB168777181FA86A7E37136756544ACC98165860E8CA61B83545F6CD1F13EE91BFA995A5DF0D2
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 4.42 : ...... ..... ....... (Subodh Gaikwad).;.;.;.;.;.;.;.;.;.;.0.7-Zip.Marathi.......401.............&...&.....&.........&.....440.&.... .. ...&.... .. ................. .... ....&.... .....&.... ....&........................ .... .......... ...... ... ..?.500.&.....&.......&.......&.....&......&....540.&.....&.... .....&..... .....&......&.......... ....&.............&........&......&.... ..... ........... ...............................

C:\Program Files\7-Zip\Lang\ms.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	4785
Entropy (8bit):	4.860196348023919
Encrypted:	false
SSDEEP:	96:0PK8d9PEVqGUK+ZY6yB42vdhut4A9ThBbRaP0Jk:wKKPEVqGnmSvdhruf9o
MD5:	E3267C5ED8158DA2B7E2679107CE1394
SHA1:	6550CDE7359A1B3450D8C0937AFFBF0252FA4B82
SHA-256:	C88BC7EA0C20769847A0403E188E273A0897D1C77DD72CC4B45471FC67E0D5E1
SHA-512:	63C185613C5855379DD4CAC3D2CF264D6BB2A0E9B483B22EAB93B7E8B9ABDA88BEE2F80FCD24F0E9BE0972A04F6C725CB20CAE678E3E4F61251721B5BDB1CDCD
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 4.30 : Khairul Ridhwan Bin Omar.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Malay.Bahasa Melayu.401.OK.Batal....&Ya.&Tidak.&Tutup.Bantuan..&Teruskan.440.Ya untuk Semua.Tidak untuk Semua.Henti.Mula Semula.&Latar belakang.&Latar depan.&Berehat.Berehat.Anda yakin untuk membatalkannya?.500.&Fail.&Edit.&Paparan.K&egemaran.&Alat.&Bantuan.540.&Buka.Buka di D&alam.Buka di L&uar.&Paparan.&Edit.Nam&akan semula.&Salin ke....&Pindahkan ke....Hapus.&Bahagi/belah Fail....Gab&ung Fail....P&roperti.Kom&en...Buat Folder.Buat Fail.K&eluar.600.Pilih &Semua.Jangan Pilih Semua.&Sonsangkan Pilihan.Pilih....Tidak Memilih....Pilih Berdasarkan Jenis.Tidak Memilih Berdasarkan Jenis.700.Ikon B&esar.Ikon K&ecil.&Senarai.&Butiran.730.Tidak Tersusun..&2 Panel.&Toolbar.Buka Root Folder.Ke atas Satu Aras.Folder Sejarah....&Segarkan Semula.750.Toolbar Arkib.Toolbar Standard.Bebutang Besar.Perlihatkan Teks Bebutang.800.&Tambah folder pada Kegemaran sebagai.Penanda Buku.900.&Opsyen....&Tanda Aras.960.&Kandungan..

C:\Program Files\7-Zip\Lang\nb.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	5649
Entropy (8bit):	5.023150217249099
Encrypted:	false
SSDEEP:	96:Q1XbkTUCIRe/Ldwrrs0C9t5oOhCtF5Iw7YXjuaPJ6Z7cfjsfcQRQ:EATdIEOrrs0C9t5oOh6bb7QuaPJ6Kfjl
MD5:	3B1958DA0544A6C318D18EF5779E81F5
SHA1:	67E991A6525DA165145C4584C3D9B398583D7E68
SHA-256:	F349529EA4584EBA51CD519B8A1D535D2DAEC762CD7369673B237FA03A526CC7
SHA-512:	E9B5E76FC908BC193738781FDBEBD894AE310F6693F7B52D4369BC4F979A8EC9E2201E5A2056FBFC380FDAD3143F3E5A3BC00D7CCB00CEC078BC0E8CAF318861
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 4.45 : Jostein Christoffer Andersen.; : Kjetil Hjartnes.; : Robert Gr.nning.;.;.;.;.;.;.;.;.0.7-Zip.Norwegian Bokmal.Norsk Bokm.l.401.OK.Avbryt....&Ja.&Nei.&Lukk.Hjelp..&Fortsett.440.Ja til &alt.Nei til a&lt.Stopp.Start p. nytt.&Bakgrunn.&Forgrunn.&Stopp.Stoppet.Vil du avbryte?.500.&Fil.&Rediger.&Vis.&Bokmerker.Verk&t.y.&Hjelp.540.&.pne..pne &internt..pne &eksternt.&Vis.&Rediger.Gi nytt &navn.&Kopier til ..&Flytt til ..S&lett.&Del opp arkiv ..&Sett sammen arkiv ..E&genskaper.&Kommentar ..Beregn sjekksum..Ny &mappe ..Ny f&il ..&Avslutt.600.Merk &alle.Merk i&ngen.Merk &omvendt.Merk ..Merk &ikke ..Merk &valgt type.Merk i&kke valgt type.700.&Store ikoner.S&m. ikoner.&Liste.&Detaljer.730.Usortert.&Flat visning.&To felt.&Verkt.ylinjer.Rotmappe.G. opp et niv..Mappelogg ..&Oppdater.750.Arkivverkt.ylinje.Standardverkt.ylinje.Store knapper.Knappetekst.800.&Bokmerk denne mappen som.Bokmerke.900.&Innstillinger ..&Ytepr.ve ..9

C:\Program Files\7-Zip\Lang\ne.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	13050
Entropy (8bit):	3.8543519831557473
Encrypted:	false
SSDEEP:	192:dNvZCtxUT2PoIhbW7dxmmWkcU0rwSdCsbW3UcSru1:d1vT2PoIRWMBwSY3Sr6
MD5:	04CFC22F9293329C5EA7EC5C4A14D3BC
SHA1:	57AA51DEC6BED50703054060F46918AA26AE0E4A
SHA-256:	E016E8872F2DE7CBC1F4FC786C747CC26B2E250E6C1B8F1C46040B72C523D90F
SHA-512:	5099E2A8B6BE04E2124280711AF1BF5807DCA5DF93DD33CCA416D56337ADAD19903AACEF3872F550D16A82F8F1471EC5D821D6E4E096E817A8C4D8340291D402
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 4.37 : Shiva Pokharel, Mahesh Subedi.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Nepali........401.... ...... .............&...&.....&.... .................&.... ...........440.&...... ...&...... ...................: .... ..........&..........&.........&.. ............ ............ .... .... .... ......... ?.500.&.....&....... ..........&...........&.........&......&......540.&..................... ..................... ...........&.........

C:\Program Files\7-Zip\Lang\nl.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	9608
Entropy (8bit):	4.880635467905247
Encrypted:	false
SSDEEP:	192:XRVV/VctnsLlc+zMZUnYel4yj7FBjYAifM3k8i1sFB2ytqPbtY+0zonViwswzdUF:Xrk+IZ2YeigFReNgB2k2btgtl
MD5:	E888911310C0B6D7A1932DE36AD27250
SHA1:	928D9FBDB0C0C83042CAC9059FFDDE48EA4E9F71
SHA-256:	4CB5F08449B5E22ED15F8A8CC038D021CDBCF56548587023D1AB31AB6CFC232D
SHA-512:	56308E46914FD3B0EF62B33331F815FE95CA4A3CF122934DD0C506A041898D94A9ED6F3E1BAEF386EFB9AA949CD47002FA859B4843F2E32C186ECDB6055FF85F
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; : Bert van Velsen.; 4.26 : Jeroen van der Weijde..; : Harm Hilvers.; 9.07 : Jeroen Tulp.; 15.00 : Jeroen Tulp.; 21.03 : Quinten Althues.; 21.05 : Jeroen Tulp.; 24.04 : Jeroen Tulp : 2024-05-13.;.;.;.0.7-Zip.Dutch.Nederlands.401.OK.Annuleren....&Ja.&Nee.A&fsluiten.Help..&Hervatten.440.Ja op &alles.Nee op a&lles.Stoppen.Herstarten.&Achtergrond.&Voorgrond.&Pauzeren.Gepauzeerd.Weet u zeker dat u wilt annuleren?.500.&Bestand.Be&werken.Bee&ld.&Favorieten.E&xtra.&Help.540.&Openen.Open b&innen.Open b&uiten.Be&kijken.&Bewerken.&Hernoemen.&Kopi.ren naar....&Verplaatsen naar....Verwij&deren.Bestand &opsplitsen....Bestanden &samenvoegen....&Eigenschappen.O&pmerking plaatsen....Controlegetal berekenen.Delta.Nieuwe map.Nieuw bestand.&Sluiten.Koppeling.&Alternatieve streams.600.&Alles selecteren.Alles deselecteren.Selectie &omkeren.&Selecteren....&Deselecteren....Selecteren op &type.Deselecteren op t&ype.700.&Grote pictogrammen.Kleine pictogra&mmen.&Lijst.&Details

C:\Program Files\7-Zip\Lang\nn.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	5525
Entropy (8bit):	4.991041089735878
Encrypted:	false
SSDEEP:	96:ewwLOC33eUlHAlE7zRzo7JAIXFZmN8oczCrsJfYsJgLu/wfYlRxKXHM2pPf8vzp:DwLv+UVAi7zRzo7uqFYN8JCrsxYseywc
MD5:	780514AF9E967D8AA65005365EFA7D78
SHA1:	9E060F149B110D0A0675B75D4A7B960563ACCA05
SHA-256:	DB540E1A6B8FFFF2497F9C1A63F85CB5F345F8CBA767F05377C0365ABAF7B7D4
SHA-512:	F85FEEFF1E89A371EB1143D695C76FBF84AFEE3699221E6E6CE7703A91EA80AC01AF27D34635FA2B61B1D6D979CB91BB98AFFBDB1CDFAE6CD04251A095EEEC84
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 4.45 : Robert Gr.nning.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Norwegian Nynorsk.Norsk Nynorsk.401.OK.Avbryt....&Ja.&Nei.&Lukke.Hjelp..&Hald fram.440.Ja til &alt.N&ei til alt.Stopp.Start p. nytt.&Bakgrunn.&Forgrunn.&Pause.Sett p. pause.Er du sikker p. du vil avbryte?.500.&Fil.&Redigere.&Vis.F&avorittar.Verk&t.y.&Hjelp.540.&Opna.Opna &Inni.Opna &Utanfor.&Vis.&Redigere.Endra &namn.&Kopiere til....&Flytt til....&Slett.&Del opp fil....Set saman filer....&Eigenskapar.Ko&mmentar.Rekna ut kontrollnummer..Opprett mappe.Opprett fil.&Avslutta.600.&Merk alle.Fjern alle markeringar.&Omvendt markering.Marker....Fjern markering....Merk etter type.Fjern markering etter type.700.S&tore ikon.S&m. ikon.&Lista.&Detaljar.730.Assortert.Flat vising.&2 felt.&Verkt.ylinjer.Opna kjeldemappa.Opp eit niv..Mappelogg....&Oppdatere.750.Arkiv verkt.ylinje.Standard verkt.ylinjer.Store knappar.Vis knappetekst.800.&Legg mappe til i favorittar som.Bokmerke.900.&Val....&Yting test.960.&Innhold....&Om

C:\Program Files\7-Zip\Lang\pa-in.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	14259
Entropy (8bit):	4.017885484807124
Encrypted:	false
SSDEEP:	192:Y/e1CL/yBWxhjeGTRjDKRC+miO7X8D+PoLQoTvKbVs4R2wjw6tK/BHHwpW0:Y/ekejg7X8GuQ8IsXw06t1b
MD5:	C9AD9D02C661644F79820E779A6D3F0F
SHA1:	92BD000AF1EA18B2FE8941CA4DF15858B4B53106
SHA-256:	E542C19640D39F3C56BF11A9EAADB554D7E74D8EC525D41A321E97C5AE5191C5
SHA-512:	40D178A217DD51A188E5C2AC5EB59DB62DB95DD0A7063E39B1ECFAD0943BB54A118767890D3AA7A753D7316AA2F0494CEF8BD81512D611AC2856256C524A5D0F
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 4.53 : Gurmeet Singh Kochar.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Punjabi, Indian........401.... ...... .......... (&Y)..... (&N).... ... (&C)........... ... (&C).440....... .. ... (&A)....... .. .... (&l)......... .... ............. (&B).......... (&F)..... (&P)..... ....... ..... ........ .. ... .... ....... ..?.500..... (&F).... (&E)..... (&V)........ (&a).... (&T)..... (&H).540..... (&O)..... .... (&I)..... .... (&u)...... (&V).... ... (&E).... .... (&m)..... ...... .. ... ..... (&C)........ ...... .. ..

C:\Program Files\7-Zip\Lang\pl.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	9911
Entropy (8bit):	5.3108412818364545
Encrypted:	false
SSDEEP:	192:ovp0mydAiVui6B3+6hX+S5YELolHgMKJas99KWGmU/DbU0E1nUv3b:Ip0mydAq6A6hOS5pLoQzd0snUT
MD5:	F8821C75507199F4EF041EEBA8B82281
SHA1:	96759A3B826BB5DBC18730378D0F8BA08C1DF7E1
SHA-256:	B4B96FDAA023A3988D514C1CB1E2914817CD538D3BB7F062778360338B73BA67
SHA-512:	173D6F0437A4E315F4F890F67EF93936E53205F950A9B718B8B232F6FAF0ED7E33E6C72531E0C2613611F4B02F5FD1ED7CDE8CBD05F2256A68FE577DAE4D3A90
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; : cienislaw.; : pixel.; 9.07 : F1xat.; 9.33 : .ukasz Maria P. Pastuszczak.; 22.00 : Micha. L..; 24.04 : Piter, Micha. L..;.;.;.;.;.0.7-Zip.Polish.Polski.401.OK.Anuluj....&Tak.&Nie.&Zamknij.Pomoc..&Kontynuuj.440.Ta&k na wszystkie.Ni&e na wszystkie.Zatrzymaj.Pon.w.&T.o.&Pierwszy plan.&Wstrzymaj.Wstrzymano.Czy na pewno chcesz anulowa.?.500.&Plik.&Edycja.&Widok.&Ulubione.&Narz.dzia.Pomo&c.540.&Otw.rz.Otw.rz &wewn.trz.Otw.rz na &zewn.trz.Pod&gl.d.&Edytuj.Zmie. &nazw..Kopiuj &do....&Przenie. do....&Usu..Podzie&l plik....Z..&cz pliki....W.&a.ciwo.ci.Ko&mentarz.Oblicz sum. kontroln..R..nice pomi.dzy plikami.Utw.rz &folder.U&tw.rz plik.Za&ko.cz.Dow&i.zanie.&Alternatywne strumienie.600.Z&aznacz wszystko.&Odznacz wszystko.Odwr.. &zaznaczenie.Zaznacz....Odznacz....Zaznacz wed.ug typu.Odznacz wed.ug typu.700.&Du.e ikony.&Ma.e ikony.&Lista.&Szczeg..y.730.Nieposortowane.Widok p.aski.&2 panele.&Paski narz.dzi.Otw.rz folder g

C:\Program Files\7-Zip\Lang\ps.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	8236
Entropy (8bit):	4.571978993858432
Encrypted:	false
SSDEEP:	192:XJLEhYBUC2Yz4e1uxLpnJ2Ega8W2uW55tmTG:FUC2YzJkxFnJ2ET8W2uW5H
MD5:	23502D5CDD3671B634832D5F722CF5EA
SHA1:	443FB98DF15B8BFD081802938E180A87EE24104D
SHA-256:	FA12CA0BE49F4921D06268FAD673838C3A4644A70DC374A931997178F588E8F4
SHA-512:	E1FC00A7AD4A817B32370F2C03EA10473070B9D2FEBC29BB87D95FF2670E8E47FF27B2C2B6D63396306DC0185E127A49F602E969166CB27073FEB735CFA47AF8
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 4.53 : 2007-12-26 : Pathanisation Project.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Pashto......401.................&...&......&...............&.440..... .. ..&..&... .. ......................&.......&......&........... ...... .... ..... .. ... .. .....500......&.....&....&..&...........&......&.540.........&.....& ............ .&...........&.....&...&............ .....&...... .....&......&......... ...&......... ...&...................&........ ........... ........... .......&....600.... ....&.... ............ .......&..................... ... ....... ... .......700...&. ...........&... ............&.........&.730..

C:\Program Files\7-Zip\Lang\pt-br.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	10094
Entropy (8bit):	4.985202993884915
Encrypted:	false
SSDEEP:	96:miY9r9BfTV6g/+fY3W8qvyyMvfWMWqTtdkKM97n6O7Ugmpien9Ju1yZYX7579H:iZBTSaW8qapvf0OtiEgihy1vX7579H
MD5:	F0CBDAA70D567EE71C685250958EC194
SHA1:	2DB013E6608739AA45453D0F69BA953FCC78B14D
SHA-256:	6B21924CAEA51B395EFA0B8FA5D7E2492CE6A6B86DCC08565A5A4DEE5C182167
SHA-512:	3AE68CC6BE78D6BCA7304516B25733A516AAF2121FB8E62EBB9B6FD5194D261117F7AB0C142DBFB2EFE2016E189E7EBB1F5BE4A82253F087A34A59CFC41EF7B9
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; : Francisco Jr.; 4.37 : Fabricio Biazzotto.; 24.06 : Atualizado por Felipe.;.;.;.;.;.;.;.;.0.7-Zip.Portuguese Brazilian.Portugu.s Brasileiro.401.OK.Cancelar....&Sim.&N.o.&Fechar.Ajuda..&Continuar.440.Sim pra &Todos.N.o pra T&odos.Parar.Reiniciar.&Em 2. plano.&Em 1. plano.&Pausar.Pausado.Voc. tem certeza que voc. quer cancelar?.500.&Arquivo.&Editar.&Visualizar.F&avoritos.&Ferramentas.&Ajuda.540.&Abrir.Abrir &por Dentro.Abrir p&or Fora.&Visualizar.&Editar.Re&nomear.&Copiar Para....&Mover Para....&Apagar.&Dividir arquivo....Com&binar arquivos....P&ropriedades.Comen&t.rio.Calcular checksum.Diff.Criar Pasta.Criar Arquivo.S&air.Link.&Correntes Alternantes.600.Selecionar &Tudo.Desmarcar Tudo.&Inverter Sele..o.Selecionar....Desmarcar....Selecionar por Tipo.Desfazer a Sele..o por Tipo.700..co&nes Grandes..c&ones Pequenos.&Lista.&Detalhes.730.Desorganizado.Visualiza..o Plana.&2 Pain.is.&Barra de Ferramentas.Abrir a Pasta Raiz.Um N.vel Acima.Hist.

C:\Program Files\7-Zip\Lang\pt.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	10167
Entropy (8bit):	4.982732709429595
Encrypted:	false
SSDEEP:	192:F6nA1S1Zm3O8M+M6RyLCyOmiqgVBSAB57MTt:F6nJMO8M+MKGUsgVBhBS5
MD5:	F868C8FE0F1CBDED1AEC5CD29754B289
SHA1:	5E0113E3D5BFB938441CAE077034E7735B18C324
SHA-256:	3C76D190EA88CC339392FDB46E005E72E16658CF07FA83487E1A77250E027F41
SHA-512:	6C83C388460A3DFCDEEA369523678867511B8FA360CAAA72DC6E042F4A281F4764F137880E5369E06E60C3B3F304B3BB8DF7E6C0EDC3992972E646729BB240F5
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; : : Carlos Macao.; : : Jo.o Alves.; : : Jo.o Frade (100 NOME TR).; 4.46 : : Rui Costa.; 9.17 : : S.rgio Marques.; 15.00 : : Rui Aguiar.; 15.00 : 2022-03-22 : Hugo Carvalho.; 22.00 : 2022-06-28 : Hugo Carvalho.; 24.07 : 2024-06-18 : Hugo Carvalho.;.;.0.7-Zip.Portuguese Portugal.Portugu.s.401.Aceitar.Cancelar....&Sim.&N.o.&Fechar.Ajuda..&Continuar.440.Sim a &tudo.N.o a t&udo.Parar.Reiniciar.&Segundo plano.P&rimeiro plano.&Pausar.Em pausa.Quer mesmo cancelar?.500.&Ficheiro.&Editar.&Ver.F&avoritos.Ferramen&tas.&Ajuda.540.&Abrir.Abrir &dentro.Abrir &fora.&Ver.&Editar.Mudar& o nome.&Copiar para....&Mover para....&Eliminar.&Dividir ficheiro....Com&binar ficheiros....P&ropriedades.Come&nt.rio.Calcular o checksum.Diff.Criar pasta.Criar ficheiro.&Sair.Liga..o.&Alternar fluxos.600.Seleccionar &tudo.Desseleccionar tudo.&Inverter selec..o.Seleccionar....Dessseleccionar....Seleccion

C:\Program Files\7-Zip\Lang\ro.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	10040
Entropy (8bit):	5.033364801945333
Encrypted:	false
SSDEEP:	192:bBLhu312JnrmZ80+hs6MKaZy5HH9+jieCn6abdXdg9R49:bbhJnro80+X1HQT6fg9G9
MD5:	9A2FC6431192E6FC18871DA5D4ADC467
SHA1:	EEA02FAF56E746DFADF67C5FE4E12A79EA2FB089
SHA-256:	4FD993DBAE9606C062DC3511292274631335956A016B74B3061BAB55F7D9C736
SHA-512:	A4945CD1522FD2A57960959C4937C55920520BE615F3CB84CBE74842479D426AFF28F3E041FA61A338B121CA3BE64EFC4C128CA94A48B4D994EEA79A42AAB7F9
Malicious:	false
Preview:	;!@Lang2@!UTF-8!.; 4.59 : Lucian Nan.; 23.00 : 2023-07-22 : Marius Hudea.; 24.05 : 2024-05-19 : Miloiu Andrei-Valentin.;.;.;.;.;.;.;.;.0.7-Zip.Romanian.Rom.n..401.Bine.Anulare....&Da.&Nu..n&chide.Ajutor..&Continu..440.Da, pentru &toate.Nu, pentru t&oate.Opre.te.Restarteaz...n &fundal.La &suprafa...&Pauz...n pauz..E.ti sigur c. vrei s. anulezi?.500.&Fi.ier.&Editeaz..&Vizualizeaz..Fav&orite.&Unelte.&Ajutor.540.&Deschide.Deschide .&n.Deschide .n &afar..&Vizualizez..&Editeaz..&Redenume.te.&Copiaz. la....&Mut. la.....ter&ge.Segmenteaz. &fi.ierul....Com&bin. segmente....&Propriet..i.Comen&tariu.Calculeaz. cod verificare.Diferen...Creaz. director.Creaz. fi.ier.&Ie.ire.Scurt.tur..Fluxuri de date &alternative.600.&Selecteaz. toate.&Deselecteaz. toate.&Inverseaz. selec.ia.Selecteaz.....Deselecteaz.....Selecteaz. dup. tip.Deselecteaz. dup. tip.700.PIctograme m&ari.Pictograme m&ici.&List..&Detalii.730.Nesortat.Vedere &plan..&2 panouri.Bare de &

C:\Program Files\7-Zip\Lang\ru.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	15936
Entropy (8bit):	4.288162718572465
Encrypted:	false
SSDEEP:	192:TmGK+SCI5WUrVarSC0sgvy995DoVdhpWQl9y5pwVt1tX8aEFPGH0IU4smVxa:fSJHBqS7/69HSdHWaZsaEFP6nm
MD5:	447E681A030C82C3832DBA0B51CC790D
SHA1:	401BF38C2122AE2493470820C92D069F3F6C7606
SHA-256:	3E76BC88DB5CB108CF8750B01BDABBB3772DBF2BF14592C6AB18B7339817D6EE
SHA-512:	D17EF32A1DE17EC1C9D6CAE6199E6623DB700B18E43B3B85EF403A60EC11B9EFC0AC0BB188B03D13F7895DFCF4ED37D1F40C1BFC4BEE469742B712ED5DE70722
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 24.04 : 2024-04-05 : Igor Pavlov.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Russian.........401.OK...........&...&....&................&...........440... ... &........ ... .&....................&......&.. ........ .....&........ ........ ............. ...... ........ ........?.500.&.....&.......&....&...........&......&........540.&............... &.............. .....&............&...................&.........&.......... .....&........... .....&..........&..... .........&......... ............&...........&..................... ...............&....... ..........&... ......&............&...........

C:\Program Files\7-Zip\Lang\sa.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	18834
Entropy (8bit):	3.802411708886365
Encrypted:	false
SSDEEP:	384:TtnNoVvuZp1uKx4IshqMehIANlXgZC0Mzat2Irn0rInzY3TPYXtr:T/u/JBr
MD5:	FD1B984BAEA0E5A905F756E9FDC54E86
SHA1:	4DA8DA9154115F6BF0962FD02DB9D7E166285C8E
SHA-256:	02CC9032C117A7818865AF3DCADBDD3C7B348BE3507681CD0032DD9BD15B76FC
SHA-512:	1595742CCCFFF001C7BE0A7809F2E700460AD4CBD684D5A0CC53C5CCF615046E2E94EFD96CEEACA3D6FB20AAA5249D7677AB1F6FAF8DAB0A1B559A0C0951913E
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 9.07 : Vinayy Sharrma, ....... .... ......;.;.;.;.;.;.;.;.;.;.0.7-Zip.Sanskrit, Indian, .....................401.... ..............&....&...&... ...........&.... ....440.&....... ....&....... ............ .... .....&...........&........(.........).&....................... .... .... ..... ... ....... .... ..... ....?.500.&.......&.........&........&.........&.......&......540.&........&.... ........&.... ........&........&........

C:\Program Files\7-Zip\Lang\si.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	18706
Entropy (8bit):	4.0202268271567725
Encrypted:	false
SSDEEP:	384:oUocZSy4PE90cZ+B7H0eEcVN/Pc+SfuwOoq9LNVHS7PzYbZLg97/78BA5UmHezQu:pfSdRz0ezJc+OuwYhaPUudu36KKoMkBj
MD5:	5203E172ECB9F384BCE04D243684551F
SHA1:	5F6A09B52D729F3F6C95ABA9D29BFD6C7CD0340B
SHA-256:	5405E5B04E670FF7A5B5242A3872803725053324FFDC31F71511EA6B2573F6E0
SHA-512:	CE6B058891375577EB726A15E5430BCE4450A9C06D3F2D3361FFE5D39C0C47097B6D0E7CDC7B907A8E5F23FA8FA5A1866661A2AA3167D982FD5AEEC33FA39077
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 4.59 : ...... ....... (Supun Budhajeewa).; 15.00 : ..... ..... (HelaBasa Group).;.;.;.;.;.;.;.;.;.0.7-Zip.Sinhala.......401...............&....&.....&............&........440.&........ ............ ............... .......&..........&..........&..................... ...... ..... .. ........?.500.&......&.........&.......&............&.......&.....540.&..... ......&..... ..... ......&....... ..... ......&.......&.........&... ... ......&... .

C:\Program Files\7-Zip\Lang\sk.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	10142
Entropy (8bit):	5.350645745471363
Encrypted:	false
SSDEEP:	192:xPc6gARXHeJlbbciOeh3rykpqMmEIN5U91n8:N3gARX+Jlbbfh3ryvTEIN5Un8
MD5:	3FDECAE1FF188894295759380B0378DA
SHA1:	935A4797540CE26828569C50924BAAE230F2D41E
SHA-256:	B53FE26795B01F3347B614EAA499D28770D94EB5B51005C842386E97D8344CB6
SHA-512:	F5B87DEFB1837E98EA46E1E37E13180976C5910F13E18A178397C530E6F15C585CF55E54048206D1A343C298BFE136E0CCF259657B29D7A8C5A9EE2537288AED
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; : Tomas Tomasek.; 9.07 : Pavel Deve.ka.; 9.38 beta : 2015-01-11 : Roman Horv.th.; 24.02 : Milan .alka.;.;.;.;.;.;.;.0.7-Zip.Slovak.Sloven.ina.401.OK.Zru.i.....&.no.&Nie.&Zavrie..Pomocn.k..Po&kra.ova..440..no na &v.etko.Nie na v.&etko.Zastavi..Re.tartova..&Pozadie.P&opredie.Po&zastavi..Pozastaven..Ste si ist., .e chcete akciu zru.i.?.500.&S.bor.&Upravi..&Zobrazi..&Ob..ben..&N.stroje.&Pomocn.k.540.&Otvori..O&tvori. vn.tri.Ot&vori. externe.&Zobrazi..&Upravi..&Premenova..&Kop.rova. do....P&resun.. do....O&dstr.ni..Ro&zdeli. s.bor....Zl..&i. s.bory....V&lastnosti.Ko&ment.r.Vypo..ta. kontroln. s..et.Rozdiel (Diff).Vytvori. prie.inok.Vytvori. s.bor.Uko&n.i..Odkaz....&Alternat.vne streamy.600.Ozna.i. v.etko.Odzna.i. v.etko.Invertova. ozna.enie.Ozna.i.....Odzna.i.....Ozna.i. pod.a typu.Odzna.i. pod.a typu.700.&Ve.k. ikony.&Mal. ikony.&Zoznam.&Podrobnosti.730.Netriedi..Ploch. vzh

C:\Program Files\7-Zip\Lang\sl.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	8407
Entropy (8bit):	4.980893267908514
Encrypted:	false
SSDEEP:	192:hTCvOZThlzUkVNOjf9FvELDTMerNJ+svj0hId:hTCv23NkrvS4MWo
MD5:	722551A008A99008006AF6CE4161537A
SHA1:	294ABEA21D393BF624A4A97C1B4DB63D3332C312
SHA-256:	6B53FB390DA88BD79D76487FF30466AE972976D2EED030ADE6D9B93991B99CBC
SHA-512:	4BDE588E3ADD4B20B3DD89953136A655E0521CF3EC97E72A7FF337BF64E41F3DA75F60E4E56C5B833B86D6C23FAFAA92EBB0EFFE1D063D499EF3992C60BAC8F0
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 22.01 : 2022-07-17 : Jadran Rudec.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Slovenian.Sloven..ina.401.Vredu.Prekli.i....&Da.&Ne.&Zapri.Po&mo...&Nadaljuj.440.Da za &vse.Ne za v&se.Ustavi.Znova za.eni.Ozad&je.&Ospredje.Premor.Na premoru.Ali ste prepri.ani, da .elite preklicati?.500.Datoteka.Urejanje.&Prikaz.Priljubljene.Orodja.Pomo..540.&Odpri.Odpri &znotraj.Odpri zu&naj.P&rikaz.&Uredi.Prei&menuj.&Kopiraj....&Premakni....Iz&bri.i.&Razdeli datoteko....&Zdru.i datoteke....L&astnosti.Ko&mentar.Izra.unaj preizusno vsoto.Razlika.Ustvari mapo.Ustvari datoteko.&Izhod.Povezava.&Nadomestni tokovi.600.Izberi &vse.Razveljavi izbiro vseh.&Preobrni izbor.Izberi....Razveljavi izbiro....Izberi po vrsti.Razveljavi izbiro po vrsti.700.&Velike ikone.&Majhne ikone.&Seznam.&Podrobnosti.730.Nerazvr..eno.Ploski prikaz.&Dve podokni.&Orodne vrstice.Odpri korensko mapo.Eno raven navzgor.Zgodovina map....&Osve.i.Samodejno osve.i.750.Orodna vrstica arhiva.Srandardna orodna vrstica.Veliki gum

C:\Program Files\7-Zip\Lang\sq.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	5579
Entropy (8bit):	5.039812534553965
Encrypted:	false
SSDEEP:	96:P/3mbERgiJQCLlUBwpMBf4WV49vXJQX2Egzqlg+5RK6uxy4rcRQKktwlm80DCDHB:P/3sue8MOWyBXyX2tyj9RpGgigi6KwJ
MD5:	69720A6D09230D9747BB2AA3C0EF650D
SHA1:	4750E61EC19BA905D6F2BC5828510FD08D915AF8
SHA-256:	B6EE3C8A14230AA7D1A17C5493E0A410C5C5C638BA7A9D81681FFED4A8DE6884
SHA-512:	92230FEE3E5BC4B57013E359E43BF5F921DCFD9CAD4522E09B11EF8BF2F21F96555FC3AF72618A06D953F8D68050629358A8A7312A649489D6CA82780B793C88
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 4.37 : Mikel Hasko.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Albanian.Shqip.401.N. rregull.Anulim....&Po.&Jo.&Mbyll.Ndihm...&Vazhdim.440.Po p.r t. gjith&a.Jo p.r t. gjit&ha.Ndalo.Rinis.N. &sfond.N. pla&n t. par..&Pushim.N. pushim.Jeni t. sigurt se d.shironi ta anuloni?.500.&Skedari.&Redaktimi.&Pamja.&T. parap.lqyerit.&Veglat.&Ndihma.540.&Hap.Hap p.rbre&nda.Hap p.rjas&hta.&Pamja.&Redakto.Ri&em.rto.&Kopjo tek....&Zhvendos tek....&Fshi.N&daj skedarin....Kom&bino skedar.t....&Vetit..Ko&menti.Llogarit shum.n e verifikimit..Krijo nj. dosje.Krijo nj. skedar.&Dil.600.S&elekto t. gjith...se&lekto t. gjith..Anasill selekti&min.Selekto.....selekto....Selekto sipas tipit..selekto sipas tipit.700.Ikona t. &m.dha.Ikona t. &vogla.&List..&Detaje.730.&T. parenditur.Pamje e rrafsht..&2 panele.&Shiritat e veglave.Hap dosjen rr.nj..Nj. nivel m. lart..Historiku i dosjes....&Rifresko.750.Shiriti i veglave i arkivit.Shiriti standard i veglave.Butona t. m.dh

C:\Program Files\7-Zip\Lang\sr-spc.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	11589
Entropy (8bit):	4.212638798878335
Encrypted:	false
SSDEEP:	192:b8TEDykT3a1oTLEKqX+KgU0XH9VL9dYALdOy7a+HSwOYAcvYxD/HI5wxhG9h2bZk:6VST0uKk9R9yAKcAcAxjJ6h8akS
MD5:	D95E6FF9DAE7FA22083D9ED73588FE1A
SHA1:	F061E9E1AFE02B7B92D626432CD9DA55BD8BC2DD
SHA-256:	817D7A33F2ADB19F47F45F78C314F6AE6DF4CA4DA133C1F7A82703E0CDEE7E20
SHA-512:	210BFDC206C2173BD680B6F319AFDA3228AC44CAF611C3846EF9AE0AD11701306BA923CCC9715086FF3CA5222F80713BF9FD6ABF61141232834DD95692EDC7C6
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; : Lazar.; 9.07 : Ozzii.;.;.;.;.;.;.;.;.;.0.7-Zip.Serbian - Cyrillic....... - .........401.. ............................................440... .. ...... .. ............................ ................... .. ... ....... .. ...... .. .........?.500................................................540................ .. 7-Zip-......... .. ........... ............................................. ............. .................. ............ ....................................... ........ ..................... ............. ...............600........ ........... ..... ........

C:\Program Files\7-Zip\Lang\sr-spl.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	6765
Entropy (8bit):	4.998761539106251
Encrypted:	false
SSDEEP:	192:ebQDPq3odT/FQ66mJpo46+z6Khowcwz+/ODBs+sO+krfRZ:eqPq4N/FKmJ2N2FWmNdrfX
MD5:	9E08D57D48B4D8CB16F98736C5C0511B
SHA1:	85A597B74BCB1CBF918D6366705F0B0C0727DE31
SHA-256:	D8C5223FE423129145C5B55A756E499D4680B1DF0A7115D72736F09E51C89C1F
SHA-512:	13E431E00F5EC0373DE201897C68A55C91962BD3DF6CD693448D3D5D6EBB478B51A1834ECD37B456761DCE94DBC4E5214FD421FA7BAD3B5B8A51051D0D8D6964
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; : Lazar.; 9.07 : Ozzii.;.;.;.;.;.;.;.;.;.0.7-Zip.Serbian - Latin.Srpski - latinica.401.U redu.Otka.i....Da.Ne.Zatvori.Pomo...Nastavi.440.Da za sve.Ne za sve.Stani.Ponovo.Pozadina.Na vrhu.Pauza.Pauza.Da li ste sigurni da .elite da prekinete?.500.Datoteka.Ure.ivanje.Pregled.Omiljeno.Alati.Pomo..540.Pogledaj.Otvori sa 7-Zip-om.Otvori sa pridru.enom programom.Pregledaj.Promeni.Preimenuj.Kopiraj u....Premesti u....Obri.i.Podeli fajl....Spoj delove....Svojstva.Komentar.Izra.unajte provernu veli.inu.razlika.Nova fascikla.Nova datoteka.Izlaz.600.Izaberi sve.Poni.ti izbor svega.Obrnuti izbor.Izaberi....Poni.ti izbor....Izaberi po tipu.Poni.ti izbor po tipu.700.Ikone.Naporedno slaganje.Spisak.Detalji.730.Bez sortiranja.Ravan pregled.2 Prozora.Trake sa alatkama.Otvori po.etnu fasciklu.Gore za jedan nivo.Hronologija....Osve.avanje.750.Rad sa arhivama.Rad sa datotekama.Velika dugmad.Prika.i tekst ispod dugmadi.800.Dodaj.Izaberi.900.Opcije....Benchmark.960

C:\Program Files\7-Zip\Lang\sv.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	8711
Entropy (8bit):	5.0441606790922044
Encrypted:	false
SSDEEP:	192:oEiQ9ofFPhWwxTyaN+tu0okvFFr7S6IqOsc9gw8tjD7FuPNfOloU31QHvBcw:oEiQibWwjNT8cotjD8NfL
MD5:	9A27F7E51E2143F4258AAC9975F78F60
SHA1:	49DFFBD91FE27A81DA38BECDE87DE6B2DF28962F
SHA-256:	233596E0D29DAD356CD31C302EB1EB3A263736F166F5A7628A753BD808668EBB
SHA-512:	83C6464E05C776910552591D6D4B8DCB5CD0CC8C627519AEFB7B61672F4478E42FDB8E023B5BFD29C313A22DEEEE75FCF66BF638F8D48156E98694F110B7D324
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; : Andreas M Nilsson, Christoffer Enqvist.; 4.59 : Bernhard Eriksson.; 22.00 : (2022-06-20) Mikael Hiort af Orn.s.;.;.;.;.;.;.;.;.0.7-Zip.Swedish.Svenska.401.OK.Avbryt....&Ja.&Nej.&St.ng.Hj.lp..F&orts.tt.440.Ja till &alla.Nej till a&lla.Stoppa.Starta om.&Bakgrunden.&F.rgrunden.&Pausa.Pausad..r du s.ker p. att du vill avbryta?.500.&Arkiv.&Redigera.&Visa.&Favoriter.Verkt&yg.&Hj.lp.540.&.ppna..ppna &internt..ppna &externt.&Visa.&Redigera.&Byt namn.&Kopiera till....&Flytta till....&Ta bort.&Dela upp fil....&Sammanfoga filer....E&genskaper.Komme&ntera.Ber.kna kontrollsumma.Differens.Skapa mapp.Skapa fil.&Avsluta.Skapa l.nk.&Alternativa datastr.mmar.600.Markera &alla.Avmarkera alla.&Invertera markering.Markera....Avmarkera....Markera efter typ.Avmarkera efter typ.700.St&ora ikoner.Sm&. ikoner.&Lista.&Detaljerad lista.730.Osorterad.Platt vy.&Tv. paneler.&Verktygsf.lt..ppna rotmappen.Upp en niv..Mapphistorik....&Uppdatera.Uppdatera automatiskt.75

C:\Program Files\7-Zip\Lang\sw.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8039
Entropy (8bit):	4.830174437133884
Encrypted:	false
SSDEEP:	192:FGtF7C6fBky7MIFT0T222a6CjlHtLG0mHR7s:O/fNaS2J6CjxdN
MD5:	BAAC3FF9FC4B6A656AC7C51D44117BD9
SHA1:	FEACD226EFB71EE149424F39AB47EBF6F64CAB04
SHA-256:	9FED3C0B4E67673BC1D8BBD67D1F6651FADE030F98D12173C3564F2C492A67F8
SHA-512:	44413A73CD0DE02F245CB5D8B35BB457AE136C1C2BBB76934F120F6D0B14FCE928B4763475730F018C6E4B4AD4881A32CF1C99879C197CC4E70B8A992B3BFCA4
Malicious:	false
Preview:	;!@Lang2@!UTF-8!.; 15.00 : 2020-05-15 : Mara Gati Lucky.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Swahili.Kiswahili.401.Sawa.Ghairi....&Ndio.&Hapana.&Funga.Usaidizi..&Endelea.440.Ndio kwa &zote.Hapana kwa z&ote.Simamisha.Washa upya.&Mandharinyuma.&Mandharimbele.&Tuliza.Imetulizwa.Una uhakika unataka kughairi?.500.&Faili.&Hariri.&Mwoneko.Z&inazopendwa.&Zana.&Usaidizi.540.&Fungua.Fungua &ndani.Fungua n&je.&Mwoneko.&Hariri.Pati&a jina upya.&Nakili hadi....&Sogeza hadi....&Futa.&Gawiza faili....Ung&anisha nyaraka....S&ifa.Toa m&aoni....Kokotoa checksum.Tofautisha.Unda kabrasha.Unda faili.F&unga.Kiungo.&Mitiririsho mbadala.600.Teua &zote.Ondoa uteuzi wote.&Pindua uteuzi.Teua....Ondoa uteuzi....Teua kulingana na aina.Ondoa uteuzi kulingana na aina.700.Iko&ni kubwa.Ikoni ndogo.&Orodha.&Maelezo.730.Haijapangwa.Mwoneko bapa.&2 paneli.&Miambaa zana.Fungua kabrasha shina.Juu kiwango kimoja.Historia ya folda....&Weka upya.Weka upya kioto.750.Mwambaa zana wa akiba.Mwambaa zana wa kawaida.Vitufe vikubwa.Onyesha m

C:\Program Files\7-Zip\Lang\ta.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	12057
Entropy (8bit):	3.6721380731890467
Encrypted:	false
SSDEEP:	192:MZOpgEdXp2Aj1N1YZsHFoXmj6OI1v/O2RmrNqBSXGdCdfy01K:x3X4xO2RmUqqX
MD5:	DD0AE446AD4C5D6F20DB6ECE80F21606
SHA1:	CDDB5DC08DA094FF69E48C1AF7E329F6B83FB6A6
SHA-256:	AE1A795105574BF2674A5DE98A4F06CADD9C79DEBDE9FC288F64B3D607FA329D
SHA-512:	543777575D32B9E1A67AFA2380B7953B79F3031AD6421314BA1DD957EC356FC0446903E09CA70A4E61F1264FC87846C968574D3ADF90F1563BAE3CCCA875636F
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 3.13 : Ve Elanjelian : ThamiZha! team.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Tamil.......401................................................440.............. ................. .......................................................... ................. .................... ...... ..... .................?.500..................................................540.......... .......... ........................................

C:\Program Files\7-Zip\Lang\tg.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	14632
Entropy (8bit):	4.341973950530399
Encrypted:	false
SSDEEP:	192:LzDXSHvMCtcY7SbE1BgUmOTfhEUDgkoSa4pTG++3slxxgYbgDfvCPKpTWO4z+dWE:uMC2YubdUmsKEAcb+3QbgDEK9KyQ2f
MD5:	EA08A1D73A4A150D7EC590B094D4E0D5
SHA1:	E4F3172CF52DB8DA27F7D95CFBA2EACFAB12D533
SHA-256:	E029F34DDEA8B1358E1F519526EF643D79BE37CFCE55BB5EA21B4BD0D026F9D3
SHA-512:	3661EC554C82F3608099E08808E5151B8D7BCCA385CF09D0FD4181073A52E1E835485DF0684F5091D0F5EF487A07298286DB463C3971E3986A6AD9B0BF7784C2
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 20.02 : 2020-10-20 : Shamsiddinov Zafar.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Tajik........401..................&.....&...&..............&..........440..... ..... &........ ..... &............... .......&.......&.. ... ........&............ ............. ....... ......, .. ......... .... ...... .......?.500.&.....&.......&.......&......................&........540.&........... ..... &........... ..... ...............&............. ......&............ ......&........ ......&.... ................ ..... &.........&..... ....... ................................... ...... .............. .......&...

C:\Program Files\7-Zip\Lang\th.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	15450
Entropy (8bit):	3.943828079014395
Encrypted:	false
SSDEEP:	384:NrQMVEpEJbIRgAOaN2gs1KM5LypJ0/vrvQYKSK46smKhjlCqRK5ZThNFdHL0eF9s:Nr3m6JbIRgzaN2gs1/+J4vrvQYzK46Pg
MD5:	6BE5BA977C60F103B54C4289399CE43E
SHA1:	48DFF625438573A366D56ECEF43BC43A10E124A8
SHA-256:	A1967002746961CDC4F3AD4F5F081BBA6DB231660CDFD5F2AB4A572EB11DD67C
SHA-512:	DA61AA3C5389B5096F1C899AD17EBC20125B18D959F8C74AAE10665F65DE4A3C2069AFE47380C093926180C952336FCBEFF71329809D7FA59AB490849B647DBB
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 4.09 : Chayanon Ruamcharoen.; 4.10 : Zafire06.; 9.13 : Kom10.;.;.;.;.;.;.;.;.0.7-Zip.Thai.....401................&....&....&...............&.............440...................................&..................&..................&..................................................500.&.....&......&.......&...........&...........&..........540.&...........................................&.......&......&............&...............&

C:\Program Files\7-Zip\Lang\tk.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	8736
Entropy (8bit):	5.243048507979006
Encrypted:	false
SSDEEP:	192:K9LGWUpW9ui2eHMMfj0RIC/2Naq49K5ztPYIzvPMdQpJzPq:859uigRr/2Yq4uJPYIzvPMZ
MD5:	1F610DF86538A3ED788D6A8024C1982E
SHA1:	3180F829602B83148C73A47EF4DAF841BB379A14
SHA-256:	A0F485755CBC6356CFA4BEF5CB6134653DC6743F4BFCA89CED92D43EC31C5649
SHA-512:	C184E3898944B2C0A12806E0B0592FD19BE05A75E7F3B2F9A69B8D39FA847E90AEBE93E1E96588AAA38DCDBB9FF89C1667BCA1B5A5FDFDB7F77E37A574981309
Malicious:	false
Preview:	;!@Lang2@!UTF-8!.; 19.00 : 2019-03-04 : Merdan NURIYEV Hazar-Balkan H.K..;.;.;.;.;.;.;.;.;.;.0.7-Zip.Turkmen.T.rkmen.e.401.Howwa.Go.bolsun et....&Howwa.&.ok..a&p.K.mek al..&Dowam et.440.Hemmesine howw&a.Hemmesine &.ok.Dur.Ga.tadan ba.la.&G.r.nme.&..e .yksyn.&S.gindir.S.gindi.Go.bolsun etjekmi?.500.&Dos.a.&D.zelt.&G.r.F&aworitler.G&urallar.&K.mek.540.&A..&I.inde A..Da.&ynda A..&G.r.&D.zelt.Adyn&y ..tget..u .ere &kop.ala.....u .ere &g...r....&...r.Fa.ly &b.l....Fa.llary &birle.dir....&D.zg.nlemeler.Tes&wir....Barlag jemini hasapla.Tapawutlanma.Bukja d.ret.Fa.l d.ret.&.yk.Bag.Akymlary .&aly..600.Hemmesini Se..Hemmesini Se.me.Se.im&i tersine .w.r.Se.....Se.me....Tiplerine g.r. se..Tiplerine g.ra se.me.700.U&ly Ikon.Ki.i Ikon.Tablissa.Jikme-jikleri.730.Sortlanmadyk.D.z G.rn...&2 Paneller.&Esbaplar.D..p Bukjany A..Bir Tekje .okary...ki Bukjalar....T.zele.Awtomatiki T.zele.750.Arhiw Esbaplary.Standart Esbaplar.Uly K

C:\Program Files\7-Zip\Lang\tr.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	9756
Entropy (8bit):	5.222646559853333
Encrypted:	false
SSDEEP:	192:CKtangmNvbq5nFczPipu9FS1zPf6MHH2L6NyE8uP+G0O249bgCGLpO6u:RtangimWPieFSRPyE8uvLyo
MD5:	CD44EF9F1C6526A18D9956517E510C16
SHA1:	DD65DAD1B27F26B538CB3C8FC11895A7C6A81F20
SHA-256:	D8DDEEC7A1D5F98BE9FE727D47F8BDF733E21693E988DCFE48089AC3344DCF30
SHA-512:	51676AE9C163686DAD3748E2DEC7898ED218673D15AF741404C4EB30E8E8C23CC8C5BB7E33E1B7CC40DE56C1ACFE2639711F47BFAC9EF9FAE5703EAA889F924D
Malicious:	false
Preview:	;!@Lang2@!UTF-8!.; 24.04 : 2024-04-05 : Ahmet Murat .ZHAN.; 22.00 : 2023-05-28 : Emir SARI.; 15.00 : 2018-11-21 : Kaya Zeren.; 9.07 : 2009-09-22 : X-FoRcE.;.;.;.;.;.;.;.0.7-Zip.Turkish.T.rk.e.401.Tamam..ptal....&Evet.&Hay.r.&Kapat.Yard.m..&Devam.440.T.m.ne &Evet.T.m.ne &Hay.r.Durdur.Yeniden Ba.lat.&Arka Planda..&n Planda.&Duraklat.Duraklat.ld...ptal etmek istiyor musunuz?.500.&Dosya.&D.zen.&G.r.n.m.&S.k Kullan.lanlar.&Ara.lar.&Yard.m.540.&A..7-Zip ..i&nde A..&Varsay.lan Uygulamada A..&G.r.nt.le.&D.zenle.&Yeniden Adland.r.Klas.re &Kopyala....Klas.re &Ta......&Sil.Dosyay. &B.l....Dosyalar. Bi&rle.tir.....&zellikler.A..kla&ma.....Sa.lamalar. Hesapla.Fark.Klas.r Olu.tur.Dosya Olu.tur.&..k.Ba.lant..&Di.er Ak..lar.600.&T.m.n. Se..T.m.n.n Se.imini Kald.r.Se.imi &Tersine .evir.Se.....Se.imi Kald.r....T.re G.re Se..T.re G.re Se.imi Kald.r.700.&B.y.k Simgeler.&K...k Simgeler.&Liste.&Ayr.nt.lar.730.S.ralamas.

C:\Program Files\7-Zip\Lang\tt.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	13706
Entropy (8bit):	4.512938543489413
Encrypted:	false
SSDEEP:	384:4sAaGWnyUCvYb6klPJFdljLNCZXg54yd+yACOFFytAQm:maG39YeklPJFLjLN+g5h+MtAd
MD5:	730C16345E2A2366C2221D5F22980666
SHA1:	41E92F0B3AEE2436183E1263AAD85787ECBABF34
SHA-256:	813B5264F3F2D2B632B346E800E738E04DC098C7B3A1A2AF64BCF3A6ACBCA037
SHA-512:	339A9B6E5788B6B2D627C16B6DCA5A942133B2F113ADC21225C693951D87EE5C476A684565C2A38510A23C42E1DFA0689A62450CB2D741D4AC43A53B9B691606
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 15.10 : 2017-02-12 : Bulat Ibrahim.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Tatar.........401.OK.... .........&....&...&..............&..... .......440.... &........ ....... .&....... .................&......&.... .......&.................... .. ....... ............?.500.&.....&........&......&..........&........&........540.&........... &............ ..&...........&................. &...........&................&.............&................ &.................... &...................&.............&.............. ...................&..... .........&.. ........&............&........... ........60

C:\Program Files\7-Zip\Lang\ug.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	10982
Entropy (8bit):	4.662514332505228
Encrypted:	false
SSDEEP:	192:Ca+X3gDVs7FuvI9w83Dce6oF3DSiskkSx6NGhu1c9:XAwpe53uUkSWlc9
MD5:	47C628C679FF488DDF4E14C457D2FCA0
SHA1:	E8DA632E677A92224B5095271087A68C60504B9C
SHA-256:	7FD494130F9B96DFCA492D495EF3FD7B4EAACF59F075172898ECE5AEBD1F6FCE
SHA-512:	A4A22D6FE3C01A3E3D93C6D555B840EEECD72F396F0BCB5AFD871292BCA5B86F2CA76E3CF44FA71DD6C1B08D6672C50D16D0FBA679A4AF4AA677993A9900E497
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 4.59 : Sahran.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Uyghur..........401........... .......(&Y)........(&N)....(&C)....................(&C).440........ ....(&A)........ ...(&L)............ ........... ....(&B)...... ....(&F)......... .....(&P)......... ................... ... ..........500.......(&F).......(&E)........(&V).......(&A)......(&T).......(&H).540....(&O).......... ........ ...(&I)..... ........ ...(&U)........(&V).......(&E).... .......(&M)........ .....(&C)........ .....(&M).......(&D)....... .......(&S)........ .........(&B)........(&R)........(&N)....... ............. ........... ............(&X).600..

C:\Program Files\7-Zip\Lang\uk.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	16420
Entropy (8bit):	4.346958198063598
Encrypted:	false
SSDEEP:	384:IyFxzaETT1SP58Hs+5tgxe3+edU74njAMcpsN0RxRgxExJx2B6LZExRlRYhT:ZvTf/eJT
MD5:	14C60B55D5400607C7B6443D10B0A37C
SHA1:	B92D556FF934F83AC3BEEC3DE20FBB909D0E1AFB
SHA-256:	262BCC4EBAE464D1C96FBFCCDCA7813E6F6CC8FDFD78FBB933DE72A2B7AC8367
SHA-512:	BC5951287DBAE1BC775293B1CCC3FCE37C2776905FBCF9EC47E49E9A28E6F54B1349B49EBF65631D04617666EED483A91870E255FEDAAAF9A4269B985310EFE1
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; : Andrij Ilechko.; : Mokiy Mazaylo.; : Sergiy Gontaruk.; : Misha Padalka.; 23.01 : 2023-06-20 : Yurii Petrashko.; 24.04 : 2024-04-17 : MrIkso.;.;.;.;.;.0.7-Zip.Ukrainian............401.OK..............&....&...&.................&...........440.... ... &....... ... ..&..........................&.. ........ ......&.. .......... ......&.................... ........, .. ....... ......... ........?.500.&.....&............&.......&...........&............&.........540.&................. .&................. &......&............&...............&..........&......... ..........&....... ..

C:\Program Files\7-Zip\Lang\uz-cyrl.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	14672
Entropy (8bit):	4.2852957756152215
Encrypted:	false
SSDEEP:	384:2dRJSgU9qXjQ8Ob5bpXUa09uQEjvj1/vkW/J/Y/pfN15N:AU9qTQ8sZpXUa09uZp1BQRlB
MD5:	0E053B461B1840743441F2B74D73E3EE
SHA1:	C3F211F45C0702531C0BB09C13EAFE32634EE9CC
SHA-256:	DD414D39F8DA2FBD5CAA0C7A7A9155C5F802B4D45F2E8828A79C7B4B63BD1179
SHA-512:	8E2144242E9000290DAD52008B3DB9878B35C1C3182B74273965A5F7B4DC4AFE146D2C97A5318525ADE263753F08413A6FA45B7EC38F9C56D5042787D9E6C78E
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 20.02 : 2020-10-21 : Shamsiddinov Zafar.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Uzbek-Cyrillic.........401......... ..........&...&....&.............&..... ......440....... &......... &.......................&......&..... .....&..... ............ ............. ..........?.500.&.....&............&........&.............&.........&......540.&......&........ ......&......... ......&........&............&..... .........&.......... ..............&.......... ............&.... .........&...... ..........&......... ................&............&.............. ...................... ........... .......&.....

C:\Program Files\7-Zip\Lang\uz.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	8888
Entropy (8bit):	5.049104436584185
Encrypted:	false
SSDEEP:	192:cNml3r3hrOfvZQY19CUfwb8NKLHnxA4vN5rBBb7U7folni:Sml3r3hrWvZQ69CUfwb84LHxAulBv0oE
MD5:	4479712709B19297483D020D11164745
SHA1:	ADBF9F8EF1C44E7F7D13EF5E0ABE1F49C4ED3F1B
SHA-256:	D62F8D3E7AA1F2636A1AD1B2AEDE0DA9FD725941A5F81D24A9B0B7599CAF0F50
SHA-512:	A857B93E9991AEE4CDD6730DE538AB3BFD13620D0A99AEA1F49859B0D479EF4F757C4D99846FC1754691802B5DAFD044FC306BD31C0429DCF15EB5DC3C0B9036
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 20.02 : 2020-10-20 : Shamsiddinov Zafar.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Uzbek.O.zbekcha.401.OK.Bekor qilmoq....&Ha.&Yo.q.&Yopmoq.Ko.mak..&Davom etmoq.440.Bariga &ha.Bariga &yo.q.To.xtatmoq.Qaytadan.&Fonda.&Fonda emas.&Pauza qilmoq.Pauza qilindi.Bekor qilinsinmi?.500.&Fayl.&Tahrirlamoq.&Ko.rinish.&Tanlanganlar.&Jihozlar.&Ko.mak.540.&Ochmoq.&Ichkarida ochmoq.&Tashqariga ochmoq.&Ko.rinish.&Tahrirlamoq.&Qayta nomlamoq.&Quyidagiga nusxalamoq....&Quyidagiga ko.chirmoq....&Olib tashlamoq.&Faylni bo.lmoq....&Fayllarni birlashtirmoq....&Xususiyatlar.&Sharh....Yakuniy summa.Taqqoslamoq.Jild tuzmoq.Fayl tuzmoq.&Dasturdan chiqmoq.Havola.&Muqobil oqimlar.600.&Barini tanlamoq.Barini tanlamaslik.&Teskari tanlash.Tanlamoq....Tanlamaslik....Turi bo.yicha tanlamoq.Turi bo.yicha tanlamaslik.700.&Yirik ikonkalarda.&Kichik ikonkalarda.&Ro.yxatsimon.&Tafsilotli.730.Saralamaslik.Bejirim ko.rinish.&2 ta panelda.&Jihozlar.Asosiy jildni ochmoq.Bir pog.ona yuqoriga

C:\Program Files\7-Zip\Lang\va.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	9508
Entropy (8bit):	4.956382401228677
Encrypted:	false
SSDEEP:	192:bFIzlmWIGz4txB2GnYESx8EvawZP7/uHCkU331:5bUzwxB2GfJwZP7/uHCkO31
MD5:	1651078BE7CE617922904CA7941FAE20
SHA1:	1FE33F74AAA6AF59B5055B968EF6424107544538
SHA-256:	C0D985DEA02778276BA3D3DF96B50B33F7BA0C1EC7C62761F0DCD67A05B62270
SHA-512:	E1721EE191E1BA24212E85C013497C66D35DB0E48DF464D2E86762B4A0855AC04FFEC59AF8C259F91DFF0924D977FFEB1FBA92A7C9A951D5F8FDDFD0B02BB67E
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 4.26 : Tomas Miralles.; 4.44 : Fernando Verd..; 24.05 : 2024-05-23 : David Chova.;.;.;.;.;.;.;.;.0.7-Zip.Valencian.Valenci..401.Accepta.Cancel.la....&Si.&No.Tan&ca.Ajuda..&Continua.440.Si a &tot.No a t&ot.Atura.Reinicia.Segon pla.Primer pla.&Pausa.Parat.Esteu segur que voleu cancel.lar?.500.&Fitxer.&Edita.&Mostra.Favorits.Eines.Ajuda.540.&Obri.Obri d&ins.Obri fora.&Mostra.&Edita.Canvia &nom.&Copia a....&Despla.a a....&Suprimeix.&Separa fitxer....Com&bina fitxers....P&ropietats.Come&ntari.Calcula checksum.Difer.ncia.Nova carpeta.Nou fitxer.Ix.Vincula.Fluxos &alternatius.600.Seleccion&a-ho tot.Deselecciona-ho tot.&Inverteix selecci..Selecciona....No selecciones....Selecciona per tipus.No selecciones per tipus.700.Icones g&rans.Icones menudes.&Llista.&Detall.730.No ordenat.Vista plana.&2 Taules.&Barres d'eines.Obri directori arrel.Directori pare.Historial de carpetes....Actualit&za.Actualitza autom.ticament.750.Barra d'eines de Fitxer.Barra d'eines Est.nda

C:\Program Files\7-Zip\Lang\vi.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	8111
Entropy (8bit):	5.364411458818708
Encrypted:	false
SSDEEP:	96:EpyG/WRw/t50jb9+lrFwm9HIb4He0Wtd2iYNo+rRkRLTEMqbfMu9854Il2cqXK:Ekhw/tmlScwlni8CSku9bW
MD5:	A0612FA9EB8196659D15C67AC965A5E6
SHA1:	AE733BBAEF962F3A10C5855ED30B6D084C8C5D5F
SHA-256:	C73634402C3EFFDB2750AB5CF6F1083ABD8771529BFF6F7E513D646E0FCDAE23
SHA-512:	74991149573FBC7B5D9BEF36B0F8CB00951BEBE959F2D9058C227F3E75A874E22C8AA6219BBD643E483E0D969674A9CA9004E33F116BC923A30C872FC3F7909C
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 2.30 : : Tran Hong Ha.; 4.42 : : Le Vu Hoang.; 4.48 : : Nguyen Hong Quan.; 9.07 : 2011-04-12 : Vietnamize Team.;.;.;.;.;.;.;.0.7-Zip.Vietnamese.Ti.ng Vi.t.401...ng ..H.y b.....C..Kh.ng...ng.Gi.p ....Ti.p t.c.440.C. t.t c..Kh.ng t.t c..D.ng.L.m l.i.Ch.y n.n.Ch. .. .u ti.n.D.ng... d.ng.B.n ch.c ch.n mu.n h.y b.?.500.T.p tin.Bi.n t.p.Xem..a th.ch.C.ng c..Gi.p ...540.M..M. t.i ..y.M. trong c.a s. kh.c.Xem.Bi.n t.p...i t.n.Sao ch.p ..n....Di chuy.n ..n....Xo..Chia c.t t.p n.n....N.i t.p n.n....Thu.c t.nh.Ch. th.ch.T.nh checksum (md5).So s.nh.T.o th. m.c.T.o t.p n.n.Tho.t.600.Ch.n t.t c..B. ch.n t.t c....o l.a ch.n.Ch.n....B. ch.n....Ch.n theo lo.i.B. ch.n theo lo.i.700.Bi.u t..ng l.n.Bi.u t..ng nh..Danh s.ch.Chi ti.t.730.Kh.ng s.p x.p.

C:\Program Files\7-Zip\Lang\yo.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	10469
Entropy (8bit):	5.284564106594488
Encrypted:	false
SSDEEP:	192:8F6LuxAINK+9IPpdcigPDojX4MmlmYplGPvxtdogal+7opiQRDev/4Fq/+ePRRtG:wxAELigPDoHITPjk6b9Fq/+1z
MD5:	5D90F9C7771022E43C15A4393A0670CE
SHA1:	689269A4B3AED23CDF59ED395732C592B515AC83
SHA-256:	DE2497946932D806F822082C3CF9F2F26A18752D9973F9D09E0889A94CE4C28A
SHA-512:	7A8BD040989CF66DD0F15BE68DFCF2799C34C491FDF900315AB82619938C79BE9F18C6A5B1A4AC7DF6BBA951B3B309DDAF4F5ED628A69B8B893406F68FBC9510
Malicious:	false
Preview:	;!@Lang2@!UTF-8!.; 15.00 : 2015-03-29 : Ibrahim Oyekan.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Yoruba.Yoruba.401.O DAA.Pa re....&B..ni.&B..k..&P.d...r.nl.w...&T..-s.w.j..440.B..ni fun &gbogbo ..B..k. fun &gbogbo ..D.r....t.nb..r...&...h.n-.gb.h.n.&Oj.-.gb.h.n.&D.d.r...d.r...e . d.j. pe .nyin f.. paar..500.&Fa.li.&Tunk..&.w..&A.y..&Irin....&.r.nl.w..540.&.i..i &si .n...i &si .ta.&.w..&Tunk..&Tun oruk. k..&...d. si....&Gb. si....&Paar..&P.n fa.li...... .w.n fa.li k.p......&.b.d..&.r. .w.ye.....e i.iro checksum..y.t...D. .p. fa.li sil...D. fa.li sil...&P.d...t..kas..&Yiyan agbara d.t..600....y.n &gbogbo fa.li.Paa ...y.n gbogbo fa.li.&Yi ...y.n Pad.....y.n....Paa ...y.n.......y.n bi ir. fa.li.Paa ...y.n bi ir. fa.li.700.&.mi .l..&.mi K.ker..&Ak.j...&Aw.n alaye.730.Lai t. l.s.

C:\Program Files\7-Zip\Lang\zh-cn.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	8236
Entropy (8bit):	6.029530102631068
Encrypted:	false
SSDEEP:	192:6vCfchxHZbOVSVzaAP67peMNyE7nA95tLPggo:OxM0VLP677y4Y1PgF
MD5:	D13839AF103477DF8CFD0BC2EB876EB0
SHA1:	93AF39EBEB9677003DB67B386588409329104F4E
SHA-256:	D04E5BD3BF1E3F3754C3603889AA1B659D1DAC518C5C6B5C1C49ECF16DCA1C01
SHA-512:	DD79B5A8790E906E8BBE3FE69476126AB76ED472B4374E5FB7F4B272365BC305492832A1E3B95D22FC7D3C9EDD9B013C7BC8871C6BC85A717ACF3B361DA1900F
Malicious:	false
Preview:	;!@Lang2@!UTF-8!.; 2.30 : 2002-09-07 : Modern Tiger, kaZek, Hutu Li.; 3.08 : 2003-08-29 : Tunghsiao Liu.; 22.00 : 2022-06-09 : Tunghsiao Liu.; 24.05 : 2024-05-16 : MagicGenius.;.;.;.;.;.;.;.0.7-Zip.Chinese Simplified......401...........(&Y)..(&N)...(&C).......(&C).440...(&A)...(&L)...........(&B)...(&F)...(&P).............500...(&F)...(&E)...(&V)...(&A)...(&T)...(&H).540...(&O).......(&I).......(&U)...(&V)...(&E)....(&M)....(&C).......(&M)......(&D).....(&S)........(&B)......(&R)...(&N)........................(&X).........(&A).600...(&A)........(&I).....................................700....(&G)....(&M)...(&L).....(&D).730.............

C:\Program Files\7-Zip\Lang\zh-tw.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	8383
Entropy (8bit):	6.039482945933355
Encrypted:	false
SSDEEP:	192:dIEm/UwNgrNf35q4H0PPTo0CCKL9xlDCrBYwlW/A2flOEBV:dxmMwN5LTo/CKJuBdMtNV
MD5:	E6C38C199079BE58EE81E8DA55E783AC
SHA1:	1AD09B0146F317786AFB0A09C7907E6CCB5C207E
SHA-256:	76A17B0A97925E5D6DEB1EBE8AE14F83BD49957C492C3733A0EA178E28B0D74B
SHA-512:	014D3FB64B22DA94D5AC7626B3E4BF9321FB05647BDB1BE3EEF79ADD3EFB06EF6B0FC1590031D4E781489AFC96BA4B7E4A86590BCE98C901812E890A4680ED02
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!.; 4.59 : Leon Tseng, sec2, ...; 9.07 - 24.04 : Jack Pang.;.;.;.;.;.;.;.;.;.0.7-Zip.Chinese Traditional......401...........(&Y)..(&N)...(&C).......(&C).440.....(&A).....(&L).............(&B).....(&F)...(&P)...........?.500...(&F)...(&E)...(&V).....(&A)...(&T)...(&H).540...(&O)......(&I)......(&U)...(&V)...(&E).....(&M)....(&C).......(&M)......(&D).....(&S)........(&B)......(&R)...(&N).........................(&X).........(&A).600...(&A).........(&I)............................700....(&G)....(&M)...(&L).....(&D).730.............(&2)....(&T)...........................(

C:\Program Files\7-Zip\License.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6031
Entropy (8bit):	5.187853729445909
Encrypted:	false
SSDEEP:	96:dNlju+xpEYNgOrLJIJzDJu3S3zVSwOrLJIJzAu3S3zVSw7Edxb1wp:pjuoDNgOrNcXJu3S3JSwOrNccu3S3JSE
MD5:	761B393DAC39374A072E58AA6A4872FC
SHA1:	FA049F28E907AB6A0489D1FEC1746DF3A26D22E2
SHA-256:	3A9A7BCA133A8AF4560F48DFA351F941E110D80A2C2466E537EC6680B9FC2DDA
SHA-512:	93C5A05469D4469C713370AC8D711CAF57BF87B91B4F77AAA6F950552180548624890EC0E910C0F0E2FA1E05417EDF37E31E9C128815A3811110BCA90885860E
Malicious:	false
Preview:	7-Zip.. ~~~~~.. License for use and distribution.. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~.... 7-Zip Copyright (C) 1999-2024 Igor Pavlov..... The licenses for files are:.... - 7z.dll:.. - The "GNU LGPL" as main license for most of the code.. - The "GNU LGPL" with "unRAR license restriction" for some code.. - The "BSD 3-clause License" for some code.. - The "BSD 2-clause License" for some code.. - All other files: the "GNU LGPL"..... Redistributions in binary form must reproduce related license information from this file..... Note:.. You can use 7-Zip on any computer, including a computer in a commercial.. organization. You don't need to register or pay for 7-Zip.......GNU LGPL information..--------------------.... This library is free software; you can redistribute it and/or.. modify it under the terms of the GNU Lesser General Public.. License as published by the Free Software Foundation; either.. version 2.1 of the License, or

C:\Program Files\7-Zip\Uninstall.exe

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.3780621318846284
Encrypted:	false
SSDEEP:	192:Qplw/Q3AjmqdD5KOEBrXJWRVkdQ2l+827nNHy+NXNUoynP+yJihMNV28d/o:ulgQ3655Kv1XIRV2Qi4Xax+yJ+MNH
MD5:	5DFDDA860BA69DF0AE0AB193CF22A4AD
SHA1:	631C3B573B87688A9C5C5F9268FA826B315ACB22
SHA-256:	2FFA1C010889DC2C03DFEF2271343AC6032C3966530C383B92D3DFD99A3AADC5
SHA-512:	BA844E4157D1DA80879D89D52155E10F02682F34D92A5A7A57FB1D723CAC66B01FF3AACE379072780C01720419FD21F1F25279F6587950E9ED4C43688C284A95
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.6...X...X...X.x.R...X..V...X.x.\...X......X...Y.W.X......X.!.R...X...^...X.Rich..X.................PE..L.....f........../..........@......f!.......0....@..........................p..............................................$9.......`...............................................................................0...............................text............................... ..`.rdata.......0......................@..@.data...X....@.......(..............@....rsrc........`.......*..............@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\descript.ion

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	366
Entropy (8bit):	4.850296649357081
Encrypted:	false
SSDEEP:	6:erK7MYoNHyQLPzXP+USQV7ZiKvwo7/qP5SiEQkXP6ZzeBVOkYBNWeR/W7jGPhrVC:CYkHt/PHVqo7I5s/EWO/NhNWePh0
MD5:	EB7E322BDC62614E49DED60E0FB23845
SHA1:	1BB477811ECDB01457790C46217B61CB53153B75
SHA-256:	1DA513F5A4E8018B9AE143884EB3EAF72454B606FD51F2401B7CFD9BE4DBBF4F
SHA-512:	8160B581A3F237D87E664D93310F5E85A42DF793B3E22390093F9FB9A0A39950BE6DF2A713B55259FCE5D5411D0499886A8039288D9481B4095FABADDDBEBB60
Malicious:	false
Preview:	7-zip.chm 7-Zip Help..7-Zip.dll 7-Zip Plugin..7-Zip32.dll 7-Zip Plugin 32-bit..7z.dll 7-Zip Engine..7z.exe 7-Zip Console ..7z.sfx 7-Zip GUI SFX..7zCon.sfx 7-Zip Console SFX..7zFM.exe 7-Zip File Manager..7zg.exe 7-Zip GUI..descript.ion 7-Zip File Descriptions..history.txt 7-Zip History..Lang 7-Zip Translations..license.txt 7-Zip License..readme.txt 7-Zip Overview..

C:\Program Files\7-Zip\readme.txt

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1714
Entropy (8bit):	4.972914136099253
Encrypted:	false
SSDEEP:	24:75J24igGGPLmVpGSLdyHalrGxs8T95LvNigwJa9YlbQGL6rZgU7ZT4sUdJrt:75HXYlLd0/7T9dvkgwJa9e8G4a
MD5:	800E525E791CE8CA84A9200DDCABD6B2
SHA1:	69800F0C14111FD0CA7F6A41268AD5F4D8ED24F4
SHA-256:	7687C86D1096D2587A8EE0A9E585725ABD1AB7A8AF98FDF1CC8234AE94624F33
SHA-512:	095A707BBE3AF79CDA2E77799817AE979F72233C92BE0CA2F1B089AA285DE6498AFCD44F84C328B094CBFC733F16C664135BFCAA9A93E5AF73BB90AFABCB71F1
Malicious:	false
Preview:	7-Zip 24.08..-----------....7-Zip is a file archiver for Windows.....7-Zip Copyright (C) 1999-2024 Igor Pavlov.....The main features of 7-Zip: .... - High compression ratio in the new 7z format.. - Supported formats:.. - Packing / unpacking: 7z, XZ, BZIP2, GZIP, TAR, ZIP and WIM... - Unpacking only: APFS, AR, ARJ, Base64, CAB, CHM, CPIO, CramFS, DMG, EXT, FAT, GPT, HFS,.. IHEX, ISO, LZH, LZMA, MBR, MSI, NSIS, NTFS, QCOW2, RAR, .. RPM, SquashFS, UDF, UEFI, VDI, VHD, VHDX, VMDK, XAR, Z and ZSTD... - Fast compression and decompression.. - Self-extracting capability for 7z format.. - Strong AES-256 encryption in 7z and ZIP formats.. - Integration with Windows Shell.. - Powerful File Manager.. - Powerful command line version.. - Localizations for 90 languages......7-Zip is free software distributed under the GNU LGPL (except for unRar code)...Read License.txt for more information about license....... This distribution package con

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip File Manager.lnk

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Oct 3 09:51:28 2023, mtime=Thu Oct 24 14:36:44 2024, atime=Sun Aug 11 12:00:00 2024, length=986624, window=hide
Category:	dropped
Size (bytes):	776
Entropy (8bit):	4.567427915343761
Encrypted:	false
SSDEEP:	12:8Dipo0YXih9xKGbdpF4kX4y9rZ0XZ3kPNQjAszUbdp2fUtz4mNmV:8DiaOdHIaZ0XZyEAaAd4fczrNm
MD5:	242B910B1ED5EF7B7FB80F1D7F81CE82
SHA1:	6816BD742728F2A905D192AE2FCDB139E0463A36
SHA-256:	048AF5DFE5138FECA362FCD9B1CD3DDDF53BE659D0065481A457938A4C6F2FF7
SHA-512:	3BCC1BBFE0AFCDB67357D70BCEC590D5B77647739F327BD76DB6F846EA10D3FEB79C1709A522E4ED9CF0BFE770F66CC5AAE2F278A93F4DB61B6A2910188986C0
Malicious:	false
Preview:	L..................F.... ............t.*&...H._............................e....P.O. .:i.....+00.../C:\.....................1.....DW.V..PROGRA~1..t......O.IDW5`....B...............J.....i...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....P.1.....CWoV..7-Zip.<......CWoVDW.V..............................7.-.Z.i.p.....Z.2......Y.h .7zFM.exe..B......CWoVXY.\|..............................7.z.F.M...e.x.e.......N...............-.......M...........T........C:\Program Files\7-Zip\7zFM.exe........\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.7.-.Z.i.p.\.7.z.F.M...e.x.e.`.......X.......818225...........hT..CrF.f4... .G...a......).;.hT..CrF.f4... .G...a......).;.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip Help.lnk

Download File

Process:	C:\Users\user\Desktop\7z2408-x64.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Oct 3 09:51:28 2023, mtime=Thu Oct 24 14:36:43 2024, atime=Sat Aug 10 15:00:00 2024, length=120396, window=hide
Category:	dropped
Size (bytes):	781
Entropy (8bit):	4.602839861790493
Encrypted:	false
SSDEEP:	12:8oKlh+0YXih96wiGbdpF4kXkhVFcu6wtjA9Zlebdp2WmtzoohxmoohImV:8P7dHGVqwJAfl6d4Wizoouooym
MD5:	6C3EBD0B07522B84DEA5581C1E5FF276
SHA1:	28E21629E3B3526F57953CB633C92A8372DD9CB3
SHA-256:	77183DAB79B89EBC61CD8BBA6735827B91486D42A5FA8813DB7674BFBDACA029
SHA-512:	E08C0105338AE136240CD779CF96010C5611B8F77D6D8FE990628428333781FE259C0BE817DD9D8397608607EA94652965FC2241886505CF4B4E3E6CD419BE9F
Malicious:	false
Preview:	L..................F.... ...........kx.*&.....Z>...L.......................g....P.O. .:i.....+00.../C:\.....................1.....DW.V..PROGRA~1..t......O.IXY.\|....B...............J.....i...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....P.1.....CWoV..7-Zip.<......CWoVXY.\|..............................7.-.Z.i.p.....\.2.L....Y.. .7-zip.chm.D......CWoVXY.\|..............................7.-.z.i.p...c.h.m.......O...............-.......N...........T........C:\Program Files\7-Zip\7-zip.chm../.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.7.-.Z.i.p.\.7.-.z.i.p...c.h.m.`.......X.......818225...........hT..CrF.f4... .G...a......).;.hT..CrF.f4... .G...a......).;.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.996466295353874
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	7z2408-x64.exe
File size:	1'624'144 bytes
MD5:	0330d0bd7341a9afe5b6d161b1ff4aa1
SHA1:	86918e72f2e43c9c664c246e62b41452d662fbf3
SHA256:	67cb9d3452c9dd974b04f4a5fd842dbcba8184f2344ff72e3662d7cdb68b099b
SHA512:	850382414d9d33eab134f8bd89dc99759f8d0459b7ad48bd9588405a3705aeb2cd727898529e3f71d9776a42e141c717e844e0b5c358818bbeac01d096907ad1
SSDEEP:	24576:UEBmEo1y9fcw5K42KmEDaMYAhr08oSG4OdWrfjcaHSNXJdx7wE9iko6qzLJmYYUP:UEvoo24xV2JJdPwMJ3x75z5q0jc/3
TLSH:	307533927C094177FA5942F1949BBDEEF8FCDD154CAC818D0BA10A6F98B5740827E2E3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~..X:...:...:...U...1.......?...U...8.......8...:...h.......1.......7.......;.......;...Rich:...........................PE..L..

File Icon


Icon Hash:	b8868baba9aba2d8

Static PE Info

General

Entrypoint:	0x407294
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT
Time Stamp:	0x66B8B5D0 [Sun Aug 11 13:00:00 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	cf0d2de4fd6406302012e0f40060395f

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 00408C38h
push 00407420h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 68h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
xor ebx, ebx
mov dword ptr [ebp-04h], ebx
push 00000002h
call dword ptr [004080BCh]
pop ecx
or dword ptr [0040D8E0h], FFFFFFFFh
or dword ptr [0040D8E4h], FFFFFFFFh
call dword ptr [004080B8h]
mov ecx, dword ptr [0040A8D0h]
mov dword ptr [eax], ecx
call dword ptr [004080B4h]
mov ecx, dword ptr [0040A8CCh]
mov dword ptr [eax], ecx
mov eax, dword ptr [004080B0h]
mov eax, dword ptr [eax]
mov dword ptr [0040D8E8h], eax
call 00007FF6ACB63EC5h
cmp dword ptr [0040A010h], ebx
jne 00007FF6ACB63DBEh
push 00407410h
call dword ptr [004080ACh]
pop ecx
call 00007FF6ACB63E97h
push 0040A00Ch
push 0040A008h
call 00007FF6ACB63E82h
mov eax, dword ptr [0040A8C8h]
mov dword ptr [ebp-6Ch], eax
lea eax, dword ptr [ebp-6Ch]
push eax
push dword ptr [0040A8C4h]
lea eax, dword ptr [ebp-64h]
push eax
lea eax, dword ptr [ebp-70h]
push eax
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [004080A4h]
push 0040A004h
push 0040A000h
call 00007FF6ACB63E4Fh

Rich Headers

Programming Language:

[ C ] VS98 (6.0) SP6 build 8804
[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8c44	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe000	0xfe8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x14c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x65ee	0x6600	92c15bc559436197211dd4ef06b937c3	False	0.6510416666666666	data	6.614114625059912	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1346	0x1400	6371f58804eb9c582c616252e35f441a	False	0.4130859375	data	4.617694084721839	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x38ec	0x200	598e1aae6ecbd8237c4383f4be94b9f1	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xe000	0xfe8	0x1000	20da3b4bc17b37bbf40354d2a9099839	False	0.37255859375	data	4.366205442800389	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xe480	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.16532258064516128
RT_ICON	0xe768	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.32094594594594594
RT_DIALOG	0xe8b8	0x176	data	English	United States	0.5802139037433155
RT_GROUP_ICON	0xe890	0x22	data	English	United States	1.0
RT_VERSION	0xe1b0	0x2d0	data	English	United States	0.4666666666666667
RT_MANIFEST	0xea30	0x5b2	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.47462277091906724

Imports

DLL	Import
ole32.dll	CoCreateInstance, CoInitialize
USER32.dll	PeekMessageW, ExitWindowsEx, GetDlgItemTextW, SetWindowTextW, ShowWindow, MessageBoxW, CreateDialogParamW, LoadIconW, SendMessageW, GetMessageW, EnableWindow, GetDlgItem, IsDialogMessageW, TranslateMessage, DispatchMessageW, SetDlgItemTextW, DestroyWindow
ADVAPI32.dll	RegSetValueExW, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, RegQueryValueExW, RegOpenKeyExW, RegCloseKey, RegCreateKeyExW
SHELL32.dll	SHGetFolderPathW, SHBrowseForFolderW, SHGetPathFromIDListW
MSVCRT.dll	_exit, _XcptFilter, _acmdln, __getmainargs, _initterm, __setusermatherr, _adjust_fdiv, __p__commode, __p__fmode, __set_app_type, _except_handler3, _controlfp, memcpy, memcmp, memmove, malloc, free, exit, memset
KERNEL32.dll	ReadFile, CloseHandle, CreateFileW, FormatMessageW, WriteFile, DeleteFileW, CreateDirectoryW, GetSystemDirectoryW, LoadLibraryW, GetModuleFileNameW, GetFileAttributesW, SetFilePointer, GetVersion, LoadLibraryExW, GetModuleHandleA, GetStartupInfoA, LocalFree, SetFileAttributesW, SetFileTime, MoveFileExW, GetLastError, lstrcatW, GetCommandLineW, lstrcpyW, GetModuleHandleW, GetProcAddress, GetCurrentProcess, lstrlenW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 17:37:00.423110008 CEST	53	57922	1.1.1.1	192.168.2.4
Oct 24, 2024 17:37:02.094926119 CEST	53	55687	1.1.1.1	192.168.2.4

Target ID:	0
Start time:	11:36:38
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\7z2408-x64.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\7z2408-x64.exe"
Imagebase:	0x400000
File size:	1'624'144 bytes
MD5 hash:	0330D0BD7341A9AFE5B6D161B1FF4AA1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	27.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	28.6%
Total number of Nodes:	294
Total number of Limit Nodes:	9

Executed Functions

Function 004017DE Relevance: 77.6, APIs: 33, Strings: 11, Instructions: 560
windowstringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,C:\Users\user\Desktop\7z2408-x64.exe,00000000), ref: 0040181F
GetDlgItemTextW.USER32(0000006F,C:\Program Files\7-Zip\,00000104), ref: 004018AC

Part of subcall function 004022B2: memcmp.MSVCRT(00000037,00408B8C,00000006), ref: 00402338
Part of subcall function 004022B2: memmove.MSVCRT(?,?,00000020,0040185A,00000104,00000000,?,0040185A), ref: 0040237B

lstrlenW.KERNEL32(C:\Program Files\7-Zip\), ref: 00401930
ShowWindow.USER32(00000005,00402A55,00402A55), ref: 004019D1
ShowWindow.USER32(00000005), ref: 004019DB
SendMessageW.USER32(00000406,00000000,?), ref: 004019EF
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00401A24
IsDialogMessageW.USER32(?), ref: 00401A37
TranslateMessage.USER32(?), ref: 00401A48
DispatchMessageW.USER32(?), ref: 00401A55
SendMessageW.USER32(00000402,00000000,00000000), ref: 00401A84
SetWindowTextW.USER32(75C0B400,75C0B400), ref: 00401ACC
lstrcpyW.KERNEL32(?,C:\Program Files\7-Zip\,?,000000FF,?,?,?,?,00402A55,00402A55,00000000,00000000,00402A55,00402A55), ref: 00401B8D
lstrcpyW.KERNEL32(C:\Program Files\7-Zip\,?), ref: 00401BAA
lstrlenW.KERNEL32(C:\Program Files\7-Zip\), ref: 00401BC3
GetFileAttributesW.KERNEL32(C:\Program Files\7-Zip\), ref: 00401BD9
SetFileAttributesW.KERNELBASE(C:\Program Files\7-Zip\,00000000), ref: 00401BE6
lstrcatW.KERNEL32(?,C:\Program Files\7-Zip\), ref: 00401C62
lstrlenW.KERNEL32(?), ref: 00401C7F
MessageBoxW.USER32(?,Error,00000212), ref: 00401CAA
SetFileTime.KERNELBASE(?,00000000,00000000,?,?), ref: 00401D68
SetFileAttributesW.KERNELBASE(C:\Program Files\7-Zip\,?,?), ref: 00401DA1
MoveFileExW.KERNEL32(C:\Program Files\7-Zip\,?,00000005,?), ref: 00401DB6
GetLastError.KERNEL32 ref: 00401DEB
SendMessageW.USER32(00000402,?,00000000), ref: 00401E14
SetWindowTextW.USER32(7-Zip 24.08 (x64) is installed), ref: 00401E5D
MessageBoxW.USER32(You must restart your system to complete the installation.Restart now?,00000104), ref: 00401EBE
GetCurrentProcess.KERNEL32(00000028,?), ref: 00401ECF
OpenProcessToken.ADVAPI32(00000000), ref: 00401ED6
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00401EEA
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00401F08
GetLastError.KERNEL32 ref: 00401F0E
ExitWindowsEx.USER32(00000002,00000000), ref: 00401F1A

Strings

C:\Program Files\7-Zip\, xrefs: 0040189B, 004018A3, 004018D1, 00401900, 0040192F, 00401B8B, 00401BA9, 00401BC2, 00401BD8, 00401BE5, 00401C60, 00401DA0, 00401DB5
C:\Users\user\Desktop\7z2408-x64.exe, xrefs: 004017E8
SeShutdownPrivilege, xrefs: 00401EE4
7-zip.dll, xrefs: 00401C0D
Error, xrefs: 00401C9E
Can't open file, xrefs: 00401C4A
Incorrect path, xrefs: 0040190B
You must restart your system to complete the installation.Restart now?, xrefs: 00401EB3
7-Zip 24.08 (x64) is installed, xrefs: 00401E52
.tmp, xrefs: 00401BB0
7-zip32.dll, xrefs: 00401C29

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID: Message$File$Window$AttributesSendTextlstrlen$ErrorLastProcessShowTokenlstrcpy$AdjustCurrentDialogDispatchExitItemLookupModuleMoveNameOpenPeekPrivilegePrivilegesTimeTranslateValueWindowslstrcatmemcmpmemmove
String ID: .tmp$7-Zip 24.08 (x64) is installed$7-zip.dll$7-zip32.dll$C:\Program Files\7-Zip\$C:\Users\user\Desktop\7z2408-x64.exe$Can't open file$Error$Incorrect path$SeShutdownPrivilege$You must restart your system to complete the installation.Restart now?
API String ID: 2360875437-3709528279
Opcode ID: 49aa2477088cb05e07a8cc8bc2188ce611f4d8f5025904ec388401a45e0dadb1
Instruction ID: bca0c9d1fc7a2cd7ed8aae71669a6c9a624b793e83b856d7a90086725f90eff6
Opcode Fuzzy Hash: 49aa2477088cb05e07a8cc8bc2188ce611f4d8f5025904ec388401a45e0dadb1
Instruction Fuzzy Hash: 583229719002199BDB20EF94DE84AEEB7B9FF44308F50847BE105B72A0DB785A85CF59

Function 004025C5 Relevance: 1.6, APIs: 1, Instructions: 55comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00408C18,00000000,00000001,00408C08,0040259C,00000000,?,00000000,?,?,?,0040259C), ref: 004025E3

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: ade2aa36860f559734fc4b5bd685036fb33efc22c7440584c789e3943ad72554
Instruction ID: d93d9dfcfae9697bc99f6fb64a647af4c93c7c6b5f3b85fac4cd9631c4badb45
Opcode Fuzzy Hash: ade2aa36860f559734fc4b5bd685036fb33efc22c7440584c789e3943ad72554
Instruction Fuzzy Hash: 3B014475700214BFD704CB98C989E5A77BCEF89755F1004B8F505EB290DA71AD05CBA0

Function 00401000 Relevance: 61.5, APIs: 25, Strings: 10, Instructions: 237
windowregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004059FD: GetVersion.KERNEL32 ref: 00405A07
Part of subcall function 004059FD: GetModuleHandleW.KERNEL32(kernel32.dll,SetDefaultDllDirectories), ref: 00405A1D
Part of subcall function 004059FD: GetProcAddress.KERNEL32(00000000), ref: 00405A24
Part of subcall function 004059FD: GetSystemDirectoryW.KERNEL32(?,00000106), ref: 00405A49
Part of subcall function 004059FD: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00405ABE

CoInitialize.OLE32(00000000), ref: 0040100F
GetCommandLineW.KERNEL32(?,?,?,00000000,?,?,?,?,004073C8,00000000,?,0000000A), ref: 0040101A
lstrcpyW.KERNEL32(0040A234,C:\Users\user\Desktop\7z2408-x64.exe,?,?,?,00000000,?,?,?,?,004073C8,00000000,?,0000000A), ref: 004010AA
GetModuleHandleW.KERNEL32(kernel32.dll,IsWow64Process,?,?,?,00000000,?,?,?,?,004073C8,00000000,?,0000000A), ref: 004010DF
GetProcAddress.KERNEL32(00000000), ref: 004010E6
GetCurrentProcess.KERNEL32(?,?,?,?,00000000,?,?,?,?,004073C8,00000000,?,0000000A), ref: 004010F7
RegOpenKeyExW.KERNELBASE(80000001,00000000,00020119,?,?,?,?,00000000,?,?,?,?,004073C8,00000000,?,0000000A), ref: 00401145
RegCloseKey.KERNELBASE(?,C:\Program Files\7-Zip\,?,?,?,00000000,?,?,?,?,004073C8,00000000,?,0000000A), ref: 00401165
CreateDialogParamW.USER32(?,00000064,00000000,00401512,00000000), ref: 004011C8
LoadIconW.USER32(?,00000001), ref: 004011E3
SendMessageW.USER32(00000080,00000001,00000000), ref: 004011FC
KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 00401206
IsDialogMessageW.USER32(00010442,?), ref: 0040123C
TranslateMessage.USER32(?), ref: 0040124B
DispatchMessageW.USER32(?), ref: 00401256
SetDlgItemTextW.USER32(00010442,00000001,Close), ref: 0040129E
GetDlgItem.USER32(00000001,00000001), ref: 004012AE
KiUserCallbackDispatcher.NTDLL(00000000), ref: 004012B1
GetDlgItem.USER32(00000002,00000000), ref: 004012BC
KiUserCallbackDispatcher.NTDLL(00000000), ref: 004012BF
GetDlgItem.USER32(00000001,00000001), ref: 004012CB
SendMessageW.USER32(00000028,00000000), ref: 004012D6
KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 004012E0
DestroyWindow.USER32(00010442,?,?,?,00000000,?,?,?,?,004073C8,00000000,?,0000000A), ref: 004012F8

Strings

C:\Program Files\7-Zip\, xrefs: 00401029, 0040108E, 00401122, 00401159, 0040116F
Software\Microsoft\Windows\CurrentVersion, xrefs: 00401175
ProgramFilesDir, xrefs: 00401170
IsWow64Process, xrefs: 004010D1
Unsupported command:, xrefs: 004010CA
C:\Users\user\Desktop\7z2408-x64.exe, xrefs: 004010A0
This installation requires Windows x64, xrefs: 00401110
C:\, xrefs: 00401188
kernel32.dll, xrefs: 004010D6
Close, xrefs: 00401297

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID: Message$CallbackDispatcherItemUser$AddressDialogHandleLoadModuleProcSend$CloseCommandCreateCurrentDestroyDirectoryDispatchIconInitializeLibraryLineOpenParamProcessSystemTextTranslateVersionWindowlstrcpy
String ID: C:\$C:\Program Files\7-Zip\$C:\Users\user\Desktop\7z2408-x64.exe$Close$IsWow64Process$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$This installation requires Windows x64$Unsupported command:$kernel32.dll
API String ID: 3116314339-572908365
Opcode ID: 3c1a314ef717c24fb4168a3f10f501934fb676fc8c999798d740cfc8b7066bf0
Instruction ID: 79ffa998225aa52afbd839500803ac24536c3644ac0211110b422c8f633d3838
Opcode Fuzzy Hash: 3c1a314ef717c24fb4168a3f10f501934fb676fc8c999798d740cfc8b7066bf0
Instruction Fuzzy Hash: BA71C571500305ABDB20BF61AF45A6B37A9EB48344F10443FF581B62F1DB798C968B5E

Function 004027C8 Relevance: 47.4, APIs: 4, Strings: 23, Instructions: 146
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004013AF: lstrlenW.KERNEL32(00000000,?,00000000,0040134D,00000104,00000000,00000000), ref: 004013B6

Part of subcall function 00402790: RegCloseKey.ADVAPI32(00000000,00000000,00000000,80000000,80000000,?,0040265D,00000000,00000000,C:\Program Files\7-Zip\), ref: 004027BB

Part of subcall function 0040273D: RegCloseKey.ADVAPI32(00000000,00000000,00000000,80000000,80000000,?,004026D9,00000000,00401E3A,00000000,00000000,C:\Program Files\7-Zip\), ref: 00402768

lstrcpyW.KERNEL32(?,C:\Program Files\7-Zip\,{23170F69-40C1-278A-1000-000100020000},{23170F69-40C1-278A-1000-000100020000},00000000,{23170F69-40C1-278A-1000-000100020000},00000000,{23170F69-40C1-278A-1000-000100020000},00000000,C:\Program Files\7-Zip\,00000000), ref: 0040286B
RegCloseKey.ADVAPI32(00000000,C:\Program Files\7-Zip\,?,00000000), ref: 004028B7
lstrcpyW.KERNEL32(?,C:\Program Files\7-Zip\,C:\Program Files\7-Zip\,?,24.08,00000000,00000000), ref: 00402931

Part of subcall function 004029ED: RegSetValueExW.KERNELBASE(00000000,NoModify,00000000,00000004,00000022,00000004,0040298A,00000001,00000022,00000022), ref: 004029FA

Part of subcall function 0040245B: lstrlenW.KERNEL32(?,00000000,C:\Program Files\7-Zip\,0040243B,C:\Program Files\7-Zip\,C:\Program Files\7-Zip\,00000000,00000000,80000001,?,004023FE), ref: 00402465
Part of subcall function 0040245B: RegSetValueExW.KERNELBASE(00000000,004083C4,00000000,00000001,?,?,?,004023FE), ref: 0040247A

RegCloseKey.KERNELBASE(00000000,Igor Pavlov,00000008,00000018,00590BA5,00000001,00000001,00000022,00000022), ref: 004029E2

Strings

C:\Program Files\7-Zip\, xrefs: 004027D2, 0040285E, 00402869, 004028AE, 0040291A, 0040292F
VersionMajor, xrefs: 004029B2
Path, xrefs: 004028A9
DisplayIcon, xrefs: 00402908
Publisher, xrefs: 004029D0
UninstallString, xrefs: 0040294D
DisplayVersion, xrefs: 004028EF
Igor Pavlov, xrefs: 004029D5
\7-Zip, xrefs: 004027F0
VersionMinor, xrefs: 004029C1
QuietUninstallString, xrefs: 00402971
EstimatedSize, xrefs: 004029A5
DisplayName, xrefs: 004028E2
7zFM.exe, xrefs: 0040286D
NoRepair, xrefs: 0040298D
NoModify, xrefs: 0040297E
24.08, xrefs: 004028F4
Software\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip, xrefs: 004028C5
Software\Microsoft\Windows\CurrentVersion\App Paths\7zFM.exe, xrefs: 00402885
{23170F69-40C1-278A-1000-000100020000}, xrefs: 004027D9, 00402808, 00402818, 0040283C, 00402852
Uninstall.exe", xrefs: 00402933
InstallLocation, xrefs: 00402915
/S, xrefs: 00402957

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID: Close$Valuelstrcpylstrlen
String ID: /S$24.08$7zFM.exe$C:\Program Files\7-Zip\$DisplayIcon$DisplayName$DisplayVersion$EstimatedSize$Igor Pavlov$InstallLocation$NoModify$NoRepair$Path$Publisher$QuietUninstallString$Software\Microsoft\Windows\CurrentVersion\App Paths\7zFM.exe$Software\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip$Uninstall.exe"$UninstallString$VersionMajor$VersionMinor$\7-Zip${23170F69-40C1-278A-1000-000100020000}
API String ID: 1122074173-3262778063
Opcode ID: 90ce98688f2d5e34a8d570e914000392af8318f38df41f941088184e0ff9db8d
Instruction ID: b9127ceb9d5a46d4aa5fde42f789f0406f2df1e76989dbd811a3b8cce1a779cf
Opcode Fuzzy Hash: 90ce98688f2d5e34a8d570e914000392af8318f38df41f941088184e0ff9db8d
Instruction Fuzzy Hash: 98512B70A00518ABCB10FB91CF89A9E737AEBC4309F6080BEA445776C5DF785E069B5D

Function 00401512 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItemTextW.USER32(?,0000006F,?,00000104), ref: 00401562
SetDlgItemTextW.USER32(?,0000006F,?), ref: 004015A4
GetDlgItem.USER32(?,0000006F), ref: 00401624
GetDlgItem.USER32(?,00000071), ref: 0040162E
GetDlgItem.USER32(?,00000072), ref: 00401638
SetWindowTextW.USER32(?), ref: 00401646
SetDlgItemTextW.USER32(?,0000006F,C:\Program Files\7-Zip\), ref: 00401654
ShowWindow.USER32(00000000), ref: 00401668
ShowWindow.USER32(00000000), ref: 00401672

Strings

C:\Program Files\7-Zip\, xrefs: 0040164C
Select the folder for installation:, xrefs: 0040157B

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID: Item$Text$Window$Show
String ID: C:\Program Files\7-Zip\$Select the folder for installation:
API String ID: 388342126-3663326204
Opcode ID: 30cb4b6e524bdc0cdeec52959ebb66b1f985e4466ad449e0e6b091809d87d5e3
Instruction ID: aa0ac4a6eaa286a9cd860ddab29ca7960ce2c466b98144f0e9de4802fb686450
Opcode Fuzzy Hash: 30cb4b6e524bdc0cdeec52959ebb66b1f985e4466ad449e0e6b091809d87d5e3
Instruction Fuzzy Hash: E631A271540208BBEB215F20DE49FAA3F68EF44744F04443AB644BA1F1CBBA9D92CE5D

Function 004024A0 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 85
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathW.SHELL32(?,00401E32,00000000,00000000,?,00000000,C:\Program Files\7-Zip\,00000000), ref: 004024DC

Part of subcall function 004013AF: lstrlenW.KERNEL32(00000000,?,00000000,0040134D,00000104,00000000,00000000), ref: 004013B6

lstrlenW.KERNEL32(?), ref: 00402528
lstrcpyW.KERNEL32(?,C:\Program Files\7-Zip\), ref: 00402558
DeleteFileW.KERNELBASE(?), ref: 00402583

Part of subcall function 004020E0: CreateDirectoryW.KERNELBASE(?,00000000,004021B3), ref: 004020E3

Part of subcall function 004025C5: CoCreateInstance.OLE32(00408C18,00000000,00000001,00408C08,0040259C,00000000,?,00000000,?,?,?,0040259C), ref: 004025E3

Strings

C:\Program Files\7-Zip\, xrefs: 004024AC, 00402552
7zFM.exe, xrefs: 00402560
7-Zip File Manager.lnk, xrefs: 00402539
7-zip.chm, xrefs: 00402567
7-Zip Help.lnk, xrefs: 00402540

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID: Createlstrlen$DeleteDirectoryFileFolderInstancePathlstrcpy
String ID: 7-Zip File Manager.lnk$7-Zip Help.lnk$7-zip.chm$7zFM.exe$C:\Program Files\7-Zip\
API String ID: 1231897949-3814743698
Opcode ID: 929d5675deb997439388413e5827c965651e28c9e6cf6438915d7e8474103172
Instruction ID: 836199bef6e1b8ae3ff7deda2154b2d10579f0acfa05bb262082896cf9c21857
Opcode Fuzzy Hash: 929d5675deb997439388413e5827c965651e28c9e6cf6438915d7e8474103172
Instruction Fuzzy Hash: 40312D71900219EBCF10EB95CFD9A9EB779AB40304F5080BED545B21D0DB799E45CB1C

Function 00402637 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 75
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00402790: RegCloseKey.ADVAPI32(00000000,00000000,00000000,80000000,80000000,?,0040265D,00000000,00000000,C:\Program Files\7-Zip\), ref: 004027BB

Part of subcall function 00402775: RegCreateKeyExW.KERNELBASE(80000000,00408368,00000000,00000000,00000000,000F003F,00000000,?,00000000,004027A2,00000000,80000000,80000000,?,0040265D,00000000), ref: 00402787

RegCloseKey.KERNELBASE(00401E3A,Apartment,?), ref: 004026C2
lstrcpyW.KERNEL32(?,C:\Program Files\7-Zip\,00401E3A,00000000,00000000,C:\Program Files\7-Zip\,00000000), ref: 0040268A

Part of subcall function 004013AF: lstrlenW.KERNEL32(00000000,?,00000000,0040134D,00000104,00000000,00000000), ref: 004013B6

Part of subcall function 0040245B: lstrlenW.KERNEL32(?,00000000,C:\Program Files\7-Zip\,0040243B,C:\Program Files\7-Zip\,C:\Program Files\7-Zip\,00000000,00000000,80000001,?,004023FE), ref: 00402465
Part of subcall function 0040245B: RegSetValueExW.KERNELBASE(00000000,004083C4,00000000,00000001,?,?,?,004023FE), ref: 0040247A

lstrcpyW.KERNEL32(?,C:\Program Files\7-Zip\,00000000,00000000,00401E3A,00000000,00000000,C:\Program Files\7-Zip\,00000000), ref: 004026FE
RegCloseKey.KERNELBASE(00000000,Apartment,?), ref: 00402736

Strings

C:\Program Files\7-Zip\, xrefs: 00402647, 00402684, 004026F8
7-zip.dll, xrefs: 00402700
Apartment, xrefs: 004026B5, 00402729
7-zip32.dll, xrefs: 0040268C
ThreadingModel, xrefs: 004026B0, 00402724

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID: Close$lstrcpylstrlen$CreateValue
String ID: 7-zip.dll$7-zip32.dll$Apartment$C:\Program Files\7-Zip\$ThreadingModel
API String ID: 1845523679-814007440
Opcode ID: 99d54b312159f407540c534f5855129b97239dda6a6048e97b93816b088f8a98
Instruction ID: e0c1b5e85c7b29de90095ac5383f9c1f78394e2e17ea02843a41af4b28f3aa51
Opcode Fuzzy Hash: 99d54b312159f407540c534f5855129b97239dda6a6048e97b93816b088f8a98
Instruction Fuzzy Hash: 70214F35600218ABDB10FBA1DF89E9E777A9F84308F60807EA444772D5DE789E069B5C

Function 004020F7 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 118
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(C:\Program Files\7-Zip\,00000000,C:\Program Files\7-Zip\,00000000), ref: 0040210F
lstrcpyW.KERNEL32(?,C:\Program Files\7-Zip\), ref: 00402124
GetFileAttributesW.KERNELBASE(?), ref: 0040218B
lstrlenW.KERNEL32(?), ref: 004021D0
GetFileAttributesW.KERNEL32(?), ref: 0040224B
lstrlenW.KERNEL32(?), ref: 00402268

Part of subcall function 004020E0: CreateDirectoryW.KERNELBASE(?,00000000,004021B3), ref: 004020E3

Strings

C:\Program Files\7-Zip\, xrefs: 00402107, 00402108, 0040210E, 00402122

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID: lstrlen$AttributesFile$CreateDirectorylstrcpy
String ID: C:\Program Files\7-Zip\
API String ID: 3759649792-3995016716
Opcode ID: 1b98bc01977e7c6620f6cbe1e7dd022a2f7f3a7a05d088e4b32267e71b4874e7
Instruction ID: f6ebc12cd63022d4102967b468339dd31ef09c2b6121dab04151c2e252e649cd
Opcode Fuzzy Hash: 1b98bc01977e7c6620f6cbe1e7dd022a2f7f3a7a05d088e4b32267e71b4874e7
Instruction Fuzzy Hash: E641913280122996DF2096E8DF8CBAE7264AB14344F5405FFD905B62D1E7FCDF858A4D

Function 00404D18 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,00400000,00401D10,00000000,00000000,C:\Program Files\7-Zip\,00000000,?), ref: 00404D4B
GetLastError.KERNEL32 ref: 00404D69

Strings

C:\Program Files\7-Zip\, xrefs: 00404D1D

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: C:\Program Files\7-Zip\
API String ID: 442123175-3995016716
Opcode ID: 46146804f2855f3a2075e9890cad093e8d2ce40a12403a818318e0a66c72cd06
Instruction ID: b4368f144cd45de466427b66c6f37b69b5f093ddedfa9160c9ce22dee7f5cf83
Opcode Fuzzy Hash: 46146804f2855f3a2075e9890cad093e8d2ce40a12403a818318e0a66c72cd06
Instruction Fuzzy Hash: 120186B6600604ABDB148F58D940BAEB7B9DFC0391F11413EEA45A7390E7789D009758

Function 00404C43 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,-7FBFE7BD,00000001,00000000,00401840,00000080,00000000,C:\Users\user\Desktop\7z2408-x64.exe,00404C42,00000000,00401843), ref: 00404C6F
GetLastError.KERNEL32 ref: 00404C81

Strings

C:\Users\user\Desktop\7z2408-x64.exe, xrefs: 00404C47

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID: CreateErrorFileLast
String ID: C:\Users\user\Desktop\7z2408-x64.exe
API String ID: 1214770103-557768597
Opcode ID: d0f132b1f7e35754d85a2099c28ba985bab998d24fafb2453eacad13ae193dbe
Instruction ID: b05d9f4319aa1628d913803176c41fd7b36891af5f92d011d2d6a52319e5d1a2
Opcode Fuzzy Hash: d0f132b1f7e35754d85a2099c28ba985bab998d24fafb2453eacad13ae193dbe
Instruction Fuzzy Hash: 55E026F27A02106FF3184B38CD06F7A62D88754B20F260B3DBB42E62C0D9B888004328

Function 00401404 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion,00000000,00020119,00000000,80000002,00000000,00401184,ProgramFilesDir,C:\Program Files\7-Zip\), ref: 00401419
RegCloseKey.ADVAPI32(00000000,?,00000000), ref: 0040143B

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00401417

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID: CloseOpen
String ID: Software\Microsoft\Windows\CurrentVersion
API String ID: 47109696-1019749484
Opcode ID: ea197e00e82a21fad55461e2a25d6b2be7d95d1369f249d9a7288cf367ddd15a
Instruction ID: 5570f971838be5c210e4a2accc44a76506a7149c7a6950c488abec6ff1e3f156
Opcode Fuzzy Hash: ea197e00e82a21fad55461e2a25d6b2be7d95d1369f249d9a7288cf367ddd15a
Instruction Fuzzy Hash: 91E03971610208BBDB10DBA0DE06AAE7668EB40765F104069B905A61A0DA389E04E7A8

Function 0040245B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,00000000,C:\Program Files\7-Zip\,0040243B,C:\Program Files\7-Zip\,C:\Program Files\7-Zip\,00000000,00000000,80000001,?,004023FE), ref: 00402465
RegSetValueExW.KERNELBASE(00000000,004083C4,00000000,00000001,?,?,?,004023FE), ref: 0040247A

Strings

C:\Program Files\7-Zip\, xrefs: 0040245B

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID: Valuelstrlen
String ID: C:\Program Files\7-Zip\
API String ID: 799288031-3995016716
Opcode ID: cc83c864d80e84ce564c0fe6eb97e2a60a57884d2975776d487c01062d2cc183
Instruction ID: 4ed770e6954c35b0a3a5ace2a251ddaf0c3e6f474f7ad74015ffada5852c5521
Opcode Fuzzy Hash: cc83c864d80e84ce564c0fe6eb97e2a60a57884d2975776d487c01062d2cc183
Instruction Fuzzy Hash: 84D05E36100210BBC7208B119D0CFABBF69EBC9720F06442EB648921608A718405CA64

Function 00402408 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00402485: RegCreateKeyExW.KERNELBASE(80000001,00408434,00000000,00000000,00000000,000F013F,00000000,004023FE,00000000,00402420,00000000,00000000,80000001,?,004023FE), ref: 00402497

Part of subcall function 0040245B: lstrlenW.KERNEL32(?,00000000,C:\Program Files\7-Zip\,0040243B,C:\Program Files\7-Zip\,C:\Program Files\7-Zip\,00000000,00000000,80000001,?,004023FE), ref: 00402465
Part of subcall function 0040245B: RegSetValueExW.KERNELBASE(00000000,004083C4,00000000,00000001,?,?,?,004023FE), ref: 0040247A

RegCloseKey.KERNELBASE(00000000,C:\Program Files\7-Zip\,C:\Program Files\7-Zip\,C:\Program Files\7-Zip\,00000000,00000000,80000001,?,004023FE), ref: 0040244F

Strings

C:\Program Files\7-Zip\, xrefs: 0040242F, 00402430, 00402435, 00402444

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Program Files\7-Zip\
API String ID: 1356686001-3995016716
Opcode ID: 7a4633444304d987466881b8bc2d9962fde262f176236eb13cd91957d7f7d179
Instruction ID: df0ad8313cd6208403a6f6586978a006ab72e4f111db4d0f99f09dd89dff7c0f
Opcode Fuzzy Hash: 7a4633444304d987466881b8bc2d9962fde262f176236eb13cd91957d7f7d179
Instruction Fuzzy Hash: F3F05E36510214EBCB00EBA5DB4988E33AAAB89314B21407AE440B7281DEB49E029798

Function 004029ED Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(00000000,NoModify,00000000,00000004,00000022,00000004,0040298A,00000001,00000022,00000022), ref: 004029FA

Strings

NoModify, xrefs: 004029F8

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID: Value
String ID: NoModify
API String ID: 3702945584-1699962838
Opcode ID: 3e27b29a8ce55f0004f328f73818b2b5a689c30158cacb75b599ce131a6d034e
Instruction ID: 6c065fc95a3a0ec3b847f77730806b6a51358ffdbb636912793ddaa94612ca43
Opcode Fuzzy Hash: 3e27b29a8ce55f0004f328f73818b2b5a689c30158cacb75b599ce131a6d034e
Instruction Fuzzy Hash: F6C092F12803007AF12087108E0AF27726CA790F18F1184297340A90C085B098008A2C

Function 00404D7A Relevance: 3.1, APIs: 2, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(?,00000104,00000000,00000000,00000104,00000000,00000000,?,?,00401873,00000000), ref: 00404DBD
GetLastError.KERNEL32(?,00401873,00000000), ref: 00404DCA

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 07f84625df344749b37252e0a233fb0b1a61cd57f0647645e3d8d3a7ac1929c1
Instruction ID: ecc9796a3c0d2aa7d629d9a961747dbf77a4330ced58c2ee988280fbeefc76f0
Opcode Fuzzy Hash: 07f84625df344749b37252e0a233fb0b1a61cd57f0647645e3d8d3a7ac1929c1
Instruction Fuzzy Hash: 1601B5B1304500AFD7548B69ED05AAB73E9EFC4750F10493BE246E72C0D578DC009668

Function 00404CB6 Relevance: 3.0, APIs: 2, Instructions: 44
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,0040185A,00400000,?,00000000,00000000,?,00000000,?,?,004022EA,0040185A,00000104,00000000), ref: 00404CE9
GetLastError.KERNEL32(?,00000000,?,?,004022EA,0040185A,00000104,00000000), ref: 00404D07

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: c601d5e73958c3d8396abd8a0fb48a708afa278f8f76f35ee36cfa897b079874
Instruction ID: 895c84d86b04f8649c1ebb19b22f32c48ffbd6e726453a132d389989ddc1f623
Opcode Fuzzy Hash: c601d5e73958c3d8396abd8a0fb48a708afa278f8f76f35ee36cfa897b079874
Instruction Fuzzy Hash: C30186B6604604ABEB148F58E940BAAB7A5EFC4351F21403EEB45A7380E7B49D00D758

Function 00401684 Relevance: 3.0, APIs: 2, Instructions: 32COMMON

Download Yara Rule

APIs

SHBrowseForFolderW.SHELL32(?), ref: 004016C7
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 004016D5

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID: BrowseFolderFromListPath
String ID:
API String ID: 1200278197-0
Opcode ID: e7bf3f3c92c66f9a74d58fe3a5a67100f031318a606b4a06c22dff4c5f3fe616
Instruction ID: 40680242efd52b0b594769a65aecdf5647435b4b9db22be16a486c32b40eb321
Opcode Fuzzy Hash: e7bf3f3c92c66f9a74d58fe3a5a67100f031318a606b4a06c22dff4c5f3fe616
Instruction Fuzzy Hash: 9EF04F71D00209AFCF54CFA4D845BAEBBF4BB08340F00863EA405F6290EB79D6448F98

Function 004016E6 Relevance: 3.0, APIs: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

SHGetPathFromIDListW.SHELL32(?,?), ref: 00401702
SendMessageW.USER32(?,00000467,00000001,?), ref: 00401730

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID: FromListMessagePathSend
String ID:
API String ID: 3727204005-0
Opcode ID: 3267fe1e053528ded4dae680779bf04f206471d632505a79808c900b2dde2d24
Instruction ID: c3e4be7dc32a6b7654b60535256cd56baea63cad526cb4d067fbbbb82a51e392
Opcode Fuzzy Hash: 3267fe1e053528ded4dae680779bf04f206471d632505a79808c900b2dde2d24
Instruction Fuzzy Hash: 31F0A97121030DAADF208F90DC49FAB3768BB04740F008232BA90BA0E2EA74C9908B59

Function 004020E0 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,004021B3), ref: 004020E3
GetLastError.KERNEL32 ref: 004020F0

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 666820e4a727066e08d63fd84040a92fe9dc0374d57e58459e7fbcd14a223cb1
Instruction ID: a265eadc54316d7fd95cf04170e731e01e4559aa9bbb8dd6e47d2c6966615eb2
Opcode Fuzzy Hash: 666820e4a727066e08d63fd84040a92fe9dc0374d57e58459e7fbcd14a223cb1
Instruction Fuzzy Hash: 65B092B07502019AEEA01B326F0DB173A686B40782F014979A241F01D5EE78C004E52C

Function 004022B2 Relevance: 2.6, APIs: 2, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00404CB6: ReadFile.KERNELBASE(?,0040185A,00400000,?,00000000,00000000,?,00000000,?,?,004022EA,0040185A,00000104,00000000), ref: 00404CE9
Part of subcall function 00404CB6: GetLastError.KERNEL32(?,00000000,?,?,004022EA,0040185A,00000104,00000000), ref: 00404D07

memcmp.MSVCRT(00000037,00408B8C,00000006), ref: 00402338
memmove.MSVCRT(?,?,00000020,0040185A,00000104,00000000,?,0040185A), ref: 0040237B

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID: ErrorFileLastReadmemcmpmemmove
String ID:
API String ID: 3189527546-0
Opcode ID: c6022915d6d55d54d23c0acc142cb1905660b4652797eab05fd6332ecb0430a7
Instruction ID: 0aef7e1153ea858ebf9175172dae74ea170abe5f700f1d096b57ba5b9091a57d
Opcode Fuzzy Hash: c6022915d6d55d54d23c0acc142cb1905660b4652797eab05fd6332ecb0430a7
Instruction Fuzzy Hash: A0218772A0030596D7209A75DA4979FB7E8BB90350F10847BDC85E72C0D6BC9E858F19

Function 004013C8 Relevance: 1.5, APIs: 1, Instructions: 25registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,00000000,?,00401436,?,00000000), ref: 004013E7

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 81fe8b38f340f5f1cb4a8a358518d1a533e15a3595ff4784dc5cf76eec413c1f
Instruction ID: eaa7313c6181f19c96f158d1732535e9dbb5764dccad63d915d8ed492d85b4e5
Opcode Fuzzy Hash: 81fe8b38f340f5f1cb4a8a358518d1a533e15a3595ff4784dc5cf76eec413c1f
Instruction Fuzzy Hash: 40E048B1510308FBDB158B54CD09FAF7ABCE701355F10417EB402F1190D674DA449624

Function 00402775 Relevance: 1.5, APIs: 1, Instructions: 12registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(80000000,00408368,00000000,00000000,00000000,000F003F,00000000,?,00000000,004027A2,00000000,80000000,80000000,?,0040265D,00000000), ref: 00402787

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 749f9e7c3ef478d9a1f49543d9b9b90bac6d8459c76963989df8a4e9b3fc3c31
Instruction ID: a0cd40991bbd9a1bcdb9785956509ffede74c94ca0a996847a4c17d4d1ec6dd8
Opcode Fuzzy Hash: 749f9e7c3ef478d9a1f49543d9b9b90bac6d8459c76963989df8a4e9b3fc3c31
Instruction Fuzzy Hash: ECC012F1250200BEFB254B208E04C37796DD7E0740B01C82C7F40D0025C931CC10E634

Function 00402485 Relevance: 1.5, APIs: 1, Instructions: 12registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(80000001,00408434,00000000,00000000,00000000,000F013F,00000000,004023FE,00000000,00402420,00000000,00000000,80000001,?,004023FE), ref: 00402497

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b5de475935815becd7aa78844d0d181ef976465a7db0097d3be5ab6f2d97049d
Instruction ID: f1e451bdf0bfcc7951d24b5c976b455968424608e5017b53810aac2f4fd58aa3
Opcode Fuzzy Hash: b5de475935815becd7aa78844d0d181ef976465a7db0097d3be5ab6f2d97049d
Instruction Fuzzy Hash: 25C012F1250200BEFA104B208E04C37B96DE7E0700B01C82C7F44D0024C531CC10E634

Function 00402A55 Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00402A5D

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: f6eb0b268e00a99eb599f393a6b4ae91c81c018a4147abb8371167258f846626
Instruction ID: 1d9907283564858cab3ed9a87674538309fc4c8b7d3b96fbd8d0dba2a866d09d
Opcode Fuzzy Hash: f6eb0b268e00a99eb599f393a6b4ae91c81c018a4147abb8371167258f846626
Instruction Fuzzy Hash: D6B0129470130141CA6812301B08053216393D0113320C47EB00290088EF3480003508

Function 00402A65 Relevance: 1.3, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00402A66

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: d0cfdb08a7dd7c132a3161af353f64445093ad6eae382f5a1a56d2cda0908abc
Instruction ID: 4d0146f6177289610204436169ef2ce7d86cab642056ce5252b11755cbc014df
Opcode Fuzzy Hash: d0cfdb08a7dd7c132a3161af353f64445093ad6eae382f5a1a56d2cda0908abc
Instruction Fuzzy Hash:

Non-executed Functions

Function 00401FB1 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 101libraryloaderstringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000106), ref: 00401FDA
lstrlenW.KERNEL32(?), ref: 00401FFA
lstrcpyW.KERNEL32(?,version.dll), ref: 00402023
LoadLibraryW.KERNEL32(?), ref: 00402030
GetProcAddress.KERNEL32(00000000,GetFileVersionInfoSizeW), ref: 0040204F
GetProcAddress.KERNEL32(GetFileVersionInfoW), ref: 0040205E
GetProcAddress.KERNEL32(VerQueryValueW), ref: 0040206E
malloc.MSVCRT ref: 0040208D
free.MSVCRT ref: 004020CE

Strings

version.dll, xrefs: 0040201D
C:\Program Files\7-Zip\, xrefs: 00401FC2
GetFileVersionInfoSizeW, xrefs: 00402049
VerQueryValueW, xrefs: 00402063
GetFileVersionInfoW, xrefs: 00402053

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystemfreelstrcpylstrlenmalloc
String ID: C:\Program Files\7-Zip\$GetFileVersionInfoSizeW$GetFileVersionInfoW$VerQueryValueW$version.dll
API String ID: 197247909-721851711
Opcode ID: ec47eff93b880e148d2193434fba117e7fd44c554c1b092129bc5c494f52ddff
Instruction ID: 30b862b13da1e34ac87170e906bfacf1945329da057f87b75dbde71edf7149dd
Opcode Fuzzy Hash: ec47eff93b880e148d2193434fba117e7fd44c554c1b092129bc5c494f52ddff
Instruction Fuzzy Hash: E0312172941258ABDB109FA4DE889AEB6B8FB04340F25447EE641F31D0DBB49E85CB58

Function 004059FD Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 00405A07
GetModuleHandleW.KERNEL32(kernel32.dll,SetDefaultDllDirectories), ref: 00405A1D
GetProcAddress.KERNEL32(00000000), ref: 00405A24
GetSystemDirectoryW.KERNEL32(?,00000106), ref: 00405A49
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00405ABE

Strings

\, xrefs: 00405A65
SetDefaultDllDirectories, xrefs: 00405A13
kernel32.dll, xrefs: 00405A18
\, xrefs: 00405A5A

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemVersion
String ID: SetDefaultDllDirectories$\$\$kernel32.dll
API String ID: 2515194075-2532076501
Opcode ID: d123e89f80f5fab968492f607823b4a41a2c9566f00eeec17f8d0454e73b1252
Instruction ID: b3bb8bffdfe7bd5023bbb0de4f0309506c969c8d5ece4cbab9e3eeb1509b392b
Opcode Fuzzy Hash: d123e89f80f5fab968492f607823b4a41a2c9566f00eeec17f8d0454e73b1252
Instruction Fuzzy Hash: E811E120210604DAD7209B549A8CFA73BB4EF40301F18447AE981FA1E0E7B88888CF6C

Function 00404061 Relevance: 1.9, APIs: 1, Instructions: 670COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(00000000,?,00000000), ref: 004043E5

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 8e01bcadc357b01dcfecbbcb8be30cdb272bc479cb18dfb8849ff7daaa8fc584
Instruction ID: b96c4a811aabbc92522fc205315539a5da5ec40ac5ea8e17d5930c03f850100b
Opcode Fuzzy Hash: 8e01bcadc357b01dcfecbbcb8be30cdb272bc479cb18dfb8849ff7daaa8fc584
Instruction Fuzzy Hash: FB529EB4A0024A9FCF20DF65C590AAEBBF1BF85304F14882EDA41A7391D778E945CB59

Function 00405F40 Relevance: 1.0, Instructions: 997COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0236eb1d7c26a410c00355cc8f136d584589a7e4a013a1ebc3c1e327b760bbb
Instruction ID: 96ee55a48e4e216831a4fcc61479aeb69f8c7217af919509bf23322d89f70c36
Opcode Fuzzy Hash: e0236eb1d7c26a410c00355cc8f136d584589a7e4a013a1ebc3c1e327b760bbb
Instruction Fuzzy Hash: 59922A71E00229CBCF08CFA9C5905ADFBB2FF89310F25826AC9567B395D6345A52CF94

Function 00406A85 Relevance: .5, Instructions: 518COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 089276976f64b7cff8191ba0974aba3fc1d498bc7f9294d448572fac6552f349
Instruction ID: a869b22cae1303f00724174f14bfd49cc7c76283c9d77cc58987d975f3a49c51
Opcode Fuzzy Hash: 089276976f64b7cff8191ba0974aba3fc1d498bc7f9294d448572fac6552f349
Instruction Fuzzy Hash: 65127131E04129DFCB08CF68C5945BCBBB2FF85351F2642AAD956BB280D7349E91DB84

Function 00405692 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a5fbccd82967d8d9d1c0aa4b07ca2768c7190832d7b39275e2752de5f8170c2
Instruction ID: aea15549169915be5237093c8821e91a1dac0d6e7a822251804508964e42d29d
Opcode Fuzzy Hash: 6a5fbccd82967d8d9d1c0aa4b07ca2768c7190832d7b39275e2752de5f8170c2
Instruction Fuzzy Hash: 9BC1A7B29006618FD751CF2DC8401167BE1EF8532877986AAD895EF386D33AE853CF94

Function 00407430 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b992da0320ec3f814fb582ec4cb6330d05488eb9d43a721a90b87cbfbd9ca5c7
Instruction ID: ea2b47763e0110ebd3b17f679a1b912fcfffb8ae47b5a2716e891b326a4797ef
Opcode Fuzzy Hash: b992da0320ec3f814fb582ec4cb6330d05488eb9d43a721a90b87cbfbd9ca5c7
Instruction Fuzzy Hash: B05176314101359BC786EF5DF8D4AEA73E1FB4830EF934A26DE8257581C634E816D6A1

Function 00407294 Relevance: 16.6, APIs: 11, Instructions: 111COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 004072C1
__p__fmode.MSVCRT ref: 004072D6
__p__commode.MSVCRT ref: 004072E4
__setusermatherr.MSVCRT ref: 00407310
_initterm.MSVCRT ref: 00407326
__getmainargs.MSVCRT ref: 00407349
_initterm.MSVCRT ref: 00407359
GetStartupInfoA.KERNEL32(?), ref: 00407398
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 004073BC
exit.MSVCRT ref: 004073CC
_XcptFilter.MSVCRT ref: 004073DE

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: 5cc436b5399664f7e9cbdc6cc894f4595b282c9740a201b4122faa70b2225200
Instruction ID: 2f8956673d21ec640f8ba0191503e7bfaf4859349c12026a4f3e2d9bb38d2992
Opcode Fuzzy Hash: 5cc436b5399664f7e9cbdc6cc894f4595b282c9740a201b4122faa70b2225200
Instruction Fuzzy Hash: 4D417171C44348AFEB209FA4DA45AAA7BB8FB05710F20413FE891B72D1C7785845DB5A

Function 0040173C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(Do you want to cancel 7-Zip 24.08 (x64) installation?,7-Zip 24.08 (x64),00000124,0040167B), ref: 00401763
DestroyWindow.USER32(0040167B), ref: 00401774

Strings

7-Zip 24.08 (x64), xrefs: 00401753
Do you want to cancel 7-Zip 24.08 (x64) installation?, xrefs: 00401758

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID: DestroyMessageWindow
String ID: 7-Zip 24.08 (x64)$Do you want to cancel 7-Zip 24.08 (x64) installation?
API String ID: 1510070584-2920729275
Opcode ID: d6cf62248c248eab8245b2aa26f211f6cb4cb2f24d628e0e12d4538413a57ec5
Instruction ID: 33d935573da361acde556b2ab307168f8462a5a6b28973dd9409d148e1638da2
Opcode Fuzzy Hash: d6cf62248c248eab8245b2aa26f211f6cb4cb2f24d628e0e12d4538413a57ec5
Instruction Fuzzy Hash: 3EE06775551300AFEB116B10EF4975536A1A71471AF60813EE041751F1CBBD08BACE0E

Function 00401325 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41stringwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 004013AF: lstrlenW.KERNEL32(00000000,?,00000000,0040134D,00000104,00000000,00000000), ref: 004013B6

lstrcatW.KERNEL32(00000000,00000000,00000104,00000000,00000000), ref: 00401389
MessageBoxW.USER32(00000000,00000010,00000104,00000000), ref: 004013A4

Strings

ERROR:, xrefs: 0040133D

Memory Dump Source

Source File: 00000000.00000002.2968483022.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2968456951.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968509698.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968533825.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2408-x64.jbxd

Similarity

API ID: Messagelstrcatlstrlen
String ID: ERROR:
API String ID: 650192479-4173811047
Opcode ID: 7e5b12aa29c5ea00aff9491e27bcfed52d1e5784986800da2f0e9e8e01b7bf7f
Instruction ID: c672725afb02d4eba33945643222a571b54df1cc3407f3fcce6f0b4f618b162a
Opcode Fuzzy Hash: 7e5b12aa29c5ea00aff9491e27bcfed52d1e5784986800da2f0e9e8e01b7bf7f
Instruction Fuzzy Hash: 7301A232A011145BE710E755ED44ADBB36F9FC0304F0040BA6989B31B0EF794E968A58

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 7z2408-x64.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\7-Zip\7-zip.chm

C:\Program Files\7-Zip\7-zip.dll

C:\Program Files\7-Zip\7-zip32.dll

C:\Program Files\7-Zip\7z.dll

C:\Program Files\7-Zip\7z.exe

C:\Program Files\7-Zip\7z.sfx

C:\Program Files\7-Zip\7zCon.sfx

C:\Program Files\7-Zip\7zFM.exe

C:\Program Files\7-Zip\7zG.exe

C:\Program Files\7-Zip\History.txt

C:\Program Files\7-Zip\Lang\af.txt

C:\Program Files\7-Zip\Lang\an.txt

C:\Program Files\7-Zip\Lang\ar.txt

C:\Program Files\7-Zip\Lang\ast.txt

C:\Program Files\7-Zip\Lang\az.txt

C:\Program Files\7-Zip\Lang\ba.txt

C:\Program Files\7-Zip\Lang\be.txt

C:\Program Files\7-Zip\Lang\bg.txt

C:\Program Files\7-Zip\Lang\bn.txt

C:\Program Files\7-Zip\Lang\br.txt

C:\Program Files\7-Zip\Lang\ca.txt

C:\Program Files\7-Zip\Lang\co.txt

C:\Program Files\7-Zip\Lang\cs.txt

C:\Program Files\7-Zip\Lang\cy.txt

C:\Program Files\7-Zip\Lang\da.txt

C:\Program Files\7-Zip\Lang\de.txt

C:\Program Files\7-Zip\Lang\el.txt

Windows Analysis Report
7z2408-x64.exe