Edit tour

Windows Analysis Report
7z2301-x64.exe

Overview

General Information

Sample name:	7z2301-x64.exe
Analysis ID:	1428447
MD5:	e5788b13546156281bf0a4b38bdd0901
SHA1:	7df28d340d7084647921cc25a8c2068bb192bdbb
SHA256:	26cb6e9f56333682122fafe79dbcdfd51e9f47cc7217dccd29ac6fc33b5598cd
Infos:

Detection

Score:	19
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Infects executable files (exe, dll, sys, html)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found dropped PE file which has not been started or loaded

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Process Tree

System is w10x64

7z2301-x64.exe (PID: 7436 cmdline: "C:\Users\user\Desktop\7z2301-x64.exe" MD5: E5788B13546156281BF0A4B38BDD0901)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: 7z2301-x64.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\7z2301-x64.exe	System file written: C:\Program Files\7-Zip\7-zip.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	System file written: C:\Program Files\7-Zip\7z.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	System file written: C:\Program Files\7-Zip\7z.exe	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	System file written: C:\Program Files\7-Zip\7-zip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	System file written: C:\Program Files\7-Zip\7zG.exe	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	System file written: C:\Program Files\7-Zip\7zFM.exe	Jump to behavior

Source: 7z2301-x64.exe, 00000000.00000003.1688177644.0000000002734000.00000004.00000020.00020000.00000000.sdmp, License.txt.0.dr	String found in binary or memory: http://www.gnu.org/
Source: 7z2301-x64.exe, 00000000.00000003.1691781092.0000000004577000.00000004.00000020.00020000.00000000.sdmp, 7zFM.exe.0.dr	String found in binary or memory: https://www.7-zip.org/

Source: C:\Users\user\Desktop\7z2301-x64.exe

Code function: 0_2_004017DE GetModuleFileNameW,GetDlgItemTextW,lstrlenW,ShowWindow,ShowWindow,ShowWindow,SendMessageW,PeekMessageW,PeekMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,SendMessageW,PeekMessageW,PeekMessageW,SetWindowTextW,lstrcpyW,lstrcpyW,lstrlenW,GetFileAttributesW,SetFileAttributesW,lstrcatW,lstrlenW,MessageBoxW,SetFileTime,SetFileAttributesW,MoveFileExW,GetLastError,SendMessageW,SetWindowTextW,MessageBoxW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,

0_2_004017DE

Source: C:\Users\user\Desktop\7z2301-x64.exe	Code function: 0_2_00404067	0_2_00404067
Source: C:\Users\user\Desktop\7z2301-x64.exe	Code function: 0_2_0040580A	0_2_0040580A
Source: C:\Users\user\Desktop\7z2301-x64.exe	Code function: 0_2_00404CC3	0_2_00404CC3
Source: C:\Users\user\Desktop\7z2301-x64.exe	Code function: 0_2_00406BFD	0_2_00406BFD
Source: C:\Users\user\Desktop\7z2301-x64.exe	Code function: 0_2_004060B8	0_2_004060B8

Source: Joe Sandbox View	Dropped File: C:\Program Files\7-Zip\7-zip.dll F9B4944D3A5536A6F8B4D5DB17D903988A3518B22FBEE6E3F6019AAF44189B3D
Source: Joe Sandbox View	Dropped File: C:\Program Files\7-Zip\7-zip32.dll 62EF98B00232F9D63A647E201ABFB354582D3FBC342EC63DF15B2A0CE514B5A6
Source: Joe Sandbox View	Dropped File: C:\Program Files\7-Zip\7z.dll 77222E81CB7004E8C3E077AADA02B555A3D38FB05B50C64AFD36CA230A8FD5B9

Source: 7z2301-x64.exe, 00000000.00000000.1634981117.000000000040D000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename7zipInstall.exe, vs 7z2301-x64.exe
Source: 7z2301-x64.exe, 00000000.00000003.1691781092.0000000004577000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7-zip.dll, vs 7z2301-x64.exe
Source: 7z2301-x64.exe, 00000000.00000003.1691781092.0000000004577000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs 7z2301-x64.exe
Source: 7z2301-x64.exe, 00000000.00000003.1691781092.0000000004577000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FileVersionFileDescriptionOriginalFilename_winzip_.rsrcCOFF_SYMBOLSCERTIFICATE vs 7z2301-x64.exe
Source: 7z2301-x64.exe, 00000000.00000003.1691781092.0000000004577000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7z.dll, vs 7z2301-x64.exe
Source: 7z2301-x64.exe, 00000000.00000003.1691781092.0000000004577000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7z.exe, vs 7z2301-x64.exe
Source: 7z2301-x64.exe, 00000000.00000003.1691781092.0000000004577000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7z.sfx.exe, vs 7z2301-x64.exe
Source: 7z2301-x64.exe, 00000000.00000003.1691781092.0000000004577000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7zFM.exe, vs 7z2301-x64.exe
Source: 7z2301-x64.exe, 00000000.00000003.1691781092.0000000004577000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7zg.exe, vs 7z2301-x64.exe
Source: 7z2301-x64.exe, 00000000.00000003.1691781092.0000000004577000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUninstall.exe, vs 7z2301-x64.exe
Source: 7z2301-x64.exe, 00000000.00000002.2876503375.0000000000197000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7zipInstall.exe, vs 7z2301-x64.exe
Source: 7z2301-x64.exe	Binary or memory string: OriginalFilename7zipInstall.exe, vs 7z2301-x64.exe

Source: 7z2301-x64.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: clean19.spre.winEXE@1/109@0/0

Source: C:\Users\user\Desktop\7z2301-x64.exe

0_2_004017DE

Source: C:\Users\user\Desktop\7z2301-x64.exe

Code function: 0_2_004025C5 CoCreateInstance,

0_2_004025C5

Source: 7z2301-x64.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\7z2301-x64.exe

File read: C:\Program Files\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\7z2301-x64.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\7z2301-x64.exe

File read: C:\Users\user\Desktop\7z2301-x64.exe

Jump to behavior

Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: playtodevice.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: devdispitemprovider.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: portabledeviceapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: networkexplorer.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior

Source: C:\Users\user\Desktop\7z2301-x64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00021401-0000-0000-C000-000000000046}\InProcServer32

Jump to behavior

Source: 7-Zip File Manager.lnk.0.dr	LNK file: ..\..\..\..\..\..\Program Files\7-Zip\7zFM.exe
Source: 7-Zip Help.lnk.0.dr	LNK file: ..\..\..\..\..\..\Program Files\7-Zip\7-zip.chm

Source: C:\Users\user\Desktop\7z2301-x64.exe	Automated click: Install
Source: C:\Users\user\Desktop\7z2301-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2301-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2301-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2301-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2301-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2301-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2301-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2301-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2301-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2301-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2301-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2301-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2301-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2301-x64.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 7z2301-x64.exe

Static file information: File size 1589510 > 1048576

Source: C:\Users\user\Desktop\7z2301-x64.exe

Code function: 0_2_00401FB1 GetSystemDirectoryW,lstrlenW,lstrcpyW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,malloc,free,

0_2_00401FB1

Source: 7-zip32.dll.0.dr	Static PE information: section name: .sxdata
Source: 7z.sfx.0.dr	Static PE information: section name: .sxdata
Source: 7zCon.sfx.0.dr	Static PE information: section name: .sxdata

Source: C:\Users\user\Desktop\7z2301-x64.exe

Code function: 0_2_004072E0 push eax; ret

0_2_0040730E

Persistence and Installation Behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\7z2301-x64.exe	System file written: C:\Program Files\7-Zip\7-zip.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	System file written: C:\Program Files\7-Zip\7z.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	System file written: C:\Program Files\7-Zip\7z.exe	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	System file written: C:\Program Files\7-Zip\7-zip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	System file written: C:\Program Files\7-Zip\7zG.exe	Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	System file written: C:\Program Files\7-Zip\7zFM.exe	Jump to behavior

Source: C:\Users\user\Desktop\7z2301-x64.exe	File created: C:\Program Files\7-Zip\7-zip.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7z2301-x64.exe	File created: C:\Program Files\7-Zip\7z.sfx	Jump to dropped file
Source: C:\Users\user\Desktop\7z2301-x64.exe	File created: C:\Program Files\7-Zip\7z.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7z2301-x64.exe	File created: C:\Program Files\7-Zip\7z.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7z2301-x64.exe	File created: C:\Program Files\7-Zip\7-zip32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7z2301-x64.exe	File created: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7z2301-x64.exe	File created: C:\Program Files\7-Zip\7zCon.sfx	Jump to dropped file
Source: C:\Users\user\Desktop\7z2301-x64.exe	File created: C:\Program Files\7-Zip\7zG.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7z2301-x64.exe	File created: C:\Program Files\7-Zip\7zFM.exe	Jump to dropped file

Source: C:\Users\user\Desktop\7z2301-x64.exe	File created: C:\Program Files\7-Zip\7z.sfx			Jump to dropped file
Source: C:\Users\user\Desktop\7z2301-x64.exe	File created: C:\Program Files\7-Zip\7zCon.sfx			Jump to dropped file

Source: C:\Users\user\Desktop\7z2301-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7-zip.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7z2301-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7z.sfx	Jump to dropped file
Source: C:\Users\user\Desktop\7z2301-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7z.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7z2301-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7z.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7z2301-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7z2301-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7-zip32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7z2301-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7zCon.sfx	Jump to dropped file
Source: C:\Users\user\Desktop\7z2301-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7zG.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7z2301-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7zFM.exe	Jump to dropped file

Source: 7z2301-x64.exe, 00000000.00000002.2876920400.0000000000823000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\MusicsProd_VMware_SATA
Source: 7z2301-x64.exe, 00000000.00000003.1747576765.000000000083E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: }\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2301-x64.exe, 00000000.00000003.2353941581.0000000000865000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}(
Source: 7z2301-x64.exe, 00000000.00000003.2353941581.0000000000865000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2301-x64.exe, 00000000.00000003.2070595360.000000000083C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:x
Source: 7z2301-x64.exe, 00000000.00000002.2876920400.0000000000861000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD0hh
Source: 7z2301-x64.exe, 00000000.00000003.1987033584.0000000005115000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}&&
Source: 7z2301-x64.exe, 00000000.00000003.2353941581.0000000000865000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}KK
Source: 7z2301-x64.exe, 00000000.00000002.2877690760.0000000005079000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}yz
Source: 7z2301-x64.exe, 00000000.00000002.2877690760.0000000005079000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}`
Source: 7z2301-x64.exe, 00000000.00000003.2101798092.0000000000870000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_SATA_CD00#4&224f==
Source: 7z2301-x64.exe, 00000000.00000003.2234627664.0000000000861000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Prod_VMware_SATA_CD0==
Source: 7z2301-x64.exe, 00000000.00000002.2876920400.00000000007CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:o
Source: 7z2301-x64.exe, 00000000.00000003.1747032469.0000000000873000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}en
Source: 7z2301-x64.exe, 00000000.00000003.2353941581.0000000000865000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: 7z2301-x64.exe, 00000000.00000003.2070595360.000000000083C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2301-x64.exe, 00000000.00000002.2876920400.00000000007CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:<S
Source: 7z2301-x64.exe, 00000000.00000002.2876920400.00000000007CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0uWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: 7z2301-x64.exe, 00000000.00000002.2877690760.0000000005079000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}``U
Source: 7z2301-x64.exe, 00000000.00000002.2876920400.00000000007CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:&
Source: 7z2301-x64.exe, 00000000.00000003.2318928092.0000000000864000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %1!ls! (%2!c!:) %3!ls!Prod_VMware_SATA_CD0==
Source: 7z2301-x64.exe, 00000000.00000003.1688177644.0000000002734000.00000004.00000020.00020000.00000000.sdmp, History.txt.0.dr	Binary or memory string: - 7-Zip now can extract VHDX disk images (Microsoft Hyper-V Virtual Hard Disk v2 format).
Source: 7z2301-x64.exe, 00000000.00000003.2234627664.0000000000844000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}$$

Source: C:\Users\user\Desktop\7z2301-x64.exe

Code function: 0_2_00401FB1 GetSystemDirectoryW,lstrlenW,lstrcpyW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,malloc,free,

0_2_00401FB1

Source: C:\Users\user\Desktop\7z2301-x64.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\7z2301-x64.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\7z2301-x64.exe

Code function: 0_2_00405B75 GetVersion,GetModuleHandleW,GetProcAddress,GetSystemDirectoryW,LoadLibraryExW,

0_2_00405B75

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	1 Taint Shared Content	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Access Token Manipulation	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
7z2301-x64.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Program Files\7-Zip\7-zip.dll	0%	ReversingLabs
C:\Program Files\7-Zip\7-zip32.dll	0%	ReversingLabs
C:\Program Files\7-Zip\7z.dll	0%	ReversingLabs
C:\Program Files\7-Zip\7z.exe	0%	ReversingLabs
C:\Program Files\7-Zip\7z.sfx	0%	ReversingLabs
C:\Program Files\7-Zip\7zCon.sfx	0%	ReversingLabs
C:\Program Files\7-Zip\7zFM.exe	0%	ReversingLabs
C:\Program Files\7-Zip\7zG.exe	0%	ReversingLabs
C:\Program Files\7-Zip\Uninstall.exe	0%	ReversingLabs

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.gnu.org/	7z2301-x64.exe, 00000000.00000003.1688177644.0000000002734000.00000004.00000020.00020000.00000000.sdmp, License.txt.0.dr	false		high
https://www.7-zip.org/	7z2301-x64.exe, 00000000.00000003.1691781092.0000000004577000.00000004.00000020.00020000.00000000.sdmp, 7zFM.exe.0.dr	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428447
Start date and time:	2024-04-18 23:56:01 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	7z2301-x64.exe
Detection:	CLEAN
Classification:	clean19.spre.winEXE@1/109@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 25 Number of non-executed functions: 10
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 7z2301-x64.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files\7-Zip\7-zip.dll	https://file.io/RqcRlWKFS2O2	Get hash	malicious	Unknown	Browse
	MDE_File_Sample_bc53e2be5cb94cf3349e488ff4045ef63b86a07b.zip	Get hash	malicious	Unknown	Browse
	SPARKtApplication.exe	Get hash	malicious	Unknown	Browse
	7z2301-x64.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	7z2301-x64.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
C:\Program Files\7-Zip\7z.dll	SecuriteInfo.com.Win64.Malware-gen.28496.11808.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.Malware-gen.28496.11808.exe	Get hash	malicious	Unknown	Browse
	https://file.io/RqcRlWKFS2O2	Get hash	malicious	Unknown	Browse
	MDE_File_Sample_bc53e2be5cb94cf3349e488ff4045ef63b86a07b.zip	Get hash	malicious	Unknown	Browse
	SPARKtApplication.exe	Get hash	malicious	Unknown	Browse
	7z2301-x64.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	7z2301-x64.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
C:\Program Files\7-Zip\7-zip32.dll	https://file.io/RqcRlWKFS2O2	Get hash	malicious	Unknown	Browse
	MDE_File_Sample_bc53e2be5cb94cf3349e488ff4045ef63b86a07b.zip	Get hash	malicious	Unknown	Browse
	SPARKtApplication.exe	Get hash	malicious	Unknown	Browse
	7z2301-x64.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	7z2301-x64.exe	Get hash	malicious	Mars Stealer, Vidar	Browse

Created / dropped Files

C:\Program Files\7-Zip\7-zip.chm

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	115300
Entropy (8bit):	7.880920405972669
Encrypted:	false
SSDEEP:	1536:J+rROVdkoexI6ypm/HR/O/E0R9cRWTU4ioFLZbSOnLvkgB7p0gv2N6pZGMeG0/S:eYTk9r9/NE96WB5nxL3NpfW6veGZ
MD5:	DA6AEC447474DF298ECA9F18C2FDA0A9
SHA1:	C1E918FC600856A85A00A89AF6CE623A4349126B
SHA-256:	20C7B0DC8B584975803F3D8DDE90BAD423CC16C0ADDE5B33899428FCF61E485E
SHA-512:	C88D73183194B368D65DA29D5573FF4598574B579D0B1824890C9915E06CEE63F235702BFE78C943994C3FE1849D9773FDDC0343E0CFD28735BCECCF38D06DC1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	ITSF....`................\|.{.......".....\|.{......."..`.......(...............T ......................d.......................,...................j..].!......."..T.....................U.n.c.o.m.p.r.e.s.s.e.d.....M.S.C.o.m.p.r.e.s.s.e.d...{.7.F.C.2.8.9.4.0.-.9.D.3.1.-.1.1.D.0.............LZXC.......................j..A.`#.._...I...$CZ5...-B.XI....+Q.U.!^{..o..Dzq.C(jW..I.^.....!....0...c=....Oq93.I.p`.E...}.O..+.5Y.%jU.X.hb5%6...V.G."..^...X.$.V,.....[#...8...="dk..=....2kl...I.@........D#`F.D2...nJ.H]V...@..................P....uo'.;m..8.......v...._.7....o\|.7.....\|.o..e..i.......W.5.Z.B. ...-........^.._.S.e^....5k.X.G.1..._\|..iV..H.....M.vk.R.._.o....&.cd..`e..+...M^......~l. a8..&3..].$QI..d.:..G......+..C.......H>rjeQ.;.O#....($.R...:q~.UE.Xf^..3..5.L.....W....i..Y..,>..8.o..'%.^sj.[q...o.4..I....=......\|......)Z,l#)8.....a.....Uc.ke.._....ZC..5.E.(fe.../...[........X....7;........Y/.?Q.....JJ..vj...*J..W....?.yy'J.`J.]..{.4.i$.m...

C:\Program Files\7-Zip\7-zip.dll

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	101376
Entropy (8bit):	5.753606983833062
Encrypted:	false
SSDEEP:	1536:T842/mwxwckhjRE3ng2Ey8thQjGYZ1JrTGvWSy/PEw22mGYTNAkQz:TY/bx7kFe3VZ7rTGvWSo28YbQz
MD5:	956D826F03D88C0B5482002BB7A83412
SHA1:	560658185C225D1BD274B6A18372FD7DE5F336AF
SHA-256:	F9B4944D3A5536A6F8B4D5DB17D903988A3518B22FBEE6E3F6019AAF44189B3D
SHA-512:	6503064802101BCA6E25B259A2BFE38E2D8B786BF2CF588AB1FB026B755F04A20857EE27E290CF50B2667425C528313B1C02E09B7B50EDBCD75A3335439C3647
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: , Detection: malicious, Browse Filename: MDE_File_Sample_bc53e2be5cb94cf3349e488ff4045ef63b86a07b.zip, Detection: malicious, Browse Filename: SPARKtApplication.exe, Detection: malicious, Browse Filename: 7z2301-x64.exe, Detection: malicious, Browse Filename: 7z2301-x64.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................................g........................................................Rich............PE..d....\.d.........." ......................................................................`.........................................`Y.......O..........P....p..p...............d....................................................................................text...(........................... ..`.rdata...j.......l..................@..@.data........`.......P..............@....pdata..p....p.......R..............@..@.rsrc...P............j..............@..@.reloc..r...........................@..B........................................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\7-zip32.dll

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	66560
Entropy (8bit):	5.865724800243528
Encrypted:	false
SSDEEP:	1536:qLYX+h0TgBYOse1oGA/DW4aVD80H9mraJ/R3k:kY00TgCO1a/DW4D0EuJ/R3k
MD5:	CE9564F1A1BB9D09693629DCFAB40356
SHA1:	F29A70FB365CC6789EC60F9FAE9478F36A809902
SHA-256:	62EF98B00232F9D63A647E201ABFB354582D3FBC342EC63DF15B2A0CE514B5A6
SHA-512:	DA9712B7E550595FD924BD0C9752E4100F9FA3A33C4E36D1C3C87058F9CD018F90FFF54E5D036F3A10A45815B178C3267EAE2F55239D2789930BA696446B2162
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: , Detection: malicious, Browse Filename: MDE_File_Sample_bc53e2be5cb94cf3349e488ff4045ef63b86a07b.zip, Detection: malicious, Browse Filename: SPARKtApplication.exe, Detection: malicious, Browse Filename: 7z2301-x64.exe, Detection: malicious, Browse Filename: 7z2301-x64.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........c{I..(I..(I..(&..(H..(...(N..(&..(M..(&..(K..(..R(J..(I..(...(..P(F..(..m(H..(...(a..(_..)H..(Rj.(K..(...(H..(...(H..(RichI..(........................PE..L....\.d...........!.........h...............................................P............@.............................................P....................0..........................................................d............................text...n........................... ..`.rdata...2.......4..................@..@.data...<...........................@....sxdata.............................@....rsrc...P...........................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................

C:\Program Files\7-Zip\7z.dll

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1841664
Entropy (8bit):	6.286587259470902
Encrypted:	false
SSDEEP:	24576:E8sHeHKHplfu94i55tbhris2CCEnWaWBvYyozGUIjnRnU:E8Y/Q94iZNrP2t0ZyyIjnRnU
MD5:	4E35A902CA8ED1C3D4551B1A470C4655
SHA1:	AD9A9B5DBE810A6D7EA2C8430C32417D87C5930C
SHA-256:	77222E81CB7004E8C3E077AADA02B555A3D38FB05B50C64AFD36CA230A8FD5B9
SHA-512:	C7966F892C1F81FBE6A2197BD229904D398A299C53C24586CA77F7F657529323E5A7260ED32DA9701FCE9989B0B9A2463CD45C5A5D77E56A1EA670E02E575A30
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: SecuriteInfo.com.Win64.Malware-gen.28496.11808.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.Malware-gen.28496.11808.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: MDE_File_Sample_bc53e2be5cb94cf3349e488ff4045ef63b86a07b.zip, Detection: malicious, Browse Filename: SPARKtApplication.exe, Detection: malicious, Browse Filename: 7z2301-x64.exe, Detection: malicious, Browse Filename: 7z2301-x64.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s..07.sc7.sc7.scA-.c6.scA-.c<.sc7.rcR.scA-.c.sc!.wb4.scA-.c..sc..pb0.scA-.c6.scA-.c6.scA-.c6.scRich7.sc................PE..d....\.d.........." ................pe....................................................`..........................................-.......$..x................1...............!...................................................................................text...]........................... ..`.rdata...^.......`..................@..@.data........0......."..............@....pdata...1.......2...(..............@..@.rsrc................Z..............@..@.reloc...3.......4..................@..B........................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\7z.exe

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	557056
Entropy (8bit):	6.204396774559151
Encrypted:	false
SSDEEP:	6144:mE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQf+L+G:d7a3iwbihym2g7XO3LWUQfh4Co
MD5:	9A1DD1D96481D61934DCC2D568971D06
SHA1:	F136EF9BF8BD2FC753292FB5B7CF173A22675FB3
SHA-256:	8CEBB25E240DB3B6986FCAED6BC0B900FA09DAD763A56FB71273529266C5C525
SHA-512:	7AC1581F8A29E778BA1A1220670796C47FA5B838417F8F635E2CB1998A01515CFF3EE57045DACB78A8EC70D43754B970743ABA600379FE6D9481958D32D8A5AA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............xaX.xaX.xaX...X.xaX...X.xaX.x`XlxaX...X.xaX..eY.xaX...X.xaX`.bY.xaX...X.xaX...X.xaXRich.xaX........................PE..d....\.d.........."...........................@...........................................`.....................................................x............@...q......................................................................0............................text...v........................... ..`.rdata..T...........................@..@.data....-..........................@....pdata...q...@...r..................@..@.rsrc................j..............@..@.reloc...............r..............@..B........................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\7z.sfx

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	214528
Entropy (8bit):	6.472055569253812
Encrypted:	false
SSDEEP:	3072:b6mV2V7sz8SjFy0ta3UqMMuQnIKfrPa/8kpaexwDEJg6oXX/F0SCRKADm:05Sj9tMGUOUksexqEy6oXXN0rKAa
MD5:	FDE7CFC05A92C34840EB8519F58E6321
SHA1:	1891D21310097F8EC825F470053723CACC9575A1
SHA-256:	8661E029CAC3FAE0819423AC442B0BAA109C863474B6BE15E4D83D3A7ECFCB13
SHA-512:	B2B90BF1C88B9CF0FE0AF3A7FA835AB32F2D88336A7E9E63010964EBDEE2C6FBEEA9F7EF71954D6B3B261D278A5901BA5CC80590557F69026F1CE0A95F00FAE8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#...M...M...M..F...M.\|.C...M..G...M..I...M.q.....M...L.N.M.\|.....M...F..M..I...M...G...M..B....M.g.N...M.8.K...M.Rich..M.........................PE..L....\.d........../...............................@......................................................................................&..............................................................................h............................text............................... ..`.rdata...h.......j..................@..@.data...tE...0......................@....sxdata.............................@....rsrc....&.......(..................@..@................................................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\7zCon.sfx

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	193024
Entropy (8bit):	6.543837268031902
Encrypted:	false
SSDEEP:	3072:iTN7sfcmo3tJLiVQyEUYa5/ZVTyLkhg7TNrh64JYyplx4LyvtgWbiJ:+mqtxaQQZVT4kS7TNd64JYUeyvt1ba
MD5:	F9BE893236C2184FEB95094815EEB22E
SHA1:	F9B530D6017050DC417BB3E1757ED0B5F9B68477
SHA-256:	885D232EB013CF2527795712C5D563AD0BDF7DF46126124F5F81411638FA7760
SHA-512:	B19A3AD2B6FB9DD5B934724A16D7B1618AF5DAB91F842334643AEC50FB8079900CC5328B35605A83EF6B0DB60BCF8919854A93ED59C73BCBC83DD69DE18E79E1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........T.YC5..C5..C5..,..@5...)..K5..,..H5..,*..A5...=..B5..C5..55...=..D5..u....5..UJ..B5..u...A5..X.Y.S5...G..@5...3..B5..RichC5..........................PE..L....\.d........../......t...........Z............@..........................p..............................................D...d....`...............................................................................................................text....s.......t.................. ..`.rdata...e.......f...x..............@..@.data...tF..........................@....sxdata......P......................@....rsrc........`......................@..@................................................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\7zFM.exe

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	952832
Entropy (8bit):	6.1620393629203045
Encrypted:	false
SSDEEP:	12288:kRKcv8Nh7py6Rmi78gkPH3aPI9vyVg/0paQuj3IdD02fKBjtp/:JBpDRmi78gkPXlyo0G/jr
MD5:	30AC0B832D75598FB3EC37B6F2A8C86A
SHA1:	6F47DBFD6FF36DF7BA581A4CEF024DA527DC3046
SHA-256:	1EA0839C8DC95AD2C060AF7D042C40C0DAED58CE8E4524C0FBA12FD73E4AFB74
SHA-512:	505870601A4389B7ED2C8FECF85835ADFD2944CBC10801F74BC4E08F5A0D6ECC9A52052FC37E216304CD1655129021862294A698ED36B3B43D428698F7263057
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\..2..2..2.0.\..2..I..2..3..2..O..2..\.D.2...6..2.._..2..N..2..J..2.Rich.2.........................PE..d....\.d.........."......b...8......Pi........@...........................................`.................................................P................... .......................................................................(.......@....................text....a.......b.................. ..`.rdata...i.......j...f..............@..@.data...............................@....pdata.. ...........................@..@.rsrc...............................@..@.reloc...............r..............@..B........................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\7zG.exe

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	700416
Entropy (8bit):	6.147294919046972
Encrypted:	false
SSDEEP:	12288:ffC6Aj+TN5uixZN+8rKhUdTC/wE1ZD0Ca5ZIXV:3LOS2opPIXV
MD5:	50F289DF0C19484E970849AAC4E6F977
SHA1:	3DC77C8830836AB844975EB002149B66DA2E10BE
SHA-256:	B9B179B305C5268AD428B6AE59DE10B4FE99CF0199BBC89B7017181905E97305
SHA-512:	877D852EA1062B90E2FD2F3C4DC7D05D9697E9A9B2929C830A770B62741F6A11E06DE73275EB871113F11143FAF1CB40D99F7C247862FFB778D26833ED5D7E38
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;.VS.y8..y8..y8...C.jy8..y9..y8...E.}y8...V..y8.i.<.~y8...U.ky8...;.~y8...D.~y8...@.~y8.Rich.y8.........PE..d....\.d.........."......&..........."........@.............................. ............`..............................................................d...........................................................................@...............................text...4$.......&.................. ..`.rdata..Ts...@...t...*..............@..@.data...83..........................@....pdata..............................@..@.rsrc....d.......f...:..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\History.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	58305
Entropy (8bit):	4.885689974497804
Encrypted:	false
SSDEEP:	768:NpyTQnnsbPNHGco4PPbiZ0OOeVC0vk90HOYssYK2:nyQnYo4PzSxOeVk90un/K2
MD5:	69A9ED93F118B332335D30F96C66F359
SHA1:	D125AD2574A90CFE50DE95D36F84014D1D0012EE
SHA-256:	83495C16B428D317EC3D27912C852F1AF4B84526F6540E579ED34EBB66364D70
SHA-512:	92625964248A543BD778AF5FAC10F48056D9ADC02C741C0FC0FD3353ABF2737CE838BC3DD08D057B86AA56A314A8C820406930B5B166497B89F321F657636201
Malicious:	false
Preview:	..HISTORY of the 7-Zip..--------------------....23.01 2023-06-20..-------------------------..- The page "Language" in 7-Zip's menu Tools/Options now shows information.. about selected translation, including the number of translated lines...- Some bugs were fixed.......23.00 2023-05-07..-------------------------..- 7-Zip now can use new ARM64 filter for compression to 7z and xz archives... ARM64 filter can increase compression ratio for data containing executable.. files compiled for ARM64 (AArch64) architecture... Also 7-Zip now parses executable files (that have exe and dll filename extensions).. before compressing, and it selects appropriate filter for each parsed file:.. - BCJ or BCJ2 filter for x86 executable files,.. - ARM64 filter for ARM64 executable files... Previous versions by default used x86 filter BCJ or BCJ2 for all exe/dll files...- Default section size for BCJ2 filter was changed from 64 MiB to 240 MiB... It can increase compression ratio

C:\Program Files\7-Zip\Lang\af.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5025
Entropy (8bit):	4.973481979003067
Encrypted:	false
SSDEEP:	96:iK00ZIftkF4Mb/u1tqnukGmaQ7pwNSSax5c1IzEHmgSnMlGqrYy:iCIftu4I/u1onPGmaopwNhaXc16EHEM/
MD5:	7DB01445EF366652C133F316C6FDF764
SHA1:	BA1AF33E920FC820BF474A47768A17C6C93A2EF4
SHA-256:	181E34045FB6338338C68D7CCAA325D47969AC43A20D20D898846F64FB68251A
SHA-512:	81373AF8700ED071AB4F307753C6F00354EA212B7BF3F24D4A61EA2FCB9F16E0674685D621E294170DAA6A71388E6B5BBF12BB1A837AB037A539AF08C9061497
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 4.09 : Petri Jooste..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Afrikaans..Afrikaans..401..OK..Kanselleer........&Ja..&Nee..A&fsluit..Hulp....&Gaan voort..440..Ja vir &almal..Nee vir a&lmal..Stop..Herbegin..&Agtergrond..&Voorgrond..&Wag..Wagtend..Is u seker dat u wil kanselleer?..500..&L.er..R&edigeer..&Vertoon..G&unstelinge..&Gereedskap..&Hulp..540..&Open..Open &Binne..Open B&uite..&Wys..R&edigeer..Her&noem..&Kopieer na.....&Verskuif na.....Ve&rwyder..Ver&deel l.er.....Kom&bineer l.ers.....E&ienskappe..Komme&ntaar......Maak gids..Maak l.er..A&fsluit..600..Selekteer &alles..Deselekteer a&lles..Keer &seleksie om..Selekteer.....Deselekteer.....Selekteer op Soort..Deselekteer op Soort..700..&Groot ikone..&Klein ikone..&Lys..&Detail..730..Ongesorteer....&2 Panele..&Nutsbalke..Maak wortelgids oop..Een vlak ho.r..Gidse geskiedenis.....&Verfris..750..Argiveernutsbalk..Standaardnutsbalk..Groot knoppies..Wys teks op knoppies..800..Voeg gids by gunstelinge &as..Boekmerk

C:\Program Files\7-Zip\Lang\an.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	7776
Entropy (8bit):	4.94944553589067
Encrypted:	false
SSDEEP:	96:ifgKLjEtegAGG8vZQGtc6p/ES4hJ9nOa7cNr8ADTSBPfbc55jXgYXqpNJU+JRP8l:ifEAGRBQ0p/745jMdDTSBXgDQ7V8vBOC
MD5:	1583A850CA7369FCECF12B4159B4328F
SHA1:	E651FF9613B31B8D9602FF6C4FA2CF27678F82F8
SHA-256:	C082AED224D70A3F77E68C0DB90FDFBCEDB8E4C12BB1A4C6DC7561BD8B1FA071
SHA-512:	BD4FC2A28E51147A78459FBD0B47D7898D1FC2024499EC65245173880979EE55F0B177DECAABC94C392A08B04EFB3B7713884525033C2414063422EBC17CF04E
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; : Feliciano Mart.nez Tur..; 9.07 : Juan Pablo Mart.nez..;..;..;..;..;..;..;..;..;..0..7-Zip..Aragonese..Aragon.s..401..Acceptar..Cancelar........&S...&No..&Zarrar..Aduya....&Continar..440..S. a &tot..No a t&ot..Aturar..Tornar a empecipiar..Se&gundo plano..P&rimer plano..&Pausa..Aturau..Yes seguro que quiers cancelar?..500..&Fichero..&Editar..&Veyer..&Favoritos..&Ferramientas..Ad&uya..540..&Ubrir..Ubrir &adintro..Ubrir &difuera..&Veyer..&Editar..Re&nombrar..&Copiar en.....&Mover ta.....&Borrar..Di&vidir o fichero.....C&ombinar os fichers.....&Propiedatz..Comen&tario..Calcular a suma de comprebaci.n..Diff..Creyar carpeta..Creyar fichero..&Salir..600..Seleccionar-lo &tot..Deseleccionar-lo tot..&Invertir selecci.n..Seleccionar.....Deseleccionar.....Seleccionar por tipo..Deseleccionar por tipo..700..Iconos g&rans..&Iconos chicotz..&Lista..&Detalles..730..Desordenau..Anvista plana..&2 panels..&Barras de ferramientas..Ubrir a carpeta radiz..Carpeta mai..Hi

C:\Program Files\7-Zip\Lang\ar.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	12794
Entropy (8bit):	4.350495654207825
Encrypted:	false
SSDEEP:	384:70CIwPJQh3hY4+6TRxAFqpdQbCs7ZpN4QyRl3fcxMZXj4V/2QT:LJi3K4+60Fqpd8Cs7ZpNryRl3fcxMZX6
MD5:	1F1268BF2A1262BA99013F7B36A82655
SHA1:	6101602D68A3F6E229847629DC03B691647046CF
SHA-256:	5A18170ADB8152458716A24BDAA12835FC26C68B31209A9E29E739FCA212A356
SHA-512:	FB44F1C92DF165BBA0EB3FDBF24F5764E5A6FCE61E2484A439C2C914EE254BDB9F8118ECD116A4FEFCA6BC3D657FFE3C25BC66B7F4FF66B1A5FF63E2579A5F8E
Malicious:	false
Preview:	;!@Lang2@!UTF-8!..; 9.07 :............:... ..-.... .........; 9.07 : Awadh A Al-Ghaamdi..;..; 15.00 : 2016-08-28 : ..... ...... .......: ... .... ........; 15.00 : 2016-08-28 : Saif H Al-asadi (edited and corrected)..; 20.00 : 2020-04-01 : Ammar Kurd (Edits and corrections)..;..;..;..;..;..0..7-Zip..Arabic........401.............. .............&.....&....&...................&.........440..... ........ .................. ..........&...........&......&..... ........... .......... ... ..... .. ..........500..&.....&.......&.........&.......&.......&........540..&.....&.... ..........&... ........&.....&..........&.. ............&.. ........&.. .....&.....&..... ............&. ...............&

C:\Program Files\7-Zip\Lang\ast.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5371
Entropy (8bit):	5.033907052031002
Encrypted:	false
SSDEEP:	96:igvORz1nEaS5HgVSmcy1wKv1HNL/P637I4U6/tMjmQW2FtlinC:iZVt4mccwKNtL/P637I4UqIxiC
MD5:	23ECE3A43D2577A1F4BB5D420ABB563F
SHA1:	34D0804C00F45C5CDA77409CBD382DC11932EF4F
SHA-256:	61D67F81971A8A2093041CE58B39C7229B413B991B2FC724E4898BC319539992
SHA-512:	3515E580E9A0E912F8D23080C380F38F91857254967BAA237F1A1CBCB1961A4E469A60A4CD2B33DD1F435CF242E364D95DF3FC95EB6998CB0FB800E86CA47470
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 4.07 : Dinamiteru..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Asturian..Asturianu..401..Val..Torgar........&Si..&Non..&Zarrar..Axuda....&Siguir..440..Si a &Too..Non a T&oo..Parar..Reentamar..&De fondu..&En primer planu..&Posar..Posao...Tas fixu que quies paralo?..500..F&icheru..&Remanar..&Ver..F&avoritos..&Ferramientes..A&xuda..540..&Abrir..Abrir &Dientro..Abrir F&uera..&Ver..&Remanar..Reno&mar..&Copiar a.....&Mover a.....&Borrar..&Partir ficheru.....Com&binar ficheros.....P&ropiedaes..Come&ntariu......Crear carpeta..Crear ficheru..Co&lar..600..Seleicionar &Too..Deseleicionar too..&Invertir seleici.n..Seleicionar.....Deseleicionar.....Seleicionar por Tipu..Deseleicionar por Tipu..700..Miniatures &Grandes..&Miniatures Peque.es..&Llista..&Detalles..730..Ens.n Ordenar....&2 Paneles..&Barres de Ferramientes..Abrir Carpeta Raiz..Xubir Un Nivel..Hestorial de Carpetes.....Actualiza&r..750..Barra Ferramientes d.Archivu..Barra Ferramientes Normal..Botones Grandes..Amos

C:\Program Files\7-Zip\Lang\az.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	9619
Entropy (8bit):	5.376459151658911
Encrypted:	false
SSDEEP:	192:i6SqAQbtI+SY+oEDQM0i+9mhZVgxHksiM04fo3gvje2ojVPC5vUZzxEBa2U:ihSrSYzEsMtVsP0sggv6pC+hxEwr
MD5:	E5A80461B90F025BE5EE9062673B53AC
SHA1:	CDF8042B7CD2BD7C9F09DFA271681CCC6E639864
SHA-256:	F0D1EAD49E7D42F897B7EA715CCE41637C3EBD7EC556541AEDD7CA2156CBA065
SHA-512:	43FA0DAB6CD8321EECAC6C3BDD5B0E90C5EFDC8D2E3919E7684222791DDE1D95C1B159E5398A1159E549AB1C33FF5C6D5052736162CFCC55267A644D631E9716
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 9.07 : F@rhad..; 15.02 : 2015-03-29 : .. .........;..;..;..;..;..;..;..;..;..0..7-Zip..Azerbaijani..Az.rbaycanca..401..OLDU...mtina........&B.li..&Xeyr..&Ba.lamaq..K.m.k....&Davam..440..&Ham.s.na B.li..Ha&m.s.na Xeyr..Dayan..Yenid.n ba.lamaq..&Arxa planda...&nd...F&asil...Fasil.d...H.qiq.t.n .m.liyyat. dayand.rmaq ist.yirsiniz?..500..&Fayl..&D.z.li...&G.r.n....S&e.ilmi.l.r..&Vasit.l.r..&Aray....540..&A.maq..&Daxild. A.maq..B&ay.rda a.maq..&Bax....&D.z.li...Ye&nid.n Adland.rmaq..&N.sx.l.m.k.....&K...rm.k.....&Silm.k..Fayl. &B.lm.k.....Fayllar. B&irl..dirm.k.....X&.susiyy.tl.r....r&h.....Yoxlama C.mi..M.qayis...Qovluq Yaratmaq..Fayl Yaratmaq...&.x.....stinad..&.v.zedici Ax.nlar..600..&Ham.s.n. Se.m.k..Se.imin L..vi..&Se.imi .evirm.k..Se.m.k.....Se.imin L..vi.....N.v.n. G.r. Se.m.k..N.v.n. G.r. Se.imin L..vi..700..&B.y.k ..ar.l.r..K&i.ik

C:\Program Files\7-Zip\Lang\ba.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	11241
Entropy (8bit):	4.699676378547734
Encrypted:	false
SSDEEP:	192:ikN8wxsv75EMVB1m6pP3z/WxdxbpXuBwBMzByzVHQnlBJ7a/NMIMx:ikNhsv75EMVB1m6pP3dzk5ww/NMIq
MD5:	C3EFC3A627FB8B406F8805A12F09739B
SHA1:	BACC7EEDE7610A824CA8EAC89ACA9F6001D25336
SHA-256:	AA8A4BAEBE75F9C0D4319FB65DEB61786DD1BD7E692226FABF2679E2606FA0D5
SHA-512:	4A4ACDD09BB26E97031EB582352EE3733735FD44114230F42ACFB16D3D820DB4E91010DD297773538C7CB7383A9C03D047FBE5F47380A92B751FC42FFEB5B9A5
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 9.20 : Haqmar..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Bashkir.............401............. ..........&.....&....&.............&.......440.......... .. .&......&...... .. ................. .......&..... .........&... ........&........ ................. .... ....... .. ...... ............?..500..&........&......&..........&............&........&.........540..&........&...... ........&..... ..........&.....&...............&...... .............&.................&............&.............. &............... ...&................&..........&................. ......Diff..... ............. &..........&........600..&.

C:\Program Files\7-Zip\Lang\be.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	11861
Entropy (8bit):	4.463971988533468
Encrypted:	false
SSDEEP:	192:i2PDEeaNB1PmcptkcDHxbLPnc67bMxQxGx4ch/JuLQRcg/oN96bPNljYiYr197:ikDFKBFmcPLxPPnIsqrJuqcgAN96b8zv
MD5:	E48F4BF2D0103001EDE9551D62A8C4DD
SHA1:	282D9093F55E9C55D449E074F7CC42D995661EC3
SHA-256:	B49445240BBD9910D1FD693654F8A51D4035FC2D2B572E7C195B917321C27F05
SHA-512:	80361EE17DC2ABDC543BC29E2B3C3395D769845908D26ECD3FDF3DA71F3CD8C514E7D15EB342104CB51AAD4086255E3466DA0E490F27960EA5602E918EBB0332
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; : Kirill Gulyakevitch..; 9.07 : 2011-03-15 : Drive DRKA..;..;..;..;..;..;..;..;..;..0..7-Zip..Belarusian..............401..OK................&.....&....&......................&............440..... ... &........ ... .&.......................&.......&.. ....... ......&......... ......... ........ ....... .......... ........?..500..&......&........&........&..........&.......&.........540..&................ &................... .&................&................&.........&......... ......&........... ......&............&..... ..........&.'...... .............&...........&................. ......Diff..&........ .

C:\Program Files\7-Zip\Lang\bg.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	13096
Entropy (8bit):	4.264364220095299
Encrypted:	false
SSDEEP:	384:i6jWFsfLEnlzlmkbjX8jD5VqWMTlHdr8vwyFSH:tfgheufHdrLyFA
MD5:	F245A8437A36ABE7BF356F77D7E9E104
SHA1:	5DED5211B33E2835BC864E63981DDBB74A58DD32
SHA-256:	4E308D796DBDF26A690102195426A6702AB567363AB8ECD5F063080AB66DC819
SHA-512:	DB868173CE3451EFB02200EAD2A33E1C8C27BECEAEC6768F7F683139D25E43D6D58D8687ED4C65F7BEDAAA3288F20B16FD5BAC11D46245C33F8D0BC64D2C7D39
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; : chavv..; : icobgr..; 4.65 : Vassia Atanassova..;..;..;..;..;..;..;..;..0..7-Zip..Bulgarian.............401..OK...............&....&....&......................&............440.... .. &.......... .. &................ ........&..... .......&........ .......&........ ............... .. ....... .. ..........?..500..&......&.............&...........&........&.............&.......540..&.................. &........... &.......&...........&.................&..........&........ .........&........ ........&..........&........ .. ..........&.......... .. ............&.............&.................. .. ......... ..

C:\Program Files\7-Zip\Lang\bn.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	15037
Entropy (8bit):	4.029160752334597
Encrypted:	false
SSDEEP:	192:ip+g4O23sZEstg+lTr++0Mx148IiZaXTXEU10bXYc+4/rexX4:ipyc2stg+lTr++0MQ8DZRDYc+4axI
MD5:	C0CF8DA47FEF56028EDBB261E4F5A691
SHA1:	D5A8030E1EA15B8F85951149EAC41AAA9C3072CA
SHA-256:	389EEABAE507E204BC53925CC1E2F1A4CC0CCE5D6E74BCA8F015213ED019D7F5
SHA-512:	03392B7563DC5790F09C03DAD7A3BA7154609E3A085BA374C123D9DF482DBFBE12FC679B49E0B9D09C2C7ECE860F4CF5E85A7A90C67EB2AEA4F2786F73C35443
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 4.46 : Team Oruddho (Fahad Mohammad Shaon, Mahmud Hassan)..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Bangla.........401..... ..................&.......&....&.... ................&...... .......440..&....... .... ........&...... .... .............. ......&........& .......&.............. ............... ..... .... ......?..500..&......&..................&..&.......&........&........540..&........ .....7-zip-. ........ ........... ........ .....&..........&............. ..........&..

C:\Program Files\7-Zip\Lang\br.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5357
Entropy (8bit):	5.033371308590495
Encrypted:	false
SSDEEP:	96:iO5Q+ICvu43NfsbvpRJ7mP1Yk1ZjZM4DkukeeaC7AQnRB12tjDZqqHrbqfx3Bdo8:ix+IMrfIpP6dYc1W4DAe1iAQnRG1ZqqS
MD5:	DB2784955E875A93EF7F2D1557F3F6F4
SHA1:	27CD891768902C51E1451F31894E3EFF30620361
SHA-256:	88233348E8BF385ECCC6CB56C4A088900C92E1FA51329769EBC5C4A5E6C2CBE5
SHA-512:	FF540924F456DA8F2BDBC3B434068B239A4D85E163DDF500906683035E47ABB1C0829A9B6FD1466C05C68F2F3AD365874BEFFBE139689771040EC95934B926CD
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 3.12 : KAD-Korvigello. An Drouizig..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Breton..Brezhoneg..401..Mat eo..Nulla.........&Ya..&Ket..&Serri...Skoazell....&Kenderc'hel..440..Ya be&pred..Ket &bepred..Paouez..Adloc'ha...&Drekleur..&Rakleur..&Ehan..Ehanet..Ha fellout a ra deoc'h nulla. ?..500..&Restr..&Aoza...&Gwelout..Di&babo...&Ostilho...&Skoazell..540..&Digeri...Digeri. a-zia&barzh..Digeri. a-zia&vaez..&Gwelout..&Aoza...Adenv&el..&Kopia. diwar.....&Dilec'hia. diwar.....D&ilemel..&Troc'ha. restr.....&Kendeuzi. restro......P&erzhio...Evezhia&denn......Sevel un teul..Sevel ur restr..&Kuitaat..600..Diuz pep &tra..Diziuz pe tra..Lakaat an &diuzad war an tu gin..Diuz.....Diziuz.....Diuz diouzh ar rizh..Diziuz diouzh ar rizh..700..Arlunio. &bras..Arlunio. &bihan..&Roll..&Munudo...730..Dirummet....&2 brenestr..&Barrenno. ostilho...Digeri. an teul gwrizienn..Teul kerent..Roll istor an teul.....Fresk&aat..750..Barrenn ziell..Barrenn skouerek..Meudel

C:\Program Files\7-Zip\Lang\ca.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	9298
Entropy (8bit):	5.021476769281166
Encrypted:	false
SSDEEP:	192:iDNC5+TqX1VvwqqNk3SE/ye3TmsZmpk0R6PeNJH+L/w3M0ZeDwDWBszBUe:iBhuX1OqqNk39BDmfHB4yXBUe
MD5:	812D4995102E9B475B874D0CFDD8F56A
SHA1:	7377BBAA47CA91755574F07FC17BE41C3FAD3237
SHA-256:	3D0FF58CCE129A004CE1D7E0608808CE64E712A0E8AEBDDB908EDA3B191BD883
SHA-512:	4E5AF4D5B699AA32DA6C3F6E027EBD6ED2DB7BCEEAD648F5D4843B307335F21F3D617AC753CF7555FF044210B49BB5475F0D66619BD1353FA9A140D1428362E8
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 9.07 : Josep Casals, Marc Folch..;.17.01.: Benet..BennyBeat..R..i.Camps..;..;..;..;..;..;..;..;..;..0..7-Zip..Catalan..Catal...401..D'acord..Cancel.la........&S...&No..Tan&ca..Ajuda....&Continua..440..S. a &tot..No a t&ot..Atura..Re&inicia..Rere&fons..Prim&er pla..&Pausa..Pausat..Segur que voleu cancel.lar?..500..&Fitxer..&Edita..&Visualitza..&Preferits..E&ines..Aj&uda..540..&Obre..Obre d&ins..Obre &fora..&Visualitza..&Edita..Reanom&ena..&Copia a.....&Mou a.....&Suprimeix..&Divideix el fitxer.....Com&bina el fitxer.....P&ropietats..Come&ntari..Calcula la suma de verificaci...Compara..Crea una carpeta..Crea un fitxer..S&urt..Enlla&...Flux &alternatiu..600..Seleccion&a-ho tot..No seleccionis res..&Inverteix la selecci...Selecciona.....Desselecciona.....Selecciona per tipus..Desselecciona per tipus..700..Icones g&rans..Icones petites..&Llista..&Detalls..730..No ordenat..Vista plana..&2 Panells..&Barres d'eines..Obre la carpeta arrel..Carpeta pare..H

C:\Program Files\7-Zip\Lang\co.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	10952
Entropy (8bit):	5.020730482172355
Encrypted:	false
SSDEEP:	192:iXTd4OzB1duAhLHev6Hqsnk82SlV8FdYojNGW/or65jEe9ytKsKdyDJg:iXTdjJuOLHq6Hqsk82SV4FjNGWgr6px1
MD5:	F9A98B99A163C842A7ADAB1CD8ACCA76
SHA1:	EFEB42FD33ED61AE7430BECF95F8E45E630EF501
SHA-256:	C9A10EE60F89A139D36325595C3DA0AFC0C07D2B6E1CC065BB45D734E1FD133C
SHA-512:	B1DA9357E3D0BAD24A7BB9BB17C94769B2B8A6C2F8F524394CF77B48013602BD35846997BE6D662507AC643C8ADFDDC6CA6C8D36807D1212918563F72708C1ED
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 22.00 : 2022-06-21 : Patriccollu di Santa Maria . Sich. (Latest Update)..; 9.20 : 2010-12-12 : Patriccollu di Santa Maria . Sich. (Creation)..;..;..;..;..;..;..;..;..;..0..7-Zip..Corsican..Corsu..401..Vai..Abbandun.........&S...&N...&Chjode..Aiutu....&Cuntinu...440..S. per &tutti..N. per t&utti..Piant...Rilanci...Tacca di &fondu..&Primu pianu..&Pausa..In pausa..Vulete veramente annull..?..500..&Schedariu..&Mudific...&Affiss...&Favuriti..A&ttrezzi..Ai&utu..540..&Apre..Apre den&tru..Apre f&ora..&Fighj...&Mudific...&Rinumin...&Cupi. versu...&Dispiazz. versu...S&quass...&Sparte u schedariu...&Unisce i schedarii...&Prupriet...Cumme&ntu...Calcul. a somma di cuntrollu..Paragun. e sfarenze..Cre. un cartulare..Cre. un schedariu..&Esce..Liame..Flussi a&lternativi..600..&Tuttu selezziun....n selezziun. &nunda..&Arritrus. a selezzione..&Selezziun.....n &micca selezziun....Selezziun. da u tipu...n selezziun. da u tipu..700.

C:\Program Files\7-Zip\Lang\cs.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	9150
Entropy (8bit):	5.370784980134246
Encrypted:	false
SSDEEP:	192:iRJ98lWxEb5BvGIrd+oc1OTno+SXhbSIm1JjSvcQpK/w:ijK0GeIrQoEOTno+SXox1JjmpKo
MD5:	36A411CF8A6673FD95B4DD282732D5AF
SHA1:	C87638050B904A596F07A3602D6F6AD327762A18
SHA-256:	83916D0FE4CC8A4C414F2E90EE3DD7371A38E2EA44414F948F6DA0F8DD23B600
SHA-512:	37593F73DB6062F4D146E24A4080C56B4625C8AAB4E5BD8F58802082E56401EC218E93DEB9908322064B4E434B855640B19822D568A4434038B6F15F4976CE16
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 4.30 : Milan Hrub...; 4.33 : Michal Molhanec..; 9.07 : Ji.. Mal.k..; 15.00 : Kry.tof .ern...;..;..;..;..;..;..;..0..7-Zip..Czech...e.tina..401..OK..Storno........&Ano..&Ne..Zav..&t..N.pov.da....Po&kra.ovat..440..Ano na &v.echno..N&e na v.echno..Zastavit..Spustit znovu..&Pozad...P&op.ed...Po&zastavit..Pozastaveno..Jste si jist., .e to chcete stornovat?..500..&Soubor...pr&avy..&Zobrazen...&Obl.ben...&N.stroje..N.po&v.da..540..&Otev..t..Otev..t u&vnit...Otev..t &mimo..&Zobrazit..&Upravit..&P.ejmenovat..Kop.rovat &do.....P.&esunout do.....Vymaza&t..&Rozd.lit soubor.....&Slou.it soubory.....Vlast&nosti..Pozn.mk&a..Vypo..tat kontroln. sou.et..Porovnat soubory..Vytvo.it slo.ku..Vytvo.it soubor..&Konec..Odk.zat..&Alternate Streams..600..Vybrat &v.e..Zru.it v.b.r v.e..&Invertovat v.b.r..Vybrat.....Zru.it v.b.r.....Vybrat podle typu..Zru.it v.b.r podle typu..700..&Velk. ikony..&Mal. ikony..&Seznam..&Podrobn

C:\Program Files\7-Zip\Lang\cy.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5216
Entropy (8bit):	5.062305295424628
Encrypted:	false
SSDEEP:	96:iJsNrEk72eXm2pFX6NFYr2KwlQSvGtpoUYPti1La7g2XC0YsYJsq6eFnc:iONrD5vAa0utpoUYP17g2O9hc
MD5:	0C15F3A55DE5D538F2748444623F2745
SHA1:	C15440A16A08339088C563E505012E67C383216A
SHA-256:	2DC41991631AAB989FD2368E1EBAB6B56DFE926307FCB1B8E887205584E99B5F
SHA-512:	D11E819FCB176B185FB6402EBEDBC29118A5CB7757577A04371182E46EB8C85B6F96A8305C15A3C366E4B2FF8DA6479E7F2F7C0CE00EA12598B957D4643A2756
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 4.37 : Owain Lewis..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Welsh..Cymraeg..401..Iawn..Canslo........&Iawn..&Na..&Cau..Cymorth....P&arhau..440..Iawn i'r &Cwbwl..Na i'r C&wbwl..Stopio..Ailgychwyn..&Cefndir..&Blaendir..&Pwyllo..Pwyllo..Ydych chi am canslo?..500..&Ffeil..&Golygu..Gwe&ld..Ff&efrynnau..&Offer..&Cymorth..540..&Agor..Agor tu &Mewn..Agor tu &Fas..Gwe&ld..&Golygu..A&ilenwi..&Cop.o i.....&Symud i.....&Dileu..&Hollti ffeil.....Cy&funo ffeilau.....&Priodweddau..Syl&wad..Cyfrifo swm-gwirio....Creu Ffolder..Creu Ffeil..Alla&n..600..Dewis y C&yfan..Dad-ddewis y Cyfan..Gwrt&hdroi'r Dewis..Dewis.....Dad-ddewis.....Dewis trwy Math..Dad-ddewis trwy Math..700..Eiconau &Mawr..Eiconau &Bach..&Rhestr..Ma&nylion..730..Dad-dosbarthu..Golwg Flat..&2 Paneli..Bariau &Offer..Agor Ffolder Gwraidd..Lan Un Lefel..Hanes Ffolderi.....&Adnewyddu..750..Bar Offer Archif..Bar Offer Arferol..Botwmau Fawr..Dangos Testun Botwmau..800..&Ychwanegu ffolder i Ffefrynnau fel..Llyfrnod..900

C:\Program Files\7-Zip\Lang\da.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	8365
Entropy (8bit):	5.033083436849625
Encrypted:	false
SSDEEP:	192:7lsrCMNPOVDlCOd6NSv9MPdYJIG8YsYccAP6ox1OYSqMHCaQEzYcdD73Q5CTG:7lsrVwJCe6NzPdYJIG8YsYccuT1RSBCV
MD5:	D8ABA2DA47C1031832957B75A6524737
SHA1:	B83069EF9F7A08F18804AE966B8D18657E2907CD
SHA-256:	F65026AE33D4302A7EF06A856F6F062C9730100F5A87D5C00FB3FEAF5FCD5805
SHA-512:	82B5F4AB8E3E2310A98BE87B5CF2CBF04B7AEAE1798CD69529325EE74ADD40BDCA38EDA865A821F66436906D4F3224004F690CF406B532E116475D2B2424B570
Malicious:	false
Preview:	;!@Lang2@!UTF-8!..; : Jakob Schmidt..; 9.07 : Kian Andersen, J.rgen Rasmussen..; 15.00 : 2016-11-25 : scootergrisen..;..;..;..;..;..;..;..;..0..7-Zip..Danish..Dansk..401..OK..Annuller........&Ja..&Nej..&Luk..Hj.lp....&Forts.t..440..Ja til &alle..Nej til a&lle..Stop..Genstart..&Baggrund..&Forgrund..&Pause..Sat p. pause..Er du sikker p., at du vil annullere?..500..&Filer..R&ediger..&Vis..F&avoritter..Funk&tioner..&Hj.lp..540..&.bn...bn &inden i...bn &uden for..&Vis..&Rediger..O&md.b..&Kopier til.....&Flyt til.....S&let..&Opdel fil.....Kom&biner filer.....&Egenskaber..Komme&ntar.....Udregn checksum..Sammenlign..Opret mappe..Opret fil..&Afslut..Opret/rediger henvisning..&Alternative str.mme..600..V.lg &alle..Frav.lg alle..&Omvendt markering..V.lg.....Frav.lg.....V.lg efter type..Frav.lg efter type..700..Sto&re ikoner..S&m. ikoner..&Liste..&Detaljer..730..Usorteret..Flad visning..&2 paneler..&V.rkt.jslinjer...bn rodmappe..Et niveau op..Mappehistorik.....&Opdater.

C:\Program Files\7-Zip\Lang\de.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	9567
Entropy (8bit):	5.07903035387867
Encrypted:	false
SSDEEP:	192:ifuT0Y83ghfM/5yT9lBJ/LQs6gIgiOvcLh30hAHE+XAgiRTlu6ZgSboZDWUL+g9C:iG0D3ghcy7Ms6gIgiOktS+Iu6CS4L+g0
MD5:	8C46FB4A3C5025C1089F5C634D5D951C
SHA1:	46272D7178330B9F1AB1AAF7F3DB068F4D8B72C0
SHA-256:	E6A716C27F11BFADBA853228A5BEC9CDD6D043F22F5DB8F70094CD2E857C3A6A
SHA-512:	E39571A8605E7F6479016F721B5E449A6028A62CD8B058054C2F6E8129FE1C3EF19F5B0D776E9D25F6FB3D8F56E1F95159EA77758A0DE5DDF9F07BADA21744DB
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 2.30 : Soeren Finster..; 4.07 : JAK-Software.DE..; 9.07 : Joachim Henke..;..;..;..;..;..;..;..;..0..7-Zip..German..Deutsch..401..OK..Abbrechen........&Ja..&Nein..&Schlie.en..Hilfe....&Fortsetzen..440..Ja f.r &alle..Nein f.r a&lle..Stopp..Neustart..&Hintergrund..&Vordergrund..&Pause..Pause..M.chten Sie wirklich abbrechen?..500..&Datei..&Bearbeiten..&Ansicht..&Favoriten..&Extras..&Hilfe..540...&ffnen..I&ntern .ffnen..E&xtern .ffnen..&Ansehen..&Bearbeiten..&Umbenennen..&Kopieren nach.....&Verschieben nach.....&L.schen..Datei auf&splitten.....Dateien &zusammenf.gen.....E&igenschaften..K&ommentieren..&Pr.fsumme berechnen..Ver&gleichen..Ordner erstellen..Datei erstellen..Be&enden..Verkn.pfung.....&Alternative Datenstr.me..600..Alles &markieren..Alles abw.hlen..Markierung &umkehren..Ausw.hlen.....Auswahl aufheben.....Nach Typ ausw.hlen..Nach Typ abw.hlen..700..&Gro.e Symbole..&Kleine Symbole..&Liste..&Details..730..Unsortiert..Alles in einer &Ebene..

C:\Program Files\7-Zip\Lang\el.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	16897
Entropy (8bit):	4.487274531804794
Encrypted:	false
SSDEEP:	384:iZF/smolE2pHjNBdrD2zH9bOrcjfnicC5aLoDNwSF:wNILRD2R5jfnic+aLoBwSF
MD5:	D74CE0F31E3C062B6631455EA2C3DCDB
SHA1:	B4267827E54A0E6D9AC32BE961640B4530B59CB2
SHA-256:	7F11663757A2BDC193547E8C2A221F92D8F1825DB0E7C801D33BA1B42FBF08FA
SHA-512:	7FEBA4C40A3634F2A2DED570448D6AA69E3118A725BB25A33144855705457BDD208C61D86E1347FBDC4BC16FDFAE3E5C20BCEAF85AACE97292789E32F3FB71DF
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; : Vasileios Karakoidas, Jacaranda Bill, Vasilis Kosmidis..; 9.07 : SkyHi [HDManiacs Team]..; 15.00 : 2015-05-07: Pete D..;..;..;..;..;..;..;..;..0..7-Zip..Greek............401..OK...............&......&....&.....................&..........440..... .. &........ .. .&....&........................ &............... &...........&..................... ........ ... ...... .. .........;..500..&........&..............&...........&............&......&.........540....&.............. ... &.... ................. .. &... ...........&...........&............&...............&..............&.................&....&.......... ............&........ .....

C:\Program Files\7-Zip\Lang\en.ttt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	7910
Entropy (8bit):	5.016592171490132
Encrypted:	false
SSDEEP:	192:iO76FtmZSw5U/LutH5EVCPXUoDzO3TMHiD7v7iH+xb:iOmKtH5EVC/U2zO34CD7Hb
MD5:	72EA78FC93365651AA4222B6EBF31BF9
SHA1:	9A2A5A2879E30DDE4571F75EB00F95F58226C768
SHA-256:	4D6405DC6F93C00FA7EFF8BBCAC256D079FF56C5D0EDAAC41BB1A80C0AB2FECD
SHA-512:	61D5A60B26162EA6218A256E7F5C31D2ABA4C24563D0A075CFF280E683B6BE61209042BD5F85E02EE6C4B5156D7F894934B6755F17594AEDE5199EDB01F63FD2
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 22.00 : 2022-06-09 : Igor Pavlov..;..;..;..;..;..;..;..;..;..;..0..7-Zip..English..English..401..OK..Cancel........&Yes..&No..&Close..Help....&Continue..440..Yes to &All..No to A&ll..Stop..Restart..&Background..&Foreground..&Pause..Paused..Are you sure you want to cancel?..500..&File..&Edit..&View..F&avorites..&Tools..&Help..540..&Open..Open &Inside..Open O&utside..&View..&Edit..Rena&me..&Copy To.....&Move To.....&Delete..&Split file.....Com&bine files.....P&roperties..Comme&nt.....Calculate checksum..Diff..Create Folder..Create File..E&xit..Link..&Alternate Streams..600..Select &All..Deselect All..&Invert Selection..Select.....Deselect.....Select by Type..Deselect by Type..700..Lar&ge Icons..S&mall Icons..&List..&Details..730..Unsorted..Flat View..&2 Panels..&Toolbars..Open Root Folder..Up One Level..Folders History.....&Refresh..Auto Refresh..750..Archive Toolbar..Standard Toolbar..Large Buttons..Show Buttons Text..800..&Add folder to Favorites as..Bookmark..90

C:\Program Files\7-Zip\Lang\eo.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5252
Entropy (8bit):	5.043449751009606
Encrypted:	false
SSDEEP:	96:iSj7ohX9NlQ48QRTfMLTd2Z1GQ3owep0N6F+5/FtpUQskpX744MMQt1kA84eB3nV:i2ohX9NlQ48GbM9iHte/o9iQskd42Qtw
MD5:	418188A5E20929D6948DE22B970A3208
SHA1:	2068DFA837475C14E13919555816416D44FF4A3E
SHA-256:	7AEFF9B0450B006C212104A541787B3A9E0912B85733F6ADDAB700B7BCC0F33D
SHA-512:	07DA2C0AE34B1F5A47D8FE2E97B62EBFDA0B3369AE257F0F4CDA14EE9D1F469D23696930B810EE83761A142FD6400825C67D954B64CB5FA246CC43B483236151
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 4.37 : Dmitri Gabinski..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Esperanto..Esperanto..401..B&one..Nuligu........&Jes..&Ne..&Fermu..Helpo....&Da.rigu..440..Jes por .&iuj..Ne por .i&uj..&Haltu..Restartigu..&Fono..&Malfono..&Pa.zo..Pa.zita...u vi vere volas nuligi?..500..&Dosiero..&Redakto..&Vido..&Favoritaj..&Agordoj..&Helpo..540..&Malfermu..Malfermu &ene..Malfermu ek&stere..&Vidigu..&Redaktu...&an.u nomon..&Kopiu en.....M&ovu en.....&Forigu..&Erigu dosierojn.....Komb&inu dosierojn.....A&tributoj..Ko&mentu..Kalkulu kontrolsumon....Kreu &dosierujon..Kre&u dos&ieron..E&liru..600..M&arku .iun..Ma&lmarku .iun..&Inversigu markon..Marku.....Malmarku.....Marku la. tipo..Malmarku la. tipo..700..&Grandaj bildetoj..&Malgrandaj bildetoj..&Listo..&Detale..730..&Neordigite..Ununivela vido..&2 paneloj..&Ilobretoj..Malfermu radikan dosierujon..Supren je unu nivelo..Dosierujhistorio......&isdatigu..750..Ar.ivo-ilobreto..Norma ilobreto..Grandaj bildetoj..Montru buton

C:\Program Files\7-Zip\Lang\es.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	10039
Entropy (8bit):	4.959838758543366
Encrypted:	false
SSDEEP:	192:i3NDFltGs+jYMtDW5BL7HjBb191llMQc70VgyLuW1UDW2oO9K:i3NHtGs+j/tD6BZPVCK
MD5:	0E082B43A79586272B05C9CA8F7C16DF
SHA1:	9EEA192851D5FB9045E88B506ED4E1558667E683
SHA-256:	88972F7E173CFED678FBA72F5EEFBC1C485D8CDAD14C49E57A9D3076CFF0C2FD
SHA-512:	3774139B300D88DCCFB318F1A261D6F8BD49EC3BE87FDE0449C9600C436D7245181BEA24E54D51B39835DD9B4F4C7DB722D61A2A62812AD58B6599ABDF8DF2F6
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; : Pablo Rodriguez..; : Jbc25..; : 2007-09-05 : Guillermo Gabrielli..; 9.07 : 2010-06-10 : Purgossu..; 2010-10-23 : Sergi Medina (corrected)..; 18.00 : 2018-01-10 : Agust.n Bou (updated)..; 22.00 : 2023-05-13 : To.o Calo (updated and minor fixes)..;..;..;..;..0..7-Zip..Spanish..Espa.ol..401..Aceptar..Cancelar........&S...&No..&Cerrar..Ayuda....&Continuar..440..S. &a todo..No a t&odo..Parar..Volver a empezar..Se&gundo plano..P&rimer plano..&Pausa..Pausado...Est.s seguro de que deseas cancelar?..500..&Fichero..&Editar..&Ver..F&avoritos..Herramien&tas..Ay&uda..540..&Abrir..Abr&ir dentro..Abrir f&uera..&Ver..&Editar..Reno&mbrar..&Copiar a.....&Mover a.....&Borrar..Di&vidir archivo.....Com&binar archivos.....P&ropiedades..Come&ntario..Suma de verificaci.n..Diferencia..Crear carpeta..Crear fichero..&Salir..Vincular..Flujos &alternativos..600..Seleccionar &todo..Deseleccionar todo..&Invertir selecci.n..Selecci

C:\Program Files\7-Zip\Lang\et.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	7071
Entropy (8bit):	5.006983544953095
Encrypted:	false
SSDEEP:	192:iz52C8/cUN7wdsU1ntA9i6fH4XKcmcb7cn:i92EA7l9i6fH4XKc9b7cn
MD5:	EE84B1C885670EADEC64639F14DA46E2
SHA1:	C4701563AFA270FD4C33802383347A3C19E2FD92
SHA-256:	7B0E52653B536AD2595DE618073C37A8FC833E1B43B0772A6A1FD3C2167F59ED
SHA-512:	B2586AEF602861A8423761164D221407FE91E4FA197956E03FC29C1CF2E560D4B338AF34EABD5739B9A1FC51EAB0EC281FC93F4615B960F99707DE5F7BF985D0
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 3.09 : Kaupo Suviste..; 9.07 : Mihkel T.nnov..;..;..;..;..;..;..;..;..;..0..7-Zip..Estonian..eesti keel..401..OK..Loobu........&Jah..&Ei..&Sulge..Abi....&J.tka..440..K.igile j&ah..K.igile e&i..Seiska..Restardi..&Taustal..&Esiplaanile..&Paus..Pausiks peatatud..Kas soovite kindlasti loobuda?..500..&Fail..&Redigeeri..&Vaade..&Lemmikud..&T..riistad..&Abi..540..&Ava..Ava s&ees..Ava v.ljasp&ool..Vaat&ur..&Redigeeri..&Nimeta .mber..&Kopeeri asukohta.....&Teisalda asukohta.....Ku&stuta..T.kel&da fail......&henda failid.....Atri&buudid..Ko&mmentaar.....Arvuta kontrollsumma..V.rdle..Loo kaust..Loo fail..&V.lju..600..V&ali k.ik..T.hista k.ik valikud..&P..ra valik..Vali.....T.hista valik.....Vali t..bi j.rgi..T.hista t..bi j.rgi valik..700..&Suured ikoonid..V.ik&esed ikoonid..&Loend...ksikasja&d..730..Sortimata..Lame vaade..&Kaks paani..&T..riistaribad..Ava juurkaust..Taseme v.rra .les..Kaustaajalugu.....&V.rskenda..750..Arhiiviriistariba..S

C:\Program Files\7-Zip\Lang\eu.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	8894
Entropy (8bit):	4.789524765462384
Encrypted:	false
SSDEEP:	192:igp4YY4DAQwPnrVpoL2Q03nCIQJ861JcBkoZEU4DHYUv:i0JvVwPrVp9lQxHcBkoZEU47v
MD5:	29EC04893F6B2C9058A8F1E0BEAF9081
SHA1:	8E7B5A0EC24153AA7BE02F0395C003DF02CF6A09
SHA-256:	536D93CA6D7C96D203B51333C4E78DE2429F78D32CC321461589626759C84127
SHA-512:	B84E6606A5F58392DE5C5F8113DB10B8212A82BB93367469284AD2DD9A961BF381E3D230179EC19A32CAE7A266CDDE7290D95A262DEA247B267FDCE905F89972
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 15.12 : 2015-12-04 : Xabier Aramendi..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Basque..Euskara..401..&Ongi..E&zeztatu........&Bai..&Ez..It&xi..&Laguntza....&Jarraitu..440..Bai &Guztiari..Ez G&uztiari..Gelditu..Berrabiarazi..Ba&rrenean..&Gainean..&Pausatu..Pausatuta..Zihur zaude ezeztatzea nahi duzula?..500..&Agiria..&Editatu..&Ikusi..&Gogokoenak..&Tresnak..&Laguntza..540..&Ireki..Ireki &Barnean..Ireki &Kanpoan..Ik&usi..&Editatu..Berrize&ndatu..Kopiatu &Hona.....&Mugitu Hona.....E&zabatu..Banan&du agiria.....Nahas&tu agiriak.....Ezau&garriak..&Aipamena.....Ka&lkulatu egiaztapen-batura..Ezber..Sortu Agiritegia..S&ortu Agiria..I&rten..Lotura..&Aldikatu Jarioak..600..Hautatu &Guztiak..Deshatutau G&uztiak..&Alderantzizkatu Hautapena..&Hautatu.....&Deshautatu.....Hautatu &Motaz..Deshautatu M&otaz..700..Ikur &Handiak..Ikur Txi&kiak..&Zerrenda..&Xehetasunak..730..Ant&olatugabe..Ik&uspegi Laua..&2 Panel..&Tresnabarrak..Ireki &Erro Agiritegia..Maila Bat &Gora..Agiritegi &H

C:\Program Files\7-Zip\Lang\ext.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	7721
Entropy (8bit):	5.01400024932309
Encrypted:	false
SSDEEP:	192:i+TjfUOQlhcX2jKnNKjgwlgI34gjwhS9kj6P3eW15Qm0ImA6uBacIUmHm:igLQUmjKt0wD6PHPD0IhBt
MD5:	316F7B64FC0B4ACC1643322AB14AFE46
SHA1:	3BFB64C9FDE5F0A1D6F7072B59F2FFF3F08C29E8
SHA-256:	D8770102923AA03E0441094FA729F602A52D447E30954F03E2DC56D1124CDA69
SHA-512:	44DD7DD40EFB832867BB13D160E54FBA8C8E2A092E34909B56C32ABE8B0FC579CBD35ABE0758589C6E2AD3CDCB1FF41F293F5743927916E4636A8BBFDC8814E3
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; : Miguel Angel..; 9.07 : Purgossu..;..;..;..;..;..;..;..;..;..0..7-Zip..Extremaduran..Estreme.u..401..Acetal..Cancelal........&S...&Nu..&Fechal..Ayua....A&continal..440..S. &a t...Nu a &t...Paral..Reinicial..Se&gundu pranu..&Primel pranu..&Paral..Parau..De siguru que quieri cancelal la operaci.n?..500..&Archivu..&Eital..&Vel..A&tihus..&Herramientas..A&yua..540..&Abril..Abril &dentru..Abril &huera..&Vel..&Eital..Renom&bral..&Copial a.....&Movel pa.....&Eliminal..De&sapartal ficheru.....Com&binal ficherus.....P&ropieais..Come&ntariu..Calculal suma e verificaci.n..Diff..Creal diret.riu..Creal ficheru..&Salil..600..Selecional &t...Deselecional t...&Invertil seleci.n..Selecional.....Deselecional.....Selecional pol tipu..Deselecional pol tipu..700..Iconus g&randis..Iconus caquerus..&Listau..&Detallis..730..Nu soportau..Vista prana..&2 panelis..Barra e herramien&tas..Abril diret.riu ra...Subil un nivel..Estorial de diret.rius.....&Atualizal..750..Ba

C:\Program Files\7-Zip\Lang\fa.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	13796
Entropy (8bit):	4.482796196224769
Encrypted:	false
SSDEEP:	192:iSOxxO3GvlXAkPd8+U3xVnOcgvZQAuxH1j+POwcMmg2kW/VUtdREm1qvOMXc:iSOxxCQRFXU3HOciluxH1+WHMmstdHMs
MD5:	6948E051256DCB49DD6E977A30C53881
SHA1:	C9C65393DDAC81447743D1348A0F45DB88A8DED8
SHA-256:	1A368671BCA4EBD97B9EDEB84976EC208CEFF1C251B93870EBCC9D35936FAA06
SHA-512:	4E580B070A1CA26B1243C3C2B99BF14756AC59D1CA0F152F0E1F61FEFF35A8E7164029A387C069812C2959F69C2F11736902DD33E7254569603AD403B8D7C1E8
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 3.12 : Edris Naderan..; 4.53 : Mehdi Farhadi..; 9.22 : Hessam Mohamadi..; 22.00: Mohammad Ali Sohrabi..;..;..;..;..;..;..;..0..7-Zip..Farsi.........401.......................&..&............................440..... ... ....... ... ...................... .......... ....................... ........ ...... .. ... .........500.........................................................540.................. .. ............. .. ................................... ............. ................. ................ ................................. ..... ...... .......... ......... ........... ...........&..........&......... .........600....

C:\Program Files\7-Zip\Lang\fi.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	9031
Entropy (8bit):	4.862969971597222
Encrypted:	false
SSDEEP:	192:ie/9UpFTV+ffGjZ1u7gNhnfyXF4GTh39Bb8Q3iT0sAPOelpwPFy:ic9UpGfOlkgNhnQfpsQdsJelec
MD5:	E18EE71739632B1C5B9225A508F98000
SHA1:	F8493DD7EFDCE82E6D8ECF869E13CAAC918B3134
SHA-256:	05BB52FA61694A00B235D4614DF7B935CA0D9B3B2CCF43BFF503E8FA1E4FABF9
SHA-512:	B81F66FDA16E4272482D25816F2EFD960FA58D463187BEEE614E561F58AB8C2C6DF29469F9A412BAEE96CC6D691D749E7FE12BBA936FD969DFFB78BD0FA2438C
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 3.08 : Ari Ryynanen..; 4.30 : Jarko P...; 4.42 : Juhani Valtasalmi..; 9.35 : T.Sakkara..; 15.05 : 2015-08-07 : Lauri Kentt...; 19.00 : 2020-12-28 : Sampo Hippel.inen..;..;..;..;..;..0..7-Zip..Finnish..Suomi..401..OK..Peruuta........&Kyll...&Ei..&Sulje..Ohje....&Jatka..440..Kyll. k&aikkiin..E&i kaikkiin..Pys.yt...Aloita uudelleen..&Tausta..&Edusta..&Tauko..Tauolla..Peruutetaanko toiminto?..500..&Tiedosto..&Muokkaa..&N.yt...&Suosikit..Ty.&kalut..&Ohje..540..&Avaa..Avaa s&is.isesti..Avaa ulkoisesti..&N.yt...&Muokkaa..Nime. &uudelleen..&Kopioi.....&Siirr......&Poista..&Jaa osiin.....&Yhdist. tiedostoja.....&Ominaisuudet..Komme&nttti.....Laske tarkiste..Ero..Luo kansio..Luo tiedosto..&Lopeta..Linkit...Vaihtoehtoiset virrat..600..V&alitse kaikki..Poista &valinnat..&K..nteinen valinta..Valitse.....Poista valinta.....Valitse tyypeitt.in..Poista valinta tyypeitt.in..700..Suu&ret kuvakkeet..&Pienet kuvakkeet..&Luettelo..&Tiedot..730..Alkuper.inen j

C:\Program Files\7-Zip\Lang\fr.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	9910
Entropy (8bit):	4.9823070549494775
Encrypted:	false
SSDEEP:	192:iNbWj/xYCMXHxl759OMLpwPGzfejsH0qNXRDvG2oZ56LXlX+78+LF3Af7Br1T:iW/0Xxl7fOkpwufqsH0EhbG22KXlu783
MD5:	B1B6E1C3CF5247EC1618A88F9853D54D
SHA1:	0671CB77AD76F9E27237AA538F8EFA6BCCC40DE3
SHA-256:	CC283E9B0C1822F757372C21F179710C4592A2F7755E706C48065BCFE70BBA5B
SHA-512:	045422D358B3348A1E52CCED12D70757A7E6026801113EB68F07A399ACC75B6ECC9A1A4401CB7A65506C6F61D4FBB348765B0C80080072BFE06E0500CF31B0AC
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 4.07 : Nicolas Sierro..; 9.07 : Philippe Berthault..; 15.14 : Sylvain St-Amand (SSTSylvain)..;..;..;..;..;..;..;..;..0..7-Zip..French..Fran.ais..401..OK..Annuler........&Oui..&Non..&Fermer..Aide....&Continuer..440..Oui pour &Tous..Non pour T&ous..Arr.ter..Red.marrer..&Arri.re-plan..P&remier plan..&Pause..En pause...tes-vous sur de vouloir annuler ?..500..&Fichier..&.dition..Affic&hage..Fa&voris..&Outils..&Aide..540..&Ouvrir..Ouvrir . l'&int.rieur..Ouvrir . l'e&xt.rieur..&Voir..&.dition..Reno&mmer..&Copier vers.....&D.placer vers.....S&upprimer..Diviser le &fichier.....Combiner les fic&hiers.....P&ropri.t.s..Comme&ntaire.....Somme de contr.le..Diff..Cr.er un dossier..Cr.er un fichier..&Quitter..Lien..Flux &Alternatif..600..S.lectionner &Tout..D.s.lectionner Tout..&Inverser la S.lection..S.lectionner.....D.s.lectionner.....S.lectionner par Sorte..D.s.lectionner par Sorte..700..&Grandes Ic.nes..&Petites Ic.nes..&Liste..&D.tails..730..

C:\Program Files\7-Zip\Lang\fur.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	7517
Entropy (8bit):	5.004977343640682
Encrypted:	false
SSDEEP:	192:i8er20XT2wwIVDQjdkg9E3JIWQ+iWPNULtCG+ydZystz3:i8erJD2wRxQL9EuiULtCG+ydksZ3
MD5:	D4361EF22B59D893C571A54A0EA9F206
SHA1:	5185AC8E059848F311A0A9A04A0D220D1882E011
SHA-256:	8413FB6F6F8C9F31A10DA448895FD6C0D70834DD33A4FE6241DC41601F6E5AE9
SHA-512:	DB290AFE0618C8558BD2344FA03930939B9890CBF3CD30AB44C72D6AAA5FAAF6010A2890E391BB9C9CB99001CBAEA8B22CAECED96BBF630786BB4B6C2FCED862
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 4.60 : Andrea Decorte (Klenje) : secont l'ortografie ufici.l de Provincie di Udin..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Friulian..Furlan..401..Va ben..Scancele........&S...&No..&Siare..&Jutori....&Continue..440..S. &a ducj..No a &ducj..Ferme..Torne a invi...&Sfont..P&rin plan..&Pause..In pause..S.stu sig.r di vol. scancel.?..500..&File..&Modifiche..&Viodude..&Prefer.ts..&Imprescj..&Jutori..540..&Viar...Viar. dentri 7-&Zip..V&iar. f.r di 7-Zip..&Mostre..M&odifiche..Gambie &non..&Copie in.....M.&f in.....&Elimine..&Div.t file.....Torne a &un. files.....P&ropiet.ts..Comen&t..Calcole so&me di control....Cree cartele..Cree file..V&a f.r..600..Selezione d&ut..&Deselezione dut..&Invert.s selezion..Selezione.....Deselezione.....Selezione par gjenar..Deselezione par gjenar..700..Iconis &grandis..Iconis &pi.ulis..&Liste..&Detais..730..Cence ordin..Viodude plane..&2 panei..Sbaris dai impresc&j..Viar. cartele princip.l..Parsore di un nivel..Storic d

C:\Program Files\7-Zip\Lang\fy.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	6433
Entropy (8bit):	5.01854164767604
Encrypted:	false
SSDEEP:	192:ikdpohFyPlmHJR/eVMIBNgjJdMe1bEIVo5XT3EVULQ:ikWpRGVwj7Me1bEQgDEV9
MD5:	B0997F61EC5AEACD1709883BAA95F8E1
SHA1:	12F3C9F988A61C4F6857B891BAB92BE3070C9380
SHA-256:	7389F61C25EC26171AE6AA93EBB2960D27EF0CAA396F0F88906D15CD0456F663
SHA-512:	2A0103AF4DE970D1ADD91FC3C5FAF9C4D3F040705AFAFC589AF0BE62DB9D318A49930E117CD619EA9B96DA6C1765BADEDFEC2DDA7A49679F2A060EBB17DDDAED
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 4.53 : Berend Ytsma..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Frisian..Frysk..401..Okee..Ofbrekke........&Jawis..&Nee..&Slute..Help....&Ferfetsje..440..Jawis foar &Alles..Nee foar A&lles..Stopje..Opnij begjinne..&Eftergr.n..&Foargr.n..&Skoftsje..Skoft..Binne jo wis dat jo .fbrekke wolle?..500..&Triem..&Bewurkje..&Byld..B&l.dwizers..&Ark..&Help..540..&Iepenje..Iepenje &yn..Iepenje b.&ten..&Byld..&Bewurkje..Omne&ame..&Kopiearje nei.....&Ferpleats nei.....&Wiskje..Triemmen &spjalte.....Triemmen Kom&binearje.....E&igenskippen..Komme&ntaar..Kontr.lesom berekenje....Map meitsje..Triem meitsje..U&tgong..600..&Alles selektearje..Alles net selektearje..&Seleksje omdraaien..Selektearje.....Net selektearje.....Selektearje neffens type..Net selektearje neffens type..700..Gru&tte Ikoanen..L&ytse Ikoanen..&List..&Details..730..Net Sortearre..Platte werjefte..&2 Panielen..&Arkbalke..Haadmap iepenje..Ien nivo omheech..Maphistoarje.....&Ferfarskje..750..Argyf arkbalke..Stan

C:\Program Files\7-Zip\Lang\ga.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	8310
Entropy (8bit):	4.90528864100292
Encrypted:	false
SSDEEP:	192:iOCmUaOzBKdHRZqt83HRE0Hru7P2HJioV/TFa18QCbjXsf0VUY+sGa:iTRNtKMt8Bk1Y+ba
MD5:	7C57F6A4A8C9D2E502331EA0E199DB03
SHA1:	A1516271F6111F84047235F9301DA3FA57729A4E
SHA-256:	DB8A126354D9999DC53C672AFCAE700B977EC124BC8BB9F7FC8FA00B7461CC45
SHA-512:	8E38F5BD61E6779CF08C7AED8EA673B660F71166E51737DB1321E1996FCFC449024DE14985F6E208E6D2489928754EEAB141CAAC0B15D3771E0E9725F2FE9EAD
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 9.07 : Sean.n . Coist.n..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Irish..Gaeilge..401..T. go maith..Cealaigh........&T...&N.l..&D.n..Cabhair....&Lean ar aghaidh..440..T. do gach ceann..N.l go gach ceann..Stad..Atosaigh..&C.lra..&Tulra..&Cuir ar sos..Ar sos..An bhfuil t. cinnte gur mian leat . a cheal.?..500..&Comhad..&Leagan..Am&harc..Cean.in..&Uirlis...&Cabhair..540..&Oscail..Oscail &istigh..Oscail &lasamuigh..&Amharc..&Eagar..Athainmnigh..&Macasamhlaigh go.....&Bog go.....S&crios..Scar an comhad.....Cumascaigh na comhaid.....Air.onna..N.ta tr.chta..R.omh an tsuim sheice.la..Diff..Cruthaigh fillte.n..Cruthaigh comhad..&Scoir..600..Roghnaigh &uile..D.roghnaigh uile..&Aisiompaigh an roghn.ch.n..Roghnaigh.....D.roghnaigh.....Roghnaigh de r.ir cine.l..D.roghnaigh de r.ir cine.l..700..&Deilbh.n. m.ra..&Deilbh.n. beaga..&Liosta..&Sonra...730..Neamhaicmithe..Gach rud in aon chiseal..&2 fhuinneog..&Barra. na n-uirlis...Oscail an fr.

C:\Program Files\7-Zip\Lang\gl.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	9613
Entropy (8bit):	4.956652972454102
Encrypted:	false
SSDEEP:	192:iwNuz4MsajkKKnr7UHusuTcgUAB9yVUADmGd6W5rnuBq75yaJQfV:iwM4jajkKKnr7UH+pxB9yVDFnuBqJJQN
MD5:	B062CDBB0424364BF5057A168C8540AA
SHA1:	24A9BC9B24B7E4676A0CB2E22A5F27476A2674B8
SHA-256:	4DB8E6DA476FADEF909AF6DA291A244296CED792133BBA9DD9AEE4CB3F5D584F
SHA-512:	7CB762F08A917010A4C2AE943A5C8A2C93D9ADE43BC6717191C5F86BE99A504CBF2C15B689C66498D16293FCAEEF4766C3FC77CEAE3F59136223DA05D66485A5
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 3.12 : 2007-11-22 : Xos. Calvo..; 9.20 : 2014-11-26 : enfeitizador..; 15.00 : 2016-02-01 : enfeitizador..; 22.00 : 2023-05-13 : enfeitizador..;..;..;..;..;..;..;..0..7-Zip..Galician..Galego..401..De acordo..Cancelar........&Si..&Non..Pe&char..Axuda....&Continuar..440..Si &a todo..Non a &todo..Parar..Reiniciar..Po.er por de&baixo..Traer ao &fronte..&Pausa..Pausado..Queres cancelar?..500..&Ficheiro..&Editar..&Ver..F&avoritos..Ferramen&tas..A&xuda..540..&Abrir..Abr&ir dentro..Abrir &f.ra..&Ver..&Editar..Cambiar no&me..&Copiar a.....&Mover a.....&Eliminar..&Dividir ficheiro.....Com&binar ficheiros.....P&ropiedades..Come&ntario.....Calcular suma de verificaci.n..Diferenzas..Crear cartafol..Crear ficheiro..Sa&.r..Ligaz.n..&Alternar fluxos..600..Seleccion&ar todo..Desmarcar todo..&Inverter selecci.n..Seleccionar.....Desmarcar.....Seleccionar por tipo..Desmarcar por tipo..700..Iconas lon&gas..Iconas &mi.das..&Lista..&Detalles..730..Sen orde..Vista plana..&2 pan

C:\Program Files\7-Zip\Lang\gu.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	17769
Entropy (8bit):	3.930360013874023
Encrypted:	false
SSDEEP:	384:ihBXaWdxmWpk2x8QL/XwnD92K+R5+Twk292Bh72/OXMQH12fdvKA52hJV22b2d+D:eB75Cw+wvKAQco
MD5:	5648518D6DC5EABF1A723774B0D3DD73
SHA1:	A4E37BDDF88C23607378213DB64D7A5AA77262DE
SHA-256:	6950ADA2E0ECA1D2ECBD99824394924C266F464828EED8183849CD429E093E8C
SHA-512:	D9E04AB9B89178DABBFA73BE6F31747A520A3E7B43035BE3FE5B4896DEEED5FD938478B4926CEBDB6E5E7338BACD98F51EFDCE116C7F4AEFC955911894FD2A0A
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 9.07 : Vinayy Sharrma : .... ..... ...... ..........;..;..;..;..;..;..;..;..;..;..0..7-Zip..Gujarati, Indian, ......................401.....................&.....&....&... ............&.... ......440..&... .... .....&... .... .............. .... .....&............&........(.........)..&...................... .... .... .... ... ... .... .... ..?..500..&.......&........&.......&........&......&.....540..&......&.... ......&.... ......&.......&........&...: ........&... ..

C:\Program Files\7-Zip\Lang\he.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	11404
Entropy (8bit):	4.000931672512656
Encrypted:	false
SSDEEP:	192:i3D58xnxi9MoO0EGp/SDB52RM/VtvQPyE7f/Y8vFzicYWrWxusvU3FXxaXbhNXf2:i3V8YdE0cP2RCVFQPyE7gcYGW9U3F490
MD5:	A5BB2A30200268A5B04282EADC770C96
SHA1:	CB63E10ECE97E7D40D54B5BF3ED0E09807CB66BF
SHA-256:	E4EDDD9D9F2F728374DD93598BDC1797A303A81B2C596C1FE0122A35BA763309
SHA-512:	F45B23473A6973711F1FBC29B074B56A952EB4A0D55278881D941F1C54BCB693A07B73E30329EDFACE9121DB094C2E3F47791C11E086B46A15341F35870E8109
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; : peterg..; : Gal Brill..; 9.13 : 2010-04-30 : Jonathan Lahav..; 19.00 : 2020-05-01 : ION..;..;..;..;..;..;..;..0..7-Zip..Hebrew.........401..................&....&....&..............&......440.... .&...... &............... ......&.....&.......&.............?.. ... .... .... .... ......500..&......&.......&.......&.........&.......&.....540...&....... .&......... .&.....&.....&......&... ........&. .......&.. ....&........&. .......&... .......&.............&....... ..... ................... ........... ......&............&..... .........600..... &........ ..... .....&.... ................. .......... ... ........ .....

C:\Program Files\7-Zip\Lang\hi.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	17871
Entropy (8bit):	3.9160779281540994
Encrypted:	false
SSDEEP:	384:iBErTw7YtUD/xvaxkTTkjxQ10Up/ijaCXEk02VQGKFO8YeY:tr1ao2hY
MD5:	EB231074C05F7E000CCAF46088E6BEFB
SHA1:	AA6A7E562C91D0DC2A61C017187D11D91050A3DB
SHA-256:	3E1515B213561D7550D73A0048A1E1073D980DA7DC61B5074752A7B8787C96E7
SHA-512:	432232838DF558DCC1B6A2E1AE297D9F632665DA9023C3C2F6442F5842307C43C9905510FE36E6CD81CE438F3888329503DAAC4FE30805B29F1F16655AFAD1AB
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 9.07 : Vinayy Sharrma : ...... .... .......;..;..;..;..;..;..;..;..;..;..0..7-Zip..Hindi, Indian, .....................401..... ................&.....&......&... ............&.... .....440..&... .. .... .....&... .. .... ................ .... ......&............&........(.........)..&....................... .... .... ..... ... ....... .... .. ....?..500..&......&........&.......&........&......&.....540..&......&.... ......&.... ......&.......&........&...: ........&.

C:\Program Files\7-Zip\Lang\hr.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	8617
Entropy (8bit):	5.041634101846494
Encrypted:	false
SSDEEP:	192:iw3kl7v3mUecLy8RIxXr1aYPDIbOPw7zinGjeQOsEyKtizzDQ:irpvNeBUuXr03inG2tyKtiPDQ
MD5:	78410155D8B0C60EB6031F89F055444A
SHA1:	7BE443B61FABAD7C73A6F2CAD8B475C77E66B6E3
SHA-256:	41AFD53F0CB057455A936D8F54BF4C7E980DEFE61C4A102CE64BA1FA707B25AB
SHA-512:	427E54CB53FC1CA772B327C5E81B0A36986D7CF73ABEFE9902A38D8915D77E402AEE92B0D5AB7D04EDFA9454BB4EB830AA873EB1989CA7688514FF63223AAEE7
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 3.12 : Alan .imek..; 4.53 : Hasan Osmanagi...; 9.07 :..; 15.05 : 2015-06-15 : Stjepan Treger..;..;..;..;..;..;..;..0..7-Zip..Croatian..Hrvatski..401..U redu..Odustani........&Da..&Ne..&Zatvori..Pomo.....Nastavi..440..Da za &Sve..Ne za Sv&e..&Stani..Ponovi..U pozadini..U prvom planu..&Pauza..Pauzirano..Poni.titi?..500..&Datoteke..&Ure.ivanje..&Izgled..Omiljene mape..&Alati..&Pomo...540..&Otvori..Ot&vori mapu..Otvori u &sustavu..Iz&gled..&Ure.ivanje..Prei&menuj..&Kopiraj u.....Premje&sti u.....O&bri.i..Podije&li datoteku.....Spo&ji datoteke.....Svojs&tva..Komentar..Izra.un kontrolnog zbroja..Uspore.ivanje..Stvo&ri mapu..Stvori &datoteku..&Izlaz..Poveznica..&Alternativni tokovi..600..Odaberi &sve..Poni.ti odabir..&Obrni odabir..Odaberi.....Poni.ti odabir.....Odabir po tipu..Poni.ti odabir tipa..700..&Velike ikone..&Male ikone..&Popis..&Detalji..730..Neso&rtirano..Sadr.aj mapa..&2 okna..Alatne &trake..&Korijen..&Nadmapa..Pro.&le mape.....O&svje.i..

C:\Program Files\7-Zip\Lang\hu.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	10177
Entropy (8bit):	5.261619210176745
Encrypted:	false
SSDEEP:	192:iZEFltey0B1cWELI7L2jJovJu2dGPBlUvmodWfVwr6ksQA3HwbfoV666VSUJwPn:ia3Ov72jJMJu2dWByuQWfVwr6ksp3Hwk
MD5:	50BBF631148BAE77C10D4C8E54FAF396
SHA1:	DF537B6A8C22374AC371ED3E99658F676DCA265F
SHA-256:	8954EA88DB4F0F00A2E6142A8EE112F160FDBF3496C29027F88ADF3A4C1960F5
SHA-512:	2AA952531F0DBF1E481E35136418CE7CB20C57F4EB23B95D839273EE7173C599984D13089A30BDDC5363C013CAD2E15A4BB415801AA6E243CD38306A2E09DCB9
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; : Jozsef Tamas Herczeg..; 9.16 : Nyilas MISY..; 15.00 : 2021-11-09 : Barnabas Kovacs..; 22.01 : 2022-07-15 : John Fowler..;..;..;..;..;..;..;..0..7-Zip..Hungarian..Magyar..401..OK..M.gsem........&Igen..&Nem..&Bez.r.s..S.g.....&Folytat.s..440..I&gen, mindre..N&em, mindre..Le.ll.t.s...jraind.t.s..&H.tt.rben..&El.t.rben..&Sz.net..Sz.neteltetve..Biztos, hogy megszak.tja a folyamatot?..500..&F.jl..S&zerkeszt.s..&N.zet..Ked&vencek..&Eszk.z.k..&S.g...540..M&egnyit.s..Megnyit.s &bel.l..Megnyit.s k.&v.l..&F.jl megtekint.se..S&zerkeszt.s...tn&evez.s..M.s&ol.s mapp.ba......t&helyez.s mapp.ba.....&T.rl.s..F.jl&darabol.s.....F.jl&egyes.t.s.....T&ulajdons.gok..&Megjegyz.s..Checksum sz.mol.sa..K.l.nbs.g..Mappa l.trehoz.sa..F.jl l.trehoz.sa..&Kil.p.s..Link..Alternat.v adatfolyam..600..Min&d kijel.l.se..Kijel.l.s megsz.ntet.se..Kijel.l.s &megford.t.sa..Kijel.l.s.....Megsz.ntet.s.....Kijel.l.s

C:\Program Files\7-Zip\Lang\hy.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	14137
Entropy (8bit):	4.33786127868888
Encrypted:	false
SSDEEP:	192:iYIecm/mNxhlsms7CBFPwWbLkSMBvAoPz3qkZXDwC7o9F9f:iNeB4lE7Gw8KoqznlT2F9f
MD5:	A3FBC89351BB849AB7A095ECA5CE55B9
SHA1:	E7EDE3DFF2B066CB74BEB3863C9637F7D0726A72
SHA-256:	5794217068ECE1E278BE92FA4CC56304FC7AEDE204AA75B49B79599F90D3AB33
SHA-512:	4CE81FB30815312ED403438EC105CC3B517E4194C599A38B5323C1DDACE0E2E5F641AC211C735F0E89F74B8C966CE9FD9C086AA84F4FF21A972CB8DCAE390707
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; : Gevorg Papikyan..; 15.00 : Hrant Ohanyan..;..;..;..;..;..;..;..;..;..0..7-Zip..Armenian...........401.......................&.....&....&.....................&............440..... ...... &......... ...... &.............................&...............&.........&............. ... ..............500..&......&..........&......&.............&..........&............540..&............ &.............. ...&.............&.............&.........&.............&..............&.............& ...........&....... ................&.................&.....................................&....... ...............&... .......

C:\Program Files\7-Zip\Lang\id.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	8662
Entropy (8bit):	4.87370351217121
Encrypted:	false
SSDEEP:	192:iiFoEmEjXnrK1MYPaMRsF4QN+79eN2eNYQrJ3nJCoiY:iYoEmEjnW7CmsFg7FeNYoJ3ncoiY
MD5:	C0774491B0289F06DF49F578AFB9D540
SHA1:	27A00AD568512AACAEB561B2D5CE73F9459C1621
SHA-256:	6161D75C555CBB39CCB97E5BB9494070414ADD1FE48894EA53478358D763D655
SHA-512:	2AE92378E2EAC856FD0A7A4EDADA03044F5F8BCCF3EE71E950085166779F7C6B8974A25DCD7E8779FAF7E5728DB6DF5FA489459A6F0A9518765A928AC10C5D0C
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 22.01 : 2023-02-25 : Frans Leung..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Indonesian..Bahasa Indonesia..401..Oke..Batal........&Ya..&Tidak..&Tutup..Bantuan....&Lanjut..440..Ya &semuanya..Tidak s&emuanya..Henti..Mulai Ulang..Latar Bela&kang..Latar &Depan..&Jeda..Dijeda..Anda yakin ingin batal?..500..&Berkas..&Edit..Tam&pilan..&Kesukaan..Pera&latan..Ban&tuan..540..&Buka..Buka di &Dalam..Buka di L&uar..&Tampilkan..&Edit..&Nama Ulang..&Salin Ke.....P&indah Ke.....&Hapus..Be&lah Berkas.....Gabun&g Berkas.....P&roperti..K&omentar.....Hitung ceksum..Beda..Buat Direktori..Buat Berkas..&Keluar..Tautan..Alternati&f Aliran..600..Pi&lih Semua..Batal Pilih Semua..Pilih Sebal&iknya..Pilih.....Batal Pilih.....Pilih Berdasarkan Tipe..Batal Pilih Berdasarkan Tipe..700..Ikon &Besar..Ikon &Kecil..&Daftar..D&etail..730..Tidak Disortir..Tampil Datar..&2 Panel..Bilah Ala&t..Buka Akar Direktori..Naik Satu Tingkat..Riwayat Direktori.....&Segarkan..Segarkan Otomatis..750..Bilah Alat Arsi

C:\Program Files\7-Zip\Lang\io.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5008
Entropy (8bit):	4.9153288805153155
Encrypted:	false
SSDEEP:	96:ippkcp8iNRBkNXmZ0bcC4+bnk9LwXzBf9pw52Nt8UVeCLP9TNW7+kV:iXJzRyyqc1+bkmVpw5wt8KeCLP9Qt
MD5:	A3A5678560AC09A798F8EDEEE63D7D87
SHA1:	0E05CE684180DA3C8193841EA58C8EE128F3FEDA
SHA-256:	583483F9D42195D1A32225FC2D6F5907B556953B9521E1E61091C947C498F966
SHA-512:	7B1DADA81EE9D4E42F257E8624E3A1DADAAE4D0F09D25F6BAACDC3212E2E1A48DA56450C06EDEA140917090BABD6457292A994087D1FA28C95121C92D6366AF1
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 4.08 : iZoom..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Ido..Ido..401..B&one..Abandonar........&Yes..&No..&Klozez..Helpo....&Durez..440..Yes por &omni..No por o&mni..Haltez..Ristartez..&Fono..&Avanajo..&Pauzo..Pauzita..Kad vu ya volas abortar?..500..&Dosiero..&Redakto..&Aspekto..&Favoraji..&Utensili..&Helpo..540..&Apertigar..Apertigar int&erne..Apertigar e&xter..&Vidigar..&Redaktar..Ch&anjar nomo..Ko&piar aden.....Transp&ozar aden.....E&facar..F&endar dosiero.....Komb&inar dosieri.....In&heraji..Ko&mentar......Krear &dosieruyo..Krear dos&iero..E&kirar..600..Merk&ar omno..Des&merkar omno..&Inversigar merko..Merkar.....Desmerkar.....Merkar segun tipo..Desmerkar segun tipo..700..&Granda ikoneti..&Mikra ikoneti..&Listo..&Tabelo..730..&Nearanjite....&2 paneli..Utens&ila paneli..Apertigar radika dosieruyo..Ad-supre ye un nivelo..Dosieruya historio.....R&inovigar..750..Utensila panelo di arkivo..Norma utensila panelo..Granda ikoneti..Videbla butontexto..800..&Adjuntar do

C:\Program Files\7-Zip\Lang\is.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	8746
Entropy (8bit):	5.21465180545354
Encrypted:	false
SSDEEP:	192:7vbGuJ7kBfcLpMPz89Pwkr5fXnNB3RQMFWdZtffvTqBmV4jLASZE33txMF:7vbrJ7k+Lpy8ukr5fXnNXxFaWBm4jLAu
MD5:	F361950B7D1BB073EF48CA729B7ED5EA
SHA1:	8C5D3FB8E09C9682C6256F05F82CA67C58F0FF2B
SHA-256:	F4F9D6DFD36512F027452499B083AD0656DF6503CE03E4E4CC45B925F1F1D678
SHA-512:	6163FB77D3155525A563AD907CDF48FA18A6CE019A073C7D9DC2438927217D0D8534ADA7FC444114F14AC216C89D12E83F5B582021BE693BAEC80BD69199909E
Malicious:	false
Preview:	;!@Lang2@!UTF-8!..; 19.02 : 2019-11-12 : Stef.n .rvar Sigmundsson..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Icelandic...slenska..401... lagi..H.tta vi.........&J...&Nei..&Loka..Hj.lp....&Halda .fram..440..&J. vi. .llu..&Nei vi. .llu..St..va..Endurr.sa..&Bakgrunnur..&Forgrunnur..&Gera hl.... hl.i..Ert .. viss um a. .. viljir h.tta vi.?..500..&Skr...&Breyta..&Sko.a..&Upp.hald..&Verkf.ri..&Hj.lp..540..&Opna..&Opna a. innanver.u..&Opna a. utanver.u..&Sko.a..&Breyta..&Endurnefna..&Afrita ......&F.ra ......&Ey.a..&Klj.fa skr......&Sameina skr.r.....&Eiginleikar..&Gera athugasemd.....Reikna samt.lu..Mismunur..Skapa m.ppu..Skapa skr...&H.tta..Tengill..&V.xlstraumar..600..&Velja allt..&Afvelja allt..&Umsn.a vali..Velja.....Afvelja.....Velja eftir tegund..Afvelja eftir tegund..700..&St.rar t.knmyndir..&Sm.ar t.knmyndir..&Listi..&Sm.atri.i..730...flokka...Flats.n..&2 spj.ld..&Verkf.rastikur..Opna r.tarm.ppu..Upp um eitt stig..M.ppusag

C:\Program Files\7-Zip\Lang\it.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	9750
Entropy (8bit):	4.877192816663925
Encrypted:	false
SSDEEP:	192:ir2sSAwv87zQka5r6dmUEWn+a2K1oTRHcpiCnPqOVjUgIgJgCgDRjgAzcWdF:iajvIC5r64UE6+a2NlqPPv5UgIgJgCgn
MD5:	7A3AA3754FD3B5DCE8D37E9A0E7A4BEE
SHA1:	12F208B86D41C81DCCECB33807CEB3C584049F07
SHA-256:	92B60EDFE7F4B65CC4DBC207DEF72155C04FD613F0053F50C0FDDAF7681299DB
SHA-512:	735AD3CF99AE8D93EBD4FB2A811DAAB552189309740017B7BE167018206BC00E06973C951B462C1157E314EC98219F8C6AB3680F45491888808C251F324A82AA
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 4.07 : Leandro Spagnol..; : Vincenzo Reale (some corrections)..; 15.05 : 2015-06-17 : TJL73..; 17.00 : 2017-02-01 : Massimo Castiglia..; 18.03 : 2018-01-15 : POLAR..; 22.00 : 2022-06-20 : TJL73..;..;..;..;..;..0..7-Zip..Italian..Italiano..401..OK..Annulla........&S...&No..&Chiudi..Aiuto....&Continua..440..S. per &tutti..No per t&utti..Arresta..Riavvia..&In background..&In primo piano..&Pausa..In pausa..Sei sicuro di voler annullare?..500..&File..&Modifica..&Visualizza..&Preferiti..&Strumenti..&Aiuto..540..&Apri..Apri in &7-Zip File Manager..Apri in E&xplorer..&Visualizza..Modifica con l'&editor predefinito..Rino&mina..&Copia in.....&Sposta in.....&Elimina..Sud&dividi il file.....&Unisci i file.....&Propriet...Comme&nto.....Calcola chec&ksum..Comparazione differenze (Diff)..Crea cartella..Crea file..E&sci..Collegamento..&Alternate Data Streams..600..&Seleziona tutto..&Deseleziona tutto..In&verti selezione..Seleziona.....Deseleziona.....Seleziona per tipo

C:\Program Files\7-Zip\Lang\ja.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	12217
Entropy (8bit):	5.3392356600192254
Encrypted:	false
SSDEEP:	192:i56vSMlRAuVo6k8FW7grGmJeAYlxCIQWYftM40c1/ZwGltXuWRzoaGN:i56vH80I8UmbYl540uXRRzoaGN
MD5:	1E121AB29C3388A0629568D98C25E9E8
SHA1:	CB45CA908D31A2373D2A45ECAFA758BEFDBBC363
SHA-256:	D86A3453713FBEA8F8D1077589404FF4792362FC1999A2D4B1BD3392180FB7D1
SHA-512:	897D04F659D691646791911BF1694EF531F1E90A995AC844FBCDDD81E2B3BD73D32B53C5B4427C2B506F6790A4807EA042E85F0E13F810FFD415DD0A519D40E9
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; : : Komuro..; : : Mick..; : : 2chBBS-software..; : : Crus Mitsuaki..; 9.23 : 2011-06-22 : nabeshin..; 15.00 : 2015-04-30 : Stepanushkin Dmitry..; 22.00 : 2022-06-20 : Rukoto Luther..;..;..;..;..0..7-Zip..Japanese.......401..OK.................(&Y).....(&N).....(&C)...........(&C)..440.......(&A)........(&L)...................(&B)..........(&F)......(&P)......................?..500......(&F)....(&E)....(&V).......(&A).....(&T).....(&H)..540....(&O)..7-Zip ...(&I).........(&U)....(&V)....(&E).......(&M).....(&C).......(&M).......(&D)........(&S)...........(&B)..........(&R)......(&N)..............

C:\Program Files\7-Zip\Lang\ka.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	18203
Entropy (8bit):	3.5729565210364287
Encrypted:	false
SSDEEP:	384:ikfn3UlfDnVKqnB+C0aHgtyr6g5W0p5rUbVkmUmqIcR5mFuBUPNIazj:7IMW6gnAbVkmUm3
MD5:	903324372F5F5E6668EE316696DC6B57
SHA1:	8E2C62A2BF2572B996C9F84F703C6E11666785FC
SHA-256:	C68E08995342D96D14BD77F4185B8BE2CCF5ED2B7B88B80977D2D93CC2691774
SHA-512:	42A03CF1CB01E9DACED980A725F6D559A5AC26454CEE5E28B9FC31577167756CBD64065C7F26F81932D72C5970ED166679DCDFCD8F8A2D02C520546E720867AA
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 9.23 : 2011-09-25 : Translated by Giorgi Maghlakelidze, original translation by Dimitri Gogelia..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Georgian...........401..OK..................&......&.....&......................&............440...... &................ ...&.............................&.........&.... ........&..........&..................... ..... .......... ........?..500..&.......&............&.......&.........&.............&...........540..&.............. &.............. ..&.......&...

C:\Program Files\7-Zip\Lang\kaa.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	8102
Entropy (8bit):	5.104223410120957
Encrypted:	false
SSDEEP:	192:iGKztgVKxXfv5NKHLm9ufAX7M5amaRi5WsU1Ok/VO1ri:iGStuYXfvBXQiuWslk/sBi
MD5:	DFBA5C2185E113EEF167A5E21C32DF76
SHA1:	E36703D7D1954E3F1729A0497674EC15C41A2F76
SHA-256:	4D631602CE3D0C4D9162AF6BF56A90C8EEF75A24D556B729191B62F79ABA0681
SHA-512:	3271B66114BD6F145693258C5E84A175ACB3DB865169734A9BEB5DE7F9AEFD06B4144650DC0E98FD47DD38AD3CABD26415640CDDC8AC611C23D14487E975FB70
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 9.07 : Atabek Murtazaev..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Karakalpak - Latin..Qaraqalpaqsha - Lat.n..401..OK..Biykar etiw........&Awa..&Yaq..&Jab.w..Ja'rdem....&Dawam etiw..440..&Barl.g'.na awa..Ba&rl.g'.na yaq..Toqtat.w..Qaytadan baslaw..&Artq. fong'a..Ald.ng'. &fong'a..&Pauza..Pauza q.l.ng'an..An.q biykar etiwdi qa'leysizbe?..500..&Fayl..&Du'zetiw..&Ko'rinis..&Sayland.lar..A's&baplar..&Ja'rdem..540..&Ash.w..&.shinde ash.w..&S.rt.nda ash.w..&Ko'riw..&Du'zetiw..At.n o'&zgertiw..Bul jerge &nusqas.n al.w.....Bul jerge ko'shiriw.....O'shiriw..&Fayld. bo'liw.....Fayllard. &biriktiriw.....Sazlawla&r..Kom&mentariy.....Qadag'alaw summas...Diff..Papka jarat.w..Fayl jarat.w..Sh&.g'.w..600..Barl.g'.n &saylaw..Saylawd. al.p taslaw..Saylawd. &teris awdar.w..Saylaw.....Saylawd. al.p taslaw.....Tu'ri boy.nsha saylaw..Tu'ri boy.nsha saylawd. al.p taslaw..700..U'&lken ikonalar..Kishi &ikonalar..&Dizim..&Keste..730..Ta'rtipsiz..Te

C:\Program Files\7-Zip\Lang\kab.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	8589
Entropy (8bit):	5.232381254145495
Encrypted:	false
SSDEEP:	192:iFKQ2IdVUQ6/gSSmlP8UulpuDUedFJhFyglCxCxqJo+Msp04ndCVv:iY7IrOgSSmlP8XpUUedFJh8FCxaB/dCF
MD5:	E7E1D9E034582D9285656B8C87B20502
SHA1:	C547644525ED918F3AEFCA7EF9F974D62FFE4F55
SHA-256:	138748A833D4A8980C3B35FAE9DD72114F7146632CE5E50D9A7F805A39F10BE7
SHA-512:	59900F8BF306C33D6526FFB8BD4E1917FAB545732045AC8119AD6D3FC126D13B2B53F9F0CBFFF098B06FD1BE7675C21566F319A840EDA2FAAC741C5743D683E3
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 15.00 : 2018-02-27 : Belkacem Mohammed..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Kabyle..Taqbaylit..401..IH..Sefsex........&Ih..&Uhu..&Mdel..Tallelt....&Kemmel..440..Ih i &Me..a..Uhu i M&e..a..Se.bes..Ales tanekra..&Agilal..&A.awas Amezwaru..&R.u..I.bes..Teb.i. ad tsefsxe.?..500..A&faylu..&.reg..&Sken..I&nurifen..&Ifecka..&Tallelt..540..&Ldi..Ldi deg &ugensu..Ldi di B&erra..&Sken..&..eg..Snif&el Isem..&N.el .er.....&Senkez .er.....&Kkes..&B.u Afaylu.....Sdu&kkel ifuyla.....A&ylan..Awenn&it.....Timernit n Usenqed..Ice..iq..Snulfu-d Akaram..Snulfu-d Afaylu..F&fe...Ase.wen..&Alternate Streams..600..Fren &Me..a..Kkes Afran i Me..a..&Tti Afran..Fren.....Kkes Afran.....Fren s Tawsit..Kkes Afran s Tawsit..700..Tig&nitin Timeqranin..T&ignitin Time.yanin..&Tabdart..&Talqayt..730..Ur Yettwafren ara..Askan Imlebbe...&2 Igalisen..&Ifeggagen n Ifecka..Ldi Akaram Agejdan..Yiwen Uswir d Asawen..Amazray n Ikaramen.....&Smiren..Asmir

C:\Program Files\7-Zip\Lang\kk.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	10732
Entropy (8bit):	4.659322147322825
Encrypted:	false
SSDEEP:	192:iwHw0jjl8sq/UDEAY40JI0lkMPK+K4ppfdMMda764a:iwHw0jjiRUD8kMPJqMdj4a
MD5:	F4C46B450A580AD5ABF0B638DCDCC6FB
SHA1:	750DFDDDDADEE9CFE0E8F651F1C6CC38CF1FCD78
SHA-256:	F2E6E55C102485E232DAAD00F68D8905F7A54F8AE2128DB6AFE25231C17ACD69
SHA-512:	24B6DC7B491302B905C1E20E67DDAB16AF9420820B6C83406618E017FA84D952661087E2EA577831441E8A3C82EF697DE713597E33626AED787F3485DD9B1F7D
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 9.07 : Arslan Beisenov, Arman Beisenov..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Kazakh...........401............................&....&.....&..................&............440........ &.......... &................... .... ......&.......&....... ..........&............................ ....... ..... ..?..500..&......&.......&.........&...........&.......&..........540..&........... &............. ............&............ ......&...........&............&........... .................... .............................&.................. ........Diff..&..... ........... .............600....... ...................... ....

C:\Program Files\7-Zip\Lang\ko.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	10289
Entropy (8bit):	5.6273231080159345
Encrypted:	false
SSDEEP:	192:i36bCE/KKcFaeVLsUsdGBbeO9ouVv40if8Knv3633q9FGdUBUe:iWCE/KKcQSLscbeOqGi0KvCAGdqUe
MD5:	F1FB53A644720BB007B3422BBC6E25A8
SHA1:	290589775EB85AD1EF6321DFF2B1CA9C6884867C
SHA-256:	3A42727F9189FD791A274CC5AD00DBFBB4B3D5BB6A83F52DE4788389FB00193B
SHA-512:	0693E323039D168A834804FAA88B6A036379B90AC5FE5391433301BE9E421525340D4CB52F22500803DACAD109193E82F1532F1976A2B958B128E68404566F43
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; : ZannyLim (...)..; : bzImage..; 4.52 : Hyeong il Kim (kurt Sawyer)..; 9.07 : Dong-yoon Han (...)..; 15.12 : Winterscenery (Ji-yong BAE)..; 16.04 : Add translation and Modify by Winterscenery (Ji-yong BAE)..; 22.00 : Winterscenery (Ji-yong BAE)..;..;..;..;..0..7-Zip..Korean.......401.................(&Y).....(&N)....(&C)...........(&C)..440.... .(&A).... ...(&L)........ ...... ...(&B).... ...(&F)......(&P)...... ...... ........?..500....(&F)....(&E)....(&V)......(&A)....(&T).....(&H)..540....(&O).... ..(&I).... ..(&U).... ..(&V)....(&E)... ..(&M)....(&C).......(&M).......(&D).... ...(&S)....... ...(&B).......(&R)....(&N)........ ...... ...... ....... ........(&X)...

C:\Program Files\7-Zip\Lang\ku-ckb.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	12337
Entropy (8bit):	4.535823242758319
Encrypted:	false
SSDEEP:	192:ilCpEmyIRe0g/OQMEuDP9Y799boVTiUaml4hSf7UAlA+cA90s5bKlcRBfwCiIErK:iOjQMTDShMTiUaTSfwA90sglMRMj2z/
MD5:	F0349C150F5209E41E8626F4FA5AEF60
SHA1:	2305FE53945A522CDD7624368AD6289E2CE40850
SHA-256:	EA4856E9C35B1DFD0A831746888EB5D298D0551021290C3F5FF8CFA5CA7306C3
SHA-512:	D1452259027C3B286F547BB6E5AEA7A195738E2FA2BF65F0BA43E3477B66980C00B4E3ACB19C9554FA8CCCFF04773B1262AF73155AF6E3891A85CC8697FA053E
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; : Ara Bakhtiar..; 4.66 : Ara Qadir..;..;..;..;..;..;..;..;..;..0..7-Zip..Kurdish - Sorani.........401.............................&......&.......&...................&..............440...... .. &............ .. ..&..............................&............&..........&......................... .. ................500..&......&..........&........&...........&............&.........540..&................ ..&... ............. .. &........&.......&..........&..........&............ .......&......... .......&.........&........ ..........&...... ....... .............&...................&.............. checksum.......

C:\Program Files\7-Zip\Lang\ku.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5774
Entropy (8bit):	5.14647905004664
Encrypted:	false
SSDEEP:	96:iPHrOVp0Wqx9Zgwx+tBttSTULz9bkfHaSSwQfBMoWURypM4L4l28Wgk+drzNadIX:iP6Vpu1MZtSTWbkvaBwQjZRyps+g9kQH
MD5:	BE2ABB068C2223233202116DB9699EB7
SHA1:	AF9DD161B82C727C298328A118675D57BD478804
SHA-256:	B79D7BC3C63B9C14C77DA43D2ECE9D8B1880AF9E5301C8BC98370857EE812640
SHA-512:	E82D3A7F7EED0814E3A9CD3BA6D6800969D37851C1950821120E5E8A10888CA07C5BEA9F1D26E34BCD28655957B82DC6AFF277FC1E962ADEC4580ACD58C6B33A
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 4.37 : Rizoy. Xerz...;..;..;..;..;..;..;..;..;..;..0..7-Zip..Kurdish..Kurd...401..Temam..Betal........&Er...&Na..Bi&gire..Al.kar.....Bi&dom.ne..440..&Ji Bo Hem.y. Er...Ji &Bo Hem.y. Na..Raweste..D.sa Destp.ke..L%i Pi.t..Li &P....&Rawest.ne..Rawestiya -..Ma bila betal bibe?..500..&Dosya..&Bipergal.ne..&N..an Bide..Bi&jare..&Am.r..A&l.kar...540..&Veke..&Di Panel. De Veke..Di &Pacey. De Veke..&N..an Bide..&Sererast bike..&Navek. N. Bid...&Ji Ber Bigire..B&ar Bike..J. B&ibe..Par.e Bi&ke.....Bike &Yek.....&Taybet...Da&xuyan...checksum heseb bike....Pe&ldankeke N...Do&siyeke N...De&rkeve..600..&Hem.y. hilbij.re..He&m. hilijartin. rake..Be&revaj. w. hilbij.re..&Hilbij.re.....Hilbijarti&n. Rake.....V. curey. hilbij.re..Hilbijartina cure rake..700..&Daw.r.n Mezin..D&aw.r.n Bi..k..&L.ste..&H.ragah...730..B. Dor..xuyakirina sade..&2 Panelan veke..Da&rik. am.ran..Peldanka Kok Veke..Astek. Berjor..D.roka Peldank

C:\Program Files\7-Zip\Lang\ky.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	12456
Entropy (8bit):	4.651026877504126
Encrypted:	false
SSDEEP:	384:ikVDGPB8R8wedC+GwW2wo7rXNMQOpR2avWPYx3jqSxv:78Z8+7CSPMkARuSN
MD5:	21249560FDE7FC9380E356A285F492F9
SHA1:	8B6B3EE173C7B31106870FF0F32EF9996D827C8E
SHA-256:	1C9EB6476FE41D1226C44721F9947A5C4D921C9D99D5C2A8D10C21FE96AAE001
SHA-512:	6B593AE0684464F1A6F71770C7BC0D7C3D503AEC8D1797EFABAEB36554C97E40CD64E31A78585FEFC9519BBEEF699DE90993B487F4B1D90F0522E252C51F31BA
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 9.20 : Kalil uulu Bolot..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Kyrgyz............401..OK...............&......&.....&.................&.........440...... &............ .&...... .................. .........&.......&....... ........&....................... ... ... .......... ........... ..... ......?..500..&......&.......&......&............&.......&........540..&.........&... ...........&... .............&.................& ..........&.... ............&.... ..... ............&..........&... ................&........ .............&...........&.................. ..........Diff..&...... ............&. ......

C:\Program Files\7-Zip\Lang\lij.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	7875
Entropy (8bit):	5.0132967137253255
Encrypted:	false
SSDEEP:	96:iElqnIXtBYvmtrW9Ig3eV9X0g6A7nudvglg6wj4y1dRiG7GxBJv3PM6ZxgxqwPOr:iaxXfim7pf7nJePcyzqBJv3/gxqwP95y
MD5:	172C567A95B28962C38D6656AC9BF861
SHA1:	FD52675FA2221D7A69209273C3468FC7A37D8153
SHA-256:	9F6BA934DEEF9DA7081FC6E266CAA2DBCC5B69D38A089CAD7AC69517EB2D363E
SHA-512:	F6FD3DA7102D7201E9C82A9EAF562DAD8EB4E053C76188B7616B8002DAC8E7CF35830B48E0ED24F997EDC14B82F5F7BDAA172DFBF7034EB109C5AF719D696A39
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 9.07 : GENOVES..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Ligurian..Zeneize..401..D'ac.rdio..Anulla........&Sci..&No..S.&ra..Agiutto....&Continoa..440..Sci pe &Tutti..No pe T&utti..Ferma..Inandia torna..Into &sfondo..&In primmo cian..&Paoza..In paoza..Ti . seguo de voei anul.?..500..&Archivio..&Modifica..&Vixoalizza..&Preferii..&Strumenti..A&giutto..540..&Arvi..Arvi into Manezat. d'archivi 7-Zip..Arvi inte Explorer..&Vixoalizza..&Modifica..Ri&nomina..&C.pia inte.....&Sp.sta inte.....Scancel&la..&Dividi l'archivio.....&Unisci i archivi.....P&ropiet...Comen&ta.....Calcola somma de contr.llo..Dif..Crea cartella..Crea archivio..Sc&i.rti..600..Sele.ionn-a &tutto..Desele.ionn-a tutto..In&verti sele.ion..Sele.ionn-a.....Desele.ionn-a.....Sele.ionn-a pe tipo..Desele.ionn-a pe tipo..700..Figue &grende..Figue picinn-e..&Listin..&D.ti..730..Nisciun ordine..Vista ciatta..&2 barco.n..Bare di &Strumenti..Arvi cartella prin.ip...Livello supei...Cronologia..

C:\Program Files\7-Zip\Lang\lt.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	9525
Entropy (8bit):	5.116704732379848
Encrypted:	false
SSDEEP:	192:iwIsB9j4K01iwimxhiZ8yczB7XhyyYR1gQEfo9GcC7MDc:iwIsyiwnhiZ1czn9YwQuZ7MDc
MD5:	BFF630AB983353341E7F2E838577B4A8
SHA1:	2911E2F2AF88056761F1B215E8CAF718E4F39C23
SHA-256:	0F88254AB0DEDDBB7125EBC013968E017E376A1ABFCE4812EAF900AC5E066D9C
SHA-512:	5BE30BD46076B2912E99215A9645A148508D3CC89E0C418F62591C1894802E37AE307D4D283FD030C6A6EFB3702D41EA05EF2C2C1A02D89795701A8152FE793E
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 2.30 : Marius Navickas..; 4.57 : Domas Jokubauskis..; 15.05 : Vaidas777..;..;..;..;..;..;..;..;..0..7-Zip..Lithuanian..Lietuvi...401..Gerai..At.aukti........&Taip..&Ne..&U.daryti..Elektroninis .inynas....&T.sti..440..T&aip Visiems..Ne v&isiems..Sustabdyti..I. naujo..&Fone..&Pirminis procesas..&Laikinai sustabdyti..Laikinai sustabdyta..Ar j.s esate tikri, kad norite at.aukti?..500..&Failas..K&eisti..&Rodyti..M.gi&amiausi...ran&kiai..&Elektroninis .inynas..540..&Atverti..Atverti v&iduje..Atverti i.&or.je..&Rodyti..K&eisti..Pervadi&nti..&Kopijuoti ......&Perkelti .......alin&ti..&Skaidyti fail......Jungti &failus.....Savy&b.s..Kome&ntuoti..Skai.iuoti kontrolin. sum...Sulyginti..Sukurti aplank...Sukurti fail...I.ei&ti..Nuoroda..&Alternatyv.s srautai..600..Pa.ym.ti &visk...Nu.ym.ti visk...Atv&irk.tinis .ym.jimas..Parinkti.....At.ym.ti.....Pasirinkti pagal tip...At.ym.ti pagal tip...700..Did&el.s piktogramos..&Ma.os piktogram

C:\Program Files\7-Zip\Lang\lv.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5420
Entropy (8bit):	5.197552252170018
Encrypted:	false
SSDEEP:	96:i01AxCUAMY/FnFMtAZVWsztyg/YEbSJlsLHI5oT+obBd+YmNRJF:imUu/ZKuW2X2JqHI5oyidy
MD5:	E2B1ECFDD2DF783F50367C24D97A2631
SHA1:	34CD068547EBD50B9D3F4829D1931BB227814835
SHA-256:	CC48E814E28FA6DD9206DF879CEC4C03B0FDE9BA8C6309B309EB52DDEC5D0C78
SHA-512:	72FE71334CF54C49EFE85B8F260BEE72EA304220EBCC19E23381973A031E78C9D71B7D6E8382F556CE1AEA1999D12D8E069874EE45F7AEBAD16EADB63B1922AA
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 4.10 : Armands Radzu.ka..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Latvian..Latvie.u..401..&Labi..&Atcelt........&J...&N...Aiz&v.rt..&Rokasgr.mata....&Turpin.t..440..J. &visiem..N. v&isiem..Stop..P.rstart.t..&Fon...&Priek.pl.n...Pa&uze..Pauz.ts..Vai piekr.tat p.rtraukt .o darb.bu?..500..&Fails..&Labo.ana..&Izskats..Ie&cien.t.s..&R.ki..&Pal.dz.ba..540..&Atv.rt..Atv.rt &iek.pus...Atv.rt .rp&us...Ap&skate..&Labot..P.&rd.v.t..&Kop.t uz.....P.r&vietot uz.....&Dz.st..&Sadal.t failu.....Ap&vienot failus......pa..&bas..&Piez.mes......Izveidot &mapi..Izveidot &failu..&Beigt..600..Iez.m.t &visu..Atcelt vis&u..I&nvert.t iez.m.jumu..Ie&z.m.t.....&Atcelt.....I&ez.m.t p.c tipa..A&tcelt p.c tipa..700..&Lielas ikonas..&Mazas ikonas..&Saraksts..S.&k.k..730..&Ne..irot....&2 pane.i..&R.ku joslas..&Atv.rt saknes mapi..L.meni &uz aug.u..Mapju &v.sture.....&P.rlas.t..750..Arh.va r.ku josla..Standarta r.ku josla..Liel

C:\Program Files\7-Zip\Lang\mk.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	8756
Entropy (8bit):	4.26114528425757
Encrypted:	false
SSDEEP:	192:ia3g0F7SHayJ5vKVEB3Bxg0eGIxpWNMll39oWvt/i4drxJ4MrZEXSW:iWg0zyJlKVEB3AMSM2mWvt/i4dtJ4MNO
MD5:	368FCBB838BA3E961F4EF6EC99D05F10
SHA1:	EE50926E675344422FB54A718F40B09A8F70B6A7
SHA-256:	BCC0DAECBAB5E972F9B8A3A4E73F6A186B785E432DBCE3B04CC0512DA6DC7840
SHA-512:	C87517DC6B0736F86464A0D3105BF0C93B7D36DE83957DA4FD0D284F7C7A5A508956C9E9B448B3F90BE1ECEF4338A99D7DFC7AA358A698F7981B4A57CEC5E9B0
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 4.09 : Gabriel Stojanoski..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Macedonian..............401....................&....&....&...................&.........440.... &........ .&............................&........&........&...................... ....... ...... .. ........?..500..&..........&.......&........&.........&........&.......540..&.............. &.............. &........&........&.......&.............&....... .......&........ .......&.........&...... ................&....... .............&.................&.................... .................... ..........&........600............ &................ ...

C:\Program Files\7-Zip\Lang\mn.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	8473
Entropy (8bit):	4.5535945088498115
Encrypted:	false
SSDEEP:	192:i2GVqAYj834yHocynU6GwgeBLHEfYfFCkMupHCwFxhjPQtQP1d/R1JTPUJ:i7bYfUjuZxhDDHZQJ
MD5:	667EE24BC0CFD8AC281EC162FED5FE5B
SHA1:	A9492486D6139430E5A3553FD211B6104666366C
SHA-256:	A52F8E6AD1731EA1ED1267AD966F2C90328103C278B61C86DD2074B62134D039
SHA-512:	8907DADC5E93020365EAFFC8FBA54B57727EC4B88020F4E00188A863EB2D86CCD5B57EC3334835D4127D35D145F45553456F6744247C6BCBEE56CA0F6D521C5E
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 3.12 : Bayar..; : Bayarsaikhan..;..;..;..;..;..;..;..;..;..0..7-Zip..Mongolian........ .....401...................&......&......&.................&............440.....&. .......... .&................ .........&.. ......&.... .....&... ......... ........... ....... ..... ... ..... ..?..500..&......&.......&..........&..... ......&............&.........540..&........... &........... &......&.......&.............. .&............ &................. &.........&........&.... .................... ............&........ .........&................ ............ ..........&.....600......... ..&.............. .......&......... .

C:\Program Files\7-Zip\Lang\mng.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	20190
Entropy (8bit):	3.555260690963891
Encrypted:	false
SSDEEP:	384:iZGUSlwi6aHQIXqB6B22bKP995BOqB8A5Y8KsC3u6cIVFQMksJYkXoFs8NC0SFM9:hJbm50qN5Esd6r/XWjgqVpzs4XZd8s0a
MD5:	B84D986F5E6B427789F70E7E049131DD
SHA1:	DE7E3511667E9F7AD5111B9F24C8F21EC0B390E1
SHA-256:	6A470983969A59FE6185901984E8DE3A5D40DC9FFD703BF5B1317F4A8CD4106E
SHA-512:	A848F0D6A7EC7A76F24547E149BA13E5D8B9F9BBF1F18F09F16306967101FE52FF984A67A0932A10C657301F4914E43A90BDD4DEFE5EC4221CABC463B078D27E
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 9.20:..; Saqirilatu Mongolqileb..; last updated: 2014-1-1..;..;..;..;..;..;..;..;..0..7-Zip..Mongolian (Unicode)........ ......401............................ (&Y)...... (&N)........ (&C)........................ (&C)..440........ .... (&A)........ .... (&L).................. ............ ..... (&B)........ ..... (&F)........... (&P)......... ........... ...... ........ .. ...500....... (&F)............. (&E)....... (&V)............ (&A)........ (&T)............ (&H)..540.......... (&O)....... ..... ... .......

C:\Program Files\7-Zip\Lang\mng2.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	21573
Entropy (8bit):	3.715896516150787
Encrypted:	false
SSDEEP:	192:iHmpcSmhZcbnD1e+Ft9780rdLnrG/d+RWsB/O54Q4gLwqZ816d20xUBEgSRnbh:iJfHp4NJOIYB
MD5:	24C48AB0E38E5F128844DF0F3A188DA7
SHA1:	AD1EC708502A54964A7C10AC1BC1249E7BDBA8A7
SHA-256:	24570CAF8879919211805A7347564A8C430DE65109D9D743A532EB56A6ED282C
SHA-512:	B1AD92BF24BA5C02B7E5EA38A8FF006C2DA08C80E74B90273A881A04B818D91BF7D148DC90EEFDC18F9432C44434827AD25C1848BA83DAA6D3F0817DC998F08C
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 9.20:..; Saqirilatu Mongolqileb..; last updated: 2013-12-11..; Update and Spelling corrected Bayarsaikhan..;..;..;..;..;..;..;..0..7-Zip..Mongolian (MenkCode).......... ......401.................................. (&Y)...... (&N).......... (&C)........................... (&C)..440......... ..... (&A)......... .... (&L)..................... ............. .... (&B)....... ... (&F)........... (&P)......... ............. ........ ............ .. ...500....... (&F)............... (&E)......... (&V).............. (&A)......... (&T

C:\Program Files\7-Zip\Lang\mr.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	10799
Entropy (8bit):	4.059636748082183
Encrypted:	false
SSDEEP:	192:iSdCIrunpyKHseL4bzwltFrj+TEpbpFeki8rJNhBB:iSt6pypS4A7OA1r
MD5:	CE09B7B9A792BF468D23279661C0C0C1
SHA1:	6FEE14A3560BFC450BBC36BACF8FE97FFD812E7F
SHA-256:	7A7F7E0D4C1CAEF0F049BC234886AE4A9E74135F21855DC05C8790F81EB9324B
SHA-512:	FAEAF21AF75E792B17D5435D0FF3956AE33071915DB019189DF4B15929DD378C46AF61EB1DB52B16AE1D66143DED8C15E46F226EF92C097C1DD0C7CF65F8A5BF
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 4.42 : ...... ..... ....... (Subodh Gaikwad)..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Marathi.........401...................&....&......&............&......440..&.... .. ....&.... .. ................... .... .....&.... ......&.... .....&.......................... .... .......... ...... ... ..?..500..&......&........&........&......&.......&.....540..&......&.... ......&..... ......&.......&........... .....&..............&.........&.......&.... ..... ............ ..........

C:\Program Files\7-Zip\Lang\ms.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5189
Entropy (8bit):	4.876378848947127
Encrypted:	false
SSDEEP:	96:i1aRqkSE8E0q2sX0OIFiC5z4USRWr8Y1KS4sgd6Jar:iMRqa8E0q2sNCCRWr8Y1Kjsgd6+
MD5:	18C00C686514667DBEF6021C2EE45755
SHA1:	3F5748014CDB921E69C693641ED40C04BE8E7F77
SHA-256:	98F13642FFB436C2CD46818C5AD1B6905C08EB4D101C3B1A86A1913D5C8AB9B2
SHA-512:	81BEFCC54BCCDD5E381A1E144263CC658AB6DFD3AD7C68BDF56E29256B0839EE6E55D382766AB93D53B05CECC78A808FF03748166B0C2E04E393C5D8B4A26F21
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 4.30 : Khairul Ridhwan Bin Omar..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Malay..Bahasa Melayu..401..OK..Batal........&Ya..&Tidak..&Tutup..Bantuan....&Teruskan..440..Ya untuk Semua..Tidak untuk Semua..Henti..Mula Semula..&Latar belakang..&Latar depan..&Berehat..Berehat..Anda yakin untuk membatalkannya?..500..&Fail..&Edit..&Paparan..K&egemaran..&Alat..&Bantuan..540..&Buka..Buka di D&alam..Buka di L&uar..&Paparan..&Edit..Nam&akan semula..&Salin ke.....&Pindahkan ke.....Hapus..&Bahagi/belah Fail.....Gab&ung Fail.....P&roperti..Kom&en......Buat Folder..Buat Fail..K&eluar..600..Pilih &Semua..Jangan Pilih Semua..&Sonsangkan Pilihan..Pilih.....Tidak Memilih.....Pilih Berdasarkan Jenis..Tidak Memilih Berdasarkan Jenis..700..Ikon B&esar..Ikon K&ecil..&Senarai..&Butiran..730..Tidak Tersusun....&2 Panel..&Toolbar..Buka Root Folder..Ke atas Satu Aras..Folder Sejarah.....&Segarkan Semula..750..Toolbar Arkib..Toolbar Standard..Bebutang Besar..Perlihatkan Teks Bebutang..800..&T

C:\Program Files\7-Zip\Lang\nb.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	6053
Entropy (8bit):	5.041539068363239
Encrypted:	false
SSDEEP:	96:i1oyhiCM4JJ/xOpGapVLSs9tToNrPQRv2GMM3gBiTZNYDnNKyxwHS0fegfwtC:iXpRJYpVms9tToNrPQRvpMEg8TmnNKyW
MD5:	475E7E403F6A31C18672116475A48145
SHA1:	8759C36DFF1E70B3F17D51BB50C23A99AC5AC862
SHA-256:	5A29EA8149BB0A86C1917ABB02C9A7FFBCD3564D77C7159853DBFBB2CB49411D
SHA-512:	F8A8C697748812299633D8B7BA3D8C9A95C7F037AF4DAB6365F75955CEB0C178F390BB1CBD0ECC6F711FCF420AFAB18251A8ECC1428CCA1F7B549448949784E9
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 4.45 : Jostein Christoffer Andersen..; : Kjetil Hjartnes..; : Robert Gr.nning..;..;..;..;..;..;..;..;..0..7-Zip..Norwegian Bokmal..Norsk Bokm.l..401..OK..Avbryt........&Ja..&Nei..&Lukk..Hjelp....&Fortsett..440..Ja til &alt..Nei til a&lt..Stopp..Start p. nytt..&Bakgrunn..&Forgrunn..&Stopp..Stoppet..Vil du avbryte?..500..&Fil..&Rediger..&Vis..&Bokmerker..Verk&t.y..&Hjelp..540..&.pne...pne &internt...pne &eksternt..&Vis..&Rediger..Gi nytt &navn..&Kopier til ...&Flytt til ...S&lett..&Del opp arkiv ...&Sett sammen arkiv ...E&genskaper..&Kommentar ...Beregn sjekksum....Ny &mappe ...Ny f&il ...&Avslutt..600..Merk &alle..Merk i&ngen..Merk &omvendt..Merk ...Merk &ikke ...Merk &valgt type..Merk i&kke valgt type..700..&Store ikoner..S&m. ikoner..&Liste..&Detaljer..730..Usortert..&Flat visning..&To felt..&Verkt.ylinjer..Rotmappe..G. opp et niv...Mappelogg ...&Oppdater..750..Arkivverkt.ylinje..Standardverkt.ylinje..Store knapper..

C:\Program Files\7-Zip\Lang\ne.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	13454
Entropy (8bit):	3.9331460421143642
Encrypted:	false
SSDEEP:	192:iv4xgZB/n6NclUY0PA8ja8QPYX89RcgDZjGKOVdp:ivYUSNcOY0PA8K0gfOJ
MD5:	7CF981CFFBF6A9707376716A4D5020E5
SHA1:	445F60618C7FB9B052C4335932A324F15F262C5D
SHA-256:	859372B67C54BE5D782C7B654BEC17DEF6F3FABED7938E0E0EDA9BC0501F8EC4
SHA-512:	51EE4532B2E047ACD86454A225CD0271F4D8903D7BA21392CA300F6D74561C7CFD8F887156D3DCBE986BF2F4F359D3EC91B4C5B50096C7D3BE05FDEC52C3C609
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 4.37 : Shiva Pokharel, Mahesh Subedi..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Nepali..........401..... ....... .................&....&......&.... ....................&.... ............440..&...... ....&...... .....................: .... ...........&...........&..........&.. ............. ............. .... .... .... ......... ?..500..&......&....... ...........&............&..........&.......&.......540..&...................... ...................... ....

C:\Program Files\7-Zip\Lang\nl.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	9529
Entropy (8bit):	4.927304320720107
Encrypted:	false
SSDEEP:	192:i3E8WYSa8oQss3Yok79n3Uaep0XTrsv3H2TzQEjsrSdOZhGcicbyonornycRtUBZ:i3hQKUaemXTOWTMos49loory34sGw
MD5:	0AD65C845A9C056F283D36B5EB3E3924
SHA1:	F7101D5E3EC4E7DC03912EFA50E7D028979E76CE
SHA-256:	2539785410A62CAD5DE140A4275FCF301C69E7ED354917761D14CBD5EE0F4FD6
SHA-512:	A3EF63B1DBB8D74D543879CA5825FD5CE825B24787322BCB8A3FF85BD3CCC850052E93036EF6BE828131053D376B47FA83AAAC64FFFB62848D27D4F90A8BBF58
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; : Bert van Velsen..; 4.26 : Jeroen van der Weijde...; : Harm Hilvers..; 9.07 : Jeroen Tulp..; 15.00 : Jeroen Tulp..; 21.03 : Quinten Althues..; 21.05 : Jeroen Tulp..; 22.00 : 2022-07-04: Jeroen Tulp..;..;..;..0..7-Zip..Dutch..Nederlands..401..OK..Annuleren........&Ja..&Nee..A&fsluiten..Help....&Hervatten..440..Ja op &alles..Nee op a&lles..Stoppen..Herstarten..&Achtergrond..&Voorgrond..&Pauzeren..Gepauzeerd..Weet u zeker dat u wilt annuleren?..500..&Bestand..Be&werken..Bee&ld..&Favorieten..E&xtra..&Help..540..&Openen..Open b&innen..Open b&uiten..Be&kijken..&Bewerken..&Hernoemen..&Kopi.ren naar.....&Verplaatsen naar.....Verwij&deren..Bestand &opsplitsen.....Bestanden &samenvoegen.....&Eigenschappen..O&pmerking plaatsen.....Controlegetal berekenen..Delta..Nieuwe map..Nieuw bestand..&Sluiten..Koppeling..&Alternatieve streams..600..&Alles selecteren..Alles deselecteren..Selectie &omkeren..&Selecteren.....&Deselecteren.....Selecteren op &type..Deselecter

C:\Program Files\7-Zip\Lang\nn.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5929
Entropy (8bit):	5.0098958158502525
Encrypted:	false
SSDEEP:	96:i6nJPNV5T7bR/eGswck/SMI9o7JZqXFwKwo/c5zJsJGYsJW8L/c1N7lHvGy/Ynxj:i8Pf5LleGshkap9o77sFuo/iJsEYsfwq
MD5:	1E487C9E8EA1455D39F65AED36AE0C3F
SHA1:	AFA4D0C9A50AC24B6331B07B2F68C3944CE60579
SHA-256:	4F042C3561D0027A99A079D06406ABF2260498EB363D16C364F8403CEA0A1593
SHA-512:	A489FF1D080732C4449049C18B4A3368F9F7423F72370B5E3F7F1E3E99620B84951D80E867A0C7069B61BE5BE0CBE9E5BF6E70624D37170B3F5ADC0B9FB8FF82
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 4.45 : Robert Gr.nning..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Norwegian Nynorsk..Norsk Nynorsk..401..OK..Avbryt........&Ja..&Nei..&Lukke..Hjelp....&Hald fram..440..Ja til &alt..N&ei til alt..Stopp..Start p. nytt..&Bakgrunn..&Forgrunn..&Pause..Sett p. pause..Er du sikker p. du vil avbryte?..500..&Fil..&Redigere..&Vis..F&avorittar..Verk&t.y..&Hjelp..540..&Opna..Opna &Inni..Opna &Utanfor..&Vis..&Redigere..Endra &namn..&Kopiere til.....&Flytt til.....&Slett..&Del opp fil.....Set saman filer.....&Eigenskapar..Ko&mmentar..Rekna ut kontrollnummer....Opprett mappe..Opprett fil..&Avslutta..600..&Merk alle..Fjern alle markeringar..&Omvendt markering..Marker.....Fjern markering.....Merk etter type..Fjern markering etter type..700..S&tore ikon..S&m. ikon..&Lista..&Detaljar..730..Assortert..Flat vising..&2 felt..&Verkt.ylinjer..Opna kjeldemappa..Opp eit niv...Mappelogg.....&Oppdatere..750..Arkiv verkt.ylinje..Standard verkt.ylinjer..Store knappar..Vis knappetekst

C:\Program Files\7-Zip\Lang\pa-in.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	14663
Entropy (8bit):	4.089147713874611
Encrypted:	false
SSDEEP:	192:iK8eAMv6KYvDPVWnkFGdRq8A9UCGRidivnjnqAPvowQoNVq4qEFmQt+MN9Y0hmrX:iKpZnt/CivnjdjQKFNt+MNfU
MD5:	3C9ABF9D79E4CD21005A7FC8DDF4F426
SHA1:	FE69BF910FC35FB60E1ECE817AD07ADD3AAEF7EF
SHA-256:	9745D4C933E675B6BB6FC617FF2D56F75BE814A8F771F7A6A99EFCBBC7406E04
SHA-512:	27FE44DCB3FAC46D546B49B3DFA0CDBF151FAE1D30109DC7C589FE2E1B7407DA2F94C521A23CFDBFD39DD0BB5AD23B07F87B0D97BA3147AA2F1DAEBCF98CB1D4
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 4.53 : Gurmeet Singh Kochar..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Punjabi, Indian..........401..... ....... .............. (&Y)...... (&N)..... ... (&C).............. ... (&C)..440........ .. ... (&A)........ .. .... (&l)........... .... .............. (&B)........... (&F)...... (&P)...... ........ ..... ........ .. ... .... ....... ..?..500...... (&F)..... (&E)...... (&V)......... (&a)..... (&T)...... (&H)..540...... (&O)...... .... (&I)...... .... (&u)....... (&V)..... ... (&E)..... .... (&m)...... ...... .. ... .....

C:\Program Files\7-Zip\Lang\pl.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	9811
Entropy (8bit):	5.332963859226106
Encrypted:	false
SSDEEP:	192:inE0xONopVdHc+Xmyrhk1s6i+6rELzpZ6+0FyNEleeNRCgrH6ufZfjp8Rb:inZxOgvXmjs5+6QLz+jDlX1rp8Rb
MD5:	AD586C59B2CE74E7B81F9CA8AB16EB5F
SHA1:	1C2423EF40E05608C3EDACDFDB06C92576F26C25
SHA-256:	09A58E5F05327A978EDFF6A25DF3EAE4D70E3E4CE10A757B9B554069A95A7E96
SHA-512:	5762636CFA9FB7E45EA0716BBB87A248A54E334E4372B1A780C790AF4464226BF21748A722F9EC216F4D5AA06E4D75BE188B5E7FA61329B82AF091937E804A5A
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; : cienislaw..; : pixel..; 9.07 : F1xat..; 9.33 : .ukasz Maria P. Pastuszczak..; 22.00 : Micha. L...;..;..;..;..;..;..0..7-Zip..Polish..Polski..401..OK..Anuluj........&Tak..&Nie..&Zamknij..Pomoc....&Kontynuuj..440..Ta&k na wszystkie..Ni&e na wszystkie..Zatrzymaj..Pon.w..&T.o..&Pierwszy plan..&Wstrzymaj..Wstrzymano..Czy na pewno chcesz anulowa.?..500..&Plik..&Edycja..&Widok..&Ulubione..&Narz.dzia..Pomo&c..540..&Otw.rz..Otw.rz &wewn.trz..Otw.rz na &zewn.trz..Pod&gl.d..&Edytuj..Zmie. &nazw...Kopiuj &do.....&Przenie. do.....&Usu...Podzie&l plik.....Z..&cz pliki.....W.&a.ciwo.ci..Ko&mentarz..Oblicz sum. kontroln...R..nice pomi.dzy plikami..Utw.rz &folder..U&tw.rz plik..Za&ko.cz..Dow&i.zanie..&Alternatywne strumienie..600..Z&aznacz wszystko..&Odznacz wszystko..Odwr.. &zaznaczenie..Zaznacz.....Odznacz.....Zaznacz wed.ug typu..Odznacz wed.ug typu..700..&Du.e ikony..&Ma.e ikony..&Lista..&Szczeg..y..730..Nieposortowane..Wi

C:\Program Files\7-Zip\Lang\ps.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	8640
Entropy (8bit):	4.630664301017851
Encrypted:	false
SSDEEP:	96:iZrJrFkaUGFoiZxn8pSbo4YCVtH7tpY+Qan1JZ0d+yccGFs8Ie30aNMfm88B9eDb:iBJZ0o98pT4YCP1pfSDHayRvpyDJe
MD5:	5A95214895DBC922DB46242E4DED0CC9
SHA1:	B44E67282700745C036C8561B3E1F98D303AB209
SHA-256:	146E35220BCD45FCB886D17A4E017145965CD2EA4DE93FCDB3D0D566A154EF08
SHA-512:	D9A9122D2768ECF3B2E065E9AACDEB453A5E60B4BC000A934C2B8D7DFC81398FB4841D302F67FE144264ABEF5EB788F16BEA2BD1EAAE703BDD8741E97E9516BF
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 4.53 : 2007-12-26 : Pathanisation Project..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Pashto........401.......................&....&.......&..................&..440...... .. ..&...&... .. .........................&........&.......&............. ...... .... ..... .. ... .. ......500.......&......&.....&...&............&.......&..540..........&......& ............. .&............&......&....&............. .....&....... .....&.......&.......... ...&.......... ...&.....................&......... ............. ............ ........&.....600..... ....&..... ............. .......&........................ ... ........ ... ........700....&. ..

C:\Program Files\7-Zip\Lang\pt-br.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	9923
Entropy (8bit):	5.032033033226407
Encrypted:	false
SSDEEP:	192:iroGaU4mlzNN8hYivh5gtE/oNYJUfdNQuQ:iUGd4mlzNFi4tEgN/fHQuQ
MD5:	F17AF860A989425B3EC74735C14564A4
SHA1:	228CCBAE3AB9223D0511B6D1B89EAD914FC6BBED
SHA-256:	A39F90E121F939F6FCF35E7AA37F907FF7308E8294EFCA948401887FBA641245
SHA-512:	2A5F47B9302868EDAD0414F7FBE7AB38BDCA991AB1DB972F304F590E1A5F0E5ABF354BE3B4093BF2F99B68415A70D3CBCCBF9EF52CC7CC39D019CF3FAD0DABDE
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; : Francisco Jr..; 4.37 : Fabricio Biazzotto..; 23.00 : Atualizado por Felipe..;..;..;..;..;..;..;..;..0..7-Zip..Portuguese Brazilian..Portugu.s Brasileiro..401..OK..Cancelar........&Sim..&N.o..&Fechar..Ajuda....&Continuar..440..Sim pra &Todos..N.o pra T&odos..Parar..Reiniciar..&Em 2. plano..&Em 1. plano..&Pausar..Pausado..Voc. tem certeza que voc. quer cancelar?..500..&Arquivo..&Editar..&Visualizar..F&avoritos..&Ferramentas..&Ajuda..540..&Abrir..Abrir &por Dentro..Abrir p&or Fora..&Visualizar..&Editar..Re&nomear..&Copiar Para.....&Mover Para.....&Apagar..&Dividir arquivo.....Com&binar arquivos.....P&ropriedades..Comen&t.rio..Calcular checksum..Diff..Criar Pasta..Criar Arquivo..S&air..Link..&Correntes Alternantes..600..Selecionar &Tudo..Desmarcar Tudo..&Inverter Sele..o..Selecionar.....Desmarcar.....Selecionar por Tipo..Desfazer a Sele..o por Tipo..700...co&nes Grandes...c&ones Pequenos..&Lista..&Detalhes..730..Desorganizado..Visualiza..o Pl

C:\Program Files\7-Zip\Lang\pt.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	9889
Entropy (8bit):	5.031384556349762
Encrypted:	false
SSDEEP:	192:imw4jPxHaLy/GR9Nz8dMzMUKlWWauPECXuN9zSYaiXnj0aQVKjqIozv:imbPxHH/GR9Nz8dMzMUKlELC+NRS3iXI
MD5:	B8F868BF02773C933FD8DE61F8FAAD4F
SHA1:	425145C1E0B09599E5BD914976A8AF79B56E32E3
SHA-256:	F2833A6AFBDB1DD3C4BE57904DF960308F293D82F8FD9291D31F0E1A7A4F8F54
SHA-512:	EECDCE2E90679060CD1B7F8523C06C12BE1F47DDB753A16BFF49FBBB595894F7FA01DF78C108FDFAF51EE1F725D961F079BF3DD7FF2BCDCAB9087BA25482C01E
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; : Carlos Macao..; : Jo.o Alves..; : Jo.o Frade (100 NOME TR)..; 4.46 : Rui Costa..; 9.17 : S.rgio Marques..; 15.00 : Rui Aguiar..; 15.00 : 2022-03-22 : Hugo Carvalho..; 22.00 : 2022-06-28 : Hugo Carvalho..;..;..;..0..7-Zip..Portuguese Portugal..Portugu.s..401..Aceitar..Cancelar........&Sim..&N.o..&Fechar..Ajuda....&Continuar..440..Sim a &tudo..N.o a t&udo..Parar..Reiniciar..&Segundo plano..P&rimeiro plano..&Pausar..Em pausa..Quer mesmo cancelar?..500..&Ficheiro..&Editar..&Ver..F&avoritos..Ferramen&tas..&Ajuda..540..&Abrir..Abrir &dentro..Abrir &fora..&Ver..&Editar..Mudar& o nome..&Copiar para.....&Mover para.....&Eliminar..&Dividir ficheiro.....Com&binar ficheiros.....P&ropriedades..Come&nt.rio..Calcular o checksum..Diff..Criar pasta..Criar ficheiro..&Sair..Liga..o..&Alternar fluxos..600..Seleccionar &tudo..Desseleccionar tudo..&Inverter selec..o..Seleccionar.....Dessseleccionar.....Seleccionar por tipo..Desseleccionar por tipo..700

C:\Program Files\7-Zip\Lang\ro.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	7573
Entropy (8bit):	5.094515398125584
Encrypted:	false
SSDEEP:	192:iAF8khF2yUYtHwf6jHwKlPVS6LWbsWGGqZfG7ORVCPF27l:iE8mUYtHCRuPjWQu6KP0x
MD5:	369C76A290F64E1789038D1A1BD00E84
SHA1:	1F654FFC11DB57CE7230CF56CA90CC15ED800049
SHA-256:	62AADC77F5B11353C4BB3582F1F9CD08A41F029F3CD2EBAF0F239B9D4FE6A712
SHA-512:	259EF6683DCB3AAA2928738DF1A5819B07173D6C29ECF1B7700F4078FDDB278150F4157C1F2E3985FBC366F1DA5AD5EEF168DDE4A25A280C71D518704FD0CF55
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 4.59 : Lucian Nan..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Romanian..Rom.n...401..Bine..Anulare........&Da..&Nu..&.nchide..Ajutor....&Continu...440..Da, pe &toate..N&ici unul..Opre.te..Restarteaz....n &fundal..La &suprafa....&Pauz....n pauz...E.ti sigur c. vrei s. anulezi?..500..&Fi.ier..&Editeaz...&Vizualizeaz...F&avorite..&Unelte..&Ajutor..540..&Deschide..Deschide .&n..Deschide .n &afar...&Vizualizez...&Editeaz...&Redenume.te..&Copiaz. la.....&Mut. la......ter&ge...mparte &fi.ierul.....&Une.te fi.ierele.....&Propriet..i..Comen&tariu..Calculeaz. suma de verificare....Creaz. director..Creaz. fi.ier..&Ie.ire..600..&Selecteaz. tot..&Deselecteaz. tot..&Inverseaz. selec.ia..Selecteaz......Deselecteaz......Selecteaz. dup. tip..Deselecteaz. dup. tip..700..Iconi.e m&ari..Iconi.e m&ici..&List...&Detalii..730..Nesortat..Vedere plan...&2 panouri..Bare de &unelte..Deschide directorul r.d.cin...Un nivel mai sus..Istoria

C:\Program Files\7-Zip\Lang\ru.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	15366
Entropy (8bit):	4.358672569717736
Encrypted:	false
SSDEEP:	192:iO2LUMKClKgihECTkV0jxOfXYCjisdvyMpf5ZOO8gCW4nY5tbVe7wE+oxZ+XU2Wz:iGfhEGhtQYpY6MXsO7CNQJ8Z+HWKu
MD5:	D79D3086FF78B45FFF7399AB0A8C47D5
SHA1:	9FA9D017D245233A84841A7D0A7C51167BDA810E
SHA-256:	8D31CE9559092F4E4FF6D4A4D1F9751B277FEA67F4674E64C81C3D9367E608F3
SHA-512:	39A0499762E7237B4BAA2EFE679367ECF080B21BF24939BA2BB2697139D5722943135486DDB055D896BACC1A64D2EB235897855537849E8BD13110BAC782F212
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 23.01 : 2023-05-15 : Igor Pavlov..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Russian...........401..OK................&....&.....&...................&............440.... ... &......... ... .&.......................&.......&.. ........ ......&......... ......... ............. ...... ........ ........?..500..&......&........&.....&............&.......&.........540..&................ &............... .....&..............&....................&..........&.......... ......&........... ......&...........&..... ..........&......... .............&............&...................... .................&....... ...........&.

C:\Program Files\7-Zip\Lang\sa.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	19238
Entropy (8bit):	3.8695802791583893
Encrypted:	false
SSDEEP:	384:it3ma17q9ntvNTsld5VFx3MkAGO310F0klrfofmR7HOwPyng:aQvQnQg
MD5:	D734464288D47B5238638791A5C4AE7F
SHA1:	696B8E4C542F4095864734C1BC204BE6F08A9A5D
SHA-256:	697C00D2A37E5100F87A93CFCA6CD67D43A78B523DB18AC65B4260CF080E5AC3
SHA-512:	75997ED2CEC4DE26AA003CD67E146173AAF8A9A80969AC3AFEA0968C90E75E16A64EC1B1AC78D0F3DC4C15917AC911C0276A63BB893EC9699647BE9E6FF147D0
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 9.07 : Vinayy Sharrma, ....... .... .......;..;..;..;..;..;..;..;..;..;..0..7-Zip..Sanskrit, Indian, .......................401..... ...................&.....&....&... ..............&.... .....440..&....... .....&....... .............. .... ......&............&........(.........)..&......................... .... .... ..... ... ....... .... ..... ....?..500..&........&..........&.........&..........&........&.......540..&.........&.... .........&.... ........

C:\Program Files\7-Zip\Lang\si.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	19201
Entropy (8bit):	4.089350986528639
Encrypted:	false
SSDEEP:	384:iIWmRcV3yPJWg7FkJi4LJN7w4WMQXn7Nkj0aQ7e5/b8hgg7W7rBBYJ4XMxzcjoag:OZVC1oJnWMQXnoD7+J4yaBiMB7PnahcE
MD5:	3C24183C8DC95EDC2B56B42C3D0275ED
SHA1:	7A3843AE91BF3CC721FE52E6C9D58FC16B6253C1
SHA-256:	3A47EF6F05B3FE22C1A94B61F4B686E4E3537C1B7E282A577174C3D86C0A2FC9
SHA-512:	906F8F5A06EB3F1099ACC8DF7A11E8012D72B52F0AEF5788851DDD9CEE30D2A209AA90E2093C83600F070BD9E7AF4AE98F7BDCCE953D4073ADDFD554405E42B0
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 4.59 : ...... ....... (Supun Budhajeewa)..; 15.00 : ..... ..... (HelaBasa Group)..;..;..;..;..;..;..;..;..;..0..7-Zip..Sinhala.........401.....................&.....&......&...............&.........440..&........ ............. ................. ........&...........&...........&....................... ...... ..... .. ........?..500..&.......&..........&........&.............&........&......540..&..... .......&..... ..... .......&....... ..... .......&........&.........

C:\Program Files\7-Zip\Lang\sk.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	9372
Entropy (8bit):	5.379400863038617
Encrypted:	false
SSDEEP:	192:ihqYyHuLGHP372c79qAFklXva+hF+zmTzeNMR:iMjUGHP72cJqAFAXi+hs0aNMR
MD5:	CA2B22D21945A478757A099EEAFDF9A9
SHA1:	5EFBF215647E82DDEAA4C83D064EF83B51413DEA
SHA-256:	E571C0D87B50F4659099B4CA618057533C22578066E411C5CEB3DF8BE1E77CFF
SHA-512:	40365AC6CDD70FF7B7AB09482E1E9263B1B131772019EDA357007D029A879111DA72B05756ADBFC3206B1C060211A16B5F10D507FB0CAA3696907C8433FE9537
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; : Tomas Tomasek..; 9.07 : Pavel Deve.ka..; 9.38 beta : 2015-01-11 : Roman Horv.th..;..;..;..;..;..;..;..;..0..7-Zip..Slovak..Sloven.ina..401..OK..Zru.i.........&.no..&Nie..&Zavrie...Pomocn.k....Po&kra.ova...440...no na &v.etko..Nie na v.&etko..Zastavi...Re.tartova...&Pozadie..P&opredie..Po&zastavi...Pozastaven...Ste si ist., .e chcete akciu zru.i.?..500..&S.bor..&Upravi...&Zobrazi...&Ob..ben...&N.stroje..&Pomocn.k..540..&Otvori...O&tvori. vn.tri..Ot&vori. externe..&Zobrazi...&Upravi...&Premenova...&Kop.rova. do.....P&resun.. do.....O&dstr.ni...Ro&zdeli. s.bor.....Zl..&i. s.bory.....V&lastnosti..Ko&ment.r..Vypo..ta. kontroln. s..et..Rozdiel (Diff)..Vytvori. prie.inok..Vytvori. s.bor..Uko&n.i...Odkaz.....600..Ozna.i. v.etko..Odzna.i. v.etko..Invertova. ozna.enie..Ozna.i......Odzna.i......Ozna.i. pod.a typu..Odzna.i. pod.a typu..700..&Ve.k. ikony..&Mal. ikony..&Zoznam..&Podrob

C:\Program Files\7-Zip\Lang\sl.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	8921
Entropy (8bit):	5.011821025657587
Encrypted:	false
SSDEEP:	192:iACcUhGAoKfrxHa5Q36dq5OSsZf1w1huHF8fY1oTraGAS17S+pVss0Bq2mXXF62G:iHhFoKlNZoZ9wi52rvhQmXA2G
MD5:	15998E10BFD00DFA00242A7A29C87E1E
SHA1:	FA03DABCE5D334CF83E5391C29A93B5F15B56F5A
SHA-256:	4C8D7A98434ED6D282FCC8691DCFD3BD9FD81A7302804522D7F5214FA9E34BD8
SHA-512:	C1ABC3039832AA2BD3381168CE84F6DCC4A60344D329507B791AA9B7634723F0027510B39940050ABCD2A32ECB6DB5AED5B350FC039699FD39F98C85A1381277
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 22.01 : 2022-07-17 : Jadran Rudec..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Slovenian..Sloven..ina..401..Vredu..Prekli.i........&Da..&Ne..&Zapri..Po&mo.....&Nadaljuj..440..Da za &vse..Ne za v&se..Ustavi..Znova za.eni..Ozad&je..&Ospredje..Premor..Na premoru..Ali ste prepri.ani, da .elite preklicati?..500..Datoteka..Urejanje..&Prikaz..Priljubljene..Orodja..Pomo...540..&Odpri..Odpri &znotraj..Odpri zu&naj..P&rikaz..&Uredi..Prei&menuj..&Kopiraj.....&Premakni.....Iz&bri.i..&Razdeli datoteko.....&Zdru.i datoteke.....L&astnosti..Ko&mentar..Izra.unaj preizusno vsoto..Razlika..Ustvari mapo..Ustvari datoteko..&Izhod..Povezava..&Nadomestni tokovi..600..Izberi &vse..Razveljavi izbiro vseh..&Preobrni izbor..Izberi.....Razveljavi izbiro.....Izberi po vrsti..Razveljavi izbiro po vrsti..700..&Velike ikone..&Majhne ikone..&Seznam..&Podrobnosti..730..Nerazvr..eno..Ploski prikaz..&Dve podokni..&Orodne vrstice..Odpri korensko mapo..Eno raven navzgor..Zgodovina map.....&O

C:\Program Files\7-Zip\Lang\sq.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5983
Entropy (8bit):	5.056118434890893
Encrypted:	false
SSDEEP:	96:iHAtkn0BEwsPPhrWkJB5k0+bV9l+vqmF5TGBrSbTSlXDvGfH2QXW7toHpaaiA5GO:iC2sUrUQJ5TbXCXsXWui8dx7kBttR/Ja
MD5:	0D0BADB86FB9F8EEED49B17BAD81B291
SHA1:	4081C76E3BB6CA34CEADDB3ED4348095D46B664F
SHA-256:	580905AD605AB3C38776091D1E0E59385501A34DD9DE0BA0F3469297C82A0F92
SHA-512:	2B018434F11AD31F7EA9770A2D21F2CC25C2C6DC5D99A5095E5B1932676EA9AA16EF8757E5D417EB5C3E669AE0B57BCE6681795813F332E1602EFC8D5C7B50FD
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 4.37 : Mikel Hasko..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Albanian..Shqip..401..N. rregull..Anulim........&Po..&Jo..&Mbyll..Ndihm.....&Vazhdim..440..Po p.r t. gjith&a..Jo p.r t. gjit&ha..Ndalo..Rinis..N. &sfond..N. pla&n t. par...&Pushim..N. pushim..Jeni t. sigurt se d.shironi ta anuloni?..500..&Skedari..&Redaktimi..&Pamja..&T. parap.lqyerit..&Veglat..&Ndihma..540..&Hap..Hap p.rbre&nda..Hap p.rjas&hta..&Pamja..&Redakto..Ri&em.rto..&Kopjo tek.....&Zhvendos tek.....&Fshi..N&daj skedarin.....Kom&bino skedar.t.....&Vetit...Ko&menti..Llogarit shum.n e verifikimit....Krijo nj. dosje..Krijo nj. skedar..&Dil..600..S&elekto t. gjith....se&lekto t. gjith...Anasill selekti&min..Selekto......selekto.....Selekto sipas tipit...selekto sipas tipit..700..Ikona t. &m.dha..Ikona t. &vogla..&List...&Detaje..730..&T. parenditur..Pamje e rrafsht...&2 panele..&Shiritat e veglave..Hap dosjen rr.nj...Nj. nivel m. lart...Historiku i dosjes.....

C:\Program Files\7-Zip\Lang\sr-spc.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	11993
Entropy (8bit):	4.283284821303782
Encrypted:	false
SSDEEP:	192:iCk9ED/u0/rzMXyBMtR/TL0wN1i9Rd9u3ZDxoAF9sOVbvmyz3xnvze0kIqLm3HGX:iCk94zBWv0b9P9gZ1lLhnbe8q0tfsH6o
MD5:	FFD26304B9B5FAE8547703515E84460D
SHA1:	CFF3F023BB47CA3C6C3DB202CD8C126B0BB2F59F
SHA-256:	283DD99EC8D13784B3D79C36766CDB16DAC0EDE0C1C09E8B1EFA64F5DC2C1A55
SHA-512:	0A4E39E2598C73F936E4C8BD56201FEE00AEB5DAAB0D7B735D5137A8B7C15830B40F028C77B528B75653540836098F5E8FC059111DD2EFBD0A46DDBDF97465C1
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; : Lazar..; 9.07 : Ozzii..;..;..;..;..;..;..;..;..;..0..7-Zip..Serbian - Cyrillic........ - ..........401... .......................................................440.... .. ....... .. ................................ ...................... .. ... ....... .. ...... .. .........?..500.......................................................540.................. .. 7-Zip-.......... .. ........... ................................................. .............. .................... ............. .......................................... ........ ....................... .............. .................60

C:\Program Files\7-Zip\Lang\sr-spl.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	7169
Entropy (8bit):	5.029859884824853
Encrypted:	false
SSDEEP:	192:iZjnEAuD8cvkp9HRmD+eyl3NLH0qgGOzeVTs8rmXab4f:i5EL8cIxMQGGjuXasf
MD5:	FD327F424C7E4F23D2C018DED334A1B5
SHA1:	0FE9A48C528BE4022B19F7373CBA9190D3BDB473
SHA-256:	D5A250B45BD51267E2B0D78CF60E7F14113419565F9B95C2B1113963396570A5
SHA-512:	AE6C2959A5348BDBC1464FD0E08A3A00F8598A2D423381E5883347A85E88F7749659E0FAC4F89D6CCBC74A1E83F47EC4F42CAC22115CA3921DEF00DE41978ADB
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; : Lazar..; 9.07 : Ozzii..;..;..;..;..;..;..;..;..;..0..7-Zip..Serbian - Latin..Srpski - latinica..401..U redu..Otka.i........Da..Ne..Zatvori..Pomo.....Nastavi..440..Da za sve..Ne za sve..Stani..Ponovo..Pozadina..Na vrhu..Pauza..Pauza..Da li ste sigurni da .elite da prekinete?..500..Datoteka..Ure.ivanje..Pregled..Omiljeno..Alati..Pomo...540..Pogledaj..Otvori sa 7-Zip-om..Otvori sa pridru.enom programom..Pregledaj..Promeni..Preimenuj..Kopiraj u.....Premesti u.....Obri.i..Podeli fajl.....Spoj delove.....Svojstva..Komentar..Izra.unajte provernu veli.inu..razlika..Nova fascikla..Nova datoteka..Izlaz..600..Izaberi sve..Poni.ti izbor svega..Obrnuti izbor..Izaberi.....Poni.ti izbor.....Izaberi po tipu..Poni.ti izbor po tipu..700..Ikone..Naporedno slaganje..Spisak..Detalji..730..Bez sortiranja..Ravan pregled..2 Prozora..Trake sa alatkama..Otvori po.etnu fasciklu..Gore za jedan nivo..Hronologija.....Osve.avanje..750..Rad sa arhivama..Rad sa datotekama.

C:\Program Files\7-Zip\Lang\sv.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	9225
Entropy (8bit):	5.0733170356250366
Encrypted:	false
SSDEEP:	192:iIFthqlCnYhITsbVA28ta0obRFz+3uCGQ9/FLFDLb0Y620X9CWHdfKaSzuQ3UBMm:iI/hdnY9bi2tWpFLJb0Y62dWHIAyC
MD5:	6C9E8093D11110E7044E0967D1DCD714
SHA1:	B864405022B4E27A3DA7F3DBA73E0239B5291745
SHA-256:	4EA68A967D6A20DB716D92D7F20E42B8E644F3ACF15C035C3E74AACCD04EA4F2
SHA-512:	61450FCDD8CB297B9C2F47493965C295352DF705EADEE11DB5121170F28231E152C474107B851940D191CCF15B0382F36C7983D825CA949D71B1408E32F73B61
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; : Andreas M Nilsson, Christoffer Enqvist..; 4.59 : Bernhard Eriksson..; 22.00 : (2022-06-20) Mikael Hiort af Orn.s..;..;..;..;..;..;..;..;..0..7-Zip..Swedish..Svenska..401..OK..Avbryt........&Ja..&Nej..&St.ng..Hj.lp....F&orts.tt..440..Ja till &alla..Nej till a&lla..Stoppa..Starta om..&Bakgrunden..&F.rgrunden..&Pausa..Pausad...r du s.ker p. att du vill avbryta?..500..&Arkiv..&Redigera..&Visa..&Favoriter..Verkt&yg..&Hj.lp..540..&.ppna...ppna &internt...ppna &externt..&Visa..&Redigera..&Byt namn..&Kopiera till.....&Flytta till.....&Ta bort..&Dela upp fil.....&Sammanfoga filer.....E&genskaper..Komme&ntera..Ber.kna kontrollsumma..Differens..Skapa mapp..Skapa fil..&Avsluta..Skapa l.nk..&Alternativa datastr.mmar..600..Markera &alla..Avmarkera alla..&Invertera markering..Markera.....Avmarkera.....Markera efter typ..Avmarkera efter typ..700..St&ora ikoner..Sm&. ikoner..&Lista..&Detaljerad lista..730..Osorterad..Platt vy..&Tv. paneler..&Verktygsf.l

C:\Program Files\7-Zip\Lang\sw.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8534
Entropy (8bit):	4.869475632527227
Encrypted:	false
SSDEEP:	192:7f+9CSE///g+aidWrT8PpH0fKxsyEeHRinn:7qCtompaKxsRn
MD5:	A67DEF153DE6E8A46AFD8EA2986148BC
SHA1:	6FE4C1F17E67DB265100B2C509FDAB8965EA9EFD
SHA-256:	F07003E1C9935CD907CC0D24C8DE65A540B33AAC7B1E3F6CBE0C94955461263B
SHA-512:	B75BC7D2B21A7C5644E24CB589E398BDB1516F822611BAAFC6242317253ADC49875BD2547F713D9235D848636A1B9C6D8B7871CA27637B74555FA3E4FDFE00F7
Malicious:	false
Preview:	;!@Lang2@!UTF-8!..; 15.00 : 2020-05-15 : Mara Gati Lucky..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Swahili..Kiswahili..401..Sawa..Ghairi........&Ndio..&Hapana..&Funga..Usaidizi....&Endelea..440..Ndio kwa &zote..Hapana kwa z&ote..Simamisha..Washa upya..&Mandharinyuma..&Mandharimbele..&Tuliza..Imetulizwa..Una uhakika unataka kughairi?..500..&Faili..&Hariri..&Mwoneko..Z&inazopendwa..&Zana..&Usaidizi..540..&Fungua..Fungua &ndani..Fungua n&je..&Mwoneko..&Hariri..Pati&a jina upya..&Nakili hadi.....&Sogeza hadi.....&Futa..&Gawiza faili.....Ung&anisha nyaraka.....S&ifa..Toa m&aoni.....Kokotoa checksum..Tofautisha..Unda kabrasha..Unda faili..F&unga..Kiungo..&Mitiririsho mbadala..600..Teua &zote..Ondoa uteuzi wote..&Pindua uteuzi..Teua.....Ondoa uteuzi.....Teua kulingana na aina..Ondoa uteuzi kulingana na aina..700..Iko&ni kubwa..Ikoni ndogo..&Orodha..&Maelezo..730..Haijapangwa..Mwoneko bapa..&2 paneli..&Miambaa zana..Fungua kabrasha shina..Juu kiwango kimoja..Historia ya folda.....&Weka upya..We

C:\Program Files\7-Zip\Lang\ta.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	12461
Entropy (8bit):	3.759475276039421
Encrypted:	false
SSDEEP:	192:iYMxAhP2NKfBuRZjaaC1e13/BNhpYY+StiAnCuu1+AuvB1nNh11N:iTlNZjaggAn3
MD5:	D393B72F709D1136BFBA0A445D763B40
SHA1:	ABF145A510DDDE5B5567BC99747A286AFD87EFAB
SHA-256:	7EA5323772A7F252F8BCAEE30ED2404BE8707CFFAA013357984F6EDF1C2B1C7C
SHA-512:	5346465FE4D31A8A8CD1DDA5A532E75FE4B160F640B5C00419067ED01FE4FA8D40AFC95329528B63B6F6F4F15FEE10129DF49B2275AC5EC7DF0C089D740D8DC9
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 3.13 : Ve Elanjelian : ThamiZha! team..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Tamil.........401............................................................440............... .................. ............................................................... .................. ..................... ...... ..... .................?..500.........................................................540............ ........... ..........................

C:\Program Files\7-Zip\Lang\tg.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	15127
Entropy (8bit):	4.407760431254582
Encrypted:	false
SSDEEP:	192:iLcxMil07H3brpQXBwkGE3RypQcG3XlDrpQK3I5D2OleVZZd3K5RATp+O1jR40pE:imK3bMlGE34Q3FBT3eDoZdaOHfllqzDv
MD5:	4A5529986613CDF743B3F7755F8F5CAE
SHA1:	970DFAD147AB3D32E93EEF6BF464BCAC23368E4F
SHA-256:	1CEDD8F699940FECACACBC5DF093BA70FB2099FAF9864376A3D990DA78B8E075
SHA-512:	1F7E8A8A21E8E5FAF546B2F4C621B326A907AFA017DD8221022DF2D19B3E41D10D5157A8713F8D5485601311029F4E25DCB21D0E9B4991B6D26D651B416239C0
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 20.02 : 2020-10-20 : Shamsiddinov Zafar..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Tajik..........401........................&......&....&.................&...........440...... ..... &......... ..... &................. ........&........&.. ... .........&............. .............. ....... ......, .. ......... .... ...... .......?..500..&......&........&........&........................&.........540..&............ ..... &............ ..... .................&.............. .......&............ .......&........ .......&.... ................. ..... &..........&..... ....... ...................................... .

C:\Program Files\7-Zip\Lang\th.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	15854
Entropy (8bit):	4.014533808085892
Encrypted:	false
SSDEEP:	384:iX9n+rMUfsqjeWnShfO1LpBIB9jip10zsP58fUhe1RBC6sl4wjn/PqIpqINAgo2J:S9n+4csqjeWnSh21LpBIB1O10zsP58fy
MD5:	05B217E13AE943B7852AE6FF6479ACF8
SHA1:	567F90FC82ECAC638432C830D35EB6F44B105584
SHA-256:	B491B33BF96E385BD503F3981FBC89A3BB16442992E48D283DFD40B411666E6D
SHA-512:	968905D4E33A91B7FC747E9B75C1D22C506C0C2C2E07CE0A414E978E724B7F77B0B60204003CA8514D2686607A0B022BF5E46B7715AD30CD37BF567ACBE3AB18
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 4.09 : Chayanon Ruamcharoen..; 4.10 : Zafire06..; 9.13 : Kom10..;..;..;..;..;..;..;..;..0..7-Zip..Thai.......401......................&.....&.....&..................&..............440........................................&...................&...................&.....................................................500..&......&.......&........&............&............&...........540..&..............................................&........&.......&........

C:\Program Files\7-Zip\Lang\tk.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	9231
Entropy (8bit):	5.263492055478717
Encrypted:	false
SSDEEP:	192:7toKrLnyvqg+g8p0k9DMfjrdTU4dX81pubJjrkLPFT8jPJzVIj7dYqxMXXDqit:7mKriqL3oRUU81pEBmPFwb9VY7dYqxMP
MD5:	585AFB2701F61F1B3845E693E66EC728
SHA1:	B1E853CBCAFA831C5EA782F40EE6942A72A8DB5F
SHA-256:	EB3A0766FA6A5DD793DA3058DDAFC9A89B4DB5F1B29842C6D81F38E9D4B71C29
SHA-512:	C02925370A3D6A6297082A7CCB67F12DDBE0368DC5A7394C24BD910ED9FE742BA5B76FBCEA34FA2159BF0591AE8F4A10B25941C9B56F1403C4FEE4BC9F800E02
Malicious:	false
Preview:	;!@Lang2@!UTF-8!..; 19.00 : 2019-03-04 : Merdan NURIYEV Hazar-Balkan H.K...;..;..;..;..;..;..;..;..;..;..0..7-Zip..Turkmen..T.rkmen.e..401..Howwa..Go.bolsun et........&Howwa..&.ok...a&p..K.mek al....&Dowam et..440..Hemmesine howw&a..Hemmesine &.ok..Dur..Ga.tadan ba.la..&G.r.nme..&..e .yksyn..&S.gindir..S.gindi..Go.bolsun etjekmi?..500..&Dos.a..&D.zelt..&G.r..F&aworitler..G&urallar..&K.mek..540..&A...&I.inde A...Da.&ynda A...&G.r..&D.zelt..Adyn&y ..tget...u .ere &kop.ala......u .ere &g...r.....&...r..Fa.ly &b.l.....Fa.llary &birle.dir.....&D.zg.nlemeler..Tes&wir.....Barlag jemini hasapla..Tapawutlanma..Bukja d.ret..Fa.l d.ret..&.yk..Bag..Akymlary .&aly...600..Hemmesini Se...Hemmesini Se.me..Se.im&i tersine .w.r..Se......Se.me.....Tiplerine g.r. se...Tiplerine g.ra se.me..700..U&ly Ikon..Ki.i Ikon..Tablissa..Jikme-jikleri..730..Sortlanmadyk..D.z G.rn....&2 Paneller..&Esbaplar..D..p Bukjany A...Bir Tekje .okary....

C:\Program Files\7-Zip\Lang\tr.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	9847
Entropy (8bit):	5.238999824211049
Encrypted:	false
SSDEEP:	192:7QzYDtLRGGx8N6ukqSquNGSbLH92sip822LfdQw6RU9JNaiwacCz:7QzMwN+7qpgLHtNQyD
MD5:	D6BF427B8F3660F0D390BB90FBD3318E
SHA1:	F28288E45310E22A9957612A765BC3EFABCF7E47
SHA-256:	859A359601FFB9DA85871F12D27C75F6DE6D239E766AE8127E95CA1B574B1C62
SHA-512:	3DB2A2DA71242817621E7173FA653D91A397E030CC80E6EC0526F8F49C1E321AF7968DF9757F974C2D1D5EC163CE0EFA442B379572A2FB8453BF01FC7D2F0C5A
Malicious:	false
Preview:	;!@Lang2@!UTF-8!..; 22.00 : 2023-05-28 : Emir SARI..; 15.00 : 2018-11-21 : Kaya Zeren..; 9.07 : 2009-09-22 : X-FoRcE ..;..;..;..;..;..;..;..;..0..7-Zip..Turkish..T.rk.e..401..Tamam...ptal........&Evet..&Hay.r..&Kapat..Yard.m....&Devam..440..T.m.ne &Evet..T.m.ne &Hay.r..Durdur..Yeniden Ba.lat..&Arka Planda...&n Planda..&Duraklat..Duraklat.ld....ptal etmek istedi.inize emin misiniz?..500..&Dosya..D.&zen..&G.r.n.m..&S.k Kullan.lanlar..&Ara.lar..&Yard.m..540..&A...7-Zip ..i&nde A...&Varsay.lan Uygulamada A...&G.r.nt.le..D.&zenle..&Yeniden Adland.r..Klas.re Ko&pyala.....Klas.re &Ta.......&Sil..Dosyay. &B.l.....Dosyalar. Bi&rle.tir......&zellikler..A..kla&ma......Sa.lamalar. Hesapla..Fark..Klas.r Olu.tur..Dosya Olu.tur....&k..Ba&.lant...Alternatif &Ak..lar..600..T.m.n. &Se...T.m.n.n Se.imini Kald.r..Se.imi &Tersine .evir..Se......Se.imini Kald.r.....T.re G.re Se...T.re G.re Se.imi Kald.r..700..&B.y.k Simgeler..&

C:\Program Files\7-Zip\Lang\tt.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	14201
Entropy (8bit):	4.573823980880442
Encrypted:	false
SSDEEP:	384:idiangc64QGQ6p6Wc84DqdqQ/P9YW0XyU9ondS8O20Biu9J5:rag/4Tzp6Wc84Dq0Q/P9YiUGnmiu9T
MD5:	5BFFF09148D010F1FCED306743EF0AC3
SHA1:	C8434A77A92FF28E2F4AC0BC0E83C9AD6FFEAD01
SHA-256:	3D113BEF1511A63EDDCB6132EC626F8A93D972BD33219D8FF55520E53B5EFD21
SHA-512:	25D7FB00C442D6E601DB99D00477F0D3681751D1829D171E35A3B01D0A03490CCA6C7366630A0AD5F7392E54075694A39F500E121B290477181A3A8F6A22BEFA
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 15.10 : 2017-02-12 : Bulat Ibrahim..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Tatar...........401..OK..... .............&.....&....&.................&..... ........440..... &........ ........ .&....... ....................&.......&.... ........&...................... .. ....... ............?..500..&......&.........&.......&...........&.........&.........540..&............ &............. ..&.............&.................. &............&.................&..............&................. &..................... &....................&..............&............... .....................&..... ..........&.. .........&

C:\Program Files\7-Zip\Lang\ug.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	11386
Entropy (8bit):	4.7182582221463525
Encrypted:	false
SSDEEP:	192:iDIm9xflePh286zK/bnZ6U4EeBVDeZTyUZirOCsiCjcY8VFDZ:iNMPhhrBNeBVSTTZUwiCuDZ
MD5:	EF3E8D61D03E42A3B40D6F0B12535ADB
SHA1:	569360BCFEB39C102A3DD78ED96204B5D733FFBE
SHA-256:	9D0268D1EEB8DFDEBBB8EA1033C2B99CD667A244C9859085BE5D54C9E5CED369
SHA-512:	6E9AFEB0A96DA6D8BF63F06DE421B8D4DDBF4D750E1BDF861FBBDC0268CBEB19068D08787F0F1655B40EBDC603D888251DAE188C3547F32B970C7F927754066A
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 4.59 : Sahran..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Uyghur............401............. ...........(&Y).........(&N).....(&C).......................(&C)..440......... ....(&A)......... ...(&L).............. ............ ....(&B)....... ....(&F).......... .....(&P).......... .................... ... ...........500........(&F)........(&E).........(&V)........(&A).......(&T)........(&H)..540.....(&O)........... ........ ...(&I)...... ........ ...(&U).........(&V)........(&E)..... .......(&M)......... .....(&C)......... .....(&M)........(&D)........ .......(&S)......... .........(&B).........(&R).........(&N)........ .............

C:\Program Files\7-Zip\Lang\uk.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	15762
Entropy (8bit):	4.40448824449925
Encrypted:	false
SSDEEP:	384:i+1+2HgJiSSXB7VPkqM68x68cS5gLKPENwloGxX7xFxexNbK7ExOiyq:LOe7Rn8XRq
MD5:	669B4C6C93939C63C345E7391E8CECE0
SHA1:	5468E0CE9569B9736FB6DAD8E61A74DA7EB39C5C
SHA-256:	A495AF551D6FCC463A61AE4AA57FDFA8619CBB10DFB9BCE92A11D2BBF6410DFF
SHA-512:	3ACA4FE4AAD95281F88FA35B55C947E59B634FBBF6086E90A4BFF30F3E12B765FB3530086EAA68F199306EDA628FFADBA48B806CF6671AF5464B9C000BC97290
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; : Andrij Ilechko..; : Mokiy Mazaylo..; : Sergiy Gontaruk..; : Misha Padalka..; 22.00 : 2022-06-19 : Yurii Petrashko..;..;..;..;..;..;..0..7-Zip..Ukrainian..............401..OK...................&.....&....&....................&............440..... ... &........ ... ..&.............................&.. ........ .......&.. .......... .......&...................... ........, .. ....... ......... ........?..500..&......&.............&........&............&.............&..........540..&.................. .&.................. &.......&.............&................&...........&......... ........

C:\Program Files\7-Zip\Lang\uz-cyrl.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	15167
Entropy (8bit):	4.352884960736366
Encrypted:	false
SSDEEP:	384:i7ggZifEX14nReON0sutg2s/Vk/A/n/pPqS:cYEF4nReON0sutg2suY/YS
MD5:	7AFEDBD6E9EF3A4A2A99BC1BCB133605
SHA1:	317D758DD9F65A6E320A4D45776A21ECB2AD60CC
SHA-256:	2DD421A44AD779D961C951F01E7ABF4AC358C61CE26EA8311A0C902B4FC77CA3
SHA-512:	48650BC3AC6C316AD6431B9DB3E49D76FD066F976FDD949A8DFDB194775B0E1C6EDA5ED99D2574C9D3C2781C6138E3BB3939C294894443EEC981C78377823AF5
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 20.02 : 2020-10-21 : Shamsiddinov Zafar..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Uzbek-Cyrillic...........401........... ..............&....&.....&................&..... .......440........ &.......... &..........................&.......&..... ......&..... ............. .............. ..........?..500..&......&.............&.........&..............&..........&.......540..&.......&........ .......&......... .......&.........&.............&..... ..........&.......... ...............&.......... .............&.... ..........&...... ...........&......... .................&.............&............... ................

C:\Program Files\7-Zip\Lang\uz.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	9383
Entropy (8bit):	5.080725632797468
Encrypted:	false
SSDEEP:	192:ijX9l/0gt5MpHB8zNq+cwKp/avDFxCg8FTO/7yWyTHGw:ijX9l/0gt5wh8zNq+cBVavDFE3cTyWyZ
MD5:	3035144EEA3A382E39541B218A5D813A
SHA1:	EB7A2F6306F7D2DED4CC88FB4CAB0F65558DB8B0
SHA-256:	A310044DBC86E2441F0D50BB7D7DADB9879359B0C6CEB1FAF413A0459E07045B
SHA-512:	99D86146E0A6407F8D0FD7179061699BC82232E6A2427203A2951FEF9089572C9C4E29C8484910F672A31F98EF13B5F3A45D5786FB118701A5B908F8F85A5C6A
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 20.02 : 2020-10-20 : Shamsiddinov Zafar..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Uzbek..O.zbekcha..401..OK..Bekor qilmoq........&Ha..&Yo.q..&Yopmoq..Ko.mak....&Davom etmoq..440..Bariga &ha..Bariga &yo.q..To.xtatmoq..Qaytadan..&Fonda..&Fonda emas..&Pauza qilmoq..Pauza qilindi..Bekor qilinsinmi?..500..&Fayl..&Tahrirlamoq..&Ko.rinish..&Tanlanganlar..&Jihozlar..&Ko.mak..540..&Ochmoq..&Ichkarida ochmoq..&Tashqariga ochmoq..&Ko.rinish..&Tahrirlamoq..&Qayta nomlamoq..&Quyidagiga nusxalamoq.....&Quyidagiga ko.chirmoq.....&Olib tashlamoq..&Faylni bo.lmoq.....&Fayllarni birlashtirmoq.....&Xususiyatlar..&Sharh.....Yakuniy summa..Taqqoslamoq..Jild tuzmoq..Fayl tuzmoq..&Dasturdan chiqmoq..Havola..&Muqobil oqimlar..600..&Barini tanlamoq..Barini tanlamaslik..&Teskari tanlash..Tanlamoq.....Tanlamaslik.....Turi bo.yicha tanlamoq..Turi bo.yicha tanlamaslik..700..&Yirik ikonkalarda..&Kichik ikonkalarda..&Ro.yxatsimon..&Tafsilotli..730..Saralamaslik..Bejiri

C:\Program Files\7-Zip\Lang\va.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	6422
Entropy (8bit):	4.98619447540291
Encrypted:	false
SSDEEP:	192:iYd/FL0HKwFgvtXdN3K3TIcmqHfc39vNH:i+5wCvtzaj5E3P
MD5:	75378BFAC013C4C49CCBD69C51CA8D27
SHA1:	73C8AA6F373FF63FDAE1AA489B16CEFEE2AB05A8
SHA-256:	C141908B9218D754DD1E6ED2FA9A2EAFA981ADC9F8D5DB438A59139605914C11
SHA-512:	646BDA053F7AE14961D240A1357C5BAC16567F57F4516730FD88A1D1B937777017CDA6C2E19FEB4AAFD358551DC82D647C114C1976DA8B7C12BB1686417299BA
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 4.26 : Tomas Miralles..; 4.44 : Fernando Verd...;..;..;..;..;..;..;..;..;..0..7-Zip..Valencian..Valenci...401..Acceptar..Cancel.lar........&Si..&No..Tan&car..Ajuda....&Continuar..440..Si a &tot..No a t&ot..Parar..Reiniciar..Segon pla..Primer pla..&Pausa..Parat..Est. segur que vol cancel.lar?..500..&Arxiu..&Editar..&Visualitzar..Favorits..Ferramentes..Ajuda..540..&Obrir..Obrir d&ins..Obrir fora..&Visualitzar..&Editar..Renom&enar..&Copiar a.....&Moure a.....&Suprimir..&Separar fitxer.....Com&binar fitxers.....P&ropietats..Come&ntari..Calcular checksum....Crear directori..Crear fitxer..Eixir..600..Seleccion&ar-ho tot..Deseleccionar-ho tot..&Invertir selecci...Seleccionar.....No seleccionar.....Seleccionar per tipus..No seleccionar per tipus..700..Icones g&rans..Icones menudes..&Llista..&Detalls..730..No ordenat..Vista plana..&2 Taules..&Barres de ferramentes..Obrir directori arrel..Directori pare..Historial de carpetes.....Actualitza&r..750..Arxiu..Est.ndar

C:\Program Files\7-Zip\Lang\vi.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	8515
Entropy (8bit):	5.3853389717622
Encrypted:	false
SSDEEP:	192:iJg8VLjw6yLuVSjHohWCOMF65E0QS3CmJdH:iJg8VfVcHpN5/CA
MD5:	044531D134ACA40D5E57CC0AB96B4940
SHA1:	988AA2BB6922360C1977B97725175613266242D2
SHA-256:	3A6DCA3E1B5C8190C81FC859B5BE83EAF54EFDCAA148F4374D1225381083406F
SHA-512:	458A86EA6468E8B1C9CC98A7A579F74854A34F101EC2EDE3AB48DD7DFBBF75EEAE184C5A23443B3CCC69B8C06E0E09EF2DF04D9F00D86CE99B82E785F95B7635
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 2.30 : : Tran Hong Ha..; 4.42 : : Le Vu Hoang..; 4.48 : : Nguyen Hong Quan..; 9.07 : 2011-04-12 : Vietnamize Team..;..;..;..;..;..;..;..0..7-Zip..Vietnamese..Ti.ng Vi.t..401....ng ...H.y b.........C...Kh.ng....ng..Gi.p ......Ti.p t.c..440..C. t.t c...Kh.ng t.t c...D.ng..L.m l.i..Ch.y n.n..Ch. .. .u ti.n..D.ng.... d.ng..B.n ch.c ch.n mu.n h.y b.?..500..T.p tin..Bi.n t.p..Xem...a th.ch..C.ng c...Gi.p ....540..M...M. t.i ..y..M. trong c.a s. kh.c..Xem..Bi.n t.p....i t.n..Sao ch.p ..n.....Di chuy.n ..n.....Xo...Chia c.t t.p n.n.....N.i t.p n.n.....Thu.c t.nh..Ch. th.ch..T.nh checksum (md5)..So s.nh..T.o th. m.c..T.o t.p n.n..Tho.t..600..Ch.n t.t c...B. ch.n t.t c.....o l.a ch.n..Ch.n.....B. ch.n.....Ch.n theo lo.i..B. ch.n theo lo.i..700..Bi.u t..ng

C:\Program Files\7-Zip\Lang\yo.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	10964
Entropy (8bit):	5.311393798483991
Encrypted:	false
SSDEEP:	192:7Xg6osRFCMtNmH9S29KDXIeuDCmkmkCWplG0v6kLoWBY6g1KihHxXUE4zVG9ARQ+:7Xg0CMASXIeV/DXPvVBFkezVGW5
MD5:	DD7102D6CC59E50E8F2382F715E632D1
SHA1:	579246EE8F47334A28EADC949A1D05E553D78C09
SHA-256:	16094E51DB670E034245E5CF5405E969386F2D9AF7682882400C1F594639CC79
SHA-512:	BFB605A06AE2F83B45474062E94B936D03CA8D2E56D8483F66AE87A42C95D830F2F44A42BBDBDE8688DABBDBADFA0DCBA376960BC0BF5F0C7DBFDCD0F8C8C06E
Malicious:	false
Preview:	;!@Lang2@!UTF-8!..; 15.00 : 2015-03-29 : Ibrahim Oyekan..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Yoruba..Yoruba..401..O DAA..Pa re........&B..ni..&B..k...&P.d....r.nl.w.....&T..-s.w.j...440..B..ni fun &gbogbo ...B..k. fun &gbogbo ...D.r.....t.nb..r....&...h.n-.gb.h.n..&Oj.-.gb.h.n..&D.d.r....d.r....e . d.j. pe .nyin f.. paar...500..&Fa.li..&Tunk...&.w...&A.y...&Irin.....&.r.nl.w...540..&.i...i &si .n....i &si .ta..&.w...&Tunk...&Tun oruk. k...&...d. si.....&Gb. si.....&Paar...&P.n fa.li....... .w.n fa.li k.p.......&.b.d...&.r. .w.ye......e i.iro checksum...y.t....D. .p. fa.li sil....D. fa.li sil....&P.d....t..kas...&Yiyan agbara d.t...600.....y.n &gbogbo fa.li..Paa ...y.n gbogbo fa.li..&Yi ...y.n Pad......y.n.....Paa ...y.n........y.n bi ir. fa.li..Paa ...y.n bi ir. fa.li..700

C:\Program Files\7-Zip\Lang\zh-cn.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	8267
Entropy (8bit):	5.988696818339102
Encrypted:	false
SSDEEP:	192:7L+OUNnnvU5RLUvMqnUxupow69yJ1L8ln9K1zy4VCrcj+v6ZpDAT21ph4LiD:7qrnnvU5R0yJ1MglExycWVADATk4LiD
MD5:	49DE441A26F05EB42B53DF11EA6251F8
SHA1:	C091048B4481E602C364625E2C810AAF4DC63631
SHA-256:	BB87EFBCE06D75ABE71032857CDEEA8B16306A07E77A7E4EF1ECE6686F5BF4F6
SHA-512:	C24F71762CA647531FC73CE409EACCAB67F5A2F6AF255457A4FEDD807749F595B9FC016C938562BBD84AB2F3C7A6C2389D2A20A4B30843155F4C348E815F13AE
Malicious:	false
Preview:	;!@Lang2@!UTF-8!..; 2.30 : 2002-09-07 : Modern Tiger, kaZek, Hutu Li..; 3.08 : 2003-08-29 : Tunghsiao Liu..; 22.00 : 2022-06-09 : Tunghsiao Liu..;..;..;..;..;..;..;..;..0..7-Zip..Chinese Simplified........401.................(&Y)...(&N)....(&C)..........(&C)..440....(&A)....(&L)..............(&B)....(&F)....(&P).................500....(&F)....(&E)....(&V)....(&A)....(&T)....(&H)..540....(&O)........(&I)........(&U)....(&V)....(&E).....(&M).....(&C)........(&M).......(&D)......(&S).........(&B).......(&R)....(&N).............................(&X)...........(&A)..600....(&A)..........(&I)..........................................700.....(&G).....(&M)....(&L)....

C:\Program Files\7-Zip\Lang\zh-tw.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	8354
Entropy (8bit):	5.992602483343991
Encrypted:	false
SSDEEP:	192:i9l5RTllmRwM4cOEVnoF0HDcaLXO7AJ8YRcddyBxU+G9dDRI:i9LRTPUZOEVaoDcdRVWUhXRI
MD5:	096221E1DB0742D91DC7087E4E3EC576
SHA1:	2ACDBE88BF9C18A8B7002F1B44745C25231D35FB
SHA-256:	64106AC25BF568125F14D30750D1608149E18407ECA006093CEE14B5176A3D12
SHA-512:	5ECE1D1C71C32A983405C9E93A28C67C2FC3A43FD16CBD54C8E7AD23D203D1ECB2F9769DE0605C0473F087EEF75351AF2F221A810876F5A40B7A139CEF8B3D0F
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 4.59 : Leon Tseng, sec2, ....; 9.07 - 22.00 : Jack Pang..;..;..;..;..;..;..;..;..;..0..7-Zip..Chinese Traditional........401.................(&Y)...(&N)....(&C)..........(&C)..440......(&A)......(&L)................(&B)......(&F)....(&P).............?..500....(&F)....(&E)....(&V)......(&A)....(&T)....(&H)..540....(&O).......(&I).......(&U)....(&V)....(&E)......(&M).....(&C)........(&M).......(&D)......(&S).........(&B).......(&R)....(&N)..............................(&X)...........(&A)..600....(&A)...........(&I).................................700.....(&G).....(&M)....(&L)......(&D)..730................(&2)

C:\Program Files\7-Zip\License.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3990
Entropy (8bit):	5.0412200010833965
Encrypted:	false
SSDEEP:	96:dslTu+xS0jaXU9zBOrYJ2rYJk9n3O3zOrTmxz0NxrVwA:WTuoS0gUTOrs2rsQn3O3SvmxQN7wA
MD5:	F4995E1BC415B0D91044673CD10A0379
SHA1:	F2EEC05948E9CF7D1B00515A69C6F63BF69E9CCA
SHA-256:	F037E7689F86A12A3F5F836DC73004547C089E4A2017687E5E0B803A19E3888B
SHA-512:	E7BB1BACAB6925978416E3DA2ACB32543B16B4F0F2289CC896194598EE9ADE5C62AA746C51CF6BF4568E77E96C0A1014E4DDB968F18F95178EE8DFB1E5A72B96
Malicious:	false
Preview:	7-Zip.. ~~~~~.. License for use and distribution.. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~.... 7-Zip Copyright (C) 1999-2023 Igor Pavlov..... The licenses for files are:.... 1) 7z.dll:.. - The "GNU LGPL" as main license for most of the code.. - The "GNU LGPL" with "unRAR license restriction" for some code.. - The "BSD 3-clause License" for some code.. 2) All other files: the "GNU LGPL"..... Redistributions in binary form must reproduce related license information from this file..... Note:.. You can use 7-Zip on any computer, including a computer in a commercial.. organization. You don't need to register or pay for 7-Zip....... GNU LGPL information.. --------------------.... This library is free software; you can redistribute it and/or.. modify it under the terms of the GNU Lesser General Public.. License as published by the Free Software Foundation; either.. version 2.1 of the License, or (at your option) any later version..... Thi

C:\Program Files\7-Zip\Uninstall.exe

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.377432707651039
Encrypted:	false
SSDEEP:	192:aplw/Q3AjmqdD5KOEBrXGWRVkdQ2l+8275N5y+NXNUoynP+yJihMrKbbP28d/o:MlgQ3655Kv1XtRV2QicXax+yJ+MObd
MD5:	AD782FFAC62E14E2269BF1379BCCBAAE
SHA1:	9539773B550E902A35764574A2BE2D05BC0D8AFC
SHA-256:	1C8A77DB924EBEB952052334DC95ADD388700C02B073B07973CD8FE0A0A360B8
SHA-512:	A1E9D6316FFC55F4751090961733E98C93B2A391666FF50B50E9DEA39783746E501D14127E7EE9343926976D7E3CD224F13736530354D8466EA995DAB35C8DC2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.6...X...X...X.x.R...X..V...X.x.\...X......X...Y.W.X......X.!.R...X...^...X.Rich..X.................PE..L...pN.d........../..........@......f!.......0....@..........................p..............................................$9.......`...............................................................................0...............................text............................... ..`.rdata.......0......................@..@.data...X....@.......(..............@....rsrc........`.......*..............@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\descript.ion

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	366
Entropy (8bit):	4.850296649357081
Encrypted:	false
SSDEEP:	6:erK7MYoNHyQLPzXP+USQV7ZiKvwo7/qP5SiEQkXP6ZzeBVOkYBNWeR/W7jGPhrVC:CYkHt/PHVqo7I5s/EWO/NhNWePh0
MD5:	EB7E322BDC62614E49DED60E0FB23845
SHA1:	1BB477811ECDB01457790C46217B61CB53153B75
SHA-256:	1DA513F5A4E8018B9AE143884EB3EAF72454B606FD51F2401B7CFD9BE4DBBF4F
SHA-512:	8160B581A3F237D87E664D93310F5E85A42DF793B3E22390093F9FB9A0A39950BE6DF2A713B55259FCE5D5411D0499886A8039288D9481B4095FABADDDBEBB60
Malicious:	false
Preview:	7-zip.chm 7-Zip Help..7-Zip.dll 7-Zip Plugin..7-Zip32.dll 7-Zip Plugin 32-bit..7z.dll 7-Zip Engine..7z.exe 7-Zip Console ..7z.sfx 7-Zip GUI SFX..7zCon.sfx 7-Zip Console SFX..7zFM.exe 7-Zip File Manager..7zg.exe 7-Zip GUI..descript.ion 7-Zip File Descriptions..history.txt 7-Zip History..Lang 7-Zip Translations..license.txt 7-Zip License..readme.txt 7-Zip Overview..

C:\Program Files\7-Zip\readme.txt

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1708
Entropy (8bit):	4.967986555374711
Encrypted:	false
SSDEEP:	24:7QqJj4igGGPLmVSGSLdyHalrGxs8T95LvNigwJa9YlbQGL6rZgU7ZT4sUdJrt:7pWXY6Ld0/7T9dvkgwJa9e8G4a
MD5:	21728B81FC32F0C39902446F02146804
SHA1:	11F0D5FC428C2D07D196ABC535B4AAC51B35AC9B
SHA-256:	BC97174A61AD73701242EE3F860E9B181006CBA083D118F4AFD41F454DA0C09A
SHA-512:	48E225B84FE5C1D717394633C115C2B812F62D199B3BBD53DAB88DF848067FCA6CCA5423BC755D8E3D001FFB5BE84E469B43E05B3A8C70AE1E578D52600EE35F
Malicious:	false
Preview:	7-Zip 23.01..-----------....7-Zip is a file archiver for Windows.....7-Zip Copyright (C) 1999-2023 Igor Pavlov.....The main features of 7-Zip: .... - High compression ratio in the new 7z format.. - Supported formats:.. - Packing / unpacking: 7z, XZ, BZIP2, GZIP, TAR, ZIP and WIM... - Unpacking only: APFS, AR, ARJ, Base64, CAB, CHM, CPIO, CramFS, DMG, EXT, FAT, GPT, HFS,.. IHEX, ISO, LZH, LZMA, MBR, MSI, NSIS, NTFS, QCOW2, RAR, .. RPM, SquashFS, UDF, UEFI, VDI, VHD, VHDX, VMDK, XAR and Z... - Fast compression and decompression.. - Self-extracting capability for 7z format.. - Strong AES-256 encryption in 7z and ZIP formats.. - Integration with Windows Shell.. - Powerful File Manager.. - Powerful command line version.. - Localizations for 90 languages......7-Zip is free software distributed under the GNU LGPL (except for unRar code)...Read License.txt for more information about license....... This distribution package contains

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip File Manager.lnk

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Oct 3 09:51:28 2023, mtime=Thu Apr 18 20:56:53 2024, atime=Tue Jun 20 07:00:00 2023, length=952832, window=hide
Category:	dropped
Size (bytes):	776
Entropy (8bit):	4.5562412483579156
Encrypted:	false
SSDEEP:	12:8Po0YXih9xKGbdpF4kX4y9rn3krZQjA9czUbdp2fHWz4mNmV:8wOdHIa3OEA9KAd4fQrNm
MD5:	4FA5B659F2D4B90999B65CF5928BAFD6
SHA1:	7EEE34174771A57B97D666ADE8EBA9CADED8F769
SHA-256:	DEF61CBEDB4F644488F73D378A8BF20D9B9004CADC893F567792B604502E3191
SHA-512:	BA603E8BE2EE1ABB08CF15A256BEE441832554E6E0922EA3CA6DF206C4E99D773F03BF4E2FC783494BBB8458D95E96ECE4FD9E7BA4F0A317E111787710668A3A
Malicious:	false
Preview:	L..................F.... ...........p.S......6M...........................e....P.O. .:i.....+00.../C:\.....................1.....DW.V..PROGRA~1..t......O.IDW5`....B...............J.....i...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....P.1.....CWoV..7-Zip.<......CWoVDW.V..............................7.-.Z.i.p.....Z.2......V.@ .7zFM.exe..B......CWoV.X................................7.z.F.M...e.x.e.......N...............-.......M............@.......C:\Program Files\7-Zip\7zFM.exe........\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.7.-.Z.i.p.\.7.z.F.M...e.x.e.`.......X.......506407...........hT..CrF.f4... .G...a......).;.hT..CrF.f4... .G...a......).;.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip Help.lnk

Download File

Process:	C:\Users\user\Desktop\7z2301-x64.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Oct 3 09:51:28 2023, mtime=Thu Apr 18 20:56:53 2024, atime=Tue Jun 20 06:00:00 2023, length=115300, window=hide
Category:	dropped
Size (bytes):	781
Entropy (8bit):	4.5859342682977005
Encrypted:	false
SSDEEP:	12:8oSNs+0YXih9gwKGbdpF4kXCsY0cQWtjAmcZlebdp2WhWzoohxmoohImV:8BidHqlJAmul6d4W+oouooym
MD5:	8EEB3279068E9A5D344AEBCFD4F5AB85
SHA1:	2F31E397E5E92F507E935BD0B5C41DF18E734860
SHA-256:	B28D26A75689C09A44473B0ACAC7683A7A95E38E5BEF58731C3E98744B35C49D
SHA-512:	836E582EFFE5F40B96749F6F04003F38E886D569B9EB70B9FD3925735E2259E191ED82CAFCC523F47BDD00E1E7676F6A6FFC674803CB4B3FF356095F4E9FF24E
Malicious:	false
Preview:	L..................F.... ............v.R....X[.D...d.......................g....P.O. .:i.....+00.../C:\.....................1.....DW.V..PROGRA~1..t......O.I.X......B...............J.....i...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....P.1.....CWoV..7-Zip.<......CWoV.X................................7.-.Z.i.p.....\.2.d....V.8 .7-zip.chm.D......CWoV.X................................7.-.z.i.p...c.h.m.......O...............-.......N............@.......C:\Program Files\7-Zip\7-zip.chm../.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.7.-.Z.i.p.\.7.-.z.i.p...c.h.m.`.......X.......506407...........hT..CrF.f4... .G...a......).;.hT..CrF.f4... .G...a......).;.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.99617273831884
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	7z2301-x64.exe
File size:	1'589'510 bytes
MD5:	e5788b13546156281bf0a4b38bdd0901
SHA1:	7df28d340d7084647921cc25a8c2068bb192bdbb
SHA256:	26cb6e9f56333682122fafe79dbcdfd51e9f47cc7217dccd29ac6fc33b5598cd
SHA512:	1f4da167ff2f1d34eeaf76c3003ba5fcabfc7a7da40e73e317aa99c6e1321cdf97e00f4feb9e79e1a72240e0376af0c3becb3d309e5bb0385e5192da17ea77ff
SSDEEP:	49152:RoOF3Wh8esAMmyyImtH97VTjrtlEfmSX4b:RoYWh8JAV/VH97F3tlQ+b
TLSH:	AF7533CC2B03CA29FDC71671E501E4A6DCFF69928D4C978F4B986E98B771531AE10217
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Jch.............a...............a.........Y.........\.....[.....8$..............Rich....................PE..L...pN.d........../

File Icon


Icon Hash:	b8868baba9aba2d8

Static PE Info

General

Entrypoint:	0x407394
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT
Time Stamp:	0x64914E70 [Tue Jun 20 07:00:00 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	cf0d2de4fd6406302012e0f40060395f

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 00408C38h
push 00407520h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 68h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
xor ebx, ebx
mov dword ptr [ebp-04h], ebx
push 00000002h
call dword ptr [004080BCh]
pop ecx
or dword ptr [0040C8E4h], FFFFFFFFh
or dword ptr [0040C8E8h], FFFFFFFFh
call dword ptr [004080B8h]
mov ecx, dword ptr [0040A8D0h]
mov dword ptr [eax], ecx
call dword ptr [004080B4h]
mov ecx, dword ptr [0040A8CCh]
mov dword ptr [eax], ecx
mov eax, dword ptr [004080B0h]
mov eax, dword ptr [eax]
mov dword ptr [0040C8ECh], eax
call 00007F70317EEB95h
cmp dword ptr [0040A010h], ebx
jne 00007F70317EEA8Eh
push 00407510h
call dword ptr [004080ACh]
pop ecx
call 00007F70317EEB67h
push 0040A00Ch
push 0040A008h
call 00007F70317EEB52h
mov eax, dword ptr [0040A8C8h]
mov dword ptr [ebp-6Ch], eax
lea eax, dword ptr [ebp-6Ch]
push eax
push dword ptr [0040A8C4h]
lea eax, dword ptr [ebp-64h]
push eax
lea eax, dword ptr [ebp-70h]
push eax
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [004080A4h]
push 0040A004h
push 0040A000h
call 00007F70317EEB1Fh

Rich Headers

Programming Language:

[ C ] VS98 (6.0) SP6 build 8804
[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8c44	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd000	0xfe8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x14c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x652c	0x6600	445aae033e52fca0b62f15545d14e511	False	0.6483992034313726	data	6.591966668904185	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1346	0x1400	e3a3ff91203697a886881dccab0c68c5	False	0.4126953125	data	4.616946763777193	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x28f0	0x200	598e1aae6ecbd8237c4383f4be94b9f1	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd000	0xfe8	0x1000	e4b28bceb799a21c6b34f15d6010fa18	False	0.373046875	data	4.367210431828476	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd480	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.16532258064516128
RT_ICON	0xd768	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.32094594594594594
RT_DIALOG	0xd8b8	0x176	data	English	United States	0.5802139037433155
RT_GROUP_ICON	0xd890	0x22	data	English	United States	1.0
RT_VERSION	0xd1b0	0x2d0	data	English	United States	0.4652777777777778
RT_MANIFEST	0xda30	0x5b2	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.47462277091906724

Imports

DLL	Import
ole32.dll	CoCreateInstance, CoInitialize
USER32.dll	PeekMessageW, ExitWindowsEx, GetDlgItemTextW, SetWindowTextW, ShowWindow, MessageBoxW, CreateDialogParamW, LoadIconW, SendMessageW, GetMessageW, EnableWindow, GetDlgItem, IsDialogMessageW, TranslateMessage, DispatchMessageW, SetDlgItemTextW, DestroyWindow
ADVAPI32.dll	RegSetValueExW, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, RegQueryValueExW, RegOpenKeyExW, RegCloseKey, RegCreateKeyExW
SHELL32.dll	SHGetFolderPathW, SHBrowseForFolderW, SHGetPathFromIDListW
MSVCRT.dll	_exit, _XcptFilter, _acmdln, __getmainargs, _initterm, __setusermatherr, _adjust_fdiv, __p__commode, __p__fmode, __set_app_type, _except_handler3, _controlfp, memcpy, memcmp, memmove, malloc, free, exit, memset
KERNEL32.dll	ReadFile, CloseHandle, CreateFileW, FormatMessageW, WriteFile, DeleteFileW, CreateDirectoryW, GetSystemDirectoryW, LoadLibraryW, GetModuleFileNameW, GetFileAttributesW, SetFilePointer, GetVersion, LoadLibraryExW, GetModuleHandleA, GetStartupInfoA, LocalFree, SetFileAttributesW, SetFileTime, MoveFileExW, GetLastError, lstrcatW, GetCommandLineW, lstrcpyW, GetModuleHandleW, GetProcAddress, GetCurrentProcess, lstrlenW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	23:56:48
Start date:	18/04/2024
Path:	C:\Users\user\Desktop\7z2301-x64.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\7z2301-x64.exe"
Imagebase:	0x400000
File size:	1'589'510 bytes
MD5 hash:	E5788B13546156281BF0A4B38BDD0901
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	27.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.1%
Total number of Nodes:	292
Total number of Limit Nodes:	12

Executed Functions

Function 004017DE Relevance: 77.6, APIs: 33, Strings: 11, Instructions: 560
windowstringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,C:\Users\user\Desktop\7z2301-x64.exe,00000000), ref: 0040181F
GetDlgItemTextW.USER32(0000006F,C:\Program Files\7-Zip\,00000104), ref: 004018AC

Part of subcall function 004022B2: memcmp.MSVCRT ref: 00402338
Part of subcall function 004022B2: memmove.MSVCRT ref: 0040237B

lstrlenW.KERNEL32(C:\Program Files\7-Zip\), ref: 00401930
ShowWindow.USER32(00000005,00402A5E,00402A5E), ref: 004019D1
ShowWindow.USER32(00000005), ref: 004019DB
SendMessageW.USER32(00000406,00000000,?), ref: 004019EF
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00401A24
IsDialogMessageW.USER32(?), ref: 00401A37
TranslateMessage.USER32(?), ref: 00401A48
DispatchMessageW.USER32(?), ref: 00401A55
SendMessageW.USER32(00000402,00000000,00000000), ref: 00401A84
SetWindowTextW.USER32(75C0B400,75C0B400), ref: 00401ACC
lstrcpyW.KERNEL32(?,C:\Program Files\7-Zip\), ref: 00401B8D
lstrcpyW.KERNEL32(C:\Program Files\7-Zip\,?), ref: 00401BAA
lstrlenW.KERNEL32(C:\Program Files\7-Zip\), ref: 00401BC3
GetFileAttributesW.KERNEL32(C:\Program Files\7-Zip\), ref: 00401BD9
SetFileAttributesW.KERNELBASE(C:\Program Files\7-Zip\,00000000), ref: 00401BE6
lstrcatW.KERNEL32(?,C:\Program Files\7-Zip\), ref: 00401C62
lstrlenW.KERNEL32(?), ref: 00401C7F
MessageBoxW.USER32(?,Error,00000212), ref: 00401CAA
SetFileTime.KERNELBASE(?,00000000,00000000,?,?), ref: 00401D68
SetFileAttributesW.KERNELBASE(C:\Program Files\7-Zip\,?,?), ref: 00401DA1
MoveFileExW.KERNEL32(C:\Program Files\7-Zip\,?,00000005,?), ref: 00401DB6
GetLastError.KERNEL32 ref: 00401DEB
SendMessageW.USER32(00000402,?,00000000), ref: 00401E14
SetWindowTextW.USER32(7-Zip 23.01 (x64) is installed), ref: 00401E5D
MessageBoxW.USER32(You must restart your system to complete the installation.Restart now?,00000104), ref: 00401EBE
GetCurrentProcess.KERNEL32(00000028,?), ref: 00401ECF
OpenProcessToken.ADVAPI32(00000000), ref: 00401ED6
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00401EEA
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00401F08
GetLastError.KERNEL32 ref: 00401F0E
ExitWindowsEx.USER32(00000002,00000000), ref: 00401F1A

Strings

You must restart your system to complete the installation.Restart now?, xrefs: 00401EB3
7-zip32.dll, xrefs: 00401C29
SeShutdownPrivilege, xrefs: 00401EE4
7-zip.dll, xrefs: 00401C0D
Error, xrefs: 00401C9E
Incorrect path, xrefs: 0040190B
7-Zip 23.01 (x64) is installed, xrefs: 00401E52
.tmp, xrefs: 00401BB0
Can't open file, xrefs: 00401C4A
C:\Users\user\Desktop\7z2301-x64.exe, xrefs: 004017E8
C:\Program Files\7-Zip\, xrefs: 0040189B, 004018A3, 004018D1, 00401900, 0040192F, 00401B8B, 00401BA9, 00401BC2, 00401BD8, 00401BE5, 00401C60, 00401DA0, 00401DB5

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID: Message$File$Window$AttributesSendTextlstrlen$ErrorLastProcessShowTokenlstrcpy$AdjustCurrentDialogDispatchExitItemLookupModuleMoveNameOpenPeekPrivilegePrivilegesTimeTranslateValueWindowslstrcatmemcmpmemmove
String ID: .tmp$7-Zip 23.01 (x64) is installed$7-zip.dll$7-zip32.dll$C:\Program Files\7-Zip\$C:\Users\user\Desktop\7z2301-x64.exe$Can't open file$Error$Incorrect path$SeShutdownPrivilege$You must restart your system to complete the installation.Restart now?
API String ID: 2360875437-373965597
Opcode ID: cc6d7ab21717064916854ead2d7ac0c3287282302b6ce32c8c65c4303c0f58d1
Instruction ID: 66cd2085490cf117befd0bddd5a3a439d4c070be1c6734ca8bb527d129fef3c8
Opcode Fuzzy Hash: cc6d7ab21717064916854ead2d7ac0c3287282302b6ce32c8c65c4303c0f58d1
Instruction Fuzzy Hash: 40321A71900219DBDB20EF94DE84AEEB7B9FB44308F50847BE105B72A0DB785A85CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004025C5 Relevance: 1.6, APIs: 1, Instructions: 55comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00408C18,00000000,00000001,00408C08,0040259C,00000000,?,00000000,?,?,?,0040259C), ref: 004025E3

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: ade2aa36860f559734fc4b5bd685036fb33efc22c7440584c789e3943ad72554
Instruction ID: d93d9dfcfae9697bc99f6fb64a647af4c93c7c6b5f3b85fac4cd9631c4badb45
Opcode Fuzzy Hash: ade2aa36860f559734fc4b5bd685036fb33efc22c7440584c789e3943ad72554
Instruction Fuzzy Hash: 3B014475700214BFD704CB98C989E5A77BCEF89755F1004B8F505EB290DA71AD05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 61.5, APIs: 25, Strings: 10, Instructions: 237
windowregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405B75: GetVersion.KERNEL32 ref: 00405B7F
Part of subcall function 00405B75: GetModuleHandleW.KERNEL32(kernel32.dll,SetDefaultDllDirectories), ref: 00405B95
Part of subcall function 00405B75: GetProcAddress.KERNEL32(00000000), ref: 00405B9C
Part of subcall function 00405B75: GetSystemDirectoryW.KERNEL32(?,00000106), ref: 00405BC1
Part of subcall function 00405B75: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00405C36

CoInitialize.OLE32(00000000), ref: 0040100F
GetCommandLineW.KERNEL32(?,?,?,00000000,?,?,?,?,004074C8,00000000,?,0000000A), ref: 0040101A
lstrcpyW.KERNEL32(0040A234,C:\Users\user\Desktop\7z2301-x64.exe), ref: 004010AA
GetModuleHandleW.KERNEL32(kernel32.dll,IsWow64Process,?,?,?,00000000,?,?,?,?,004074C8,00000000,?,0000000A), ref: 004010DF
GetProcAddress.KERNEL32(00000000), ref: 004010E6
GetCurrentProcess.KERNEL32(?,?,?,?,00000000,?,?,?,?,004074C8,00000000,?,0000000A), ref: 004010F7
RegOpenKeyExW.KERNELBASE(80000001,00000000,00020119,?,?,?,?,00000000,?,?,?,?,004074C8,00000000,?,0000000A), ref: 00401145
RegCloseKey.KERNELBASE(?,C:\Program Files\7-Zip\,?,?,?,00000000,?,?,?,?,004074C8,00000000,?,0000000A), ref: 00401165
CreateDialogParamW.USER32(?,00000064,00000000,00401512,00000000), ref: 004011C8
LoadIconW.USER32(?,00000001), ref: 004011E3
SendMessageW.USER32(00000080,00000001,00000000), ref: 004011FC
KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 00401206
IsDialogMessageW.USER32(00020472,?), ref: 0040123C
TranslateMessage.USER32(?), ref: 0040124B
DispatchMessageW.USER32(?), ref: 00401256
SetDlgItemTextW.USER32(00020472,00000001,Close), ref: 0040129E
GetDlgItem.USER32(00000001,00000001), ref: 004012AE
KiUserCallbackDispatcher.NTDLL(00000000), ref: 004012B1
GetDlgItem.USER32(00000002,00000000), ref: 004012BC
KiUserCallbackDispatcher.NTDLL(00000000), ref: 004012BF
GetDlgItem.USER32(00000001,00000001), ref: 004012CB
SendMessageW.USER32(00000028,00000000), ref: 004012D6
KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 004012E0
DestroyWindow.USER32(00020472,?,?,?,00000000,?,?,?,?,004074C8,00000000,?,0000000A), ref: 004012F8

Strings

ProgramFilesDir, xrefs: 00401170
C:\, xrefs: 00401188
Software\Microsoft\Windows\CurrentVersion, xrefs: 00401175
C:\Users\user\Desktop\7z2301-x64.exe, xrefs: 004010A0
Close, xrefs: 00401297
Unsupported command:, xrefs: 004010CA
kernel32.dll, xrefs: 004010D6
IsWow64Process, xrefs: 004010D1
This installation requires Windows x86, xrefs: 00401110
C:\Program Files\7-Zip\, xrefs: 00401029, 0040108E, 00401122, 00401159, 0040116F

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID: Message$CallbackDispatcherItemUser$AddressDialogHandleLoadModuleProcSend$CloseCommandCreateCurrentDestroyDirectoryDispatchIconInitializeLibraryLineOpenParamProcessSystemTextTranslateVersionWindowlstrcpy
String ID: C:\$C:\Program Files\7-Zip\$C:\Users\user\Desktop\7z2301-x64.exe$Close$IsWow64Process$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$This installation requires Windows x86$Unsupported command:$kernel32.dll
API String ID: 3116314339-4224304371
Opcode ID: b778ba2ec6813ee3b4403d19b2da296b992c2ddfe391c583d1a348ebdcbf80d8
Instruction ID: 1413ca56da54795811e2c54d54d5be295a7d7bf986bab02126f3a8206ae00ba7
Opcode Fuzzy Hash: b778ba2ec6813ee3b4403d19b2da296b992c2ddfe391c583d1a348ebdcbf80d8
Instruction Fuzzy Hash: C571C571500309ABDB20BF61AF45A6B37A9EB48344F10443FF581B62F1DB798C968B5E

Uniqueness

Uniqueness Score: -1.00%

Function 004027C8 Relevance: 47.4, APIs: 4, Strings: 23, Instructions: 146
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004013AF: lstrlenW.KERNEL32(00000000,?,00000000,0040134D,00000104,00000000,00000000), ref: 004013B6

Part of subcall function 00402790: RegCloseKey.ADVAPI32(00000000,00000000,00000000,80000000,80000000,?,0040265D,00000000,00000000,C:\Program Files\7-Zip\), ref: 004027BB

Part of subcall function 0040273D: RegCloseKey.ADVAPI32(00000000,00000000,00000000,80000000,80000000,?,004026D9,00000000,00401E3A,00000000,00000000,C:\Program Files\7-Zip\), ref: 00402768

lstrcpyW.KERNEL32(?,C:\Program Files\7-Zip\), ref: 0040286B
RegCloseKey.ADVAPI32(00000000,C:\Program Files\7-Zip\,?,00000000), ref: 004028B7
lstrcpyW.KERNEL32(?,C:\Program Files\7-Zip\), ref: 00402931

Part of subcall function 004029ED: RegSetValueExW.KERNELBASE(00000000,NoModify,00000000,00000004,00000022,00000004,0040298A,00000001,00000022,00000022), ref: 004029FA

Part of subcall function 0040245B: lstrlenW.KERNEL32(?,00000000,C:\Program Files\7-Zip\,0040243B,C:\Program Files\7-Zip\,C:\Program Files\7-Zip\,00000000,00000000,80000001,?,004023FE), ref: 00402465
Part of subcall function 0040245B: RegSetValueExW.KERNELBASE(00000000,004083C4,00000000,00000001,?,?,?,004023FE), ref: 0040247A

RegCloseKey.KERNELBASE(00000000,Igor Pavlov,00000001,00000017,005859BB,00000001,00000001,00000022,00000022), ref: 004029E2

Strings

/S, xrefs: 00402957
EstimatedSize, xrefs: 004029A5
23.01, xrefs: 004028F4
DisplayVersion, xrefs: 004028EF
UninstallString, xrefs: 0040294D
DisplayIcon, xrefs: 00402908
NoRepair, xrefs: 0040298D
NoModify, xrefs: 0040297E
Publisher, xrefs: 004029D0
7zFM.exe, xrefs: 0040286D
QuietUninstallString, xrefs: 00402971
Software\Microsoft\Windows\CurrentVersion\App Paths\7zFM.exe, xrefs: 00402885
{23170F69-40C1-278A-1000-000100020000}, xrefs: 004027D9, 00402808, 00402818, 0040283C, 00402852
Uninstall.exe", xrefs: 00402933
InstallLocation, xrefs: 00402915
\7-Zip, xrefs: 004027F0
Igor Pavlov, xrefs: 004029D5
Path, xrefs: 004028A9
Software\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip, xrefs: 004028C5
VersionMinor, xrefs: 004029C1
VersionMajor, xrefs: 004029B2
C:\Program Files\7-Zip\, xrefs: 004027D2, 0040285E, 00402869, 004028AE, 0040291A, 0040292F
DisplayName, xrefs: 004028E2

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID: Close$Valuelstrcpylstrlen
String ID: /S$23.01$7zFM.exe$C:\Program Files\7-Zip\$DisplayIcon$DisplayName$DisplayVersion$EstimatedSize$Igor Pavlov$InstallLocation$NoModify$NoRepair$Path$Publisher$QuietUninstallString$Software\Microsoft\Windows\CurrentVersion\App Paths\7zFM.exe$Software\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip$Uninstall.exe"$UninstallString$VersionMajor$VersionMinor$\7-Zip${23170F69-40C1-278A-1000-000100020000}
API String ID: 1122074173-2401921054
Opcode ID: 8afbcba8837ccf55f76af57f6cd28934d03a326d7ef7aca2f2ae9b0dbce28b2d
Instruction ID: 99dcab980323d0d0118e3633f048609a6d0e709a76e0492445b05521234046e5
Opcode Fuzzy Hash: 8afbcba8837ccf55f76af57f6cd28934d03a326d7ef7aca2f2ae9b0dbce28b2d
Instruction Fuzzy Hash: 77513C70A00518ABCB10FB91CF89A9E737ADB84309F6080BEA445776C5DF785E06DB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00401512 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItemTextW.USER32(?,0000006F,?,00000104), ref: 00401562
SetDlgItemTextW.USER32(?,0000006F,?), ref: 004015A4
GetDlgItem.USER32(?,0000006F), ref: 00401624
GetDlgItem.USER32(?,00000071), ref: 0040162E
GetDlgItem.USER32(?,00000072), ref: 00401638
SetWindowTextW.USER32(?), ref: 00401646
SetDlgItemTextW.USER32(?,0000006F,C:\Program Files\7-Zip\), ref: 00401654
ShowWindow.USER32(00000000), ref: 00401668
ShowWindow.USER32(00000000), ref: 00401672

Strings

Select the folder for installation:, xrefs: 0040157B
C:\Program Files\7-Zip\, xrefs: 0040164C

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID: Item$Text$Window$Show
String ID: C:\Program Files\7-Zip\$Select the folder for installation:
API String ID: 388342126-3663326204
Opcode ID: 30cb4b6e524bdc0cdeec52959ebb66b1f985e4466ad449e0e6b091809d87d5e3
Instruction ID: aa0ac4a6eaa286a9cd860ddab29ca7960ce2c466b98144f0e9de4802fb686450
Opcode Fuzzy Hash: 30cb4b6e524bdc0cdeec52959ebb66b1f985e4466ad449e0e6b091809d87d5e3
Instruction Fuzzy Hash: E631A271540208BBEB215F20DE49FAA3F68EF44744F04443AB644BA1F1CBBA9D92CE5D

Uniqueness

Uniqueness Score: -1.00%

Function 004024A0 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 85
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathW.SHELL32(?,00401E32,00000000,00000000,?,00000000,C:\Program Files\7-Zip\,00000000), ref: 004024DC

Part of subcall function 004013AF: lstrlenW.KERNEL32(00000000,?,00000000,0040134D,00000104,00000000,00000000), ref: 004013B6

lstrlenW.KERNEL32(?), ref: 00402528
lstrcpyW.KERNEL32(?,C:\Program Files\7-Zip\), ref: 00402558
DeleteFileW.KERNELBASE(?), ref: 00402583

Part of subcall function 004020E0: CreateDirectoryW.KERNELBASE(?,00000000,004021B3), ref: 004020E3

Part of subcall function 004025C5: CoCreateInstance.OLE32(00408C18,00000000,00000001,00408C08,0040259C,00000000,?,00000000,?,?,?,0040259C), ref: 004025E3

Strings

7zFM.exe, xrefs: 00402560
7-zip.chm, xrefs: 00402567
7-Zip File Manager.lnk, xrefs: 00402539
7-Zip Help.lnk, xrefs: 00402540
C:\Program Files\7-Zip\, xrefs: 004024AC, 00402552

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID: Createlstrlen$DeleteDirectoryFileFolderInstancePathlstrcpy
String ID: 7-Zip File Manager.lnk$7-Zip Help.lnk$7-zip.chm$7zFM.exe$C:\Program Files\7-Zip\
API String ID: 1231897949-3814743698
Opcode ID: 929d5675deb997439388413e5827c965651e28c9e6cf6438915d7e8474103172
Instruction ID: 836199bef6e1b8ae3ff7deda2154b2d10579f0acfa05bb262082896cf9c21857
Opcode Fuzzy Hash: 929d5675deb997439388413e5827c965651e28c9e6cf6438915d7e8474103172
Instruction Fuzzy Hash: 40312D71900219EBCF10EB95CFD9A9EB779AB40304F5080BED545B21D0DB799E45CB1C

Uniqueness

Uniqueness Score: -1.00%

Function 00402637 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 75
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00402790: RegCloseKey.ADVAPI32(00000000,00000000,00000000,80000000,80000000,?,0040265D,00000000,00000000,C:\Program Files\7-Zip\), ref: 004027BB

Part of subcall function 00402775: RegCreateKeyExW.KERNELBASE(80000000,00408368,00000000,00000000,00000000,000F003F,00000000,?,00000000,004027A2,00000000,80000000,80000000,?,0040265D,00000000), ref: 00402787

RegCloseKey.KERNELBASE(00401E3A,Apartment,?), ref: 004026C2
lstrcpyW.KERNEL32(?,C:\Program Files\7-Zip\), ref: 0040268A

Part of subcall function 004013AF: lstrlenW.KERNEL32(00000000,?,00000000,0040134D,00000104,00000000,00000000), ref: 004013B6

Part of subcall function 0040245B: lstrlenW.KERNEL32(?,00000000,C:\Program Files\7-Zip\,0040243B,C:\Program Files\7-Zip\,C:\Program Files\7-Zip\,00000000,00000000,80000001,?,004023FE), ref: 00402465
Part of subcall function 0040245B: RegSetValueExW.KERNELBASE(00000000,004083C4,00000000,00000001,?,?,?,004023FE), ref: 0040247A

lstrcpyW.KERNEL32(?,C:\Program Files\7-Zip\), ref: 004026FE
RegCloseKey.KERNELBASE(00000000,Apartment,?), ref: 00402736

Strings

7-zip32.dll, xrefs: 0040268C
ThreadingModel, xrefs: 004026B0, 00402724
7-zip.dll, xrefs: 00402700
Apartment, xrefs: 004026B5, 00402729
C:\Program Files\7-Zip\, xrefs: 00402647, 00402684, 004026F8

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID: Close$lstrcpylstrlen$CreateValue
String ID: 7-zip.dll$7-zip32.dll$Apartment$C:\Program Files\7-Zip\$ThreadingModel
API String ID: 1845523679-814007440
Opcode ID: 99d54b312159f407540c534f5855129b97239dda6a6048e97b93816b088f8a98
Instruction ID: e0c1b5e85c7b29de90095ac5383f9c1f78394e2e17ea02843a41af4b28f3aa51
Opcode Fuzzy Hash: 99d54b312159f407540c534f5855129b97239dda6a6048e97b93816b088f8a98
Instruction Fuzzy Hash: 70214F35600218ABDB10FBA1DF89E9E777A9F84308F60807EA444772D5DE789E069B5C

Uniqueness

Uniqueness Score: -1.00%

Function 004020F7 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 118
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(C:\Program Files\7-Zip\,00000000,C:\Program Files\7-Zip\,00000000), ref: 0040210F
lstrcpyW.KERNEL32(?,C:\Program Files\7-Zip\), ref: 00402124
GetFileAttributesW.KERNELBASE(?), ref: 0040218B
lstrlenW.KERNEL32(?), ref: 004021D0
GetFileAttributesW.KERNEL32(?), ref: 0040224B
lstrlenW.KERNEL32(?), ref: 00402268

Part of subcall function 004020E0: CreateDirectoryW.KERNELBASE(?,00000000,004021B3), ref: 004020E3

Strings

C:\Program Files\7-Zip\, xrefs: 00402107, 00402108, 0040210E, 00402122

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID: lstrlen$AttributesFile$CreateDirectorylstrcpy
String ID: C:\Program Files\7-Zip\
API String ID: 3759649792-3995016716
Opcode ID: 1b98bc01977e7c6620f6cbe1e7dd022a2f7f3a7a05d088e4b32267e71b4874e7
Instruction ID: f6ebc12cd63022d4102967b468339dd31ef09c2b6121dab04151c2e252e649cd
Opcode Fuzzy Hash: 1b98bc01977e7c6620f6cbe1e7dd022a2f7f3a7a05d088e4b32267e71b4874e7
Instruction Fuzzy Hash: E641913280122996DF2096E8DF8CBAE7264AB14344F5405FFD905B62D1E7FCDF858A4D

Uniqueness

Uniqueness Score: -1.00%

Function 00404E90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,00400000,00401D10,00000000,00000000,C:\Program Files\7-Zip\,00000000,?), ref: 00404EC3
GetLastError.KERNEL32 ref: 00404EE1

Strings

C:\Program Files\7-Zip\, xrefs: 00404E95

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: C:\Program Files\7-Zip\
API String ID: 442123175-3995016716
Opcode ID: 46146804f2855f3a2075e9890cad093e8d2ce40a12403a818318e0a66c72cd06
Instruction ID: a00555c4f1c7dd3d93ceaf1e95f69faab7851ec96fb4f6ba0e58f3c2e5f9d448
Opcode Fuzzy Hash: 46146804f2855f3a2075e9890cad093e8d2ce40a12403a818318e0a66c72cd06
Instruction Fuzzy Hash: AE0162BA600204ABDB148F59D9407AAB7E9FFC0391F21453EEA45A6380E7749E408798

Uniqueness

Uniqueness Score: -1.00%

Function 00401404 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion,00000000,00020119,00000000,80000002,00000000,00401184,ProgramFilesDir,C:\Program Files\7-Zip\), ref: 00401419
RegCloseKey.ADVAPI32(00000000,?,00000000), ref: 0040143B

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00401417

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID: CloseOpen
String ID: Software\Microsoft\Windows\CurrentVersion
API String ID: 47109696-1019749484
Opcode ID: ea197e00e82a21fad55461e2a25d6b2be7d95d1369f249d9a7288cf367ddd15a
Instruction ID: 5570f971838be5c210e4a2accc44a76506a7149c7a6950c488abec6ff1e3f156
Opcode Fuzzy Hash: ea197e00e82a21fad55461e2a25d6b2be7d95d1369f249d9a7288cf367ddd15a
Instruction Fuzzy Hash: 91E03971610208BBDB10DBA0DE06AAE7668EB40765F104069B905A61A0DA389E04E7A8

Uniqueness

Uniqueness Score: -1.00%

Function 00404DBB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,-7FBFE7BD,00000001,00000000,00401840,00000080,00000000,C:\Users\user\Desktop\7z2301-x64.exe,00404DBA,00000000,00401843), ref: 00404DE7
GetLastError.KERNEL32 ref: 00404DF9

Strings

C:\Users\user\Desktop\7z2301-x64.exe, xrefs: 00404DBF

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID: CreateErrorFileLast
String ID: C:\Users\user\Desktop\7z2301-x64.exe
API String ID: 1214770103-2762374221
Opcode ID: d0f132b1f7e35754d85a2099c28ba985bab998d24fafb2453eacad13ae193dbe
Instruction ID: 9d19ab25722c3398d4ba4ebc24386183723f92154e06d25d7203ad5b2e8ca365
Opcode Fuzzy Hash: d0f132b1f7e35754d85a2099c28ba985bab998d24fafb2453eacad13ae193dbe
Instruction Fuzzy Hash: 62E026F27A01106FF3284B38DD06F7A7294CB44B20F154B3EBB52E62C0D9B88C404228

Uniqueness

Uniqueness Score: -1.00%

Function 0040245B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,00000000,C:\Program Files\7-Zip\,0040243B,C:\Program Files\7-Zip\,C:\Program Files\7-Zip\,00000000,00000000,80000001,?,004023FE), ref: 00402465
RegSetValueExW.KERNELBASE(00000000,004083C4,00000000,00000001,?,?,?,004023FE), ref: 0040247A

Strings

C:\Program Files\7-Zip\, xrefs: 0040245B

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID: Valuelstrlen
String ID: C:\Program Files\7-Zip\
API String ID: 799288031-3995016716
Opcode ID: cc83c864d80e84ce564c0fe6eb97e2a60a57884d2975776d487c01062d2cc183
Instruction ID: 4ed770e6954c35b0a3a5ace2a251ddaf0c3e6f474f7ad74015ffada5852c5521
Opcode Fuzzy Hash: cc83c864d80e84ce564c0fe6eb97e2a60a57884d2975776d487c01062d2cc183
Instruction Fuzzy Hash: 84D05E36100210BBC7208B119D0CFABBF69EBC9720F06442EB648921608A718405CA64

Uniqueness

Uniqueness Score: -1.00%

Function 00402408 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00402485: RegCreateKeyExW.KERNELBASE(80000001,00408434,00000000,00000000,00000000,000F013F,00000000,004023FE,00000000,00402420,00000000,00000000,80000001,?,004023FE), ref: 00402497

Part of subcall function 0040245B: lstrlenW.KERNEL32(?,00000000,C:\Program Files\7-Zip\,0040243B,C:\Program Files\7-Zip\,C:\Program Files\7-Zip\,00000000,00000000,80000001,?,004023FE), ref: 00402465
Part of subcall function 0040245B: RegSetValueExW.KERNELBASE(00000000,004083C4,00000000,00000001,?,?,?,004023FE), ref: 0040247A

RegCloseKey.KERNELBASE(00000000,C:\Program Files\7-Zip\,C:\Program Files\7-Zip\,C:\Program Files\7-Zip\,00000000,00000000,80000001,?,004023FE), ref: 0040244F

Strings

C:\Program Files\7-Zip\, xrefs: 0040242F, 00402430, 00402435, 00402444

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Program Files\7-Zip\
API String ID: 1356686001-3995016716
Opcode ID: 7a4633444304d987466881b8bc2d9962fde262f176236eb13cd91957d7f7d179
Instruction ID: df0ad8313cd6208403a6f6586978a006ab72e4f111db4d0f99f09dd89dff7c0f
Opcode Fuzzy Hash: 7a4633444304d987466881b8bc2d9962fde262f176236eb13cd91957d7f7d179
Instruction Fuzzy Hash: F3F05E36510214EBCB00EBA5DB4988E33AAAB89314B21407AE440B7281DEB49E029798

Uniqueness

Uniqueness Score: -1.00%

Function 004029ED Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(00000000,NoModify,00000000,00000004,00000022,00000004,0040298A,00000001,00000022,00000022), ref: 004029FA

Strings

NoModify, xrefs: 004029F8

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID: Value
String ID: NoModify
API String ID: 3702945584-1699962838
Opcode ID: 3e27b29a8ce55f0004f328f73818b2b5a689c30158cacb75b599ce131a6d034e
Instruction ID: 6c065fc95a3a0ec3b847f77730806b6a51358ffdbb636912793ddaa94612ca43
Opcode Fuzzy Hash: 3e27b29a8ce55f0004f328f73818b2b5a689c30158cacb75b599ce131a6d034e
Instruction Fuzzy Hash: F6C092F12803007AF12087108E0AF27726CA790F18F1184297340A90C085B098008A2C

Uniqueness

Uniqueness Score: -1.00%

Function 00404EF2 Relevance: 3.1, APIs: 2, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(?,00000104,00000000,00000000,00000104,00000000,00000000,?,?,00401873,00000000), ref: 00404F35
GetLastError.KERNEL32(?,00401873,00000000), ref: 00404F42

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 2f38af0628b3574979d69c84ff4a6f7999e2681a6a22fe43970544d5aba432b1
Instruction ID: f12056426c651b6aeeaf75923787ac210e36672dd25cfbaa98524d797ba8f603
Opcode Fuzzy Hash: 2f38af0628b3574979d69c84ff4a6f7999e2681a6a22fe43970544d5aba432b1
Instruction Fuzzy Hash: 9101D4B2304101AFD714DB68DE05A6B73E9EBC8350F24893BF71AE72C0DA74DC009668

Uniqueness

Uniqueness Score: -1.00%

Function 00404E2E Relevance: 3.0, APIs: 2, Instructions: 44
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,0040185A,00400000,?,00000000,00000000,?,00000000,?,?,004022EA,0040185A,00000104,00000000), ref: 00404E61
GetLastError.KERNEL32(?,00000000,?,?,004022EA,0040185A,00000104,00000000), ref: 00404E7F

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: c601d5e73958c3d8396abd8a0fb48a708afa278f8f76f35ee36cfa897b079874
Instruction ID: f71361c565d8cf9d14b06bb42d639a1751b4bb332ba826a7bb949c5d2874a6e5
Opcode Fuzzy Hash: c601d5e73958c3d8396abd8a0fb48a708afa278f8f76f35ee36cfa897b079874
Instruction Fuzzy Hash: 690186B6600204ABDB148F58D944BAAB7A9FFD4361F21403EEE49A7280E7749D00C798

Uniqueness

Uniqueness Score: -1.00%

Function 00401684 Relevance: 3.0, APIs: 2, Instructions: 32COMMON

Download Yara Rule

APIs

SHBrowseForFolderW.SHELL32(?), ref: 004016C7
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 004016D5

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID: BrowseFolderFromListPath
String ID:
API String ID: 1200278197-0
Opcode ID: e7bf3f3c92c66f9a74d58fe3a5a67100f031318a606b4a06c22dff4c5f3fe616
Instruction ID: 40680242efd52b0b594769a65aecdf5647435b4b9db22be16a486c32b40eb321
Opcode Fuzzy Hash: e7bf3f3c92c66f9a74d58fe3a5a67100f031318a606b4a06c22dff4c5f3fe616
Instruction Fuzzy Hash: 9EF04F71D00209AFCF54CFA4D845BAEBBF4BB08340F00863EA405F6290EB79D6448F98

Uniqueness

Uniqueness Score: -1.00%

Function 004016E6 Relevance: 3.0, APIs: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

SHGetPathFromIDListW.SHELL32(?,?), ref: 00401702
SendMessageW.USER32(?,00000467,00000001,?), ref: 00401730

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID: FromListMessagePathSend
String ID:
API String ID: 3727204005-0
Opcode ID: 3267fe1e053528ded4dae680779bf04f206471d632505a79808c900b2dde2d24
Instruction ID: c3e4be7dc32a6b7654b60535256cd56baea63cad526cb4d067fbbbb82a51e392
Opcode Fuzzy Hash: 3267fe1e053528ded4dae680779bf04f206471d632505a79808c900b2dde2d24
Instruction Fuzzy Hash: 31F0A97121030DAADF208F90DC49FAB3768BB04740F008232BA90BA0E2EA74C9908B59

Uniqueness

Uniqueness Score: -1.00%

Function 004020E0 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,004021B3), ref: 004020E3
GetLastError.KERNEL32 ref: 004020F0

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 666820e4a727066e08d63fd84040a92fe9dc0374d57e58459e7fbcd14a223cb1
Instruction ID: a265eadc54316d7fd95cf04170e731e01e4559aa9bbb8dd6e47d2c6966615eb2
Opcode Fuzzy Hash: 666820e4a727066e08d63fd84040a92fe9dc0374d57e58459e7fbcd14a223cb1
Instruction Fuzzy Hash: 65B092B07502019AEEA01B326F0DB173A686B40782F014979A241F01D5EE78C004E52C

Uniqueness

Uniqueness Score: -1.00%

Function 004022B2 Relevance: 2.6, APIs: 2, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00404E2E: ReadFile.KERNELBASE(?,0040185A,00400000,?,00000000,00000000,?,00000000,?,?,004022EA,0040185A,00000104,00000000), ref: 00404E61
Part of subcall function 00404E2E: GetLastError.KERNEL32(?,00000000,?,?,004022EA,0040185A,00000104,00000000), ref: 00404E7F

memcmp.MSVCRT ref: 00402338
memmove.MSVCRT ref: 0040237B

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID: ErrorFileLastReadmemcmpmemmove
String ID:
API String ID: 3189527546-0
Opcode ID: 5f75426f9babdf6d0919c0f40d7b995975e9086697f1ef9d48edf1f120544427
Instruction ID: beae3ac1fdeecf6bcb94536ec961a6748e0c9aa2ac0110697051df5a64e5e27c
Opcode Fuzzy Hash: 5f75426f9babdf6d0919c0f40d7b995975e9086697f1ef9d48edf1f120544427
Instruction Fuzzy Hash: CD21A772A0030596D7309EB5DA4979FB7E8BB90340F10847BDC84E32C0E6BC9E858B18

Uniqueness

Uniqueness Score: -1.00%

Function 004013C8 Relevance: 1.5, APIs: 1, Instructions: 25registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,00000000,?,00401436,?,00000000), ref: 004013E7

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 81fe8b38f340f5f1cb4a8a358518d1a533e15a3595ff4784dc5cf76eec413c1f
Instruction ID: eaa7313c6181f19c96f158d1732535e9dbb5764dccad63d915d8ed492d85b4e5
Opcode Fuzzy Hash: 81fe8b38f340f5f1cb4a8a358518d1a533e15a3595ff4784dc5cf76eec413c1f
Instruction Fuzzy Hash: 40E048B1510308FBDB158B54CD09FAF7ABCE701355F10417EB402F1190D674DA449624

Uniqueness

Uniqueness Score: -1.00%

Function 00402775 Relevance: 1.5, APIs: 1, Instructions: 12registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(80000000,00408368,00000000,00000000,00000000,000F003F,00000000,?,00000000,004027A2,00000000,80000000,80000000,?,0040265D,00000000), ref: 00402787

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 749f9e7c3ef478d9a1f49543d9b9b90bac6d8459c76963989df8a4e9b3fc3c31
Instruction ID: a0cd40991bbd9a1bcdb9785956509ffede74c94ca0a996847a4c17d4d1ec6dd8
Opcode Fuzzy Hash: 749f9e7c3ef478d9a1f49543d9b9b90bac6d8459c76963989df8a4e9b3fc3c31
Instruction Fuzzy Hash: ECC012F1250200BEFB254B208E04C37796DD7E0740B01C82C7F40D0025C931CC10E634

Uniqueness

Uniqueness Score: -1.00%

Function 00402485 Relevance: 1.5, APIs: 1, Instructions: 12registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(80000001,00408434,00000000,00000000,00000000,000F013F,00000000,004023FE,00000000,00402420,00000000,00000000,80000001,?,004023FE), ref: 00402497

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b5de475935815becd7aa78844d0d181ef976465a7db0097d3be5ab6f2d97049d
Instruction ID: f1e451bdf0bfcc7951d24b5c976b455968424608e5017b53810aac2f4fd58aa3
Opcode Fuzzy Hash: b5de475935815becd7aa78844d0d181ef976465a7db0097d3be5ab6f2d97049d
Instruction Fuzzy Hash: 25C012F1250200BEFA104B208E04C37B96DE7E0700B01C82C7F44D0024C531CC10E634

Uniqueness

Uniqueness Score: -1.00%

Function 00402A5E Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00402A66

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: f6eb0b268e00a99eb599f393a6b4ae91c81c018a4147abb8371167258f846626
Instruction ID: 11cd6563f4cbda07a9914685f6cb8fa7aa11fae2f5c8d6b01bd7f45a7c049767
Opcode Fuzzy Hash: f6eb0b268e00a99eb599f393a6b4ae91c81c018a4147abb8371167258f846626
Instruction Fuzzy Hash: F2B01295A0110051CA5402301B0C053222293D4503324C47DB00290084EF3481003508

Uniqueness

Uniqueness Score: -1.00%

Function 00402A55 Relevance: 1.3, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00402A56

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: d0cfdb08a7dd7c132a3161af353f64445093ad6eae382f5a1a56d2cda0908abc
Instruction ID: 4d0146f6177289610204436169ef2ce7d86cab642056ce5252b11755cbc014df
Opcode Fuzzy Hash: d0cfdb08a7dd7c132a3161af353f64445093ad6eae382f5a1a56d2cda0908abc
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00401FB1 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 101libraryloaderstringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000106), ref: 00401FDA
lstrlenW.KERNEL32(?), ref: 00401FFA
lstrcpyW.KERNEL32(?,version.dll), ref: 00402023
LoadLibraryW.KERNEL32(?), ref: 00402030
GetProcAddress.KERNEL32(00000000,GetFileVersionInfoSizeW), ref: 0040204F
GetProcAddress.KERNEL32(GetFileVersionInfoW), ref: 0040205E
GetProcAddress.KERNEL32(VerQueryValueW), ref: 0040206E
malloc.MSVCRT ref: 0040208D
free.MSVCRT(00000000), ref: 004020CE

Strings

VerQueryValueW, xrefs: 00402063
GetFileVersionInfoW, xrefs: 00402053
GetFileVersionInfoSizeW, xrefs: 00402049
version.dll, xrefs: 0040201D
C:\Program Files\7-Zip\, xrefs: 00401FC2

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystemfreelstrcpylstrlenmalloc
String ID: C:\Program Files\7-Zip\$GetFileVersionInfoSizeW$GetFileVersionInfoW$VerQueryValueW$version.dll
API String ID: 197247909-721851711
Opcode ID: ec47eff93b880e148d2193434fba117e7fd44c554c1b092129bc5c494f52ddff
Instruction ID: 30b862b13da1e34ac87170e906bfacf1945329da057f87b75dbde71edf7149dd
Opcode Fuzzy Hash: ec47eff93b880e148d2193434fba117e7fd44c554c1b092129bc5c494f52ddff
Instruction Fuzzy Hash: E0312172941258ABDB109FA4DE889AEB6B8FB04340F25447EE641F31D0DBB49E85CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00405B75 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 00405B7F
GetModuleHandleW.KERNEL32(kernel32.dll,SetDefaultDllDirectories), ref: 00405B95
GetProcAddress.KERNEL32(00000000), ref: 00405B9C
GetSystemDirectoryW.KERNEL32(?,00000106), ref: 00405BC1
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00405C36

Strings

\, xrefs: 00405BDD
\, xrefs: 00405BD2
kernel32.dll, xrefs: 00405B90
SetDefaultDllDirectories, xrefs: 00405B8B

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemVersion
String ID: SetDefaultDllDirectories$\$\$kernel32.dll
API String ID: 2515194075-2532076501
Opcode ID: d123e89f80f5fab968492f607823b4a41a2c9566f00eeec17f8d0454e73b1252
Instruction ID: 1e2de54c04ca7af598511b71a4d671dfb78ace00e3e7cc2718f47b3bc8f1ef27
Opcode Fuzzy Hash: d123e89f80f5fab968492f607823b4a41a2c9566f00eeec17f8d0454e73b1252
Instruction Fuzzy Hash: 3811D3601047049AEB205B589A4DF573BF5EF00701F1944BAE9C1FA1E1EBB8A889CF1D

Uniqueness

Uniqueness Score: -1.00%

Function 00404067 Relevance: 1.9, APIs: 1, Instructions: 670COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 004043EB

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 2aa6e967654bc62e7e68551c20f4d1d4d77fa984ecfd0de9e3043523f2221a22
Instruction ID: fe7479609cd49ff85301085f21fe850b028b2f4f29c466da63529bdd4068196a
Opcode Fuzzy Hash: 2aa6e967654bc62e7e68551c20f4d1d4d77fa984ecfd0de9e3043523f2221a22
Instruction Fuzzy Hash: B4528BB5A0024ADFCF20DF65C590AAEBBB1BF85304F14892EEA41A7391D738E945CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004060B8 Relevance: 1.0, Instructions: 997COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0236eb1d7c26a410c00355cc8f136d584589a7e4a013a1ebc3c1e327b760bbb
Instruction ID: 81fd564c154277bb1b810504a83b9f22e1839f4a6fcb86aecc57d7b09fb160a1
Opcode Fuzzy Hash: e0236eb1d7c26a410c00355cc8f136d584589a7e4a013a1ebc3c1e327b760bbb
Instruction Fuzzy Hash: 37922A71E00229CBCF08CFA9C5905ADFBB2FF89310F25826AC9567B395D6345A52CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00406BFD Relevance: .5, Instructions: 518COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 089276976f64b7cff8191ba0974aba3fc1d498bc7f9294d448572fac6552f349
Instruction ID: e9da01b0ea7ea0a1944df3fc96a4bda1ad3211d5e363a263cb32b72e05c55a95
Opcode Fuzzy Hash: 089276976f64b7cff8191ba0974aba3fc1d498bc7f9294d448572fac6552f349
Instruction Fuzzy Hash: E8126131E04129DFDB08CF68C5945ACBBB2EF85351F2542AAD856BB3C0D7389E81DB84

Uniqueness

Uniqueness Score: -1.00%

Function 0040580A Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a5fbccd82967d8d9d1c0aa4b07ca2768c7190832d7b39275e2752de5f8170c2
Instruction ID: 8f03669866decfb3854dff15df40acd9d45c2bd2e6ff59028abef17453089aab
Opcode Fuzzy Hash: 6a5fbccd82967d8d9d1c0aa4b07ca2768c7190832d7b39275e2752de5f8170c2
Instruction Fuzzy Hash: F4C185B29005218FC751CF29C88015A7BE1EF8532877996ABD495EF386D33AE847CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00404CC3 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e792cfdbfc04ae64f3520fabdc0383bd224db819a4f3945fdcf1cb02b73ab0d0
Instruction ID: 4b9901e10727f6b2d8ec93675f44e6cc95d541542a032f7bd0c82907b9e2eb06
Opcode Fuzzy Hash: e792cfdbfc04ae64f3520fabdc0383bd224db819a4f3945fdcf1cb02b73ab0d0
Instruction Fuzzy Hash: 0431A7729001099FDB15CF6DD84429ABBB2FFC9359F1A807EDA44AF351C638A691CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 00407394 Relevance: 16.6, APIs: 11, Instructions: 111COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 004073C1
__p__fmode.MSVCRT ref: 004073D6
__p__commode.MSVCRT ref: 004073E4
__setusermatherr.MSVCRT ref: 00407410
_initterm.MSVCRT ref: 00407426
__getmainargs.MSVCRT ref: 00407449
_initterm.MSVCRT ref: 00407459
GetStartupInfoA.KERNEL32(?), ref: 00407498
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 004074BC
exit.MSVCRT ref: 004074CC
_XcptFilter.MSVCRT ref: 004074DE

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: 466e4c369bd3c534fb0a0abb42730cef7b842fa64af262a66d3c658e87da6ed2
Instruction ID: b403381376d37c999f9735cb8a19fc8fd4be3a2ea3aa90117e20819b838336a8
Opcode Fuzzy Hash: 466e4c369bd3c534fb0a0abb42730cef7b842fa64af262a66d3c658e87da6ed2
Instruction Fuzzy Hash: 284160B1C04348AFDB209FA4DE45AAA7BB8EB05710F20413FE481B72D1D6786845CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040173C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(Do you want to cancel 7-Zip 23.01 (x64) installation?,7-Zip 23.01 (x64),00000124,0040167B), ref: 00401763
DestroyWindow.USER32(0040167B), ref: 00401774

Strings

Do you want to cancel 7-Zip 23.01 (x64) installation?, xrefs: 00401758
7-Zip 23.01 (x64), xrefs: 00401753

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID: DestroyMessageWindow
String ID: 7-Zip 23.01 (x64)$Do you want to cancel 7-Zip 23.01 (x64) installation?
API String ID: 1510070584-453677832
Opcode ID: d6cf62248c248eab8245b2aa26f211f6cb4cb2f24d628e0e12d4538413a57ec5
Instruction ID: 33d935573da361acde556b2ab307168f8462a5a6b28973dd9409d148e1638da2
Opcode Fuzzy Hash: d6cf62248c248eab8245b2aa26f211f6cb4cb2f24d628e0e12d4538413a57ec5
Instruction Fuzzy Hash: 3EE06775551300AFEB116B10EF4975536A1A71471AF60813EE041751F1CBBD08BACE0E

Uniqueness

Uniqueness Score: -1.00%

Function 00401325 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41stringwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 004013AF: lstrlenW.KERNEL32(00000000,?,00000000,0040134D,00000104,00000000,00000000), ref: 004013B6

lstrcatW.KERNEL32(00000000,00000000), ref: 00401389
MessageBoxW.USER32(00000000,00000010,00000104,00000000), ref: 004013A4

Strings

ERROR:, xrefs: 0040133D

Memory Dump Source

Source File: 00000000.00000002.2876559511.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2876536065.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876585621.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876607000.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2876630032.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7z2301-x64.jbxd

Similarity

API ID: Messagelstrcatlstrlen
String ID: ERROR:
API String ID: 650192479-4173811047
Opcode ID: 7e5b12aa29c5ea00aff9491e27bcfed52d1e5784986800da2f0e9e8e01b7bf7f
Instruction ID: c672725afb02d4eba33945643222a571b54df1cc3407f3fcce6f0b4f618b162a
Opcode Fuzzy Hash: 7e5b12aa29c5ea00aff9491e27bcfed52d1e5784986800da2f0e9e8e01b7bf7f
Instruction Fuzzy Hash: 7301A232A011145BE710E755ED44ADBB36F9FC0304F0040BA6989B31B0EF794E968A58

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 7z2301-x64.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\7-Zip\7-zip.chm

C:\Program Files\7-Zip\7-zip.dll

C:\Program Files\7-Zip\7-zip32.dll

C:\Program Files\7-Zip\7z.dll

C:\Program Files\7-Zip\7z.exe

C:\Program Files\7-Zip\7z.sfx

C:\Program Files\7-Zip\7zCon.sfx

C:\Program Files\7-Zip\7zFM.exe

C:\Program Files\7-Zip\7zG.exe

C:\Program Files\7-Zip\History.txt

C:\Program Files\7-Zip\Lang\af.txt

C:\Program Files\7-Zip\Lang\an.txt

C:\Program Files\7-Zip\Lang\ar.txt

C:\Program Files\7-Zip\Lang\ast.txt

C:\Program Files\7-Zip\Lang\az.txt

C:\Program Files\7-Zip\Lang\ba.txt

C:\Program Files\7-Zip\Lang\be.txt

C:\Program Files\7-Zip\Lang\bg.txt

C:\Program Files\7-Zip\Lang\bn.txt

C:\Program Files\7-Zip\Lang\br.txt

C:\Program Files\7-Zip\Lang\ca.txt

C:\Program Files\7-Zip\Lang\co.txt

C:\Program Files\7-Zip\Lang\cs.txt

C:\Program Files\7-Zip\Lang\cy.txt

C:\Program Files\7-Zip\Lang\da.txt

C:\Program Files\7-Zip\Lang\de.txt

Windows Analysis Report
7z2301-x64.exe