5eadcb607000f8d619fd021b4136867c0268cb563452c62430f6ddb217484af3

Analysis

max time kernel
32s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14/03/2023, 16:41

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

FileMenuTools-setup.exe
Size

11.2MB
MD5

5bec5683414cd92912e1db22260e2b64
SHA1

ab5188e4c64b568683648974741ceef7a655c319
SHA256

5eadcb607000f8d619fd021b4136867c0268cb563452c62430f6ddb217484af3
SHA512

edafc25159de351ae2f365763fc616bf696da92fcfe07c2e87494896152b51d6ca3823a9cbdbc2bc2906c0543435f048025fab66af898db9db768c5676dc3a6a
SSDEEP

196608:jfxZbtHGrXzEBa6StmDdLyqVgbbw8o5ofFCEFcU1EQdtdH1v6ze5D93xRsqvCW/C:bjtqz6a6FPCbGezFb1ltdHlKiDxFvC4C

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1748	FileMenuTools-setup.tmp
284	_setup64.tmp
1972	register.exe

Loads dropped DLL 12 IoCs

pid	Process
1204	FileMenuTools-setup.exe
1748	FileMenuTools-setup.tmp
1748	FileMenuTools-setup.tmp
1272	Process not Found
1272	Process not Found
1272	Process not Found
1272	Process not Found
1748	FileMenuTools-setup.tmp
1748	FileMenuTools-setup.tmp
1676	regsvr32.exe
816	regsvr32.exe
452	regsvr32.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C1B2C38F-3DCA-4E3D-BC34-D5B87B636543}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C1B2C38F-3DCA-4E3D-BC34-D5B87B636543}\InProcServer32\ = "C:\\Program Files\\LopeSoft\\FileMenu Tools\\FileMenuTools64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C1B2C38F-3DCA-4E3D-BC34-D5B87B636543}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	FileMenuTools-setup.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\InnoSetupRegFile.0000000001 = "\"C:\\Windows\\is-6FE2O.exe\" /REG /REGSVRMODE"	FileMenuTools-setup.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-NENM8.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-P67O8.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-NSDCN.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\unins000.msg	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-FUMT7.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-UMI7Q.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-BS9T8.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\is-1N1EG.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-PHHEG.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-EBMJH.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\is-TF8NC.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-0NKKD.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-B9LE6.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\is-6NG9F.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\is-O5S1A.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-4NHCE.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-B9K9T.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-KLTMH.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\is-1ELIS.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-475VC.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-NPRUN.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-EOOHD.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-RDG7O.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-HS5I3.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-0O0VB.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-218H2.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-RRJBD.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-NB2GO.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-U5RAL.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-4RQOM.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-1ACQL.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-LVQUN.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\CrashSender\is-I0H9A.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\CrashSender\is-DLRMS.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-CETV8.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-42H66.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-8JBQC.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-O3343.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-Q8LLK.tmp	FileMenuTools-setup.tmp
File opened for modification	C:\Program Files\LopeSoft\FileMenu Tools\unins000.dat	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-T6AGD.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-89VIR.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-IHJGQ.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-BHTQ1.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-J9IIL.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\is-0G7DN.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\is-MJ1SJ.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-FO3PC.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-RUM2D.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-MMLD9.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-733TU.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-3BDDE.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-26AKD.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\is-29F8U.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-E40TE.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\is-NQDGI.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-UK026.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-I0B4R.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\is-MM3ED.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-93DEG.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-FJ1Q9.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-LF7L5.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-2G4D8.tmp	FileMenuTools-setup.tmp
File created	C:\Program Files\LopeSoft\FileMenu Tools\lang\is-VMPTM.tmp	FileMenuTools-setup.tmp

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\is-6FE2O.exe	FileMenuTools-setup.tmp
File created	C:\Windows\is-6FE2O.msg	FileMenuTools-setup.tmp
File created	C:\Windows\is-6FE2O.lst	FileMenuTools-setup.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 30 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\FileMenuTools	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1B2C38F-3DCA-4E3D-BC34-D5B87B636543}\ = "FileMenuTools"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\FileMenuTools	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C1B2C38F-3DCA-4E3D-BC34-D5B87B636543}\ = "FileMenuTools"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C1B2C38F-3DCA-4E3D-BC34-D5B87B636543}\InProcServer32\ = "C:\\Program Files\\LopeSoft\\FileMenu Tools\\FileMenuTools64.dll"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\FileMenuTools	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\FileMenuTools\ = "{C1B2C38F-3DCA-4E3D-BC34-D5B87B636543}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\FileMenuTools\ = "{C1B2C38F-3DCA-4E3D-BC34-D5B87B636543}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1B2C38F-3DCA-4E3D-BC34-D5B87B636543}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\FileMenuTools\ = "{C1B2C38F-3DCA-4E3D-BC34-D5B87B636543}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\FileMenuTools	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\FileMenuTools	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\FileMenuTools\ = "{C1B2C38F-3DCA-4E3D-BC34-D5B87B636543}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\FileMenuTools\ = "{C1B2C38F-3DCA-4E3D-BC34-D5B87B636543}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\FileMenuTools\ = "{C1B2C38F-3DCA-4E3D-BC34-D5B87B636543}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\FileMenuTools\ = "{C1B2C38F-3DCA-4E3D-BC34-D5B87B636543}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\FileMenuTools\ = "{C1B2C38F-3DCA-4E3D-BC34-D5B87B636543}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\FileMenuTools	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C1B2C38F-3DCA-4E3D-BC34-D5B87B636543}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C1B2C38F-3DCA-4E3D-BC34-D5B87B636543}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\FileMenuTools	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1B2C38F-3DCA-4E3D-BC34-D5B87B636543}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1B2C38F-3DCA-4E3D-BC34-D5B87B636543}\InProcServer32\ = "C:\\Program Files\\LopeSoft\\FileMenu Tools\\FileMenuTools.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\FileMenuTools	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\FileMenuTools	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C1B2C38F-3DCA-4E3D-BC34-D5B87B636543}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1B2C38F-3DCA-4E3D-BC34-D5B87B636543}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\FileMenuTools	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\FileMenuTools	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\FileMenuTools	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1204	FileMenuTools-setup.exe
Token: 33	1700	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1700	AUDIODG.EXE
Token: 33	1700	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1700	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1748	FileMenuTools-setup.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1972	register.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1748	1204	FileMenuTools-setup.exe	28
PID 1204 wrote to memory of 1748	1204	FileMenuTools-setup.exe	28
PID 1204 wrote to memory of 1748	1204	FileMenuTools-setup.exe	28
PID 1204 wrote to memory of 1748	1204	FileMenuTools-setup.exe	28
PID 1204 wrote to memory of 1748	1204	FileMenuTools-setup.exe	28
PID 1204 wrote to memory of 1748	1204	FileMenuTools-setup.exe	28
PID 1204 wrote to memory of 1748	1204	FileMenuTools-setup.exe	28
PID 1748 wrote to memory of 284	1748	FileMenuTools-setup.tmp	29
PID 1748 wrote to memory of 284	1748	FileMenuTools-setup.tmp	29
PID 1748 wrote to memory of 284	1748	FileMenuTools-setup.tmp	29
PID 1748 wrote to memory of 284	1748	FileMenuTools-setup.tmp	29
PID 1748 wrote to memory of 1972	1748	FileMenuTools-setup.tmp	32
PID 1748 wrote to memory of 1972	1748	FileMenuTools-setup.tmp	32
PID 1748 wrote to memory of 1972	1748	FileMenuTools-setup.tmp	32
PID 1748 wrote to memory of 1972	1748	FileMenuTools-setup.tmp	32
PID 1972 wrote to memory of 1676	1972	register.exe	33
PID 1972 wrote to memory of 1676	1972	register.exe	33
PID 1972 wrote to memory of 1676	1972	register.exe	33
PID 1972 wrote to memory of 1676	1972	register.exe	33
PID 1972 wrote to memory of 1676	1972	register.exe	33
PID 1972 wrote to memory of 1676	1972	register.exe	33
PID 1972 wrote to memory of 1676	1972	register.exe	33
PID 1972 wrote to memory of 816	1972	register.exe	34
PID 1972 wrote to memory of 816	1972	register.exe	34
PID 1972 wrote to memory of 816	1972	register.exe	34
PID 1972 wrote to memory of 816	1972	register.exe	34
PID 1972 wrote to memory of 816	1972	register.exe	34
PID 1972 wrote to memory of 816	1972	register.exe	34
PID 1972 wrote to memory of 816	1972	register.exe	34
PID 816 wrote to memory of 452	816	regsvr32.exe	35
PID 816 wrote to memory of 452	816	regsvr32.exe	35
PID 816 wrote to memory of 452	816	regsvr32.exe	35
PID 816 wrote to memory of 452	816	regsvr32.exe	35
PID 816 wrote to memory of 452	816	regsvr32.exe	35
PID 816 wrote to memory of 452	816	regsvr32.exe	35
PID 816 wrote to memory of 452	816	regsvr32.exe	35

C:\Users\Admin\AppData\Local\Temp\FileMenuTools-setup.exe
"C:\Users\Admin\AppData\Local\Temp\FileMenuTools-setup.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Users\Admin\AppData\Local\Temp\is-5D1EK.tmp\FileMenuTools-setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-5D1EK.tmp\FileMenuTools-setup.tmp" /SL5="$70128,10837547,801792,C:\Users\Admin\AppData\Local\Temp\FileMenuTools-setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Users\Admin\AppData\Local\Temp\is-Q3N2J.tmp\_isetup\_setup64.tmp
    helper 105 0x1DC
    3⤵
    - Executes dropped EXE
    PID:284
- - C:\Program Files\LopeSoft\FileMenu Tools\register.exe
    "C:\Program Files\LopeSoft\FileMenu Tools\register.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1972
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\LopeSoft\FileMenu Tools\FileMenuTools.dll"
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:1676
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\LopeSoft\FileMenu Tools\FileMenuTools64.dll"
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:816
    - - C:\Windows\system32\regsvr32.exe
        
        /s "C:\Program Files\LopeSoft\FileMenu Tools\FileMenuTools64.dll"
        5⤵
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:452

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1316

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x580
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1700

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:604

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\LopeSoft\FileMenu Tools\FileMenuTools64.exe

Filesize
4.4MB

MD5
ed1023b9f48359d2b67b5fd48d92d732

SHA1
9b70bc211699327bde05cad8453b53fc941b3b98

SHA256
7d184124b27583cf935eee44688f9510dbff7e5bb5d1df0b2972869cbd01a7d2

SHA512
dbab8fc05f294c9dd6d5a42985939fa46629c68497651d300aab31b495addcd43194b9390f26f41a4adc7f57dac836f72a7d12385774309b296c4912c6614df0

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\Chinese(Simplified)_dll.lng

Filesize
39KB

MD5
bd8300ab9026ab7057ad968cdd2aed36

SHA1
3dae452687e15dbcfae0e8a3573a6bf9b33d2f54

SHA256
4c9e6bbead946cf883bb9f4038799e22cefcce755ab435a96dcf915af217dee3

SHA512
9cbd39aad61719e8c316173af9c2ab3a1f32a2e8eb90767182e3b58c72b69f13d67b67dde2976c4bb0cb90a82231d827ebacfbefb10f06d7b1fc8d5f41a3e11b

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\Chinese(Simplified)_exe.lng

Filesize
21KB

MD5
bc0bd44e9cbe310429f50c646027c5be

SHA1
146311bc2858df6d0920a3e70c9a1a685627fefc

SHA256
6637a4ead65ce49057ffd01860bcd9aeec69a9c9f6ba83ec3a59542ed853655a

SHA512
17b0cf50673ffdd387a8a8d0ee7912a7a7453e2bf1331c4c24dffc7ef99eb566fbe14953e1754a6145f9fa73e56c069fcb0c0568cf41b4281335874642ae84d6

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\Polish_dll.lng

Filesize
42KB

MD5
fda386a4cfe31617cfad081cce2922cf

SHA1
7bc943e330518e01e1720126512cff3b2e847957

SHA256
ceaa58c426d1b993339db3aac85a26155d9dfeff17db57f02ac30c73b6904cc3

SHA512
46b2a40e0d361a9c818f6031cf05c610772452b640e5ff4fb2b3356dd086d0625b9402d72a02aedc4c854f87a93cca60e7d594c120049de3c1ea04c953d3f149

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\Polish_exe.lng

Filesize
30KB

MD5
f0f1809cc6d07cc3a21ccb0d496f6ac8

SHA1
970c5cff1eddf81008072e69b62d75fa51886574

SHA256
31f32b3089555a7a45266af1a5d229f6e55d1df53cd364b3abe5271029c4807e

SHA512
69b738133d6a03f9530cb543c3c64996670ec038a3c6c03b566cab0a9a3965829cb96fe10c73d2b32026cb48342ee8ec0c4008c58387eb89fd82605103a63c4d

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\Slovenian_dll.lng

Filesize
42KB

MD5
3bc4f48335caf1efed13b576878d419a

SHA1
db57ee218bd9c255134f0c2fb4f98602964f7e4c

SHA256
4b8c9aed077b333ad3ad5ba10de205076f4c0503538f341fce2857b4796edaec

SHA512
2e3e8ce5039a75196ae069f06760f003de3fb35dd71c3f213e3a5106d1e1c9470441ffa66ae6732fcf4a1ec772da50d4d1dfa1160981a2aa647091e6d08a5a50

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\Slovenian_exe.lng

Filesize
24KB

MD5
be159631a40f1c06a2d52f276b1100c2

SHA1
afa217e5a14babab9faeb4d9c54a68bf75150dd4

SHA256
fabeca03f02180f0dcc1c99959b33a02c37dc32c237d28592e112df7ef009a90

SHA512
74fb12644080e06751245bafe3c02930eee264eaa05b71a88e685243b84560fe40346782856508a7309785a9d049dd25df8ffb19ec3b9d41a7c26391e53ae6be

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\Turkish_dll.lng

Filesize
19KB

MD5
f6397c8758246f45b38c3996af366c3a

SHA1
41eca804fd2907e64ee8fb4bcd72618a23695e91

SHA256
ebad3d30e66fcbde0d74b4839d79a85d8b302d32f5bf2628296bb93cd7884693

SHA512
45ba627acc096c6b19e2b5b7c8c4f4c004eab250c5ce59d15d61156919e3d92307f29dc6b641bfba2659964eff7a7cb68457383e47cf6694ecbeadd28f65f732

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\Turkish_exe.lng

Filesize
23KB

MD5
ad24668dbce2752173a0d43fc606be92

SHA1
af53306bf6faea2f1cc34a115e4e39557f9102e0

SHA256
be24d33ea16f8d734576d15b2bc1930826d9e813a4195c17069532098c3b54f6

SHA512
58a84e04af972b7a962f5f8da2ac02213fb16cb72bb3da5b0b6f851252fc59e6e95661e2946454bf135dfd3e01fda5203b5c25613e9f28e354f4801656d1119d

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\chinese_traditional_dll.lng

Filesize
40KB

MD5
b0c6c892d59c1e4b7a8d013e8aaeed0a

SHA1
d00912ecd072ec681a67ae807d005ad8118a6a4a

SHA256
fa346c1f4b327432e4f36bbaaf44279cf25727b8d7d4ff886036b872b1b587a8

SHA512
34e7cd493b8dde2dd8ab068a9e99708cfd1b5b00016d36f0bbf92d25e563c74b306dbf7120f8fb9e4de5f7a4d94e7039a7a93e2db11a8bb0e0b6c1266934ade7

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\chinese_traditional_exe.lng

Filesize
22KB

MD5
03c022947f08227860924d76f50b3282

SHA1
eab9799a10da82448cf1af9f8a46253a5ffbdae9

SHA256
ab9d1f8d9368858f533d8f9aa63e9b905b551487decab003826f67a92ca69896

SHA512
6e6c99bcc9ec8c0e82689856c0614cc66dac7d2ea3d7b0d7b9c0d8a903bd1896a6c5f2ccee0d38823897f645ea67e4445ac6ca4157a2b8ae4f50e8ddb33dd41c

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\czech_dll.lng

Filesize
19KB

MD5
7b110608489c282bbdbb83d7233807a2

SHA1
ad91353208becf1a990ebd4b33f1274a37424189

SHA256
8a0688d4c739f3ce6e0e799b0b460fdccca5d6253f9ad5a42bebbf8af770729b

SHA512
db8f5947030089af249a79559efb3bfdef989bcaafb5c3f1746571550e84dcc69f1f06fa4d249322f78aebb078485482b4a2a1cb5ccdb86ae5db822a8441322c

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\czech_exe.lng

Filesize
24KB

MD5
d6bf7a838720789724ccf419ac6d41e2

SHA1
e22882eb37622a326e2fbb87ead79e91170e78f5

SHA256
ba26e00597b5c9fa3d7dfd8fcb89be98738e6c2f72a7dd9c6695600c7e5de99d

SHA512
4949e20b37620995f1e8ece8bd1f5ea88b4ed058230a3f79e003634068c329d73500fb90093193a8a912ff3a20d528f180587f5d826e6a70aa087ca220e86eba

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\danish_dll.lng

Filesize
36KB

MD5
3cf298d43d7e137b9b30045147b69d3e

SHA1
2e25227f5873c61d3202ab9203a8b4b22f2d93ca

SHA256
3bdf33117b4c6189816b1c443c9885435a476884cac6986067ef72651aa7ad1c

SHA512
d2c114227a0c8d8f51c6fa6a8ef5d0ea6367d396620e5d5c66d6c3371b5db93a1a945f91e764dbd1cc6a07855670311c6f2d0317583ef9fe1bf1d5484fd02d6b

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\danish_exe.lng

Filesize
24KB

MD5
bdafcff796a4da5fa1a47728db3d1cc8

SHA1
6529664769a23afe7ef559f886bcfa8aaece4419

SHA256
728879f5492aa8759aa3649021f81d35c580c5f64a1e94577d06c94a00124b91

SHA512
16e2c7737b62fbe1dcdb0a0b742eb2700e297b4ee8c94c319f90d186d0cfd4eb1cd294ddc8a5c51d29a03b47c2f9985375a53a5fa2b2cb349159017bb00f8de7

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\dutch (nl)_dll.lng

Filesize
38KB

MD5
006c9c53e62688e56766a1f8fe022540

SHA1
12667b4fcfc4b321fdf47f3736a150de3410548f

SHA256
df6f98f417d4b4c333eaf567d0ba771675229e401095e5e76895f2fda092b00e

SHA512
e06b479f7eef7a5ae64db4f25a5b00c1a78520af5bd10bbfe1b79b3b0e868816c1c2dbae5cb2e0080eacdebd663164b7ea64419fb705b4efcb458f69623e3531

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\dutch (nl)_exe.lng

Filesize
23KB

MD5
32f5a8db39e0bb6788ac96dfc3ce9b6d

SHA1
5cb4a6d1070f46e35e01e740089522b3782719c7

SHA256
464b7fdb00b21e3ab5caf320e596a437c787d299a267de75d8409f3d9f24b114

SHA512
291ab2af30af6b919e546161eddb9a3f2a11a3d965071e2daa33cf11b866705ef626a054135f072c778e1dcf8909b2e518cc92ec5e738a18890544d54fb1947d

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\dutch_dll.lng

Filesize
17KB

MD5
a7561fdf67fcc310081dcf6b2e7c8ad4

SHA1
3d45577bc6f6e119cd83daae5febb2dae45d5b1c

SHA256
1930d1bebfbdde37cc7cb94a4ef20eb599e97926fb39da28182c457d7d1b8dda

SHA512
e19df91a6d78aa12b476cb53097d475a971886c29fe94b8bdb8856e90dc011711afce0a4ee896b7f8b58c956c213cf60a5ebd7b22067f1abc6a5e2ff0c4b1aa9

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\dutch_exe.lng

Filesize
24KB

MD5
96881a36ce20f343dc15d4107719162f

SHA1
ebca350e27589fda97c83a2fcf300c1b93b5dd69

SHA256
1f46ac91b554ac5b41ce735cfc87a6bb97a003d5a7526d4d3faf1d5eed543dcc

SHA512
092c203401768ea92bc661f5fffd6d398c7cc25fedf5b72083a1eb2b42a7c1504c6c1c55590a9ef87b90c37b786119bb81e6c58fdcacec74b0fdcc5aac27093d

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\english_dll.lng

Filesize
41KB

MD5
a5ac71e3cb29f014260cb2366fa0a881

SHA1
175a66be413860afd4fc1c68dc26282fa1923aca

SHA256
4fd5f5b03e5c1e995afea1763efbca4f3b44510e9282bfaf0e530433ac5ee20e

SHA512
b3dc86e0058f3e739029eda5cfa04caa72d620bc6fad411563d930a00abf95cf5e30eba9b1d49d1f60611d00176bbf96a21b441f72e880081e107f5e646ce5d4

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\english_exe.lng

Filesize
23KB

MD5
f31c5f329151a87fff4a926547458d16

SHA1
2f5310366b1742ce54a35469d82b569e6eff305e

SHA256
b91113757064ed312fd08e631f3bce84fc4ae9efdf2a1d91bfc8869d0073ba72

SHA512
8389a2a8ed0643f0efb14a4cb12e96c1e0d2e27903ff61f265bdc46d4a51a41c75e12b7f6f4a0b314c87631a0f083d86136ba63b072de557933dc4ff71f342b1

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\finnish_dll.lng

Filesize
43KB

MD5
884918ebdbb4c689aa33cd9dde6cffc6

SHA1
94c50ad17dfce2808694a68794897147dd1698e7

SHA256
046a7f970e033a22c645c4b7980cf10bea23adadd83e9636e4aa8c02a683ff13

SHA512
e621062f899f669183f97a7459e0c4ccb6d08b4c8b7035484a5a71ea8bfe9ba4eec34bab74808c6e4ed04e9190011cb8c70f2719f18ddeea7b67625716b3119d

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\finnish_exe.lng

Filesize
24KB

MD5
b9bc7b1eafae1bc4e9ab01261ace085b

SHA1
ddc879004186e401e9a0969f687ffdfc5c9a7710

SHA256
18c1783b7d6bb88e83ce1aba55c076c46a4df3586487d0d0509aa52aa50c9f70

SHA512
87f515d02992b12434bc4df54436ddf4d1f2bb915e88d0d43a2ae87478211aca20a254d75a582116c170ea536bfe331312cac2c54f7a4b82da7856777f2dcfe5

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\french_dll.lng

Filesize
47KB

MD5
4198c2ca18a5b794c6a14d7d578c44b4

SHA1
c474c5b00b7e26a8d89a7059ef53854d9d005b6c

SHA256
2ef83af27e51b3ed681f0deb830d89d298604a49f2c142ea7a4a66a0df46884c

SHA512
56ae90544bb434518c424adccc74291f1228e86331c01a86d2ca8959b8c8276a37f1cbcf5f17fd16bb822f17ffb2a82c81a74df218e82899a01066ae65614724

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\french_exe.lng

Filesize
26KB

MD5
8743aa3316f1758618d2d07fbd45f27a

SHA1
ba9d14173286190a7eb251cd724e5336621a284a

SHA256
cf33fcd009d3cf669823edb776168ee89f09f1dc20b20a482d45d671cab7cdb7

SHA512
fb54c28b03d120f1ea1a4356de77ec76bbde1dca4f1868858bb4255b7e3d9e6870b4c00c87e67ce987e76c269b7c15bce3a51768989e6f15b996e75c2f82d346

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\german_dll.lng

Filesize
46KB

MD5
42610eb5a66b2e104bf030370b7c99ae

SHA1
d93c1d2a1d910722406d412cc647331ff09055a5

SHA256
62b2d9c886ce21af61b26e5d5c8d304c39eab0a47965de728491902f7847712d

SHA512
ab7684a1eafe79e6607e8b60cd6af3e46254c6dac2cdb61290fbd265f236fb7250d7aafdf64b2bc69569f1ff13e0ae0f26204e0931494bc3ed8304df146065ac

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\german_exe.lng

Filesize
27KB

MD5
9aec1f5abfac25f5c7e250727844db1b

SHA1
b81e06e6acb1102d227966c3adabdcd5869381da

SHA256
472ef13d89bb8a13481048846e83b87752b816ab236cf047452b7f4ddb166f1f

SHA512
5b093eb15c19d2752e13ee9e41eb374ed73b771a6ae3bf1e91a0250f5f90c464264ec73bae097b1fad353ad419a5dd18a0f0c5da9478add30257adea86ca1964

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\hungarian_dll.lng

Filesize
44KB

MD5
a3091c98d683e723c9c0c981bd07ac93

SHA1
3e448eaa0948d7ab1f4a9be5a708dcf38cf492de

SHA256
4ea37463c47ca934507edaa81156889eeba527f53d72c6662a4791a3c68e7744

SHA512
ecd3f54b08084e421cfc135df89d72d1d9b6cbc26a8128128da94c32f672d2d4fa2886dff3daf30efc228642c3869b103c68cc3331a4e786a07b7a4fba93c1ad

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\hungarian_exe.lng

Filesize
24KB

MD5
47916a5bb01e9a9707d23c741e23f442

SHA1
78da508bd8edc6eccb373dd36063dce12b881645

SHA256
159977bb7ec8e65d1bffc47b5ab6569543af58b00494d07fe4ae71b1d6411c07

SHA512
01606b23f1ce345675280023357a9c68b7b60e8fd0b09641c776e6536b1d5f46c3a061d0e0a63e0e91910d3f0f534e009f43950da115c597c525df33bf2b03cd

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\italian_dll.lng

Filesize
41KB

MD5
9bdea3b1bddc8d3f93450f62e5f7373e

SHA1
b41e9c40ea61b58406abde4acf9e17047ad6be4d

SHA256
4cab7c9bab0c3f544fcedc3dcc2ad3128e34f1901b6f54a22d408acaa59fa1cd

SHA512
5905481ca17843fc25af4a76edc1d964dd35e58b0e05b0b57f051150242eb4460703f60cda407cdd6b4f1d52f1809399f317e7ed65e82ce044e7c29f1ee4406d

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\italian_exe.lng

Filesize
23KB

MD5
5530533bc2fcc22a058aa2f46341a4d7

SHA1
f23d00411512fd847145349841b13ec4d99e1889

SHA256
fd3b76c5522258a91fbd70947b463d7ebe7b1bb2dc706c5691ee79ff872d730f

SHA512
cdf3e2d792faa4349c503f88cace23747d494ddf44dd92aae85af619c2c39136d8f6997c8a92282a6ac1a5057f81752b7fcc1c9b7b3719ce4cd1bb70b6f21946

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\japanese_dll.lng

Filesize
52KB

MD5
df977ec57901e299fc6dbdb7b9b5ce23

SHA1
d16330386e29009a5429440654e686e1ca87bce2

SHA256
a1b1b1de954e18ec2ab08a235f4778b9ecb93dba9c8d29b10f9bea17e3cae0cc

SHA512
280634dc8ced96cd37054c99ab4723f3c8557a0afd9a1feba2960a9385aabf9cf27c356f8f16fb65753b241299d9e89fc108e0a19d5cfa445e706cf3c2afb32b

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\japanese_exe.lng

Filesize
30KB

MD5
6939334d6f7e73c5c3a3937972109b5b

SHA1
dd5b1bd268cfe754b92c1989291083541594aafc

SHA256
9141d18a6836013f3e0e472c254fb6cbc49ae3615d23f9a5a5643e507cad635d

SHA512
0f61447ee88c35af60e4b631002c4f78787319d6d4806c90561001a1830a9c2744d1fb3e6127bc3b606311cb29083bc6154024fca6bc9e79324a3ee35c152670

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\korean_dll.lng

Filesize
51KB

MD5
68d0918c7f7e1a90554bb817c18787ee

SHA1
2a3e90a98ed6cb7e5f68f17806ddc5e1b192d1e8

SHA256
15137624127ef863b82181c0b26327acbd407d57ae703e5e154d0ef75a40a4db

SHA512
6c3b0460d07b03621a45457aa642b1e3f6ee3670708938e2d14e99f002202f85a3c9a86908dc2044772ad0ae77907f9303add624b031362a66a629b6b7d16b96

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\korean_exe.lng

Filesize
31KB

MD5
31fbf5d5f28a035aad6069b74c11c43b

SHA1
0b1a1644a2b0dbf3f06432b5f2d83661dfe3afbf

SHA256
658a847a46053b8cea4759c3be923959e03a43f61f0f874c14f19fa318533439

SHA512
1389623ee5602d7fdf150eafdf6cdb1f391200a781b59c007723d9908e9110cc0e6baacbccaab73312fbad4ab65b1dffa94aba4235045afaef90633dbd4d5c79

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\portuguese-br_dll.lng

Filesize
46KB

MD5
23fe44e756cd94db128ef829cf2c57d9

SHA1
c3a5133f4c8932e4066a180436c07cce994e1d1e

SHA256
d307291ff489de09982f1f34172b89a4baf918098f5e4c626e4c80509177b0eb

SHA512
f3f000ec601a919e42a2c47e245897cf32feb373d23a20606c237ac6235bca5257579b27c07ec154d987efcafc18b75d62b649f9dab3e2f622817b8e6b39a093

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\portuguese-br_exe.lng

Filesize
26KB

MD5
61ed97c7c96c3c52194a29a88cd015e9

SHA1
61c68f64ee08c472fa0e671a43eb9941db34df66

SHA256
8e95bb8882bcdacdd6d95904dde87bf8ef9e6799e7b3c2937c85865bcadac4f2

SHA512
b1d09d9ef51c2e790e57393f34f9e7f856c6c463d762160bb174b1cee674bec2630adac1bb5d10f47e0d3c2ed31616cf56fd4612079f5bc57ed12d6949e1cc80

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\romanian_dll.lng

Filesize
33KB

MD5
3160b209edd0967ae6cb12590e541afe

SHA1
8d14f22f17f82e5ddcd7ccd728e0c6fb016d3fb7

SHA256
aa59ab3c07cb3dde3e3fcd366e99b7f3c0041eede4564de965828a67fa969794

SHA512
75ea2e87c00158f8c57ccc5e8373cd45c92e208996ac8f56e78c8f17346804d660f90118171d7042ac6633a6b7ee2b139e9b44cd7223872cad6dc9f2684fd97c

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\romanian_exe.lng

Filesize
21KB

MD5
4f69724d8e01d3d7accce6ccd95ffa18

SHA1
d4060af5aec78ca8aee47bd6aa51aa1155ed5ff9

SHA256
04829e87e936f4d1610159cefff30bb305b2f55750c0f20341b678af8f39ee6b

SHA512
c452c04fc18aef0cb5e11126e11630ae24d88047ec2d1297936e33ba4510c60b5c40df66ca736caee229fe3f94911548a67981319abee4a72ef1189eb02db411

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\russian_dll.lng

Filesize
66KB

MD5
9ec382123a8a1f32793a954b658b5416

SHA1
3f77ed03c5707c3c821b1e6e770faa2b1e4ce462

SHA256
13b9da6cac716e4c289431f67db02962c5699adc4c6c2f20341ce61981d2a383

SHA512
d3b6b0e4960df5c89e53aea46e63a0471586034dfd2af1ba2cf516788138e37209f6a36492a5287e73ed36a96af4c4c38ee0a9f5784cf4f84d28297c62814a81

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\russian_exe.lng

Filesize
37KB

MD5
b570eb0c1b455e5db6c5e23846a8e24e

SHA1
0007b0322e6cc39ed043bbe5003a2916e940616f

SHA256
744f296b027058221e8a3ce0a6939dae96fc61f46b4c5d4aeafcbd3572beceb9

SHA512
e0036e4b5ec70a1911ff0645f72e8eeb42aa23078135cc18d22095fe0650da32a46abc69b2deafddcd2fbebace309828a599686ff99caa49a7461399a1cf5418

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\slovak_dll.lng

Filesize
48KB

MD5
184cc0461cfc9378123d4cb5b06a28c7

SHA1
481a5001cc3f436292fe7ebdb1e15f5cde837664

SHA256
cc63545c81fd6d1138fbbfa0755c5fb005972c5e9a9b022bf0cfac164d322381

SHA512
9a8fd2da24812d0f810db5056ddd268aa8c631585e3cd3f24ec4c3e1dfb1af8faf2fe522b0626eaf5cb058ea648b33f1b2a28b699e11b658b0f59782a3f47f2d

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\slovak_exe.lng

Filesize
26KB

MD5
4087c30e3842f00bd43810e817a4a6fb

SHA1
6d748a76e8c82bc1407702dcf50a32080d1c6eb7

SHA256
c4e71aa27b9759d7cc8218c64ec1b1b87f04d17fbe58656478646989f0f7bdae

SHA512
b04a0887777ac52b1fdf52f265c62a50fa386243656260a19218783130ca915fec0cbbeda0290458d710bd57387c94a33d4a9cc41b361ed50a094e128688e2c3

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\spanish_dll.lng

Filesize
48KB

MD5
53c954db30db4f7a2482af3e38dfedc4

SHA1
608fb90eb98ac9bb675ccd0d9907f9426f979e96

SHA256
d78c6da0e2f9f88773ed9b105a9d15c51baa5bfb7a9d3f4ca26749cfa5430b85

SHA512
ba04900786eee10879e12d4be595a139861ba6c2a389252a6effdfe61480b547ae3c3fc301323621af281396fc398a84a4e7fcd3cda023e98e1e09da6f6a8550

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\spanish_exe.lng

Filesize
26KB

MD5
e51f566293ccf7014a364f73f85dfe29

SHA1
e95f6c6cb6888988fe2d1ceb2be4c24833a5706f

SHA256
fc980a73c9869a3796f3fdbb569a897072530168e0c5f2d32734fde8120a71ab

SHA512
ea6f055f8e1c88b0ee7d0f8dc943447042e5b08606464a921b7437f2eb312865a5472032d4476af3379afefdc49dc4653f3dfd4f6e6a310c4125eb0b5b85e732

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\swedish_dll.lng

Filesize
21KB

MD5
4e967ff1115d156c81c3c90ef01ece39

SHA1
0bfccb4bfc8e62801342fa88b83102e1982d172e

SHA256
e2fc337a041677148e6ee9a62d8d2c9f21e37c525586dc21a035b63d78344b3f

SHA512
7b2f18b061be6cf19ce9dfabd3d70339d1f54b852375de18d3d18a792ef4d2d8998286c991ce1a636e44b6ec1b75b7d2226567d2d837e11e1f1f6e74e9182cf8

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\swedish_exe.lng

Filesize
23KB

MD5
441d022aa04cf3f028b16fd9dc92a7b6

SHA1
f0cbd640176273e2ce0f81cea401758edffb3f18

SHA256
de4d93b0593233d8cd2b4a2cc8e8de97ea441d98e31644d5bf20a97b2e6aa465

SHA512
0b88c3078dc62410049cb49dd5a619ddb5cce22bfc7e44efde1200bdf67e8b03f91348de7075fb75490e6e86d16985c4ddcd6f2d2abc2e03b6471805efada5ff

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\ukrainian_dll.lng

Filesize
60KB

MD5
46065b600969799f55fd8d2ace6beb0f

SHA1
ecf4afe7d02ff77e1dc7f4beb81155da421f533a

SHA256
10bd89da516bd30528337ee7bf11e39a72ca317d990bea19b0d02b9d27a6b726

SHA512
ecf6600e7723caa46a8af6a19e4074e2dc54f7950515e992e7b60ffa4ce4b2015147bd5d35204919e3f9bca331bc4088cac332e87e15fc076364b5d2f6417f11

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\ukrainian_exe.lng

Filesize
35KB

MD5
9c29af4b97c799532115910960ff9976

SHA1
3b72288611e5a2739efec0d742f25973477d813d

SHA256
c1faae70bb2ec21eef99b8b0add0113b7942d8e00346464f468af6a8541d0d43

SHA512
b54e92025c660fc4d8807547ec67698c5c83a4ccdcbeea0a9eeab8277f09534ff1c1003e73205a154cd9a2e1cb478612f2a7a0fa13d945296428bc5d38ca7b4f

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\valencian_dll.lng

Filesize
39KB

MD5
7265adfa3f4aeea8d13c654e7970d69a

SHA1
759346d7849c1412fc8c08f062043273fc7e2380

SHA256
1a5de19686a12076167e2d04e2d48095eb70aa41e6e5e29af35a909c386b8802

SHA512
a695ac2ace9d092c0065644f2b91b742744979a18954d91544b70fc74a9ca35de9c3f7fa4dc269536facdff5d6bdcd7890a9e9f9250fc020d27e1ce2c31bb754

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\valencian_exe.lng

Filesize
24KB

MD5
92d9a03ebd4b2c20e7febc6031c4ffd4

SHA1
2006d5fba066fdabfadb798095f9939d99b9840b

SHA256
696e41299957cc4a33ebeb7823250c69482c4b1c88385a9abec5adb02dfaefa6

SHA512
dbf03548356ae5252f2fe18bf08dcbb6870c2e150d7c949c13d4b1bfa9c18d37c99006a99c72f302e773612bced71f7baebfda8f47f2e66fbb03ba0ee3b75593

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\vietnamese_dll.lng

Filesize
53KB

MD5
7a13d84c6116fbd983b0389a61571984

SHA1
ffb01020a13db749db0131108399b2ba4e2fba6d

SHA256
948f61f2b51bb4d984683c6c25539e30ad5f306260351f322541b1aa1b22c22f

SHA512
14894a68cea79e2d9c9fa15b8e627f151216f8032620afb7a406c9ee866c9dd0b204713c035c30eaafab157065c687af4ede425066c68ccfe5ce006abc6acd00

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\lang\vietnamese_exe.lng

Filesize
28KB

MD5
d11efca460a39b3b3bd56328030df468

SHA1
65bc02940d18ab5a3d1c05506c6939d9cef47744

SHA256
9cdfb83081b9679476956c868e0c3000eb489cedf0d49c2f815e1b0d9fba9c0e

SHA512
6dccdd2d0994e381516c2b74e5883b7a91644e93990ee1780aa80eab9ffb4ae9ee3d961ee90bdb96ff5c4b253a1e690524e1427d9b82f7ede31cbc829eccb250

Download Submit
C:\Program Files\LopeSoft\FileMenu Tools\unins000.exe

Filesize
3.0MB

MD5
86da90308357f74768b89a477d8d305d

SHA1
c86b0ac52a156ea62ce082963c4f6a00ffe80038

SHA256
0921f50ca26960f6a007e5bd40152ed5255cd1d02789f4e31a3bc6a681a133be

SHA512
1c1073030f1328f73c62d9eb65c16cd9cd01c977bf070eab322ce6454d04cda27565f415cb6c4e7da4581d8954f1865c5938bf014f1be33a3f8ebe517afb0803

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5D1EK.tmp\FileMenuTools-setup.tmp

Filesize
3.0MB

MD5
86da90308357f74768b89a477d8d305d

SHA1
c86b0ac52a156ea62ce082963c4f6a00ffe80038

SHA256
0921f50ca26960f6a007e5bd40152ed5255cd1d02789f4e31a3bc6a681a133be

SHA512
1c1073030f1328f73c62d9eb65c16cd9cd01c977bf070eab322ce6454d04cda27565f415cb6c4e7da4581d8954f1865c5938bf014f1be33a3f8ebe517afb0803

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5D1EK.tmp\FileMenuTools-setup.tmp

Filesize
3.0MB

MD5
86da90308357f74768b89a477d8d305d

SHA1
c86b0ac52a156ea62ce082963c4f6a00ffe80038

SHA256
0921f50ca26960f6a007e5bd40152ed5255cd1d02789f4e31a3bc6a681a133be

SHA512
1c1073030f1328f73c62d9eb65c16cd9cd01c977bf070eab322ce6454d04cda27565f415cb6c4e7da4581d8954f1865c5938bf014f1be33a3f8ebe517afb0803

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-Q3N2J.tmp\_isetup\_setup64.tmp

Filesize
6KB

MD5
e4211d6d009757c078a9fac7ff4f03d4

SHA1
019cd56ba687d39d12d4b13991c9a42ea6ba03da

SHA256
388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95

SHA512
17257f15d843e88bb78adcfb48184b8ce22109cc2c99e709432728a392afae7b808ed32289ba397207172de990a354f15c2459b6797317da8ea18b040c85787e

Download Submit
\Program Files\LopeSoft\FileMenu Tools\FileMenuTools64.exe

Filesize
4.4MB

MD5
ed1023b9f48359d2b67b5fd48d92d732

SHA1
9b70bc211699327bde05cad8453b53fc941b3b98

SHA256
7d184124b27583cf935eee44688f9510dbff7e5bb5d1df0b2972869cbd01a7d2

SHA512
dbab8fc05f294c9dd6d5a42985939fa46629c68497651d300aab31b495addcd43194b9390f26f41a4adc7f57dac836f72a7d12385774309b296c4912c6614df0

Download Submit
\Program Files\LopeSoft\FileMenu Tools\FileMenuTools64.exe

Filesize
4.4MB

MD5
ed1023b9f48359d2b67b5fd48d92d732

SHA1
9b70bc211699327bde05cad8453b53fc941b3b98

SHA256
7d184124b27583cf935eee44688f9510dbff7e5bb5d1df0b2972869cbd01a7d2

SHA512
dbab8fc05f294c9dd6d5a42985939fa46629c68497651d300aab31b495addcd43194b9390f26f41a4adc7f57dac836f72a7d12385774309b296c4912c6614df0

Download Submit
\Program Files\LopeSoft\FileMenu Tools\FileMenuTools64.exe

Filesize
4.4MB

MD5
ed1023b9f48359d2b67b5fd48d92d732

SHA1
9b70bc211699327bde05cad8453b53fc941b3b98

SHA256
7d184124b27583cf935eee44688f9510dbff7e5bb5d1df0b2972869cbd01a7d2

SHA512
dbab8fc05f294c9dd6d5a42985939fa46629c68497651d300aab31b495addcd43194b9390f26f41a4adc7f57dac836f72a7d12385774309b296c4912c6614df0

Download Submit
\Program Files\LopeSoft\FileMenu Tools\FileMenuTools64.exe

Filesize
4.4MB

MD5
ed1023b9f48359d2b67b5fd48d92d732

SHA1
9b70bc211699327bde05cad8453b53fc941b3b98

SHA256
7d184124b27583cf935eee44688f9510dbff7e5bb5d1df0b2972869cbd01a7d2

SHA512
dbab8fc05f294c9dd6d5a42985939fa46629c68497651d300aab31b495addcd43194b9390f26f41a4adc7f57dac836f72a7d12385774309b296c4912c6614df0

Download Submit
\Program Files\LopeSoft\FileMenu Tools\FileMenuTools64.exe

Filesize
4.4MB

MD5
ed1023b9f48359d2b67b5fd48d92d732

SHA1
9b70bc211699327bde05cad8453b53fc941b3b98

SHA256
7d184124b27583cf935eee44688f9510dbff7e5bb5d1df0b2972869cbd01a7d2

SHA512
dbab8fc05f294c9dd6d5a42985939fa46629c68497651d300aab31b495addcd43194b9390f26f41a4adc7f57dac836f72a7d12385774309b296c4912c6614df0

Download Submit
\Program Files\LopeSoft\FileMenu Tools\FileMenuTools64.exe

Filesize
4.4MB

MD5
ed1023b9f48359d2b67b5fd48d92d732

SHA1
9b70bc211699327bde05cad8453b53fc941b3b98

SHA256
7d184124b27583cf935eee44688f9510dbff7e5bb5d1df0b2972869cbd01a7d2

SHA512
dbab8fc05f294c9dd6d5a42985939fa46629c68497651d300aab31b495addcd43194b9390f26f41a4adc7f57dac836f72a7d12385774309b296c4912c6614df0

Download Submit
\Program Files\LopeSoft\FileMenu Tools\register.exe

Filesize
2.0MB

MD5
65ec142c26fc9317ef3c36147e70d858

SHA1
d1f082a9522bd04a3b4d75e85e2ba636accab0e2

SHA256
8ffb6713aeb633cfa47b6d528c336f5942c4ed5f8e8d735fbc2e2e505ef2f7e2

SHA512
6df0542310c59dc99021d39a4a180d79a5688f19deebf1843e862bd05c1b23d749d71d5160915c195a16c2f9be75cce2be14e568772429b359a16ee5ab4d5469

Download Submit
\Users\Admin\AppData\Local\Temp\is-5D1EK.tmp\FileMenuTools-setup.tmp

Filesize
3.0MB

MD5
86da90308357f74768b89a477d8d305d

SHA1
c86b0ac52a156ea62ce082963c4f6a00ffe80038

SHA256
0921f50ca26960f6a007e5bd40152ed5255cd1d02789f4e31a3bc6a681a133be

SHA512
1c1073030f1328f73c62d9eb65c16cd9cd01c977bf070eab322ce6454d04cda27565f415cb6c4e7da4581d8954f1865c5938bf014f1be33a3f8ebe517afb0803

Download Submit
\Users\Admin\AppData\Local\Temp\is-Q3N2J.tmp\_isetup\_setup64.tmp

Filesize
6KB

MD5
e4211d6d009757c078a9fac7ff4f03d4

SHA1
019cd56ba687d39d12d4b13991c9a42ea6ba03da

SHA256
388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95

SHA512
17257f15d843e88bb78adcfb48184b8ce22109cc2c99e709432728a392afae7b808ed32289ba397207172de990a354f15c2459b6797317da8ea18b040c85787e

Download Submit
memory/604-282-0x0000000002760000-0x0000000002761000-memory.dmp

Filesize
4KB

Download
memory/1204-63-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download
memory/1204-54-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download
memory/1204-280-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download
memory/1316-281-0x00000000027C0000-0x00000000027C1000-memory.dmp

Filesize
4KB

Download
memory/1748-62-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1748-64-0x0000000000400000-0x000000000070C000-memory.dmp

Filesize
3.0MB

Download
memory/1748-275-0x0000000000400000-0x000000000070C000-memory.dmp

Filesize
3.0MB

Download
memory/1748-279-0x0000000000400000-0x000000000070C000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads