Analysis

  • max time kernel
    151s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-03-2023 16:41

General

  • Target

    FileMenuTools-setup.exe

  • Size

    11.2MB

  • MD5

    5bec5683414cd92912e1db22260e2b64

  • SHA1

    ab5188e4c64b568683648974741ceef7a655c319

  • SHA256

    5eadcb607000f8d619fd021b4136867c0268cb563452c62430f6ddb217484af3

  • SHA512

    edafc25159de351ae2f365763fc616bf696da92fcfe07c2e87494896152b51d6ca3823a9cbdbc2bc2906c0543435f048025fab66af898db9db768c5676dc3a6a

  • SSDEEP

    196608:jfxZbtHGrXzEBa6StmDdLyqVgbbw8o5ofFCEFcU1EQdtdH1v6ze5D93xRsqvCW/C:bjtqz6a6FPCbGezFb1ltdHlKiDxFvC4C

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 6 IoCs
  • Registers COM server for autorun 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 30 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FileMenuTools-setup.exe
    "C:\Users\Admin\AppData\Local\Temp\FileMenuTools-setup.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2772
    • C:\Users\Admin\AppData\Local\Temp\is-DPHF3.tmp\FileMenuTools-setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-DPHF3.tmp\FileMenuTools-setup.tmp" /SL5="$C0056,10837547,801792,C:\Users\Admin\AppData\Local\Temp\FileMenuTools-setup.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:876
      • C:\Users\Admin\AppData\Local\Temp\is-DLCND.tmp\_isetup\_setup64.tmp
        helper 105 0x444
        3⤵
        • Executes dropped EXE
        PID:2252
      • C:\Program Files\LopeSoft\FileMenu Tools\register.exe
        "C:\Program Files\LopeSoft\FileMenu Tools\register.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2044
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\LopeSoft\FileMenu Tools\FileMenuTools.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:1580
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\LopeSoft\FileMenu Tools\FileMenuTools64.dll"
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:4448
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files\LopeSoft\FileMenu Tools\FileMenuTools64.dll"
            5⤵
            • Loads dropped DLL
            • Registers COM server for autorun
            • Modifies registry class
            PID:4672
  • C:\Program Files\LopeSoft\FileMenu Tools\FileMenuTools64.exe
    "C:\Program Files\LopeSoft\FileMenu Tools\FileMenuTools64.exe" /init
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:1992
  • C:\program files\lopesoft\filemenu tools\filemenutools64.exe
    "C:\program files\lopesoft\filemenu tools\filemenutools64.exe" /u
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetWindowsHookEx
    PID:5084
  • C:\Program Files\LopeSoft\FileMenu Tools\FileMenuTools64.exe
    "C:\Program Files\LopeSoft\FileMenu Tools\FileMenuTools64.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:3120

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\LopeSoft\FileMenu Tools\FileMenuTools.dll

    Filesize

    8.6MB

    MD5

    c4e0eac8daaea4bd9be3bd41351f83c1

    SHA1

    e09d8c1f68649d7c839884e0029531a45eb86961

    SHA256

    8250b005121889370ee8b855771f584e5002cb131790d5a21e4d169d2c25e433

    SHA512

    3cb1b521ed5081d5af427ab375ef43cce2d7bb3189a0012e2eb3885403baaefdf9cf26f83e4b282f8e96a4a463a5af91d42693ec01723f7dcf3a8de6869cb8c6

  • C:\Program Files\LopeSoft\FileMenu Tools\FileMenuTools.dll

    Filesize

    8.6MB

    MD5

    c4e0eac8daaea4bd9be3bd41351f83c1

    SHA1

    e09d8c1f68649d7c839884e0029531a45eb86961

    SHA256

    8250b005121889370ee8b855771f584e5002cb131790d5a21e4d169d2c25e433

    SHA512

    3cb1b521ed5081d5af427ab375ef43cce2d7bb3189a0012e2eb3885403baaefdf9cf26f83e4b282f8e96a4a463a5af91d42693ec01723f7dcf3a8de6869cb8c6

  • C:\Program Files\LopeSoft\FileMenu Tools\FileMenuTools64.dll

    Filesize

    10.6MB

    MD5

    eff3b34ef3b7c0c0f13883b4e5d842d6

    SHA1

    f799952789cf83312fcc17d1d64dfaabac2ebf47

    SHA256

    1ee3c90faa52f8a9b4b5956d16abaa1d9f7003517fa1097b685cd2beee0c0428

    SHA512

    bdf52ceec13be6c09434b01371e2b8c13c779da3235b8c09b78bc45133ead1f008f2167b6ee0f69d2ae89f22826a0a78e96711ce7efb6f2c30fd6305a9d95c6a

  • C:\Program Files\LopeSoft\FileMenu Tools\FileMenuTools64.dll

    Filesize

    10.6MB

    MD5

    eff3b34ef3b7c0c0f13883b4e5d842d6

    SHA1

    f799952789cf83312fcc17d1d64dfaabac2ebf47

    SHA256

    1ee3c90faa52f8a9b4b5956d16abaa1d9f7003517fa1097b685cd2beee0c0428

    SHA512

    bdf52ceec13be6c09434b01371e2b8c13c779da3235b8c09b78bc45133ead1f008f2167b6ee0f69d2ae89f22826a0a78e96711ce7efb6f2c30fd6305a9d95c6a

  • C:\Program Files\LopeSoft\FileMenu Tools\FileMenuTools64.dll

    Filesize

    10.6MB

    MD5

    eff3b34ef3b7c0c0f13883b4e5d842d6

    SHA1

    f799952789cf83312fcc17d1d64dfaabac2ebf47

    SHA256

    1ee3c90faa52f8a9b4b5956d16abaa1d9f7003517fa1097b685cd2beee0c0428

    SHA512

    bdf52ceec13be6c09434b01371e2b8c13c779da3235b8c09b78bc45133ead1f008f2167b6ee0f69d2ae89f22826a0a78e96711ce7efb6f2c30fd6305a9d95c6a

  • C:\Program Files\LopeSoft\FileMenu Tools\FileMenuTools64.dll

    Filesize

    10.6MB

    MD5

    eff3b34ef3b7c0c0f13883b4e5d842d6

    SHA1

    f799952789cf83312fcc17d1d64dfaabac2ebf47

    SHA256

    1ee3c90faa52f8a9b4b5956d16abaa1d9f7003517fa1097b685cd2beee0c0428

    SHA512

    bdf52ceec13be6c09434b01371e2b8c13c779da3235b8c09b78bc45133ead1f008f2167b6ee0f69d2ae89f22826a0a78e96711ce7efb6f2c30fd6305a9d95c6a

  • C:\Program Files\LopeSoft\FileMenu Tools\FileMenuTools64.exe

    Filesize

    4.4MB

    MD5

    ed1023b9f48359d2b67b5fd48d92d732

    SHA1

    9b70bc211699327bde05cad8453b53fc941b3b98

    SHA256

    7d184124b27583cf935eee44688f9510dbff7e5bb5d1df0b2972869cbd01a7d2

    SHA512

    dbab8fc05f294c9dd6d5a42985939fa46629c68497651d300aab31b495addcd43194b9390f26f41a4adc7f57dac836f72a7d12385774309b296c4912c6614df0

  • C:\Program Files\LopeSoft\FileMenu Tools\FileMenuTools64.exe

    Filesize

    4.4MB

    MD5

    ed1023b9f48359d2b67b5fd48d92d732

    SHA1

    9b70bc211699327bde05cad8453b53fc941b3b98

    SHA256

    7d184124b27583cf935eee44688f9510dbff7e5bb5d1df0b2972869cbd01a7d2

    SHA512

    dbab8fc05f294c9dd6d5a42985939fa46629c68497651d300aab31b495addcd43194b9390f26f41a4adc7f57dac836f72a7d12385774309b296c4912c6614df0

  • C:\Program Files\LopeSoft\FileMenu Tools\FileMenuTools64.exe

    Filesize

    4.4MB

    MD5

    ed1023b9f48359d2b67b5fd48d92d732

    SHA1

    9b70bc211699327bde05cad8453b53fc941b3b98

    SHA256

    7d184124b27583cf935eee44688f9510dbff7e5bb5d1df0b2972869cbd01a7d2

    SHA512

    dbab8fc05f294c9dd6d5a42985939fa46629c68497651d300aab31b495addcd43194b9390f26f41a4adc7f57dac836f72a7d12385774309b296c4912c6614df0

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\Chinese(Simplified)_dll.lng

    Filesize

    39KB

    MD5

    bd8300ab9026ab7057ad968cdd2aed36

    SHA1

    3dae452687e15dbcfae0e8a3573a6bf9b33d2f54

    SHA256

    4c9e6bbead946cf883bb9f4038799e22cefcce755ab435a96dcf915af217dee3

    SHA512

    9cbd39aad61719e8c316173af9c2ab3a1f32a2e8eb90767182e3b58c72b69f13d67b67dde2976c4bb0cb90a82231d827ebacfbefb10f06d7b1fc8d5f41a3e11b

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\Chinese(Simplified)_exe.lng

    Filesize

    21KB

    MD5

    bc0bd44e9cbe310429f50c646027c5be

    SHA1

    146311bc2858df6d0920a3e70c9a1a685627fefc

    SHA256

    6637a4ead65ce49057ffd01860bcd9aeec69a9c9f6ba83ec3a59542ed853655a

    SHA512

    17b0cf50673ffdd387a8a8d0ee7912a7a7453e2bf1331c4c24dffc7ef99eb566fbe14953e1754a6145f9fa73e56c069fcb0c0568cf41b4281335874642ae84d6

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\Polish_dll.lng

    Filesize

    42KB

    MD5

    fda386a4cfe31617cfad081cce2922cf

    SHA1

    7bc943e330518e01e1720126512cff3b2e847957

    SHA256

    ceaa58c426d1b993339db3aac85a26155d9dfeff17db57f02ac30c73b6904cc3

    SHA512

    46b2a40e0d361a9c818f6031cf05c610772452b640e5ff4fb2b3356dd086d0625b9402d72a02aedc4c854f87a93cca60e7d594c120049de3c1ea04c953d3f149

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\Polish_exe.lng

    Filesize

    30KB

    MD5

    f0f1809cc6d07cc3a21ccb0d496f6ac8

    SHA1

    970c5cff1eddf81008072e69b62d75fa51886574

    SHA256

    31f32b3089555a7a45266af1a5d229f6e55d1df53cd364b3abe5271029c4807e

    SHA512

    69b738133d6a03f9530cb543c3c64996670ec038a3c6c03b566cab0a9a3965829cb96fe10c73d2b32026cb48342ee8ec0c4008c58387eb89fd82605103a63c4d

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\Slovenian_dll.lng

    Filesize

    42KB

    MD5

    3bc4f48335caf1efed13b576878d419a

    SHA1

    db57ee218bd9c255134f0c2fb4f98602964f7e4c

    SHA256

    4b8c9aed077b333ad3ad5ba10de205076f4c0503538f341fce2857b4796edaec

    SHA512

    2e3e8ce5039a75196ae069f06760f003de3fb35dd71c3f213e3a5106d1e1c9470441ffa66ae6732fcf4a1ec772da50d4d1dfa1160981a2aa647091e6d08a5a50

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\Slovenian_exe.lng

    Filesize

    24KB

    MD5

    be159631a40f1c06a2d52f276b1100c2

    SHA1

    afa217e5a14babab9faeb4d9c54a68bf75150dd4

    SHA256

    fabeca03f02180f0dcc1c99959b33a02c37dc32c237d28592e112df7ef009a90

    SHA512

    74fb12644080e06751245bafe3c02930eee264eaa05b71a88e685243b84560fe40346782856508a7309785a9d049dd25df8ffb19ec3b9d41a7c26391e53ae6be

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\Turkish_dll.lng

    Filesize

    19KB

    MD5

    f6397c8758246f45b38c3996af366c3a

    SHA1

    41eca804fd2907e64ee8fb4bcd72618a23695e91

    SHA256

    ebad3d30e66fcbde0d74b4839d79a85d8b302d32f5bf2628296bb93cd7884693

    SHA512

    45ba627acc096c6b19e2b5b7c8c4f4c004eab250c5ce59d15d61156919e3d92307f29dc6b641bfba2659964eff7a7cb68457383e47cf6694ecbeadd28f65f732

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\Turkish_exe.lng

    Filesize

    23KB

    MD5

    ad24668dbce2752173a0d43fc606be92

    SHA1

    af53306bf6faea2f1cc34a115e4e39557f9102e0

    SHA256

    be24d33ea16f8d734576d15b2bc1930826d9e813a4195c17069532098c3b54f6

    SHA512

    58a84e04af972b7a962f5f8da2ac02213fb16cb72bb3da5b0b6f851252fc59e6e95661e2946454bf135dfd3e01fda5203b5c25613e9f28e354f4801656d1119d

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\chinese_traditional_dll.lng

    Filesize

    40KB

    MD5

    b0c6c892d59c1e4b7a8d013e8aaeed0a

    SHA1

    d00912ecd072ec681a67ae807d005ad8118a6a4a

    SHA256

    fa346c1f4b327432e4f36bbaaf44279cf25727b8d7d4ff886036b872b1b587a8

    SHA512

    34e7cd493b8dde2dd8ab068a9e99708cfd1b5b00016d36f0bbf92d25e563c74b306dbf7120f8fb9e4de5f7a4d94e7039a7a93e2db11a8bb0e0b6c1266934ade7

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\chinese_traditional_exe.lng

    Filesize

    22KB

    MD5

    03c022947f08227860924d76f50b3282

    SHA1

    eab9799a10da82448cf1af9f8a46253a5ffbdae9

    SHA256

    ab9d1f8d9368858f533d8f9aa63e9b905b551487decab003826f67a92ca69896

    SHA512

    6e6c99bcc9ec8c0e82689856c0614cc66dac7d2ea3d7b0d7b9c0d8a903bd1896a6c5f2ccee0d38823897f645ea67e4445ac6ca4157a2b8ae4f50e8ddb33dd41c

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\czech_dll.lng

    Filesize

    19KB

    MD5

    7b110608489c282bbdbb83d7233807a2

    SHA1

    ad91353208becf1a990ebd4b33f1274a37424189

    SHA256

    8a0688d4c739f3ce6e0e799b0b460fdccca5d6253f9ad5a42bebbf8af770729b

    SHA512

    db8f5947030089af249a79559efb3bfdef989bcaafb5c3f1746571550e84dcc69f1f06fa4d249322f78aebb078485482b4a2a1cb5ccdb86ae5db822a8441322c

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\czech_exe.lng

    Filesize

    24KB

    MD5

    d6bf7a838720789724ccf419ac6d41e2

    SHA1

    e22882eb37622a326e2fbb87ead79e91170e78f5

    SHA256

    ba26e00597b5c9fa3d7dfd8fcb89be98738e6c2f72a7dd9c6695600c7e5de99d

    SHA512

    4949e20b37620995f1e8ece8bd1f5ea88b4ed058230a3f79e003634068c329d73500fb90093193a8a912ff3a20d528f180587f5d826e6a70aa087ca220e86eba

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\danish_dll.lng

    Filesize

    36KB

    MD5

    3cf298d43d7e137b9b30045147b69d3e

    SHA1

    2e25227f5873c61d3202ab9203a8b4b22f2d93ca

    SHA256

    3bdf33117b4c6189816b1c443c9885435a476884cac6986067ef72651aa7ad1c

    SHA512

    d2c114227a0c8d8f51c6fa6a8ef5d0ea6367d396620e5d5c66d6c3371b5db93a1a945f91e764dbd1cc6a07855670311c6f2d0317583ef9fe1bf1d5484fd02d6b

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\danish_exe.lng

    Filesize

    24KB

    MD5

    bdafcff796a4da5fa1a47728db3d1cc8

    SHA1

    6529664769a23afe7ef559f886bcfa8aaece4419

    SHA256

    728879f5492aa8759aa3649021f81d35c580c5f64a1e94577d06c94a00124b91

    SHA512

    16e2c7737b62fbe1dcdb0a0b742eb2700e297b4ee8c94c319f90d186d0cfd4eb1cd294ddc8a5c51d29a03b47c2f9985375a53a5fa2b2cb349159017bb00f8de7

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\dutch (nl)_dll.lng

    Filesize

    38KB

    MD5

    006c9c53e62688e56766a1f8fe022540

    SHA1

    12667b4fcfc4b321fdf47f3736a150de3410548f

    SHA256

    df6f98f417d4b4c333eaf567d0ba771675229e401095e5e76895f2fda092b00e

    SHA512

    e06b479f7eef7a5ae64db4f25a5b00c1a78520af5bd10bbfe1b79b3b0e868816c1c2dbae5cb2e0080eacdebd663164b7ea64419fb705b4efcb458f69623e3531

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\dutch (nl)_exe.lng

    Filesize

    23KB

    MD5

    32f5a8db39e0bb6788ac96dfc3ce9b6d

    SHA1

    5cb4a6d1070f46e35e01e740089522b3782719c7

    SHA256

    464b7fdb00b21e3ab5caf320e596a437c787d299a267de75d8409f3d9f24b114

    SHA512

    291ab2af30af6b919e546161eddb9a3f2a11a3d965071e2daa33cf11b866705ef626a054135f072c778e1dcf8909b2e518cc92ec5e738a18890544d54fb1947d

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\dutch_dll.lng

    Filesize

    17KB

    MD5

    a7561fdf67fcc310081dcf6b2e7c8ad4

    SHA1

    3d45577bc6f6e119cd83daae5febb2dae45d5b1c

    SHA256

    1930d1bebfbdde37cc7cb94a4ef20eb599e97926fb39da28182c457d7d1b8dda

    SHA512

    e19df91a6d78aa12b476cb53097d475a971886c29fe94b8bdb8856e90dc011711afce0a4ee896b7f8b58c956c213cf60a5ebd7b22067f1abc6a5e2ff0c4b1aa9

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\dutch_exe.lng

    Filesize

    24KB

    MD5

    96881a36ce20f343dc15d4107719162f

    SHA1

    ebca350e27589fda97c83a2fcf300c1b93b5dd69

    SHA256

    1f46ac91b554ac5b41ce735cfc87a6bb97a003d5a7526d4d3faf1d5eed543dcc

    SHA512

    092c203401768ea92bc661f5fffd6d398c7cc25fedf5b72083a1eb2b42a7c1504c6c1c55590a9ef87b90c37b786119bb81e6c58fdcacec74b0fdcc5aac27093d

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\english_dll.lng

    Filesize

    41KB

    MD5

    a5ac71e3cb29f014260cb2366fa0a881

    SHA1

    175a66be413860afd4fc1c68dc26282fa1923aca

    SHA256

    4fd5f5b03e5c1e995afea1763efbca4f3b44510e9282bfaf0e530433ac5ee20e

    SHA512

    b3dc86e0058f3e739029eda5cfa04caa72d620bc6fad411563d930a00abf95cf5e30eba9b1d49d1f60611d00176bbf96a21b441f72e880081e107f5e646ce5d4

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\english_exe.lng

    Filesize

    23KB

    MD5

    f31c5f329151a87fff4a926547458d16

    SHA1

    2f5310366b1742ce54a35469d82b569e6eff305e

    SHA256

    b91113757064ed312fd08e631f3bce84fc4ae9efdf2a1d91bfc8869d0073ba72

    SHA512

    8389a2a8ed0643f0efb14a4cb12e96c1e0d2e27903ff61f265bdc46d4a51a41c75e12b7f6f4a0b314c87631a0f083d86136ba63b072de557933dc4ff71f342b1

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\finnish_dll.lng

    Filesize

    43KB

    MD5

    884918ebdbb4c689aa33cd9dde6cffc6

    SHA1

    94c50ad17dfce2808694a68794897147dd1698e7

    SHA256

    046a7f970e033a22c645c4b7980cf10bea23adadd83e9636e4aa8c02a683ff13

    SHA512

    e621062f899f669183f97a7459e0c4ccb6d08b4c8b7035484a5a71ea8bfe9ba4eec34bab74808c6e4ed04e9190011cb8c70f2719f18ddeea7b67625716b3119d

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\finnish_exe.lng

    Filesize

    24KB

    MD5

    b9bc7b1eafae1bc4e9ab01261ace085b

    SHA1

    ddc879004186e401e9a0969f687ffdfc5c9a7710

    SHA256

    18c1783b7d6bb88e83ce1aba55c076c46a4df3586487d0d0509aa52aa50c9f70

    SHA512

    87f515d02992b12434bc4df54436ddf4d1f2bb915e88d0d43a2ae87478211aca20a254d75a582116c170ea536bfe331312cac2c54f7a4b82da7856777f2dcfe5

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\french_dll.lng

    Filesize

    47KB

    MD5

    4198c2ca18a5b794c6a14d7d578c44b4

    SHA1

    c474c5b00b7e26a8d89a7059ef53854d9d005b6c

    SHA256

    2ef83af27e51b3ed681f0deb830d89d298604a49f2c142ea7a4a66a0df46884c

    SHA512

    56ae90544bb434518c424adccc74291f1228e86331c01a86d2ca8959b8c8276a37f1cbcf5f17fd16bb822f17ffb2a82c81a74df218e82899a01066ae65614724

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\french_exe.lng

    Filesize

    26KB

    MD5

    8743aa3316f1758618d2d07fbd45f27a

    SHA1

    ba9d14173286190a7eb251cd724e5336621a284a

    SHA256

    cf33fcd009d3cf669823edb776168ee89f09f1dc20b20a482d45d671cab7cdb7

    SHA512

    fb54c28b03d120f1ea1a4356de77ec76bbde1dca4f1868858bb4255b7e3d9e6870b4c00c87e67ce987e76c269b7c15bce3a51768989e6f15b996e75c2f82d346

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\german_dll.lng

    Filesize

    46KB

    MD5

    42610eb5a66b2e104bf030370b7c99ae

    SHA1

    d93c1d2a1d910722406d412cc647331ff09055a5

    SHA256

    62b2d9c886ce21af61b26e5d5c8d304c39eab0a47965de728491902f7847712d

    SHA512

    ab7684a1eafe79e6607e8b60cd6af3e46254c6dac2cdb61290fbd265f236fb7250d7aafdf64b2bc69569f1ff13e0ae0f26204e0931494bc3ed8304df146065ac

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\german_exe.lng

    Filesize

    27KB

    MD5

    9aec1f5abfac25f5c7e250727844db1b

    SHA1

    b81e06e6acb1102d227966c3adabdcd5869381da

    SHA256

    472ef13d89bb8a13481048846e83b87752b816ab236cf047452b7f4ddb166f1f

    SHA512

    5b093eb15c19d2752e13ee9e41eb374ed73b771a6ae3bf1e91a0250f5f90c464264ec73bae097b1fad353ad419a5dd18a0f0c5da9478add30257adea86ca1964

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\hungarian_dll.lng

    Filesize

    44KB

    MD5

    a3091c98d683e723c9c0c981bd07ac93

    SHA1

    3e448eaa0948d7ab1f4a9be5a708dcf38cf492de

    SHA256

    4ea37463c47ca934507edaa81156889eeba527f53d72c6662a4791a3c68e7744

    SHA512

    ecd3f54b08084e421cfc135df89d72d1d9b6cbc26a8128128da94c32f672d2d4fa2886dff3daf30efc228642c3869b103c68cc3331a4e786a07b7a4fba93c1ad

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\hungarian_exe.lng

    Filesize

    24KB

    MD5

    47916a5bb01e9a9707d23c741e23f442

    SHA1

    78da508bd8edc6eccb373dd36063dce12b881645

    SHA256

    159977bb7ec8e65d1bffc47b5ab6569543af58b00494d07fe4ae71b1d6411c07

    SHA512

    01606b23f1ce345675280023357a9c68b7b60e8fd0b09641c776e6536b1d5f46c3a061d0e0a63e0e91910d3f0f534e009f43950da115c597c525df33bf2b03cd

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\italian_dll.lng

    Filesize

    41KB

    MD5

    9bdea3b1bddc8d3f93450f62e5f7373e

    SHA1

    b41e9c40ea61b58406abde4acf9e17047ad6be4d

    SHA256

    4cab7c9bab0c3f544fcedc3dcc2ad3128e34f1901b6f54a22d408acaa59fa1cd

    SHA512

    5905481ca17843fc25af4a76edc1d964dd35e58b0e05b0b57f051150242eb4460703f60cda407cdd6b4f1d52f1809399f317e7ed65e82ce044e7c29f1ee4406d

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\italian_exe.lng

    Filesize

    23KB

    MD5

    5530533bc2fcc22a058aa2f46341a4d7

    SHA1

    f23d00411512fd847145349841b13ec4d99e1889

    SHA256

    fd3b76c5522258a91fbd70947b463d7ebe7b1bb2dc706c5691ee79ff872d730f

    SHA512

    cdf3e2d792faa4349c503f88cace23747d494ddf44dd92aae85af619c2c39136d8f6997c8a92282a6ac1a5057f81752b7fcc1c9b7b3719ce4cd1bb70b6f21946

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\japanese_dll.lng

    Filesize

    52KB

    MD5

    df977ec57901e299fc6dbdb7b9b5ce23

    SHA1

    d16330386e29009a5429440654e686e1ca87bce2

    SHA256

    a1b1b1de954e18ec2ab08a235f4778b9ecb93dba9c8d29b10f9bea17e3cae0cc

    SHA512

    280634dc8ced96cd37054c99ab4723f3c8557a0afd9a1feba2960a9385aabf9cf27c356f8f16fb65753b241299d9e89fc108e0a19d5cfa445e706cf3c2afb32b

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\japanese_exe.lng

    Filesize

    30KB

    MD5

    6939334d6f7e73c5c3a3937972109b5b

    SHA1

    dd5b1bd268cfe754b92c1989291083541594aafc

    SHA256

    9141d18a6836013f3e0e472c254fb6cbc49ae3615d23f9a5a5643e507cad635d

    SHA512

    0f61447ee88c35af60e4b631002c4f78787319d6d4806c90561001a1830a9c2744d1fb3e6127bc3b606311cb29083bc6154024fca6bc9e79324a3ee35c152670

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\korean_dll.lng

    Filesize

    51KB

    MD5

    68d0918c7f7e1a90554bb817c18787ee

    SHA1

    2a3e90a98ed6cb7e5f68f17806ddc5e1b192d1e8

    SHA256

    15137624127ef863b82181c0b26327acbd407d57ae703e5e154d0ef75a40a4db

    SHA512

    6c3b0460d07b03621a45457aa642b1e3f6ee3670708938e2d14e99f002202f85a3c9a86908dc2044772ad0ae77907f9303add624b031362a66a629b6b7d16b96

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\korean_exe.lng

    Filesize

    31KB

    MD5

    31fbf5d5f28a035aad6069b74c11c43b

    SHA1

    0b1a1644a2b0dbf3f06432b5f2d83661dfe3afbf

    SHA256

    658a847a46053b8cea4759c3be923959e03a43f61f0f874c14f19fa318533439

    SHA512

    1389623ee5602d7fdf150eafdf6cdb1f391200a781b59c007723d9908e9110cc0e6baacbccaab73312fbad4ab65b1dffa94aba4235045afaef90633dbd4d5c79

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\portuguese-br_dll.lng

    Filesize

    46KB

    MD5

    23fe44e756cd94db128ef829cf2c57d9

    SHA1

    c3a5133f4c8932e4066a180436c07cce994e1d1e

    SHA256

    d307291ff489de09982f1f34172b89a4baf918098f5e4c626e4c80509177b0eb

    SHA512

    f3f000ec601a919e42a2c47e245897cf32feb373d23a20606c237ac6235bca5257579b27c07ec154d987efcafc18b75d62b649f9dab3e2f622817b8e6b39a093

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\portuguese-br_exe.lng

    Filesize

    26KB

    MD5

    61ed97c7c96c3c52194a29a88cd015e9

    SHA1

    61c68f64ee08c472fa0e671a43eb9941db34df66

    SHA256

    8e95bb8882bcdacdd6d95904dde87bf8ef9e6799e7b3c2937c85865bcadac4f2

    SHA512

    b1d09d9ef51c2e790e57393f34f9e7f856c6c463d762160bb174b1cee674bec2630adac1bb5d10f47e0d3c2ed31616cf56fd4612079f5bc57ed12d6949e1cc80

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\romanian_dll.lng

    Filesize

    33KB

    MD5

    3160b209edd0967ae6cb12590e541afe

    SHA1

    8d14f22f17f82e5ddcd7ccd728e0c6fb016d3fb7

    SHA256

    aa59ab3c07cb3dde3e3fcd366e99b7f3c0041eede4564de965828a67fa969794

    SHA512

    75ea2e87c00158f8c57ccc5e8373cd45c92e208996ac8f56e78c8f17346804d660f90118171d7042ac6633a6b7ee2b139e9b44cd7223872cad6dc9f2684fd97c

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\romanian_exe.lng

    Filesize

    21KB

    MD5

    4f69724d8e01d3d7accce6ccd95ffa18

    SHA1

    d4060af5aec78ca8aee47bd6aa51aa1155ed5ff9

    SHA256

    04829e87e936f4d1610159cefff30bb305b2f55750c0f20341b678af8f39ee6b

    SHA512

    c452c04fc18aef0cb5e11126e11630ae24d88047ec2d1297936e33ba4510c60b5c40df66ca736caee229fe3f94911548a67981319abee4a72ef1189eb02db411

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\russian_dll.lng

    Filesize

    66KB

    MD5

    9ec382123a8a1f32793a954b658b5416

    SHA1

    3f77ed03c5707c3c821b1e6e770faa2b1e4ce462

    SHA256

    13b9da6cac716e4c289431f67db02962c5699adc4c6c2f20341ce61981d2a383

    SHA512

    d3b6b0e4960df5c89e53aea46e63a0471586034dfd2af1ba2cf516788138e37209f6a36492a5287e73ed36a96af4c4c38ee0a9f5784cf4f84d28297c62814a81

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\russian_exe.lng

    Filesize

    37KB

    MD5

    b570eb0c1b455e5db6c5e23846a8e24e

    SHA1

    0007b0322e6cc39ed043bbe5003a2916e940616f

    SHA256

    744f296b027058221e8a3ce0a6939dae96fc61f46b4c5d4aeafcbd3572beceb9

    SHA512

    e0036e4b5ec70a1911ff0645f72e8eeb42aa23078135cc18d22095fe0650da32a46abc69b2deafddcd2fbebace309828a599686ff99caa49a7461399a1cf5418

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\slovak_dll.lng

    Filesize

    48KB

    MD5

    184cc0461cfc9378123d4cb5b06a28c7

    SHA1

    481a5001cc3f436292fe7ebdb1e15f5cde837664

    SHA256

    cc63545c81fd6d1138fbbfa0755c5fb005972c5e9a9b022bf0cfac164d322381

    SHA512

    9a8fd2da24812d0f810db5056ddd268aa8c631585e3cd3f24ec4c3e1dfb1af8faf2fe522b0626eaf5cb058ea648b33f1b2a28b699e11b658b0f59782a3f47f2d

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\slovak_exe.lng

    Filesize

    26KB

    MD5

    4087c30e3842f00bd43810e817a4a6fb

    SHA1

    6d748a76e8c82bc1407702dcf50a32080d1c6eb7

    SHA256

    c4e71aa27b9759d7cc8218c64ec1b1b87f04d17fbe58656478646989f0f7bdae

    SHA512

    b04a0887777ac52b1fdf52f265c62a50fa386243656260a19218783130ca915fec0cbbeda0290458d710bd57387c94a33d4a9cc41b361ed50a094e128688e2c3

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\spanish_dll.lng

    Filesize

    48KB

    MD5

    53c954db30db4f7a2482af3e38dfedc4

    SHA1

    608fb90eb98ac9bb675ccd0d9907f9426f979e96

    SHA256

    d78c6da0e2f9f88773ed9b105a9d15c51baa5bfb7a9d3f4ca26749cfa5430b85

    SHA512

    ba04900786eee10879e12d4be595a139861ba6c2a389252a6effdfe61480b547ae3c3fc301323621af281396fc398a84a4e7fcd3cda023e98e1e09da6f6a8550

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\spanish_exe.lng

    Filesize

    26KB

    MD5

    e51f566293ccf7014a364f73f85dfe29

    SHA1

    e95f6c6cb6888988fe2d1ceb2be4c24833a5706f

    SHA256

    fc980a73c9869a3796f3fdbb569a897072530168e0c5f2d32734fde8120a71ab

    SHA512

    ea6f055f8e1c88b0ee7d0f8dc943447042e5b08606464a921b7437f2eb312865a5472032d4476af3379afefdc49dc4653f3dfd4f6e6a310c4125eb0b5b85e732

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\swedish_dll.lng

    Filesize

    21KB

    MD5

    4e967ff1115d156c81c3c90ef01ece39

    SHA1

    0bfccb4bfc8e62801342fa88b83102e1982d172e

    SHA256

    e2fc337a041677148e6ee9a62d8d2c9f21e37c525586dc21a035b63d78344b3f

    SHA512

    7b2f18b061be6cf19ce9dfabd3d70339d1f54b852375de18d3d18a792ef4d2d8998286c991ce1a636e44b6ec1b75b7d2226567d2d837e11e1f1f6e74e9182cf8

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\swedish_exe.lng

    Filesize

    23KB

    MD5

    441d022aa04cf3f028b16fd9dc92a7b6

    SHA1

    f0cbd640176273e2ce0f81cea401758edffb3f18

    SHA256

    de4d93b0593233d8cd2b4a2cc8e8de97ea441d98e31644d5bf20a97b2e6aa465

    SHA512

    0b88c3078dc62410049cb49dd5a619ddb5cce22bfc7e44efde1200bdf67e8b03f91348de7075fb75490e6e86d16985c4ddcd6f2d2abc2e03b6471805efada5ff

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\ukrainian_dll.lng

    Filesize

    60KB

    MD5

    46065b600969799f55fd8d2ace6beb0f

    SHA1

    ecf4afe7d02ff77e1dc7f4beb81155da421f533a

    SHA256

    10bd89da516bd30528337ee7bf11e39a72ca317d990bea19b0d02b9d27a6b726

    SHA512

    ecf6600e7723caa46a8af6a19e4074e2dc54f7950515e992e7b60ffa4ce4b2015147bd5d35204919e3f9bca331bc4088cac332e87e15fc076364b5d2f6417f11

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\ukrainian_exe.lng

    Filesize

    35KB

    MD5

    9c29af4b97c799532115910960ff9976

    SHA1

    3b72288611e5a2739efec0d742f25973477d813d

    SHA256

    c1faae70bb2ec21eef99b8b0add0113b7942d8e00346464f468af6a8541d0d43

    SHA512

    b54e92025c660fc4d8807547ec67698c5c83a4ccdcbeea0a9eeab8277f09534ff1c1003e73205a154cd9a2e1cb478612f2a7a0fa13d945296428bc5d38ca7b4f

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\valencian_dll.lng

    Filesize

    39KB

    MD5

    7265adfa3f4aeea8d13c654e7970d69a

    SHA1

    759346d7849c1412fc8c08f062043273fc7e2380

    SHA256

    1a5de19686a12076167e2d04e2d48095eb70aa41e6e5e29af35a909c386b8802

    SHA512

    a695ac2ace9d092c0065644f2b91b742744979a18954d91544b70fc74a9ca35de9c3f7fa4dc269536facdff5d6bdcd7890a9e9f9250fc020d27e1ce2c31bb754

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\valencian_exe.lng

    Filesize

    24KB

    MD5

    92d9a03ebd4b2c20e7febc6031c4ffd4

    SHA1

    2006d5fba066fdabfadb798095f9939d99b9840b

    SHA256

    696e41299957cc4a33ebeb7823250c69482c4b1c88385a9abec5adb02dfaefa6

    SHA512

    dbf03548356ae5252f2fe18bf08dcbb6870c2e150d7c949c13d4b1bfa9c18d37c99006a99c72f302e773612bced71f7baebfda8f47f2e66fbb03ba0ee3b75593

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\vietnamese_dll.lng

    Filesize

    53KB

    MD5

    7a13d84c6116fbd983b0389a61571984

    SHA1

    ffb01020a13db749db0131108399b2ba4e2fba6d

    SHA256

    948f61f2b51bb4d984683c6c25539e30ad5f306260351f322541b1aa1b22c22f

    SHA512

    14894a68cea79e2d9c9fa15b8e627f151216f8032620afb7a406c9ee866c9dd0b204713c035c30eaafab157065c687af4ede425066c68ccfe5ce006abc6acd00

  • C:\Program Files\LopeSoft\FileMenu Tools\lang\vietnamese_exe.lng

    Filesize

    28KB

    MD5

    d11efca460a39b3b3bd56328030df468

    SHA1

    65bc02940d18ab5a3d1c05506c6939d9cef47744

    SHA256

    9cdfb83081b9679476956c868e0c3000eb489cedf0d49c2f815e1b0d9fba9c0e

    SHA512

    6dccdd2d0994e381516c2b74e5883b7a91644e93990ee1780aa80eab9ffb4ae9ee3d961ee90bdb96ff5c4b253a1e690524e1427d9b82f7ede31cbc829eccb250

  • C:\Program Files\LopeSoft\FileMenu Tools\register.exe

    Filesize

    2.0MB

    MD5

    65ec142c26fc9317ef3c36147e70d858

    SHA1

    d1f082a9522bd04a3b4d75e85e2ba636accab0e2

    SHA256

    8ffb6713aeb633cfa47b6d528c336f5942c4ed5f8e8d735fbc2e2e505ef2f7e2

    SHA512

    6df0542310c59dc99021d39a4a180d79a5688f19deebf1843e862bd05c1b23d749d71d5160915c195a16c2f9be75cce2be14e568772429b359a16ee5ab4d5469

  • C:\Users\Admin\AppData\Local\Temp\is-DLCND.tmp\_isetup\_setup64.tmp

    Filesize

    6KB

    MD5

    e4211d6d009757c078a9fac7ff4f03d4

    SHA1

    019cd56ba687d39d12d4b13991c9a42ea6ba03da

    SHA256

    388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95

    SHA512

    17257f15d843e88bb78adcfb48184b8ce22109cc2c99e709432728a392afae7b808ed32289ba397207172de990a354f15c2459b6797317da8ea18b040c85787e

  • C:\Users\Admin\AppData\Local\Temp\is-DPHF3.tmp\FileMenuTools-setup.tmp

    Filesize

    3.0MB

    MD5

    86da90308357f74768b89a477d8d305d

    SHA1

    c86b0ac52a156ea62ce082963c4f6a00ffe80038

    SHA256

    0921f50ca26960f6a007e5bd40152ed5255cd1d02789f4e31a3bc6a681a133be

    SHA512

    1c1073030f1328f73c62d9eb65c16cd9cd01c977bf070eab322ce6454d04cda27565f415cb6c4e7da4581d8954f1865c5938bf014f1be33a3f8ebe517afb0803

  • C:\Users\Admin\AppData\Local\Temp\is-DPHF3.tmp\FileMenuTools-setup.tmp

    Filesize

    3.0MB

    MD5

    86da90308357f74768b89a477d8d305d

    SHA1

    c86b0ac52a156ea62ce082963c4f6a00ffe80038

    SHA256

    0921f50ca26960f6a007e5bd40152ed5255cd1d02789f4e31a3bc6a681a133be

    SHA512

    1c1073030f1328f73c62d9eb65c16cd9cd01c977bf070eab322ce6454d04cda27565f415cb6c4e7da4581d8954f1865c5938bf014f1be33a3f8ebe517afb0803

  • C:\Windows\is-GCF5B.exe

    Filesize

    3.0MB

    MD5

    86da90308357f74768b89a477d8d305d

    SHA1

    c86b0ac52a156ea62ce082963c4f6a00ffe80038

    SHA256

    0921f50ca26960f6a007e5bd40152ed5255cd1d02789f4e31a3bc6a681a133be

    SHA512

    1c1073030f1328f73c62d9eb65c16cd9cd01c977bf070eab322ce6454d04cda27565f415cb6c4e7da4581d8954f1865c5938bf014f1be33a3f8ebe517afb0803

  • memory/876-160-0x0000000000400000-0x000000000070C000-memory.dmp

    Filesize

    3.0MB

  • memory/876-155-0x0000000000400000-0x000000000070C000-memory.dmp

    Filesize

    3.0MB

  • memory/876-141-0x0000000000400000-0x000000000070C000-memory.dmp

    Filesize

    3.0MB

  • memory/876-365-0x0000000000400000-0x000000000070C000-memory.dmp

    Filesize

    3.0MB

  • memory/876-368-0x0000000000400000-0x000000000070C000-memory.dmp

    Filesize

    3.0MB

  • memory/876-139-0x0000000000A00000-0x0000000000A01000-memory.dmp

    Filesize

    4KB

  • memory/2772-369-0x0000000000400000-0x00000000004D1000-memory.dmp

    Filesize

    836KB

  • memory/2772-140-0x0000000000400000-0x00000000004D1000-memory.dmp

    Filesize

    836KB

  • memory/2772-133-0x0000000000400000-0x00000000004D1000-memory.dmp

    Filesize

    836KB