0a9e739910578192e2ad3f8f805a863d5cbcacbc38cde6488d7bbef5395dba87

Analysis

max time kernel
65s
max time network
68s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
19-01-2023 17:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

spsetup132.exe
Size

8.6MB
MD5

2e57838af780fba75f9085a67cde99e4
SHA1

8070b4e5c50a4a981f6dcf78ffd424c065182b09
SHA256

0a9e739910578192e2ad3f8f805a863d5cbcacbc38cde6488d7bbef5395dba87
SHA512

84d58581d306c568db4ce572c509f69751932fe9293218f531e4d92951dd7d804756aeca8ede459c0a634e6f140fd9455693955325739657b5699d5d48d0ce63
SSDEEP

196608:FuYr1j0wlfy/tycs/bZ6ctLCyoZcmtZs47ctad+UK7HZDLtHw57I:FuYr5ik/TtLCfXOad+/ZHs7I

Score

8^/10

bootkit discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2420	Speccy64.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Control Panel\International\Geo\Nation	spsetup132.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Control Panel\International\Geo\Nation	Speccy64.exe

Loads dropped DLL 64 IoCs

pid	Process
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Speccy64.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	Speccy64.exe
File opened (read-only)	\??\K:	Speccy64.exe
File opened (read-only)	\??\M:	Speccy64.exe
File opened (read-only)	\??\P:	Speccy64.exe
File opened (read-only)	\??\Q:	Speccy64.exe
File opened (read-only)	\??\T:	Speccy64.exe
File opened (read-only)	\??\U:	Speccy64.exe
File opened (read-only)	\??\G:	Speccy64.exe
File opened (read-only)	\??\V:	Speccy64.exe
File opened (read-only)	\??\J:	Speccy64.exe
File opened (read-only)	\??\L:	Speccy64.exe
File opened (read-only)	\??\O:	Speccy64.exe
File opened (read-only)	\??\W:	Speccy64.exe
File opened (read-only)	\??\Y:	Speccy64.exe
File opened (read-only)	\??\B:	Speccy64.exe
File opened (read-only)	\??\F:	Speccy64.exe
File opened (read-only)	\??\N:	Speccy64.exe
File opened (read-only)	\??\R:	Speccy64.exe
File opened (read-only)	\??\S:	Speccy64.exe
File opened (read-only)	\??\X:	Speccy64.exe
File opened (read-only)	\??\E:	Speccy64.exe
File opened (read-only)	\??\I:	Speccy64.exe
File opened (read-only)	\??\Z:	Speccy64.exe
File opened (read-only)	\??\A:	Speccy64.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	Speccy64.exe
File opened for modification	\??\PhysicalDrive0	Speccy64.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	\??\c:\windows\system32\driverstore\filerepository\keyboard.inf_amd64_82738beb7b514250\keyboard.PNF	Speccy64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_b0ca8be2ac09ed24\msmouse.PNF	Speccy64.exe
File created	\??\c:\windows\system32\driverstore\filerepository\msmouse.inf_amd64_b0ca8be2ac09ed24\msmouse.PNF	Speccy64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_82738beb7b514250\keyboard.PNF	Speccy64.exe

Drops file in Program Files directory 37 IoCs

description	ioc	Process
File created	C:\Program Files\Speccy\Lang\lang-1031.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1051.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1055.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1067.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Speccy.exe	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1037.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1045.dll	spsetup132.exe
File created	C:\Program Files\Speccy\uninst.exe	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-9999.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1058.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1068.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1079.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1102.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-2070.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-2074.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1034.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1053.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1036.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1041.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1050.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-2052.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1052.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1060.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1062.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1066.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Speccy64.exe	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1026.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1035.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1038.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1043.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1049.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-3098.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-5146.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1040.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1046.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1059.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1071.dll	spsetup132.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\setuperr.log	Speccy64.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	spsetup132.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\setupact.log	Speccy64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	Speccy64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	Speccy64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	Speccy64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	Speccy64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc	Speccy64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	Speccy64.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "3751"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Speccy.SPECCY\DefaultIcon\ = "C:\\Program Files\\Speccy\\Speccy64.exe,0"	spsetup132.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\ccleaner.com\Total = "13"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Speccy.SPECCY\ = "Speccy Snapshot"	spsetup132.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Speccy.SPECCY\DefaultIcon	spsetup132.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\ccleaner.com\Total = "3052"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\ccleaner.com\Total = "3771"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\ccleaner.com\Total = "3070"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\SharedCookie_MRACMigrationDone = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "77"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.ccleaner.com\ = "77"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.speccy\ = "Speccy.SPECCY"	spsetup132.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "{AFB3660F-0280-46B5-8290-FDD700504BF8}"	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.speccy	spsetup132.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.ccleaner.com\ = "26"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.ccleaner.com\ = "3396"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Speccy.SPECCY	spsetup132.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\ccleaner.com\Total = "26"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Speccy.SPECCY\shell\open\command	spsetup132.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Speccy.SPECCY\shell\open\command\ = "\"C:\\Program Files\\Speccy\\Speccy64.exe\" \"%1\""	spsetup132.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\ccleaner.com\Total = "3396"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
620	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3500	MicrosoftEdgeCP.exe
3500	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeRestorePrivilege	1728	spsetup132.exe
Token: SeDebugPrivilege	1136	MicrosoftEdge.exe
Token: SeDebugPrivilege	1136	MicrosoftEdge.exe
Token: SeDebugPrivilege	1136	MicrosoftEdge.exe
Token: SeDebugPrivilege	1136	MicrosoftEdge.exe
Token: SeLoadDriverPrivilege	2420	Speccy64.exe
Token: SeShutdownPrivilege	5028	svchost.exe
Token: SeCreatePagefilePrivilege	5028	svchost.exe
Token: SeDebugPrivilege	3332	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3332	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3332	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3332	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2648	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2648	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	2420	Speccy64.exe
Token: SeCreatePagefilePrivilege	2420	Speccy64.exe
Token: SeDebugPrivilege	2420	Speccy64.exe
Token: SeShutdownPrivilege	2420	Speccy64.exe
Token: SeCreatePagefilePrivilege	2420	Speccy64.exe
Token: SeShutdownPrivilege	2420	Speccy64.exe
Token: SeCreatePagefilePrivilege	2420	Speccy64.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2420	Speccy64.exe
2420	Speccy64.exe
2420	Speccy64.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2420	Speccy64.exe
2420	Speccy64.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
1728	spsetup132.exe
1136	MicrosoftEdge.exe
2420	Speccy64.exe
2420	Speccy64.exe
3500	MicrosoftEdgeCP.exe
3500	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2420	1728	spsetup132.exe	74
PID 1728 wrote to memory of 2420	1728	spsetup132.exe	74
PID 2420 wrote to memory of 3008	2420	Speccy64.exe	81
PID 2420 wrote to memory of 3008	2420	Speccy64.exe	81
PID 2420 wrote to memory of 2424	2420	Speccy64.exe	84
PID 2420 wrote to memory of 2424	2420	Speccy64.exe	84
PID 2420 wrote to memory of 2224	2420	Speccy64.exe	88
PID 2420 wrote to memory of 2224	2420	Speccy64.exe	88

C:\Users\Admin\AppData\Local\Temp\spsetup132.exe
"C:\Users\Admin\AppData\Local\Temp\spsetup132.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Program Files\Speccy\Speccy64.exe
  "C:\Program Files\Speccy\Speccy64.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Enumerates connected drives
  - Writes to the Master Boot Record (MBR)
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Program Files\Java\jre1.8.0_66\bin\java.exe
    "C:\Program Files\Java\jre1.8.0_66\bin\java" -version
    3⤵
    PID:3008
- - C:\Program Files\Java\jdk1.8.0_66\bin\java.exe
    "C:\Program Files\Java\jdk1.8.0_66\bin\java" -version
    3⤵
    PID:2424
- - C:\Windows\system32\secedit.exe
    /export /cfg "C:\Users\Admin\AppData\Local\Temp\spc_se.txt" /quiet /areas SECURITYPOLICY
    3⤵
    PID:2224

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1136

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1572

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5028

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:3500

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3332

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4448

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Speccy\Speccy64.exe

Filesize
7.3MB

MD5
d41812a78894d4e47df163db19d354e6

SHA1
580a2d42799843fb213c91d730d850c5db997363

SHA256
5465297f50aa45b3d19c721259f38452b533e4569e85fef7568867303a7bc3ee

SHA512
a5957c9502cf4ba650f204808f37c116aaaec4e26fadff2db3c1e331f73c8cdf76ade248ee8a548196f4083624c2640efd5bdf4f7e85d777973a1bd6fa83f10f

Download Submit
C:\Program Files\Speccy\Speccy64.exe

Filesize
7.3MB

MD5
d41812a78894d4e47df163db19d354e6

SHA1
580a2d42799843fb213c91d730d850c5db997363

SHA256
5465297f50aa45b3d19c721259f38452b533e4569e85fef7568867303a7bc3ee

SHA512
a5957c9502cf4ba650f204808f37c116aaaec4e26fadff2db3c1e331f73c8cdf76ade248ee8a548196f4083624c2640efd5bdf4f7e85d777973a1bd6fa83f10f

Download Submit
C:\Program Files\Speccy\lang\lang-1026.dll

Filesize
78KB

MD5
4679b87ceb52b6a2c4f58fbc4f81b903

SHA1
7c655ecd763cf44ff7217f17c700186e6bf53e1b

SHA256
0eaaf207d8bf0ce106bc357c2e388384cd49d8eb3deda1d471274d141ffc63fd

SHA512
fa4d40a7ac5d41c8f495b263b2f241c55815337b41760383d9e2b3fe317a385d3a3da9b2436c55c3541e8f235450348c3bc101e0ddae4961081d74c1ed647299

Download Submit
C:\Program Files\Speccy\lang\lang-1031.dll

Filesize
78KB

MD5
fbe8a53b36d7ba86bfc7d0c3a1d7659f

SHA1
1ced3b3d2af5250289080f524c41de2ef484eaac

SHA256
2c8095af8905d8b72204bd896e7865b91f6f77c375a5a1c9cffa0e3887ba8577

SHA512
f8de0d37e3ef3972504e6a05c58ce3d3a3ce13e8f55fac7795fde468add2648305f055aa7b6de47fab23e5446a22748da989dbaf1bf189a006fbc70efe0f475d

Download Submit
C:\Program Files\Speccy\lang\lang-1034.dll

Filesize
86KB

MD5
52e6a2417cb6855d34b2c29e8c46a7cf

SHA1
9fe0c63039728334f023b8b08f3d45c3c3b739a2

SHA256
a84dbfab73568b73ee5f94bce0b43cc2487638962d3e500d1fdb1d666ec1e024

SHA512
d1161a7cb8b1e7cda982ca96758c0ef3e2ad039fe1f5b913c704c189bf960a9e02cdeae310512227881d559fa3cee226e5c4616b3279198c38a983102750ad35

Download Submit
C:\Program Files\Speccy\lang\lang-1035.dll

Filesize
83KB

MD5
17aa2f62022349d437c88fa20e4a2614

SHA1
9a42e8eb8fd0cccf90ea090c22221078f85f005f

SHA256
3e85a29e06e9b3249f07f01f5b1d28bc9596d3c5a3e9a1c0f59ab4febede2af0

SHA512
fc2f49fdc448ddad09db040cb549139c971db92f9379fb19fc3b3bc5afeb7aaf236a3ff9e844246515d80bfbf892619129219020bc391fb200d43803242938f0

Download Submit
C:\Program Files\Speccy\lang\lang-1036.dll

Filesize
83KB

MD5
b1284354327ef02b49e544ac793f6133

SHA1
19099eac446b960bd15a2585030355bfc1a661e4

SHA256
854c2e3e288ea5197fc84842107c991d081794ea6a72bcb92a0696f1f64b056c

SHA512
f78930cbb75c1ed46ccafef428d664b4e6f248d3e1cf54604e838216795608df58cb250e6e2360d509e1db0ad342a8a234cec3ae19cd140ff055079bd435d97c

Download Submit
C:\Program Files\Speccy\lang\lang-1037.dll

Filesize
66KB

MD5
ebefa147111fde9b5201b44022c6dfaa

SHA1
c7c0a4010fcd09ac9cceb122e468f7e672c946b5

SHA256
01d24790c1aa19b18a58ad491de497e5d97551e4e69f72c4981d551d8ac28fd2

SHA512
549019de74a55553eb39c5cf68b0de87f382abf7fb857c721a20bd7797e35d424838c4fd11328950b6311a8db0a84b9280c28b539c5c93283cbd526fe2584ef9

Download Submit
C:\Program Files\Speccy\lang\lang-1038.dll

Filesize
81KB

MD5
16e8b36b7d32c9ba1244acc916f61875

SHA1
3e87cedec5899f7d35121b07faa1bb1b00a5bcd4

SHA256
007d6edd16d867fd90ef10ba1e0dbdbc3a1d00f675df8c58a654dd1c3633689d

SHA512
5db00a5ddae227cf7c4b99dbe8ccb3a7a4bff55ed902bd349c343a33668a3b19ec63f322ad9eb7b3a5a62944bfb39f7ac8225b6410b1d1e202f1f7246b9a2e68

Download Submit
C:\Program Files\Speccy\lang\lang-1040.dll

Filesize
81KB

MD5
0bbd0dd2123f0134289e1899beeadcfa

SHA1
c1b0d49f4d5c24b5f0605b3a514fe8b3cb5de02c

SHA256
e3b75bd3ffaa7a165adaf2101bbd0190afc7515194069856edc3397959f3a0a4

SHA512
4c85aedc57025c89d9f7719f96fc7cda02fb4bc57e506ade8cbb03cd77c5bab3ba358b3925cf2fccc9bdc4f8f1b9ae0be5840f91e351ae1b3d62b44a27bfbe87

Download Submit
C:\Program Files\Speccy\lang\lang-1041.dll

Filesize
55KB

MD5
e4ae139f1191415dfa94906870ab28b5

SHA1
83f7f161eef6c09ca8485b5dcba95b898c973b2d

SHA256
4ab959ee29db99f381aa37e4b05fa33cb87a5c31b76e236ab0c29bd9f1d4538d

SHA512
cd002a81a9a139b71bde764820536693bdf1fd763eb23023982a55a754cdde9461b773d3ab590e339f6fd27ac84e17d633f068586e0f9b7e34a5b5887daec6c8

Download Submit
C:\Program Files\Speccy\lang\lang-1043.dll

Filesize
82KB

MD5
ffb6e35bc7a5998ff5d5ba24a869f466

SHA1
d5a642bb6aa88fff2459cda34fbda8b4cd816f23

SHA256
4fd71f7dc6932583940f26c87032fd370999ef92ddaa828d6298984850348701

SHA512
30c3282538c6b599d4d469e5ab7558a24f5f781627d40211b00f1ad88df619ba8d199e000c3ab87d5be40760272aac389ee31a48ff2784e22312519770a49b1a

Download Submit
C:\Program Files\Speccy\lang\lang-1045.dll

Filesize
81KB

MD5
0c56b1b96b3be18b7ec58b1c663a524c

SHA1
64159f43ce937b180b71e331693671631df07168

SHA256
c578d97c07dd5422fdd2a73e66c3555fbf302e25c85dd9a15e9c75120930402b

SHA512
031d6d25416e5a0a9a7a911a850d90e98eea174e1e630e3e7292feb5e5831e131b996b0cd7b72048fbebb90db7922fca1e4401b74d76ee5b849e8ca4421e49bc

Download Submit
C:\Program Files\Speccy\lang\lang-1046.dll

Filesize
78KB

MD5
1ff7950eeeeeac8ae4a0eaea33ee7b42

SHA1
918cb4b578f579f0aeb59aea3d64aa918c43f964

SHA256
e4f747fc2c6d19f38aa0b04852e9ab8152bb4b04468d6115bb76cb5d06b46031

SHA512
f6fb85e66e56320bf93e38abcce29bf6a67a8df7f6a5cb1a9abd9aa794394d302f7bbf7a0249f6c8552517ed9eed960e08c21f73fda883fd52a983c841fd2ff6

Download Submit
C:\Program Files\Speccy\lang\lang-1049.dll

Filesize
77KB

MD5
6fbe3b991761678df3943a4fdacd53b4

SHA1
23121473e2b0356ea46ee4105813c2bb6d4a1d8e

SHA256
1ace20196a9ba651d8267314fdce3686eddb82c47a8f97593a865daa18c2e7bd

SHA512
5b5632a05b50ac6d7159c7bade950c9c11d04d4d2f6e7520a612680bc6d253492da21c5bd561c2d7301fd39715021915b8d91d92146da8f0557c6d2adf4e4795

Download Submit
C:\Program Files\Speccy\lang\lang-1050.dll

Filesize
85KB

MD5
9151b422df85c5332162254567c0c9d0

SHA1
8cb5a1b093bdd7338010d44dd954b4ca0f26f67d

SHA256
d9fb740bb46df481c44356684fe644fc945bc57ff269f8b619419a26b11d3d35

SHA512
8660a05b82de92582cbe46e79f1801c9c0516d9465ac2b6ad3417face79e1b1471fb03c9ce07927e87c03a0ee0f26237c11d3a3e333dfa8a1794718bc5344c47

Download Submit
C:\Program Files\Speccy\lang\lang-1051.dll

Filesize
73KB

MD5
e9e5e0b4e27a260a0a5ae43bda4a1812

SHA1
c814f9172c24a5ce58374999264af02b99b828f7

SHA256
5858f1ad625b3934cb6bdf1c5a14b4368da94c0cb97d0d1b65b6985d23450b59

SHA512
311093dfa8ec36a98b0f308f8cc752797e0f2e40c6b0fb541510dcd61f33ddc135dcd6a7b0dc3982a813d499d9d685c6e5ef80080547f6f756c2db5f22f8eedd

Download Submit
C:\Program Files\Speccy\lang\lang-1052.dll

Filesize
79KB

MD5
c4ed5ea4876722b228d9a189386e2654

SHA1
89dfdc5d45913db12a6b3cc2684ae7ab09c74994

SHA256
68f5a8b4cabf62a0c5eefb02478416240992d08dbb3214765ba341dc4cbd3b0d

SHA512
1a2f07592773b1d55ce9b20b7a67f369cfab29e07cb0ce55ec3b43d8e6dd4d784568b35d24260890c5c368daabfd1d2459bb2030d08a4ce4542af6cac5defdf7

Download Submit
\Program Files\Speccy\Lang\lang-1026.dll

Filesize
78KB

MD5
4679b87ceb52b6a2c4f58fbc4f81b903

SHA1
7c655ecd763cf44ff7217f17c700186e6bf53e1b

SHA256
0eaaf207d8bf0ce106bc357c2e388384cd49d8eb3deda1d471274d141ffc63fd

SHA512
fa4d40a7ac5d41c8f495b263b2f241c55815337b41760383d9e2b3fe317a385d3a3da9b2436c55c3541e8f235450348c3bc101e0ddae4961081d74c1ed647299

Download Submit
\Program Files\Speccy\Lang\lang-1026.dll

Filesize
78KB

MD5
4679b87ceb52b6a2c4f58fbc4f81b903

SHA1
7c655ecd763cf44ff7217f17c700186e6bf53e1b

SHA256
0eaaf207d8bf0ce106bc357c2e388384cd49d8eb3deda1d471274d141ffc63fd

SHA512
fa4d40a7ac5d41c8f495b263b2f241c55815337b41760383d9e2b3fe317a385d3a3da9b2436c55c3541e8f235450348c3bc101e0ddae4961081d74c1ed647299

Download Submit
\Program Files\Speccy\Lang\lang-1031.dll

Filesize
78KB

MD5
fbe8a53b36d7ba86bfc7d0c3a1d7659f

SHA1
1ced3b3d2af5250289080f524c41de2ef484eaac

SHA256
2c8095af8905d8b72204bd896e7865b91f6f77c375a5a1c9cffa0e3887ba8577

SHA512
f8de0d37e3ef3972504e6a05c58ce3d3a3ce13e8f55fac7795fde468add2648305f055aa7b6de47fab23e5446a22748da989dbaf1bf189a006fbc70efe0f475d

Download Submit
\Program Files\Speccy\Lang\lang-1031.dll

Filesize
78KB

MD5
fbe8a53b36d7ba86bfc7d0c3a1d7659f

SHA1
1ced3b3d2af5250289080f524c41de2ef484eaac

SHA256
2c8095af8905d8b72204bd896e7865b91f6f77c375a5a1c9cffa0e3887ba8577

SHA512
f8de0d37e3ef3972504e6a05c58ce3d3a3ce13e8f55fac7795fde468add2648305f055aa7b6de47fab23e5446a22748da989dbaf1bf189a006fbc70efe0f475d

Download Submit
\Program Files\Speccy\Lang\lang-1034.dll

Filesize
86KB

MD5
52e6a2417cb6855d34b2c29e8c46a7cf

SHA1
9fe0c63039728334f023b8b08f3d45c3c3b739a2

SHA256
a84dbfab73568b73ee5f94bce0b43cc2487638962d3e500d1fdb1d666ec1e024

SHA512
d1161a7cb8b1e7cda982ca96758c0ef3e2ad039fe1f5b913c704c189bf960a9e02cdeae310512227881d559fa3cee226e5c4616b3279198c38a983102750ad35

Download Submit
\Program Files\Speccy\Lang\lang-1034.dll

Filesize
86KB

MD5
52e6a2417cb6855d34b2c29e8c46a7cf

SHA1
9fe0c63039728334f023b8b08f3d45c3c3b739a2

SHA256
a84dbfab73568b73ee5f94bce0b43cc2487638962d3e500d1fdb1d666ec1e024

SHA512
d1161a7cb8b1e7cda982ca96758c0ef3e2ad039fe1f5b913c704c189bf960a9e02cdeae310512227881d559fa3cee226e5c4616b3279198c38a983102750ad35

Download Submit
\Program Files\Speccy\Lang\lang-1035.dll

Filesize
83KB

MD5
17aa2f62022349d437c88fa20e4a2614

SHA1
9a42e8eb8fd0cccf90ea090c22221078f85f005f

SHA256
3e85a29e06e9b3249f07f01f5b1d28bc9596d3c5a3e9a1c0f59ab4febede2af0

SHA512
fc2f49fdc448ddad09db040cb549139c971db92f9379fb19fc3b3bc5afeb7aaf236a3ff9e844246515d80bfbf892619129219020bc391fb200d43803242938f0

Download Submit
\Program Files\Speccy\Lang\lang-1035.dll

Filesize
83KB

MD5
17aa2f62022349d437c88fa20e4a2614

SHA1
9a42e8eb8fd0cccf90ea090c22221078f85f005f

SHA256
3e85a29e06e9b3249f07f01f5b1d28bc9596d3c5a3e9a1c0f59ab4febede2af0

SHA512
fc2f49fdc448ddad09db040cb549139c971db92f9379fb19fc3b3bc5afeb7aaf236a3ff9e844246515d80bfbf892619129219020bc391fb200d43803242938f0

Download Submit
\Program Files\Speccy\Lang\lang-1036.dll

Filesize
83KB

MD5
b1284354327ef02b49e544ac793f6133

SHA1
19099eac446b960bd15a2585030355bfc1a661e4

SHA256
854c2e3e288ea5197fc84842107c991d081794ea6a72bcb92a0696f1f64b056c

SHA512
f78930cbb75c1ed46ccafef428d664b4e6f248d3e1cf54604e838216795608df58cb250e6e2360d509e1db0ad342a8a234cec3ae19cd140ff055079bd435d97c

Download Submit
\Program Files\Speccy\Lang\lang-1036.dll

Filesize
83KB

MD5
b1284354327ef02b49e544ac793f6133

SHA1
19099eac446b960bd15a2585030355bfc1a661e4

SHA256
854c2e3e288ea5197fc84842107c991d081794ea6a72bcb92a0696f1f64b056c

SHA512
f78930cbb75c1ed46ccafef428d664b4e6f248d3e1cf54604e838216795608df58cb250e6e2360d509e1db0ad342a8a234cec3ae19cd140ff055079bd435d97c

Download Submit
\Program Files\Speccy\Lang\lang-1037.dll

Filesize
66KB

MD5
ebefa147111fde9b5201b44022c6dfaa

SHA1
c7c0a4010fcd09ac9cceb122e468f7e672c946b5

SHA256
01d24790c1aa19b18a58ad491de497e5d97551e4e69f72c4981d551d8ac28fd2

SHA512
549019de74a55553eb39c5cf68b0de87f382abf7fb857c721a20bd7797e35d424838c4fd11328950b6311a8db0a84b9280c28b539c5c93283cbd526fe2584ef9

Download Submit
\Program Files\Speccy\Lang\lang-1037.dll

Filesize
66KB

MD5
ebefa147111fde9b5201b44022c6dfaa

SHA1
c7c0a4010fcd09ac9cceb122e468f7e672c946b5

SHA256
01d24790c1aa19b18a58ad491de497e5d97551e4e69f72c4981d551d8ac28fd2

SHA512
549019de74a55553eb39c5cf68b0de87f382abf7fb857c721a20bd7797e35d424838c4fd11328950b6311a8db0a84b9280c28b539c5c93283cbd526fe2584ef9

Download Submit
\Program Files\Speccy\Lang\lang-1038.dll

Filesize
81KB

MD5
16e8b36b7d32c9ba1244acc916f61875

SHA1
3e87cedec5899f7d35121b07faa1bb1b00a5bcd4

SHA256
007d6edd16d867fd90ef10ba1e0dbdbc3a1d00f675df8c58a654dd1c3633689d

SHA512
5db00a5ddae227cf7c4b99dbe8ccb3a7a4bff55ed902bd349c343a33668a3b19ec63f322ad9eb7b3a5a62944bfb39f7ac8225b6410b1d1e202f1f7246b9a2e68

Download Submit
\Program Files\Speccy\Lang\lang-1038.dll

Filesize
81KB

MD5
16e8b36b7d32c9ba1244acc916f61875

SHA1
3e87cedec5899f7d35121b07faa1bb1b00a5bcd4

SHA256
007d6edd16d867fd90ef10ba1e0dbdbc3a1d00f675df8c58a654dd1c3633689d

SHA512
5db00a5ddae227cf7c4b99dbe8ccb3a7a4bff55ed902bd349c343a33668a3b19ec63f322ad9eb7b3a5a62944bfb39f7ac8225b6410b1d1e202f1f7246b9a2e68

Download Submit
\Program Files\Speccy\Lang\lang-1040.dll

Filesize
81KB

MD5
0bbd0dd2123f0134289e1899beeadcfa

SHA1
c1b0d49f4d5c24b5f0605b3a514fe8b3cb5de02c

SHA256
e3b75bd3ffaa7a165adaf2101bbd0190afc7515194069856edc3397959f3a0a4

SHA512
4c85aedc57025c89d9f7719f96fc7cda02fb4bc57e506ade8cbb03cd77c5bab3ba358b3925cf2fccc9bdc4f8f1b9ae0be5840f91e351ae1b3d62b44a27bfbe87

Download Submit
\Program Files\Speccy\Lang\lang-1040.dll

Filesize
81KB

MD5
0bbd0dd2123f0134289e1899beeadcfa

SHA1
c1b0d49f4d5c24b5f0605b3a514fe8b3cb5de02c

SHA256
e3b75bd3ffaa7a165adaf2101bbd0190afc7515194069856edc3397959f3a0a4

SHA512
4c85aedc57025c89d9f7719f96fc7cda02fb4bc57e506ade8cbb03cd77c5bab3ba358b3925cf2fccc9bdc4f8f1b9ae0be5840f91e351ae1b3d62b44a27bfbe87

Download Submit
\Program Files\Speccy\Lang\lang-1041.dll

Filesize
55KB

MD5
e4ae139f1191415dfa94906870ab28b5

SHA1
83f7f161eef6c09ca8485b5dcba95b898c973b2d

SHA256
4ab959ee29db99f381aa37e4b05fa33cb87a5c31b76e236ab0c29bd9f1d4538d

SHA512
cd002a81a9a139b71bde764820536693bdf1fd763eb23023982a55a754cdde9461b773d3ab590e339f6fd27ac84e17d633f068586e0f9b7e34a5b5887daec6c8

Download Submit
\Program Files\Speccy\Lang\lang-1041.dll

Filesize
55KB

MD5
e4ae139f1191415dfa94906870ab28b5

SHA1
83f7f161eef6c09ca8485b5dcba95b898c973b2d

SHA256
4ab959ee29db99f381aa37e4b05fa33cb87a5c31b76e236ab0c29bd9f1d4538d

SHA512
cd002a81a9a139b71bde764820536693bdf1fd763eb23023982a55a754cdde9461b773d3ab590e339f6fd27ac84e17d633f068586e0f9b7e34a5b5887daec6c8

Download Submit
\Program Files\Speccy\Lang\lang-1043.dll

Filesize
82KB

MD5
ffb6e35bc7a5998ff5d5ba24a869f466

SHA1
d5a642bb6aa88fff2459cda34fbda8b4cd816f23

SHA256
4fd71f7dc6932583940f26c87032fd370999ef92ddaa828d6298984850348701

SHA512
30c3282538c6b599d4d469e5ab7558a24f5f781627d40211b00f1ad88df619ba8d199e000c3ab87d5be40760272aac389ee31a48ff2784e22312519770a49b1a

Download Submit
\Program Files\Speccy\Lang\lang-1043.dll

Filesize
82KB

MD5
ffb6e35bc7a5998ff5d5ba24a869f466

SHA1
d5a642bb6aa88fff2459cda34fbda8b4cd816f23

SHA256
4fd71f7dc6932583940f26c87032fd370999ef92ddaa828d6298984850348701

SHA512
30c3282538c6b599d4d469e5ab7558a24f5f781627d40211b00f1ad88df619ba8d199e000c3ab87d5be40760272aac389ee31a48ff2784e22312519770a49b1a

Download Submit
\Program Files\Speccy\Lang\lang-1045.dll

Filesize
81KB

MD5
0c56b1b96b3be18b7ec58b1c663a524c

SHA1
64159f43ce937b180b71e331693671631df07168

SHA256
c578d97c07dd5422fdd2a73e66c3555fbf302e25c85dd9a15e9c75120930402b

SHA512
031d6d25416e5a0a9a7a911a850d90e98eea174e1e630e3e7292feb5e5831e131b996b0cd7b72048fbebb90db7922fca1e4401b74d76ee5b849e8ca4421e49bc

Download Submit
\Program Files\Speccy\Lang\lang-1045.dll

Filesize
81KB

MD5
0c56b1b96b3be18b7ec58b1c663a524c

SHA1
64159f43ce937b180b71e331693671631df07168

SHA256
c578d97c07dd5422fdd2a73e66c3555fbf302e25c85dd9a15e9c75120930402b

SHA512
031d6d25416e5a0a9a7a911a850d90e98eea174e1e630e3e7292feb5e5831e131b996b0cd7b72048fbebb90db7922fca1e4401b74d76ee5b849e8ca4421e49bc

Download Submit
\Program Files\Speccy\Lang\lang-1046.dll

Filesize
78KB

MD5
1ff7950eeeeeac8ae4a0eaea33ee7b42

SHA1
918cb4b578f579f0aeb59aea3d64aa918c43f964

SHA256
e4f747fc2c6d19f38aa0b04852e9ab8152bb4b04468d6115bb76cb5d06b46031

SHA512
f6fb85e66e56320bf93e38abcce29bf6a67a8df7f6a5cb1a9abd9aa794394d302f7bbf7a0249f6c8552517ed9eed960e08c21f73fda883fd52a983c841fd2ff6

Download Submit
\Program Files\Speccy\Lang\lang-1046.dll

Filesize
78KB

MD5
1ff7950eeeeeac8ae4a0eaea33ee7b42

SHA1
918cb4b578f579f0aeb59aea3d64aa918c43f964

SHA256
e4f747fc2c6d19f38aa0b04852e9ab8152bb4b04468d6115bb76cb5d06b46031

SHA512
f6fb85e66e56320bf93e38abcce29bf6a67a8df7f6a5cb1a9abd9aa794394d302f7bbf7a0249f6c8552517ed9eed960e08c21f73fda883fd52a983c841fd2ff6

Download Submit
\Program Files\Speccy\Lang\lang-1049.dll

Filesize
77KB

MD5
6fbe3b991761678df3943a4fdacd53b4

SHA1
23121473e2b0356ea46ee4105813c2bb6d4a1d8e

SHA256
1ace20196a9ba651d8267314fdce3686eddb82c47a8f97593a865daa18c2e7bd

SHA512
5b5632a05b50ac6d7159c7bade950c9c11d04d4d2f6e7520a612680bc6d253492da21c5bd561c2d7301fd39715021915b8d91d92146da8f0557c6d2adf4e4795

Download Submit
\Program Files\Speccy\Lang\lang-1049.dll

Filesize
77KB

MD5
6fbe3b991761678df3943a4fdacd53b4

SHA1
23121473e2b0356ea46ee4105813c2bb6d4a1d8e

SHA256
1ace20196a9ba651d8267314fdce3686eddb82c47a8f97593a865daa18c2e7bd

SHA512
5b5632a05b50ac6d7159c7bade950c9c11d04d4d2f6e7520a612680bc6d253492da21c5bd561c2d7301fd39715021915b8d91d92146da8f0557c6d2adf4e4795

Download Submit
\Program Files\Speccy\Lang\lang-1050.dll

Filesize
85KB

MD5
9151b422df85c5332162254567c0c9d0

SHA1
8cb5a1b093bdd7338010d44dd954b4ca0f26f67d

SHA256
d9fb740bb46df481c44356684fe644fc945bc57ff269f8b619419a26b11d3d35

SHA512
8660a05b82de92582cbe46e79f1801c9c0516d9465ac2b6ad3417face79e1b1471fb03c9ce07927e87c03a0ee0f26237c11d3a3e333dfa8a1794718bc5344c47

Download Submit
\Program Files\Speccy\Lang\lang-1050.dll

Filesize
85KB

MD5
9151b422df85c5332162254567c0c9d0

SHA1
8cb5a1b093bdd7338010d44dd954b4ca0f26f67d

SHA256
d9fb740bb46df481c44356684fe644fc945bc57ff269f8b619419a26b11d3d35

SHA512
8660a05b82de92582cbe46e79f1801c9c0516d9465ac2b6ad3417face79e1b1471fb03c9ce07927e87c03a0ee0f26237c11d3a3e333dfa8a1794718bc5344c47

Download Submit
\Program Files\Speccy\Lang\lang-1051.dll

Filesize
73KB

MD5
e9e5e0b4e27a260a0a5ae43bda4a1812

SHA1
c814f9172c24a5ce58374999264af02b99b828f7

SHA256
5858f1ad625b3934cb6bdf1c5a14b4368da94c0cb97d0d1b65b6985d23450b59

SHA512
311093dfa8ec36a98b0f308f8cc752797e0f2e40c6b0fb541510dcd61f33ddc135dcd6a7b0dc3982a813d499d9d685c6e5ef80080547f6f756c2db5f22f8eedd

Download Submit
\Program Files\Speccy\Lang\lang-1051.dll

Filesize
73KB

MD5
e9e5e0b4e27a260a0a5ae43bda4a1812

SHA1
c814f9172c24a5ce58374999264af02b99b828f7

SHA256
5858f1ad625b3934cb6bdf1c5a14b4368da94c0cb97d0d1b65b6985d23450b59

SHA512
311093dfa8ec36a98b0f308f8cc752797e0f2e40c6b0fb541510dcd61f33ddc135dcd6a7b0dc3982a813d499d9d685c6e5ef80080547f6f756c2db5f22f8eedd

Download Submit
\Users\Admin\AppData\Local\Temp\nsy78D0.tmp\ButtonEvent.dll

Filesize
5KB

MD5
c24568a3b0d7c8d7761e684eb77252b5

SHA1
66db7f147cbc2309d8d78fdce54660041acbc60d

SHA256
e2da6d8b73b5954d58baa89a949aacece0527dfb940ca130ac6d3fd992d0909d

SHA512
5d43e4c838fd7f4c6a4ab6cc6d63e0f81d765d9ca33d9278d082c4f75f9416907df10b003e10edc1b5ef39535f722d8dbfab114775ac67da7f9390dcc2b4b443

Download Submit
\Users\Admin\AppData\Local\Temp\nsy78D0.tmp\System.dll

Filesize
11KB

MD5
41a3c964232edd2d7d5edea53e8245cd

SHA1
76d7e1fbf15cc3da4dd63a063d6ab2f0868a2206

SHA256
8b65fec615c7b371c23f8f7f344b12dc5085e40a556f96db318ed757494d62d5

SHA512
fa16bd9d020602e3065afd5c0638bc37775b40eb18bfa33b4ca5babcc3e6f112ae7d43457a6e9685ddbe6e94b954a1dc43d1da7af9ca7464019a3f110af549c1

Download Submit
\Users\Admin\AppData\Local\Temp\nsy78D0.tmp\System.dll

Filesize
11KB

MD5
41a3c964232edd2d7d5edea53e8245cd

SHA1
76d7e1fbf15cc3da4dd63a063d6ab2f0868a2206

SHA256
8b65fec615c7b371c23f8f7f344b12dc5085e40a556f96db318ed757494d62d5

SHA512
fa16bd9d020602e3065afd5c0638bc37775b40eb18bfa33b4ca5babcc3e6f112ae7d43457a6e9685ddbe6e94b954a1dc43d1da7af9ca7464019a3f110af549c1

Download Submit
\Users\Admin\AppData\Local\Temp\nsy78D0.tmp\UserInfo.dll

Filesize
4KB

MD5
c1f778a6d65178d34bde4206161a98e0

SHA1
29719fffef1ab6fe2df47e5ed258a5e3b3a11cfc

SHA256
9caf7a78f750713180cf64d18967a2b803b5580e636e59279dcaaf18ba0daa87

SHA512
9c3cf25cf43f85a5f9c9ed555f12f3626ef9daeeedd4d366ada58748ead1f6e279fea977c76ae8bae1dc49bfd852e899cb137c4a006c13e9fcebf6e5e2926a4d

Download Submit
\Users\Admin\AppData\Local\Temp\nsy78D0.tmp\UserInfo.dll

Filesize
4KB

MD5
c1f778a6d65178d34bde4206161a98e0

SHA1
29719fffef1ab6fe2df47e5ed258a5e3b3a11cfc

SHA256
9caf7a78f750713180cf64d18967a2b803b5580e636e59279dcaaf18ba0daa87

SHA512
9c3cf25cf43f85a5f9c9ed555f12f3626ef9daeeedd4d366ada58748ead1f6e279fea977c76ae8bae1dc49bfd852e899cb137c4a006c13e9fcebf6e5e2926a4d

Download Submit
\Users\Admin\AppData\Local\Temp\nsy78D0.tmp\g\gcapi_dll.dll

Filesize
348KB

MD5
2973af8515effd0a3bfc7a43b03b3fcc

SHA1
4209cded0caac7c5cb07bcb29f1ee0dc5ac211ee

SHA256
d0e4581210a22135ce5deb47d9df4d636a94b3813e0649aab84822c9f08af2a0

SHA512
b6f9653142ec00b2e0a5045f0f2c7ba5dbbda8ef39edf14c80a24ecab3c41f081eb466994aaf0879ac96b201ba5c02d478275710e4d08b3debc739063d177f7e

Download Submit
\Users\Admin\AppData\Local\Temp\nsy78D0.tmp\g\gcapi_dll.dll

Filesize
348KB

MD5
2973af8515effd0a3bfc7a43b03b3fcc

SHA1
4209cded0caac7c5cb07bcb29f1ee0dc5ac211ee

SHA256
d0e4581210a22135ce5deb47d9df4d636a94b3813e0649aab84822c9f08af2a0

SHA512
b6f9653142ec00b2e0a5045f0f2c7ba5dbbda8ef39edf14c80a24ecab3c41f081eb466994aaf0879ac96b201ba5c02d478275710e4d08b3debc739063d177f7e

Download Submit
\Users\Admin\AppData\Local\Temp\nsy78D0.tmp\inetc.dll

Filesize
23KB

MD5
7760daf1b6a7f13f06b25b5a09137ca1

SHA1
cc5a98ea3aa582de5428c819731e1faeccfcf33a

SHA256
5233110ed8e95a4a1042f57d9b2dc72bc253e8cb5282437637a51e4e9fcb9079

SHA512
d038bea292ffa2f2f44c85305350645d504be5c45a9d1b30db6d9708bfac27e2ff1e41a76c844d9231d465f31d502a5313dfded6309326d6dfbe30e51a76fdb5

Download Submit
\Users\Admin\AppData\Local\Temp\nsy78D0.tmp\inetc.dll

Filesize
23KB

MD5
7760daf1b6a7f13f06b25b5a09137ca1

SHA1
cc5a98ea3aa582de5428c819731e1faeccfcf33a

SHA256
5233110ed8e95a4a1042f57d9b2dc72bc253e8cb5282437637a51e4e9fcb9079

SHA512
d038bea292ffa2f2f44c85305350645d504be5c45a9d1b30db6d9708bfac27e2ff1e41a76c844d9231d465f31d502a5313dfded6309326d6dfbe30e51a76fdb5

Download Submit
\Users\Admin\AppData\Local\Temp\nsy78D0.tmp\nsDialogs.dll

Filesize
9KB

MD5
2aba8f16eca82517460013a3de7cbf67

SHA1
3812192fa7b873f426c4b0d0d822b3c9d51aa164

SHA256
60b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d

SHA512
4e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0

Download Submit
\Users\Admin\AppData\Local\Temp\nsy78D0.tmp\nsDialogs.dll

Filesize
9KB

MD5
2aba8f16eca82517460013a3de7cbf67

SHA1
3812192fa7b873f426c4b0d0d822b3c9d51aa164

SHA256
60b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d

SHA512
4e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0

Download Submit
\Users\Admin\AppData\Local\Temp\nsy78D0.tmp\nsDialogs.dll

Filesize
9KB

MD5
2aba8f16eca82517460013a3de7cbf67

SHA1
3812192fa7b873f426c4b0d0d822b3c9d51aa164

SHA256
60b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d

SHA512
4e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0

Download Submit
\Users\Admin\AppData\Local\Temp\nsy78D0.tmp\nsDialogs.dll

Filesize
9KB

MD5
2aba8f16eca82517460013a3de7cbf67

SHA1
3812192fa7b873f426c4b0d0d822b3c9d51aa164

SHA256
60b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d

SHA512
4e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0

Download Submit
\Users\Admin\AppData\Local\Temp\nsy78D0.tmp\nsDialogs.dll

Filesize
9KB

MD5
2aba8f16eca82517460013a3de7cbf67

SHA1
3812192fa7b873f426c4b0d0d822b3c9d51aa164

SHA256
60b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d

SHA512
4e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0

Download Submit
\Users\Admin\AppData\Local\Temp\nsy78D0.tmp\nsDialogs.dll

Filesize
9KB

MD5
2aba8f16eca82517460013a3de7cbf67

SHA1
3812192fa7b873f426c4b0d0d822b3c9d51aa164

SHA256
60b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d

SHA512
4e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0

Download Submit
\Users\Admin\AppData\Local\Temp\nsy78D0.tmp\ui\pfUI.dll

Filesize
13.6MB

MD5
1bfa036321fcb209564549538345a289

SHA1
8ede722a5cc6135847ad5276f30143022fa7bacf

SHA256
547e48f35a1c38362cfa71a3ffe1b81cc8d61eb204157828e2ec58a80f3e4b2e

SHA512
9729cc5ca18dbd58b516169de053d50e0df9288fc2d91cbbbd887573fe006c5f506789f23a09a73dfcf75fa71b9cff88e0f59da550263d877939be8c4f996d92

Download Submit
memory/1728-153-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-143-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-180-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-183-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-184-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-185-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-178-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-179-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-177-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-176-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-175-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-173-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-172-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-169-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-168-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-167-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-117-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-166-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-165-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-164-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-133-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-162-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-163-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-158-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-159-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-161-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-155-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-156-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-154-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-140-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-149-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-151-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-116-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-152-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-150-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-182-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-146-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-148-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-147-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-145-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-144-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-142-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-141-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-139-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-138-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-137-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-136-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-135-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-134-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-132-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-131-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-130-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-129-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-128-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-127-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-126-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-125-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-124-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-123-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-122-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-121-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-120-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-119-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-118-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-423-0x00000000024A0000-0x00000000034A0000-memory.dmp

Filesize
16.0MB

Download
memory/3008-411-0x0000000002AC0000-0x0000000003AC0000-memory.dmp

Filesize
16.0MB

Download