0a9e739910578192e2ad3f8f805a863d5cbcacbc38cde6488d7bbef5395dba87

Analysis

max time kernel
122s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22-02-2023 16:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

spsetup132.exe
Size

8.6MB
MD5

2e57838af780fba75f9085a67cde99e4
SHA1

8070b4e5c50a4a981f6dcf78ffd424c065182b09
SHA256

0a9e739910578192e2ad3f8f805a863d5cbcacbc38cde6488d7bbef5395dba87
SHA512

84d58581d306c568db4ce572c509f69751932fe9293218f531e4d92951dd7d804756aeca8ede459c0a634e6f140fd9455693955325739657b5699d5d48d0ce63
SSDEEP

196608:FuYr1j0wlfy/tycs/bZ6ctLCyoZcmtZs47ctad+UK7HZDLtHw57I:FuYr5ik/TtLCfXOad+/ZHs7I

Score

7^/10

bootkit discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	spsetup132.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Speccy64.exe

Executes dropped EXE 1 IoCs

pid	Process
3160	Speccy64.exe

Loads dropped DLL 64 IoCs

pid	Process
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Speccy64.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	Speccy64.exe
File opened (read-only)	\??\R:	Speccy64.exe
File opened (read-only)	\??\T:	Speccy64.exe
File opened (read-only)	\??\W:	Speccy64.exe
File opened (read-only)	\??\Y:	Speccy64.exe
File opened (read-only)	\??\U:	Speccy64.exe
File opened (read-only)	\??\F:	Speccy64.exe
File opened (read-only)	\??\J:	Speccy64.exe
File opened (read-only)	\??\K:	Speccy64.exe
File opened (read-only)	\??\L:	Speccy64.exe
File opened (read-only)	\??\M:	Speccy64.exe
File opened (read-only)	\??\X:	Speccy64.exe
File opened (read-only)	\??\Z:	Speccy64.exe
File opened (read-only)	\??\H:	Speccy64.exe
File opened (read-only)	\??\I:	Speccy64.exe
File opened (read-only)	\??\Q:	Speccy64.exe
File opened (read-only)	\??\S:	Speccy64.exe
File opened (read-only)	\??\V:	Speccy64.exe
File opened (read-only)	\??\P:	Speccy64.exe
File opened (read-only)	\??\B:	Speccy64.exe
File opened (read-only)	\??\E:	Speccy64.exe
File opened (read-only)	\??\G:	Speccy64.exe
File opened (read-only)	\??\N:	Speccy64.exe
File opened (read-only)	\??\O:	Speccy64.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	Speccy64.exe
File opened for modification	\??\PhysicalDrive0	Speccy64.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	\??\c:\windows\system32\driverstore\filerepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF	Speccy64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	Speccy64.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	Speccy64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF	Speccy64.exe
File created	\??\c:\windows\system32\driverstore\filerepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF	Speccy64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF	Speccy64.exe

Drops file in Program Files directory 39 IoCs

description	ioc	Process
File created	C:\Program Files\Speccy\Lang\lang-1071.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-2052.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-9999.dll	spsetup132.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230222170818.pma	setup.exe
File created	C:\Program Files\Speccy\Speccy.exe	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1055.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1036.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1038.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1040.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1050.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1053.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1062.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1049.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1066.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1067.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-2070.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-5146.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1026.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1031.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1037.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1102.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-2074.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1043.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1045.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1059.dll	spsetup132.exe
File created	C:\Program Files\Speccy\uninst.exe	spsetup132.exe
File created	C:\Program Files\Speccy\Speccy64.exe	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1046.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1060.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1079.dll	spsetup132.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\7e4f8484-11b8-43f4-b78b-ba4b67877682.tmp	setup.exe
File created	C:\Program Files\Speccy\Lang\lang-3098.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1034.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1035.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1041.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1051.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1052.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1058.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1068.dll	spsetup132.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc	Speccy64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	Speccy64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	Speccy64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	Speccy64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	Speccy64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	Speccy64.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.speccy\ = "Speccy.SPECCY"	spsetup132.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Speccy.SPECCY\shell	spsetup132.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Speccy.SPECCY\DefaultIcon\ = "C:\\Program Files\\Speccy\\Speccy64.exe,0"	spsetup132.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Speccy.SPECCY\shell\open\command	spsetup132.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.speccy	spsetup132.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Speccy.SPECCY	spsetup132.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Speccy.SPECCY\ = "Speccy Snapshot"	spsetup132.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Speccy.SPECCY\shell\ = "open"	spsetup132.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Speccy.SPECCY\DefaultIcon	spsetup132.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Speccy.SPECCY\shell\open	spsetup132.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Speccy.SPECCY\shell\open\command\ = "\"C:\\Program Files\\Speccy\\Speccy64.exe\" \"%1\""	spsetup132.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe
3160	Speccy64.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeRestorePrivilege	4648	spsetup132.exe
Token: SeLoadDriverPrivilege	3160	Speccy64.exe
Token: SeShutdownPrivilege	3160	Speccy64.exe
Token: SeCreatePagefilePrivilege	3160	Speccy64.exe
Token: SeDebugPrivilege	3160	Speccy64.exe
Token: SeShutdownPrivilege	3160	Speccy64.exe
Token: SeCreatePagefilePrivilege	3160	Speccy64.exe
Token: SeShutdownPrivilege	3160	Speccy64.exe
Token: SeCreatePagefilePrivilege	3160	Speccy64.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3160	Speccy64.exe
3160	Speccy64.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
3160	Speccy64.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3160	Speccy64.exe
3160	Speccy64.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
4648	spsetup132.exe
3160	Speccy64.exe
3160	Speccy64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4172	4648	spsetup132.exe	85
PID 4648 wrote to memory of 4172	4648	spsetup132.exe	85
PID 4172 wrote to memory of 2188	4172	msedge.exe	86
PID 4172 wrote to memory of 2188	4172	msedge.exe	86
PID 4648 wrote to memory of 3160	4648	spsetup132.exe	87
PID 4648 wrote to memory of 3160	4648	spsetup132.exe	87
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 3412	4172	msedge.exe	90
PID 4172 wrote to memory of 4380	4172	msedge.exe	91
PID 4172 wrote to memory of 4380	4172	msedge.exe	91
PID 4172 wrote to memory of 1016	4172	msedge.exe	92
PID 4172 wrote to memory of 1016	4172	msedge.exe	92
PID 4172 wrote to memory of 1016	4172	msedge.exe	92
PID 4172 wrote to memory of 1016	4172	msedge.exe	92
PID 4172 wrote to memory of 1016	4172	msedge.exe	92
PID 4172 wrote to memory of 1016	4172	msedge.exe	92
PID 4172 wrote to memory of 1016	4172	msedge.exe	92
PID 4172 wrote to memory of 1016	4172	msedge.exe	92
PID 4172 wrote to memory of 1016	4172	msedge.exe	92
PID 4172 wrote to memory of 1016	4172	msedge.exe	92
PID 4172 wrote to memory of 1016	4172	msedge.exe	92
PID 4172 wrote to memory of 1016	4172	msedge.exe	92
PID 4172 wrote to memory of 1016	4172	msedge.exe	92
PID 4172 wrote to memory of 1016	4172	msedge.exe	92
PID 4172 wrote to memory of 1016	4172	msedge.exe	92
PID 4172 wrote to memory of 1016	4172	msedge.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\spsetup132.exe
"C:\Users\Admin\AppData\Local\Temp\spsetup132.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.ccleaner.com/go/app_releasenotes?p=4&v=1.32.803&l=1033&b=1&a=0
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd8,0x104,0x7ffac9dd46f8,0x7ffac9dd4708,0x7ffac9dd4718
    3⤵
    PID:2188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,6475475624493737582,3784930146556033053,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
    3⤵
    PID:3412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,6475475624493737582,3784930146556033053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
    3⤵
    PID:4380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,6475475624493737582,3784930146556033053,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
    3⤵
    PID:1016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6475475624493737582,3784930146556033053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:2444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6475475624493737582,3784930146556033053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:2728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6475475624493737582,3784930146556033053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2052 /prefetch:1
    3⤵
    PID:1640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6475475624493737582,3784930146556033053,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4344 /prefetch:1
    3⤵
    PID:4144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6475475624493737582,3784930146556033053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
    3⤵
    PID:3496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6475475624493737582,3784930146556033053,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
    3⤵
    PID:4492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6475475624493737582,3784930146556033053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
    3⤵
    PID:1820
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,6475475624493737582,3784930146556033053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4268 /prefetch:8
    3⤵
    PID:1076
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:1608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x128,0x22c,0x7ff6ba9d5460,0x7ff6ba9d5470,0x7ff6ba9d5480
      4⤵
      PID:2724
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,6475475624493737582,3784930146556033053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4268 /prefetch:8
    3⤵
    PID:4128
- C:\Program Files\Speccy\Speccy64.exe
  "C:\Program Files\Speccy\Speccy64.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Enumerates connected drives
  - Writes to the Master Boot Record (MBR)
  - Drops file in System32 directory
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3160
- - C:\Program Files\Java\jre1.8.0_66\bin\java.exe
    "C:\Program Files\Java\jre1.8.0_66\bin\java" -version
    3⤵
    PID:1724
- - C:\Program Files\Java\jdk1.8.0_66\bin\java.exe
    "C:\Program Files\Java\jdk1.8.0_66\bin\java" -version
    3⤵
    PID:4604
- - C:\Windows\system32\secedit.exe
    /export /cfg "C:\Users\Admin\AppData\Local\Temp\spc_se.txt" /quiet /areas SECURITYPOLICY
    3⤵
    PID:1664

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1068

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Speccy\Lang\lang-1026.dll

Filesize
78KB

MD5
4679b87ceb52b6a2c4f58fbc4f81b903

SHA1
7c655ecd763cf44ff7217f17c700186e6bf53e1b

SHA256
0eaaf207d8bf0ce106bc357c2e388384cd49d8eb3deda1d471274d141ffc63fd

SHA512
fa4d40a7ac5d41c8f495b263b2f241c55815337b41760383d9e2b3fe317a385d3a3da9b2436c55c3541e8f235450348c3bc101e0ddae4961081d74c1ed647299

Download Submit
C:\Program Files\Speccy\Lang\lang-1026.dll

Filesize
78KB

MD5
4679b87ceb52b6a2c4f58fbc4f81b903

SHA1
7c655ecd763cf44ff7217f17c700186e6bf53e1b

SHA256
0eaaf207d8bf0ce106bc357c2e388384cd49d8eb3deda1d471274d141ffc63fd

SHA512
fa4d40a7ac5d41c8f495b263b2f241c55815337b41760383d9e2b3fe317a385d3a3da9b2436c55c3541e8f235450348c3bc101e0ddae4961081d74c1ed647299

Download Submit
C:\Program Files\Speccy\Lang\lang-1031.dll

Filesize
78KB

MD5
fbe8a53b36d7ba86bfc7d0c3a1d7659f

SHA1
1ced3b3d2af5250289080f524c41de2ef484eaac

SHA256
2c8095af8905d8b72204bd896e7865b91f6f77c375a5a1c9cffa0e3887ba8577

SHA512
f8de0d37e3ef3972504e6a05c58ce3d3a3ce13e8f55fac7795fde468add2648305f055aa7b6de47fab23e5446a22748da989dbaf1bf189a006fbc70efe0f475d

Download Submit
C:\Program Files\Speccy\Lang\lang-1031.dll

Filesize
78KB

MD5
fbe8a53b36d7ba86bfc7d0c3a1d7659f

SHA1
1ced3b3d2af5250289080f524c41de2ef484eaac

SHA256
2c8095af8905d8b72204bd896e7865b91f6f77c375a5a1c9cffa0e3887ba8577

SHA512
f8de0d37e3ef3972504e6a05c58ce3d3a3ce13e8f55fac7795fde468add2648305f055aa7b6de47fab23e5446a22748da989dbaf1bf189a006fbc70efe0f475d

Download Submit
C:\Program Files\Speccy\Lang\lang-1034.dll

Filesize
86KB

MD5
52e6a2417cb6855d34b2c29e8c46a7cf

SHA1
9fe0c63039728334f023b8b08f3d45c3c3b739a2

SHA256
a84dbfab73568b73ee5f94bce0b43cc2487638962d3e500d1fdb1d666ec1e024

SHA512
d1161a7cb8b1e7cda982ca96758c0ef3e2ad039fe1f5b913c704c189bf960a9e02cdeae310512227881d559fa3cee226e5c4616b3279198c38a983102750ad35

Download Submit
C:\Program Files\Speccy\Lang\lang-1034.dll

Filesize
86KB

MD5
52e6a2417cb6855d34b2c29e8c46a7cf

SHA1
9fe0c63039728334f023b8b08f3d45c3c3b739a2

SHA256
a84dbfab73568b73ee5f94bce0b43cc2487638962d3e500d1fdb1d666ec1e024

SHA512
d1161a7cb8b1e7cda982ca96758c0ef3e2ad039fe1f5b913c704c189bf960a9e02cdeae310512227881d559fa3cee226e5c4616b3279198c38a983102750ad35

Download Submit
C:\Program Files\Speccy\Lang\lang-1035.dll

Filesize
83KB

MD5
17aa2f62022349d437c88fa20e4a2614

SHA1
9a42e8eb8fd0cccf90ea090c22221078f85f005f

SHA256
3e85a29e06e9b3249f07f01f5b1d28bc9596d3c5a3e9a1c0f59ab4febede2af0

SHA512
fc2f49fdc448ddad09db040cb549139c971db92f9379fb19fc3b3bc5afeb7aaf236a3ff9e844246515d80bfbf892619129219020bc391fb200d43803242938f0

Download Submit
C:\Program Files\Speccy\Lang\lang-1035.dll

Filesize
83KB

MD5
17aa2f62022349d437c88fa20e4a2614

SHA1
9a42e8eb8fd0cccf90ea090c22221078f85f005f

SHA256
3e85a29e06e9b3249f07f01f5b1d28bc9596d3c5a3e9a1c0f59ab4febede2af0

SHA512
fc2f49fdc448ddad09db040cb549139c971db92f9379fb19fc3b3bc5afeb7aaf236a3ff9e844246515d80bfbf892619129219020bc391fb200d43803242938f0

Download Submit
C:\Program Files\Speccy\Lang\lang-1036.dll

Filesize
83KB

MD5
b1284354327ef02b49e544ac793f6133

SHA1
19099eac446b960bd15a2585030355bfc1a661e4

SHA256
854c2e3e288ea5197fc84842107c991d081794ea6a72bcb92a0696f1f64b056c

SHA512
f78930cbb75c1ed46ccafef428d664b4e6f248d3e1cf54604e838216795608df58cb250e6e2360d509e1db0ad342a8a234cec3ae19cd140ff055079bd435d97c

Download Submit
C:\Program Files\Speccy\Lang\lang-1036.dll

Filesize
83KB

MD5
b1284354327ef02b49e544ac793f6133

SHA1
19099eac446b960bd15a2585030355bfc1a661e4

SHA256
854c2e3e288ea5197fc84842107c991d081794ea6a72bcb92a0696f1f64b056c

SHA512
f78930cbb75c1ed46ccafef428d664b4e6f248d3e1cf54604e838216795608df58cb250e6e2360d509e1db0ad342a8a234cec3ae19cd140ff055079bd435d97c

Download Submit
C:\Program Files\Speccy\Lang\lang-1037.dll

Filesize
66KB

MD5
ebefa147111fde9b5201b44022c6dfaa

SHA1
c7c0a4010fcd09ac9cceb122e468f7e672c946b5

SHA256
01d24790c1aa19b18a58ad491de497e5d97551e4e69f72c4981d551d8ac28fd2

SHA512
549019de74a55553eb39c5cf68b0de87f382abf7fb857c721a20bd7797e35d424838c4fd11328950b6311a8db0a84b9280c28b539c5c93283cbd526fe2584ef9

Download Submit
C:\Program Files\Speccy\Lang\lang-1037.dll

Filesize
66KB

MD5
ebefa147111fde9b5201b44022c6dfaa

SHA1
c7c0a4010fcd09ac9cceb122e468f7e672c946b5

SHA256
01d24790c1aa19b18a58ad491de497e5d97551e4e69f72c4981d551d8ac28fd2

SHA512
549019de74a55553eb39c5cf68b0de87f382abf7fb857c721a20bd7797e35d424838c4fd11328950b6311a8db0a84b9280c28b539c5c93283cbd526fe2584ef9

Download Submit
C:\Program Files\Speccy\Lang\lang-1038.dll

Filesize
81KB

MD5
16e8b36b7d32c9ba1244acc916f61875

SHA1
3e87cedec5899f7d35121b07faa1bb1b00a5bcd4

SHA256
007d6edd16d867fd90ef10ba1e0dbdbc3a1d00f675df8c58a654dd1c3633689d

SHA512
5db00a5ddae227cf7c4b99dbe8ccb3a7a4bff55ed902bd349c343a33668a3b19ec63f322ad9eb7b3a5a62944bfb39f7ac8225b6410b1d1e202f1f7246b9a2e68

Download Submit
C:\Program Files\Speccy\Lang\lang-1038.dll

Filesize
81KB

MD5
16e8b36b7d32c9ba1244acc916f61875

SHA1
3e87cedec5899f7d35121b07faa1bb1b00a5bcd4

SHA256
007d6edd16d867fd90ef10ba1e0dbdbc3a1d00f675df8c58a654dd1c3633689d

SHA512
5db00a5ddae227cf7c4b99dbe8ccb3a7a4bff55ed902bd349c343a33668a3b19ec63f322ad9eb7b3a5a62944bfb39f7ac8225b6410b1d1e202f1f7246b9a2e68

Download Submit
C:\Program Files\Speccy\Lang\lang-1040.dll

Filesize
81KB

MD5
0bbd0dd2123f0134289e1899beeadcfa

SHA1
c1b0d49f4d5c24b5f0605b3a514fe8b3cb5de02c

SHA256
e3b75bd3ffaa7a165adaf2101bbd0190afc7515194069856edc3397959f3a0a4

SHA512
4c85aedc57025c89d9f7719f96fc7cda02fb4bc57e506ade8cbb03cd77c5bab3ba358b3925cf2fccc9bdc4f8f1b9ae0be5840f91e351ae1b3d62b44a27bfbe87

Download Submit
C:\Program Files\Speccy\Lang\lang-1040.dll

Filesize
81KB

MD5
0bbd0dd2123f0134289e1899beeadcfa

SHA1
c1b0d49f4d5c24b5f0605b3a514fe8b3cb5de02c

SHA256
e3b75bd3ffaa7a165adaf2101bbd0190afc7515194069856edc3397959f3a0a4

SHA512
4c85aedc57025c89d9f7719f96fc7cda02fb4bc57e506ade8cbb03cd77c5bab3ba358b3925cf2fccc9bdc4f8f1b9ae0be5840f91e351ae1b3d62b44a27bfbe87

Download Submit
C:\Program Files\Speccy\Lang\lang-1041.dll

Filesize
55KB

MD5
e4ae139f1191415dfa94906870ab28b5

SHA1
83f7f161eef6c09ca8485b5dcba95b898c973b2d

SHA256
4ab959ee29db99f381aa37e4b05fa33cb87a5c31b76e236ab0c29bd9f1d4538d

SHA512
cd002a81a9a139b71bde764820536693bdf1fd763eb23023982a55a754cdde9461b773d3ab590e339f6fd27ac84e17d633f068586e0f9b7e34a5b5887daec6c8

Download Submit
C:\Program Files\Speccy\Lang\lang-1041.dll

Filesize
55KB

MD5
e4ae139f1191415dfa94906870ab28b5

SHA1
83f7f161eef6c09ca8485b5dcba95b898c973b2d

SHA256
4ab959ee29db99f381aa37e4b05fa33cb87a5c31b76e236ab0c29bd9f1d4538d

SHA512
cd002a81a9a139b71bde764820536693bdf1fd763eb23023982a55a754cdde9461b773d3ab590e339f6fd27ac84e17d633f068586e0f9b7e34a5b5887daec6c8

Download Submit
C:\Program Files\Speccy\Lang\lang-1043.dll

Filesize
82KB

MD5
ffb6e35bc7a5998ff5d5ba24a869f466

SHA1
d5a642bb6aa88fff2459cda34fbda8b4cd816f23

SHA256
4fd71f7dc6932583940f26c87032fd370999ef92ddaa828d6298984850348701

SHA512
30c3282538c6b599d4d469e5ab7558a24f5f781627d40211b00f1ad88df619ba8d199e000c3ab87d5be40760272aac389ee31a48ff2784e22312519770a49b1a

Download Submit
C:\Program Files\Speccy\Lang\lang-1043.dll

Filesize
82KB

MD5
ffb6e35bc7a5998ff5d5ba24a869f466

SHA1
d5a642bb6aa88fff2459cda34fbda8b4cd816f23

SHA256
4fd71f7dc6932583940f26c87032fd370999ef92ddaa828d6298984850348701

SHA512
30c3282538c6b599d4d469e5ab7558a24f5f781627d40211b00f1ad88df619ba8d199e000c3ab87d5be40760272aac389ee31a48ff2784e22312519770a49b1a

Download Submit
C:\Program Files\Speccy\Lang\lang-1045.dll

Filesize
81KB

MD5
0c56b1b96b3be18b7ec58b1c663a524c

SHA1
64159f43ce937b180b71e331693671631df07168

SHA256
c578d97c07dd5422fdd2a73e66c3555fbf302e25c85dd9a15e9c75120930402b

SHA512
031d6d25416e5a0a9a7a911a850d90e98eea174e1e630e3e7292feb5e5831e131b996b0cd7b72048fbebb90db7922fca1e4401b74d76ee5b849e8ca4421e49bc

Download Submit
C:\Program Files\Speccy\Lang\lang-1045.dll

Filesize
81KB

MD5
0c56b1b96b3be18b7ec58b1c663a524c

SHA1
64159f43ce937b180b71e331693671631df07168

SHA256
c578d97c07dd5422fdd2a73e66c3555fbf302e25c85dd9a15e9c75120930402b

SHA512
031d6d25416e5a0a9a7a911a850d90e98eea174e1e630e3e7292feb5e5831e131b996b0cd7b72048fbebb90db7922fca1e4401b74d76ee5b849e8ca4421e49bc

Download Submit
C:\Program Files\Speccy\Lang\lang-1046.dll

Filesize
78KB

MD5
1ff7950eeeeeac8ae4a0eaea33ee7b42

SHA1
918cb4b578f579f0aeb59aea3d64aa918c43f964

SHA256
e4f747fc2c6d19f38aa0b04852e9ab8152bb4b04468d6115bb76cb5d06b46031

SHA512
f6fb85e66e56320bf93e38abcce29bf6a67a8df7f6a5cb1a9abd9aa794394d302f7bbf7a0249f6c8552517ed9eed960e08c21f73fda883fd52a983c841fd2ff6

Download Submit
C:\Program Files\Speccy\Lang\lang-1046.dll

Filesize
78KB

MD5
1ff7950eeeeeac8ae4a0eaea33ee7b42

SHA1
918cb4b578f579f0aeb59aea3d64aa918c43f964

SHA256
e4f747fc2c6d19f38aa0b04852e9ab8152bb4b04468d6115bb76cb5d06b46031

SHA512
f6fb85e66e56320bf93e38abcce29bf6a67a8df7f6a5cb1a9abd9aa794394d302f7bbf7a0249f6c8552517ed9eed960e08c21f73fda883fd52a983c841fd2ff6

Download Submit
C:\Program Files\Speccy\Lang\lang-1049.dll

Filesize
77KB

MD5
6fbe3b991761678df3943a4fdacd53b4

SHA1
23121473e2b0356ea46ee4105813c2bb6d4a1d8e

SHA256
1ace20196a9ba651d8267314fdce3686eddb82c47a8f97593a865daa18c2e7bd

SHA512
5b5632a05b50ac6d7159c7bade950c9c11d04d4d2f6e7520a612680bc6d253492da21c5bd561c2d7301fd39715021915b8d91d92146da8f0557c6d2adf4e4795

Download Submit
C:\Program Files\Speccy\Lang\lang-1049.dll

Filesize
77KB

MD5
6fbe3b991761678df3943a4fdacd53b4

SHA1
23121473e2b0356ea46ee4105813c2bb6d4a1d8e

SHA256
1ace20196a9ba651d8267314fdce3686eddb82c47a8f97593a865daa18c2e7bd

SHA512
5b5632a05b50ac6d7159c7bade950c9c11d04d4d2f6e7520a612680bc6d253492da21c5bd561c2d7301fd39715021915b8d91d92146da8f0557c6d2adf4e4795

Download Submit
C:\Program Files\Speccy\Lang\lang-1050.dll

Filesize
85KB

MD5
9151b422df85c5332162254567c0c9d0

SHA1
8cb5a1b093bdd7338010d44dd954b4ca0f26f67d

SHA256
d9fb740bb46df481c44356684fe644fc945bc57ff269f8b619419a26b11d3d35

SHA512
8660a05b82de92582cbe46e79f1801c9c0516d9465ac2b6ad3417face79e1b1471fb03c9ce07927e87c03a0ee0f26237c11d3a3e333dfa8a1794718bc5344c47

Download Submit
C:\Program Files\Speccy\Lang\lang-1050.dll

Filesize
85KB

MD5
9151b422df85c5332162254567c0c9d0

SHA1
8cb5a1b093bdd7338010d44dd954b4ca0f26f67d

SHA256
d9fb740bb46df481c44356684fe644fc945bc57ff269f8b619419a26b11d3d35

SHA512
8660a05b82de92582cbe46e79f1801c9c0516d9465ac2b6ad3417face79e1b1471fb03c9ce07927e87c03a0ee0f26237c11d3a3e333dfa8a1794718bc5344c47

Download Submit
C:\Program Files\Speccy\Lang\lang-1051.dll

Filesize
73KB

MD5
e9e5e0b4e27a260a0a5ae43bda4a1812

SHA1
c814f9172c24a5ce58374999264af02b99b828f7

SHA256
5858f1ad625b3934cb6bdf1c5a14b4368da94c0cb97d0d1b65b6985d23450b59

SHA512
311093dfa8ec36a98b0f308f8cc752797e0f2e40c6b0fb541510dcd61f33ddc135dcd6a7b0dc3982a813d499d9d685c6e5ef80080547f6f756c2db5f22f8eedd

Download Submit
C:\Program Files\Speccy\Lang\lang-1051.dll

Filesize
73KB

MD5
e9e5e0b4e27a260a0a5ae43bda4a1812

SHA1
c814f9172c24a5ce58374999264af02b99b828f7

SHA256
5858f1ad625b3934cb6bdf1c5a14b4368da94c0cb97d0d1b65b6985d23450b59

SHA512
311093dfa8ec36a98b0f308f8cc752797e0f2e40c6b0fb541510dcd61f33ddc135dcd6a7b0dc3982a813d499d9d685c6e5ef80080547f6f756c2db5f22f8eedd

Download Submit
C:\Program Files\Speccy\Speccy64.exe

Filesize
7.3MB

MD5
d41812a78894d4e47df163db19d354e6

SHA1
580a2d42799843fb213c91d730d850c5db997363

SHA256
5465297f50aa45b3d19c721259f38452b533e4569e85fef7568867303a7bc3ee

SHA512
a5957c9502cf4ba650f204808f37c116aaaec4e26fadff2db3c1e331f73c8cdf76ade248ee8a548196f4083624c2640efd5bdf4f7e85d777973a1bd6fa83f10f

Download Submit
C:\Program Files\Speccy\Speccy64.exe

Filesize
7.3MB

MD5
d41812a78894d4e47df163db19d354e6

SHA1
580a2d42799843fb213c91d730d850c5db997363

SHA256
5465297f50aa45b3d19c721259f38452b533e4569e85fef7568867303a7bc3ee

SHA512
a5957c9502cf4ba650f204808f37c116aaaec4e26fadff2db3c1e331f73c8cdf76ade248ee8a548196f4083624c2640efd5bdf4f7e85d777973a1bd6fa83f10f

Download Submit
C:\Program Files\Speccy\Speccy64.exe

Filesize
7.3MB

MD5
d41812a78894d4e47df163db19d354e6

SHA1
580a2d42799843fb213c91d730d850c5db997363

SHA256
5465297f50aa45b3d19c721259f38452b533e4569e85fef7568867303a7bc3ee

SHA512
a5957c9502cf4ba650f204808f37c116aaaec4e26fadff2db3c1e331f73c8cdf76ade248ee8a548196f4083624c2640efd5bdf4f7e85d777973a1bd6fa83f10f

Download Submit
C:\Program Files\Speccy\lang\lang-1026.dll

Filesize
78KB

MD5
4679b87ceb52b6a2c4f58fbc4f81b903

SHA1
7c655ecd763cf44ff7217f17c700186e6bf53e1b

SHA256
0eaaf207d8bf0ce106bc357c2e388384cd49d8eb3deda1d471274d141ffc63fd

SHA512
fa4d40a7ac5d41c8f495b263b2f241c55815337b41760383d9e2b3fe317a385d3a3da9b2436c55c3541e8f235450348c3bc101e0ddae4961081d74c1ed647299

Download Submit
C:\Program Files\Speccy\lang\lang-1031.dll

Filesize
78KB

MD5
fbe8a53b36d7ba86bfc7d0c3a1d7659f

SHA1
1ced3b3d2af5250289080f524c41de2ef484eaac

SHA256
2c8095af8905d8b72204bd896e7865b91f6f77c375a5a1c9cffa0e3887ba8577

SHA512
f8de0d37e3ef3972504e6a05c58ce3d3a3ce13e8f55fac7795fde468add2648305f055aa7b6de47fab23e5446a22748da989dbaf1bf189a006fbc70efe0f475d

Download Submit
C:\Program Files\Speccy\lang\lang-1034.dll

Filesize
86KB

MD5
52e6a2417cb6855d34b2c29e8c46a7cf

SHA1
9fe0c63039728334f023b8b08f3d45c3c3b739a2

SHA256
a84dbfab73568b73ee5f94bce0b43cc2487638962d3e500d1fdb1d666ec1e024

SHA512
d1161a7cb8b1e7cda982ca96758c0ef3e2ad039fe1f5b913c704c189bf960a9e02cdeae310512227881d559fa3cee226e5c4616b3279198c38a983102750ad35

Download Submit
C:\Program Files\Speccy\lang\lang-1035.dll

Filesize
83KB

MD5
17aa2f62022349d437c88fa20e4a2614

SHA1
9a42e8eb8fd0cccf90ea090c22221078f85f005f

SHA256
3e85a29e06e9b3249f07f01f5b1d28bc9596d3c5a3e9a1c0f59ab4febede2af0

SHA512
fc2f49fdc448ddad09db040cb549139c971db92f9379fb19fc3b3bc5afeb7aaf236a3ff9e844246515d80bfbf892619129219020bc391fb200d43803242938f0

Download Submit
C:\Program Files\Speccy\lang\lang-1036.dll

Filesize
83KB

MD5
b1284354327ef02b49e544ac793f6133

SHA1
19099eac446b960bd15a2585030355bfc1a661e4

SHA256
854c2e3e288ea5197fc84842107c991d081794ea6a72bcb92a0696f1f64b056c

SHA512
f78930cbb75c1ed46ccafef428d664b4e6f248d3e1cf54604e838216795608df58cb250e6e2360d509e1db0ad342a8a234cec3ae19cd140ff055079bd435d97c

Download Submit
C:\Program Files\Speccy\lang\lang-1037.dll

Filesize
66KB

MD5
ebefa147111fde9b5201b44022c6dfaa

SHA1
c7c0a4010fcd09ac9cceb122e468f7e672c946b5

SHA256
01d24790c1aa19b18a58ad491de497e5d97551e4e69f72c4981d551d8ac28fd2

SHA512
549019de74a55553eb39c5cf68b0de87f382abf7fb857c721a20bd7797e35d424838c4fd11328950b6311a8db0a84b9280c28b539c5c93283cbd526fe2584ef9

Download Submit
C:\Program Files\Speccy\lang\lang-1038.dll

Filesize
81KB

MD5
16e8b36b7d32c9ba1244acc916f61875

SHA1
3e87cedec5899f7d35121b07faa1bb1b00a5bcd4

SHA256
007d6edd16d867fd90ef10ba1e0dbdbc3a1d00f675df8c58a654dd1c3633689d

SHA512
5db00a5ddae227cf7c4b99dbe8ccb3a7a4bff55ed902bd349c343a33668a3b19ec63f322ad9eb7b3a5a62944bfb39f7ac8225b6410b1d1e202f1f7246b9a2e68

Download Submit
C:\Program Files\Speccy\lang\lang-1040.dll

Filesize
81KB

MD5
0bbd0dd2123f0134289e1899beeadcfa

SHA1
c1b0d49f4d5c24b5f0605b3a514fe8b3cb5de02c

SHA256
e3b75bd3ffaa7a165adaf2101bbd0190afc7515194069856edc3397959f3a0a4

SHA512
4c85aedc57025c89d9f7719f96fc7cda02fb4bc57e506ade8cbb03cd77c5bab3ba358b3925cf2fccc9bdc4f8f1b9ae0be5840f91e351ae1b3d62b44a27bfbe87

Download Submit
C:\Program Files\Speccy\lang\lang-1041.dll

Filesize
55KB

MD5
e4ae139f1191415dfa94906870ab28b5

SHA1
83f7f161eef6c09ca8485b5dcba95b898c973b2d

SHA256
4ab959ee29db99f381aa37e4b05fa33cb87a5c31b76e236ab0c29bd9f1d4538d

SHA512
cd002a81a9a139b71bde764820536693bdf1fd763eb23023982a55a754cdde9461b773d3ab590e339f6fd27ac84e17d633f068586e0f9b7e34a5b5887daec6c8

Download Submit
C:\Program Files\Speccy\lang\lang-1043.dll

Filesize
82KB

MD5
ffb6e35bc7a5998ff5d5ba24a869f466

SHA1
d5a642bb6aa88fff2459cda34fbda8b4cd816f23

SHA256
4fd71f7dc6932583940f26c87032fd370999ef92ddaa828d6298984850348701

SHA512
30c3282538c6b599d4d469e5ab7558a24f5f781627d40211b00f1ad88df619ba8d199e000c3ab87d5be40760272aac389ee31a48ff2784e22312519770a49b1a

Download Submit
C:\Program Files\Speccy\lang\lang-1045.dll

Filesize
81KB

MD5
0c56b1b96b3be18b7ec58b1c663a524c

SHA1
64159f43ce937b180b71e331693671631df07168

SHA256
c578d97c07dd5422fdd2a73e66c3555fbf302e25c85dd9a15e9c75120930402b

SHA512
031d6d25416e5a0a9a7a911a850d90e98eea174e1e630e3e7292feb5e5831e131b996b0cd7b72048fbebb90db7922fca1e4401b74d76ee5b849e8ca4421e49bc

Download Submit
C:\Program Files\Speccy\lang\lang-1046.dll

Filesize
78KB

MD5
1ff7950eeeeeac8ae4a0eaea33ee7b42

SHA1
918cb4b578f579f0aeb59aea3d64aa918c43f964

SHA256
e4f747fc2c6d19f38aa0b04852e9ab8152bb4b04468d6115bb76cb5d06b46031

SHA512
f6fb85e66e56320bf93e38abcce29bf6a67a8df7f6a5cb1a9abd9aa794394d302f7bbf7a0249f6c8552517ed9eed960e08c21f73fda883fd52a983c841fd2ff6

Download Submit
C:\Program Files\Speccy\lang\lang-1049.dll

Filesize
77KB

MD5
6fbe3b991761678df3943a4fdacd53b4

SHA1
23121473e2b0356ea46ee4105813c2bb6d4a1d8e

SHA256
1ace20196a9ba651d8267314fdce3686eddb82c47a8f97593a865daa18c2e7bd

SHA512
5b5632a05b50ac6d7159c7bade950c9c11d04d4d2f6e7520a612680bc6d253492da21c5bd561c2d7301fd39715021915b8d91d92146da8f0557c6d2adf4e4795

Download Submit
C:\Program Files\Speccy\lang\lang-1050.dll

Filesize
85KB

MD5
9151b422df85c5332162254567c0c9d0

SHA1
8cb5a1b093bdd7338010d44dd954b4ca0f26f67d

SHA256
d9fb740bb46df481c44356684fe644fc945bc57ff269f8b619419a26b11d3d35

SHA512
8660a05b82de92582cbe46e79f1801c9c0516d9465ac2b6ad3417face79e1b1471fb03c9ce07927e87c03a0ee0f26237c11d3a3e333dfa8a1794718bc5344c47

Download Submit
C:\Program Files\Speccy\lang\lang-1051.dll

Filesize
73KB

MD5
e9e5e0b4e27a260a0a5ae43bda4a1812

SHA1
c814f9172c24a5ce58374999264af02b99b828f7

SHA256
5858f1ad625b3934cb6bdf1c5a14b4368da94c0cb97d0d1b65b6985d23450b59

SHA512
311093dfa8ec36a98b0f308f8cc752797e0f2e40c6b0fb541510dcd61f33ddc135dcd6a7b0dc3982a813d499d9d685c6e5ef80080547f6f756c2db5f22f8eedd

Download Submit
C:\Program Files\Speccy\lang\lang-1052.dll

Filesize
79KB

MD5
c4ed5ea4876722b228d9a189386e2654

SHA1
89dfdc5d45913db12a6b3cc2684ae7ab09c74994

SHA256
68f5a8b4cabf62a0c5eefb02478416240992d08dbb3214765ba341dc4cbd3b0d

SHA512
1a2f07592773b1d55ce9b20b7a67f369cfab29e07cb0ce55ec3b43d8e6dd4d784568b35d24260890c5c368daabfd1d2459bb2030d08a4ce4542af6cac5defdf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
78c7656527762ed2977adf983a6f4766

SHA1
21a66d2eefcb059371f4972694057e4b1f827ce6

SHA256
e1000099751602ae1adcec6f1c74e1d65f472936817b45239dfed4b043984296

SHA512
0a8e58ae95163b3cdf8e81b5085887761e73cb7c836a1a6a972e837fb3df69b2ac70cfd6311d06d40656344ec35eb48e512f007561480f0345486ac2b329be0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
099b4ba2787e99b696fc61528100f83f

SHA1
06e1f8b7391e1d548e49a1022f6ce6e7aa61f292

SHA256
cdb1db488e260ed750edfe1c145850b57ee8ab819d75237a167e673116a33ee8

SHA512
4309375e10785564ceb03e0127ced414e366a5b833f16a60d796471d871b479e4c044db5268902d9dfd14715ca577cb26042bab8f7b0f31fe8abf33947feb9d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4c857eb1-5331-491b-adc1-eab802ba6ec8.tmp

Filesize
5KB

MD5
1e6bcdf86db3d6e04ff4c855ddd7a567

SHA1
cb50e264f62e54a3802ab563c06b966f2b076793

SHA256
a5ec08e13cee4ef696af52e52d5f19c12a04a3ce91c6d23fa8796fa19725419c

SHA512
673fe09d5fb603c9ddc18efa48c2574a12ddb9a34500a77678b87106203d0ce5ff3dd43857524f6876eb0147bba07a817b532dbda685708cd1258632b4a0319c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
7297636d625b5c487ff38183a413a142

SHA1
66f93b95838d3e6a32b1beed0a6a5a6ff6941a0d

SHA256
afca5a32acd6910a4b301cedbfa681650f25f60251d373c77c446bcd2ed2cf4f

SHA512
a76c8e8d78cc33d803989059a95f8e640aa5fd831403cc6440d503341ba18b34f025b93c622375264f3a1839754a01da4db9fd52c36c4640277bc6638e6a6ce5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
184B

MD5
a92f21957202ec4fd9c5acf9d3525526

SHA1
dab7205087a7bfe9b1ece2d1f7c6274b6747ad66

SHA256
fdc81b7df6d6755906d1793d4923ac747e3c1a2a3560ce9ae09abe38ebaf7f64

SHA512
5b67367dce475ca83d5377a75a5032573deae732a50b604f36ce018ca1b0cc848aaa829676dea6ec25f9e6a9a54bf2631b04c519f5c7a75b4f727eb1e96251b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6030a4eb2fcd7b2bf494436c9e09423f

SHA1
214a9ceba229f1a95c399b326e761fa8fe677ad6

SHA256
c436f75f208e23649dfd70a5c02b35a1223b2f2762ddab5138350673f5fd9684

SHA512
1a1e4461139ff684271372671f16e1f374ba200fc029d2528904dd4b0a4a4ab2ef07d7c2e4a680999bce137a0a4d672f0a7767ee6aa185d68231bb662967e728

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
19fd459b3fd5a465539872d4f547427c

SHA1
153e27f64c2569cf355877fdf359534806e3d327

SHA256
202120c0091ffe849b8fe6452270b44388fa47c37ff152c2e8b0936561f9f8dd

SHA512
bf8f72bb34b8d949d70279dd012000303e05cb24e46647235f27d3208eb76fab4b21c31aa8fd80a3b24944351c2ddc365508cc88d5e224a762af09fd33c06882

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8ef530b72fca8791a7193064cc137ab2

SHA1
2c78050d5bf77339ee97abbb33b8ef9668e6e1bf

SHA256
c35404435c472f33e176100838b7abda76c1b836649adb2357d965a64e658a17

SHA512
95d4240b3ac2d21d3c981461eff35d3ef6abf02d0bc05c0a7f3688bd5c7ae935e66ff874588d0231b26f8bbd9133da64b0116ad46b5620c9c221c4ea44e864ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
02ee7addc9e8a2d07af55556ebf0ff5c

SHA1
020161bb64ecb7c6e6886ccc055908984dc651d8

SHA256
552d3ed359b7a52278ce621674d16428d8a7969f6cd5663df18e240cce66aadc

SHA512
567989543c3848a0c3276d96b96ca761f750e4b71fb74f36d809f590ffe16a72fd5ece251737a8b1ffe65f0051e211bd7ad19d2b8b0b7ca1b7ffc86dd2a52883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
fdb8b3b85759713e408818448f00c844

SHA1
5514c3e21aa5ed4de6fa96ae2eee84d8f738215a

SHA256
6ad54a844f619b8bb9dd11a24ba69fc6f5d29964ea5d0100964bb5ef82a5e6e7

SHA512
3a65e3c84013993ff9acc608bb50e7bb9c0d46cfc57aa4c67efee054f1bdb2649552c9b13e8960ad87c445882eff450ef524e277a41490513f0905fb939c332c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
1f79e3841b28c78393e055a7d31554e5

SHA1
753bd801460d3cc13d624724ef759dcae43a35e8

SHA256
5f423f43507a5925afd040aa5bcb74c404fe6b1df53f9536ceae6cd6477a7124

SHA512
33de84adb04c64d64f80a57fee544dda245a1b42a5faa745db43c14067b328d02bb342d4cad109276ea276c31adfb009a88302a78ec4bd5f8c9e1a510ed1625b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
b3c2af3b304f1d0e40564b723d550732

SHA1
6fc6db70941e9be6ee79ef67de85e7e77d9b6f92

SHA256
beab46577e355befb851f1a1cc6c24130b8480b43b1771229114eb316e54ff45

SHA512
e2cf11de0b0146b781d4b412d5ae0b19aa4b2c709c05208abdb35d2c0222cfd006dcf4de460c634bdf059ab7927e81981163c11fcd980d733f06910ec2ab38ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\V01.log

Filesize
512KB

MD5
3d05c11e9335c08b12b014a51812342e

SHA1
d0f815562d3bb3465d57afabbd364e3139a34bc5

SHA256
dc1fedcd0b771c026c6efc227f30ad633b806de725d38451cf51c4f7c821a54c

SHA512
1999311d633b237ca088817ebae00263ed8ed19fb7927336f051ab7a85bc2d5c47533e457d252c482ed9666f054a65b9298ef59850fd82377e4ce7ebdb2331a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat

Filesize
14.0MB

MD5
757d85970811ea7af84241d0dea991a2

SHA1
efe4832fbd43dfb9caa18eca8b404fe751eb831a

SHA256
a767e1a23765efc260c97f4946398b28ec2adc7596aa21ea6cdf36dd351d272b

SHA512
236dca2f98e49bcbaf1c35b1ba9c637141b44b420223a2c480f72a4f5446fbd4c39d2f437498840af636cec5c342bb2ef936bccb9611ad7c36f3896bebc49a39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm

Filesize
16KB

MD5
760bbe87f9c2011f1fc492011df80ace

SHA1
fc0311489cf849593ae50faff22d675e4807b82f

SHA256
18f7ba0d07ae2826a16a0f2f757fce8bf9070f1e97c0cfddf5a54f9878edb5e4

SHA512
d52fb5016cbeca34d6867d8cc2b115ae1c3992a81a247e84095753842930dd9278b32e8a943bb61986fe4c72427ec6d2520c8afc577983c1fd6668be3b733415

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi77D6.tmp\ButtonEvent.dll

Filesize
5KB

MD5
c24568a3b0d7c8d7761e684eb77252b5

SHA1
66db7f147cbc2309d8d78fdce54660041acbc60d

SHA256
e2da6d8b73b5954d58baa89a949aacece0527dfb940ca130ac6d3fd992d0909d

SHA512
5d43e4c838fd7f4c6a4ab6cc6d63e0f81d765d9ca33d9278d082c4f75f9416907df10b003e10edc1b5ef39535f722d8dbfab114775ac67da7f9390dcc2b4b443

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi77D6.tmp\ButtonEvent.dll

Filesize
5KB

MD5
c24568a3b0d7c8d7761e684eb77252b5

SHA1
66db7f147cbc2309d8d78fdce54660041acbc60d

SHA256
e2da6d8b73b5954d58baa89a949aacece0527dfb940ca130ac6d3fd992d0909d

SHA512
5d43e4c838fd7f4c6a4ab6cc6d63e0f81d765d9ca33d9278d082c4f75f9416907df10b003e10edc1b5ef39535f722d8dbfab114775ac67da7f9390dcc2b4b443

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi77D6.tmp\System.dll

Filesize
11KB

MD5
41a3c964232edd2d7d5edea53e8245cd

SHA1
76d7e1fbf15cc3da4dd63a063d6ab2f0868a2206

SHA256
8b65fec615c7b371c23f8f7f344b12dc5085e40a556f96db318ed757494d62d5

SHA512
fa16bd9d020602e3065afd5c0638bc37775b40eb18bfa33b4ca5babcc3e6f112ae7d43457a6e9685ddbe6e94b954a1dc43d1da7af9ca7464019a3f110af549c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi77D6.tmp\System.dll

Filesize
11KB

MD5
41a3c964232edd2d7d5edea53e8245cd

SHA1
76d7e1fbf15cc3da4dd63a063d6ab2f0868a2206

SHA256
8b65fec615c7b371c23f8f7f344b12dc5085e40a556f96db318ed757494d62d5

SHA512
fa16bd9d020602e3065afd5c0638bc37775b40eb18bfa33b4ca5babcc3e6f112ae7d43457a6e9685ddbe6e94b954a1dc43d1da7af9ca7464019a3f110af549c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi77D6.tmp\System.dll

Filesize
11KB

MD5
41a3c964232edd2d7d5edea53e8245cd

SHA1
76d7e1fbf15cc3da4dd63a063d6ab2f0868a2206

SHA256
8b65fec615c7b371c23f8f7f344b12dc5085e40a556f96db318ed757494d62d5

SHA512
fa16bd9d020602e3065afd5c0638bc37775b40eb18bfa33b4ca5babcc3e6f112ae7d43457a6e9685ddbe6e94b954a1dc43d1da7af9ca7464019a3f110af549c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi77D6.tmp\UserInfo.dll

Filesize
4KB

MD5
c1f778a6d65178d34bde4206161a98e0

SHA1
29719fffef1ab6fe2df47e5ed258a5e3b3a11cfc

SHA256
9caf7a78f750713180cf64d18967a2b803b5580e636e59279dcaaf18ba0daa87

SHA512
9c3cf25cf43f85a5f9c9ed555f12f3626ef9daeeedd4d366ada58748ead1f6e279fea977c76ae8bae1dc49bfd852e899cb137c4a006c13e9fcebf6e5e2926a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi77D6.tmp\UserInfo.dll

Filesize
4KB

MD5
c1f778a6d65178d34bde4206161a98e0

SHA1
29719fffef1ab6fe2df47e5ed258a5e3b3a11cfc

SHA256
9caf7a78f750713180cf64d18967a2b803b5580e636e59279dcaaf18ba0daa87

SHA512
9c3cf25cf43f85a5f9c9ed555f12f3626ef9daeeedd4d366ada58748ead1f6e279fea977c76ae8bae1dc49bfd852e899cb137c4a006c13e9fcebf6e5e2926a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi77D6.tmp\UserInfo.dll

Filesize
4KB

MD5
c1f778a6d65178d34bde4206161a98e0

SHA1
29719fffef1ab6fe2df47e5ed258a5e3b3a11cfc

SHA256
9caf7a78f750713180cf64d18967a2b803b5580e636e59279dcaaf18ba0daa87

SHA512
9c3cf25cf43f85a5f9c9ed555f12f3626ef9daeeedd4d366ada58748ead1f6e279fea977c76ae8bae1dc49bfd852e899cb137c4a006c13e9fcebf6e5e2926a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi77D6.tmp\g\gcapi_dll.dll

Filesize
348KB

MD5
2973af8515effd0a3bfc7a43b03b3fcc

SHA1
4209cded0caac7c5cb07bcb29f1ee0dc5ac211ee

SHA256
d0e4581210a22135ce5deb47d9df4d636a94b3813e0649aab84822c9f08af2a0

SHA512
b6f9653142ec00b2e0a5045f0f2c7ba5dbbda8ef39edf14c80a24ecab3c41f081eb466994aaf0879ac96b201ba5c02d478275710e4d08b3debc739063d177f7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi77D6.tmp\g\gcapi_dll.dll

Filesize
348KB

MD5
2973af8515effd0a3bfc7a43b03b3fcc

SHA1
4209cded0caac7c5cb07bcb29f1ee0dc5ac211ee

SHA256
d0e4581210a22135ce5deb47d9df4d636a94b3813e0649aab84822c9f08af2a0

SHA512
b6f9653142ec00b2e0a5045f0f2c7ba5dbbda8ef39edf14c80a24ecab3c41f081eb466994aaf0879ac96b201ba5c02d478275710e4d08b3debc739063d177f7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi77D6.tmp\g\gcapi_dll.dll

Filesize
348KB

MD5
2973af8515effd0a3bfc7a43b03b3fcc

SHA1
4209cded0caac7c5cb07bcb29f1ee0dc5ac211ee

SHA256
d0e4581210a22135ce5deb47d9df4d636a94b3813e0649aab84822c9f08af2a0

SHA512
b6f9653142ec00b2e0a5045f0f2c7ba5dbbda8ef39edf14c80a24ecab3c41f081eb466994aaf0879ac96b201ba5c02d478275710e4d08b3debc739063d177f7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi77D6.tmp\inetc.dll

Filesize
23KB

MD5
7760daf1b6a7f13f06b25b5a09137ca1

SHA1
cc5a98ea3aa582de5428c819731e1faeccfcf33a

SHA256
5233110ed8e95a4a1042f57d9b2dc72bc253e8cb5282437637a51e4e9fcb9079

SHA512
d038bea292ffa2f2f44c85305350645d504be5c45a9d1b30db6d9708bfac27e2ff1e41a76c844d9231d465f31d502a5313dfded6309326d6dfbe30e51a76fdb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi77D6.tmp\inetc.dll

Filesize
23KB

MD5
7760daf1b6a7f13f06b25b5a09137ca1

SHA1
cc5a98ea3aa582de5428c819731e1faeccfcf33a

SHA256
5233110ed8e95a4a1042f57d9b2dc72bc253e8cb5282437637a51e4e9fcb9079

SHA512
d038bea292ffa2f2f44c85305350645d504be5c45a9d1b30db6d9708bfac27e2ff1e41a76c844d9231d465f31d502a5313dfded6309326d6dfbe30e51a76fdb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi77D6.tmp\inetc.dll

Filesize
23KB

MD5
7760daf1b6a7f13f06b25b5a09137ca1

SHA1
cc5a98ea3aa582de5428c819731e1faeccfcf33a

SHA256
5233110ed8e95a4a1042f57d9b2dc72bc253e8cb5282437637a51e4e9fcb9079

SHA512
d038bea292ffa2f2f44c85305350645d504be5c45a9d1b30db6d9708bfac27e2ff1e41a76c844d9231d465f31d502a5313dfded6309326d6dfbe30e51a76fdb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi77D6.tmp\nsDialogs.dll

Filesize
9KB

MD5
2aba8f16eca82517460013a3de7cbf67

SHA1
3812192fa7b873f426c4b0d0d822b3c9d51aa164

SHA256
60b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d

SHA512
4e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi77D6.tmp\nsDialogs.dll

Filesize
9KB

MD5
2aba8f16eca82517460013a3de7cbf67

SHA1
3812192fa7b873f426c4b0d0d822b3c9d51aa164

SHA256
60b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d

SHA512
4e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi77D6.tmp\nsDialogs.dll

Filesize
9KB

MD5
2aba8f16eca82517460013a3de7cbf67

SHA1
3812192fa7b873f426c4b0d0d822b3c9d51aa164

SHA256
60b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d

SHA512
4e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi77D6.tmp\nsDialogs.dll

Filesize
9KB

MD5
2aba8f16eca82517460013a3de7cbf67

SHA1
3812192fa7b873f426c4b0d0d822b3c9d51aa164

SHA256
60b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d

SHA512
4e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi77D6.tmp\nsDialogs.dll

Filesize
9KB

MD5
2aba8f16eca82517460013a3de7cbf67

SHA1
3812192fa7b873f426c4b0d0d822b3c9d51aa164

SHA256
60b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d

SHA512
4e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi77D6.tmp\nsDialogs.dll

Filesize
9KB

MD5
2aba8f16eca82517460013a3de7cbf67

SHA1
3812192fa7b873f426c4b0d0d822b3c9d51aa164

SHA256
60b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d

SHA512
4e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi77D6.tmp\nsDialogs.dll

Filesize
9KB

MD5
2aba8f16eca82517460013a3de7cbf67

SHA1
3812192fa7b873f426c4b0d0d822b3c9d51aa164

SHA256
60b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d

SHA512
4e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi77D6.tmp\ui\pfUI.dll

Filesize
13.6MB

MD5
1bfa036321fcb209564549538345a289

SHA1
8ede722a5cc6135847ad5276f30143022fa7bacf

SHA256
547e48f35a1c38362cfa71a3ffe1b81cc8d61eb204157828e2ec58a80f3e4b2e

SHA512
9729cc5ca18dbd58b516169de053d50e0df9288fc2d91cbbbd887573fe006c5f506789f23a09a73dfcf75fa71b9cff88e0f59da550263d877939be8c4f996d92

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi77D6.tmp\ui\pfUI.dll

Filesize
13.6MB

MD5
1bfa036321fcb209564549538345a289

SHA1
8ede722a5cc6135847ad5276f30143022fa7bacf

SHA256
547e48f35a1c38362cfa71a3ffe1b81cc8d61eb204157828e2ec58a80f3e4b2e

SHA512
9729cc5ca18dbd58b516169de053d50e0df9288fc2d91cbbbd887573fe006c5f506789f23a09a73dfcf75fa71b9cff88e0f59da550263d877939be8c4f996d92

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi77D6.tmp\ui\res\Montserrat-Regular.otf

Filesize
44KB

MD5
27e50ffd6a14cbc8221c9dbd3b5208dc

SHA1
713c997ce002a4d8762c2dcc405213061233e4bc

SHA256
40fc1142200a5c1c18f80b6915257083c528c7f7fd2b00a552aeebc42898d428

SHA512
0a602f88cfba906b41719943465edb09917c447d746bfed5c9ce9c75d077f6aed2f8146697acd74557359f1ae267ca2a8e3a2ca40fb1633bde8e6114261abd90

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi77D6.tmp\ui\res\PF_logo.png

Filesize
3KB

MD5
079cca30760cca3c01863b6b96e87848

SHA1
98c2ca01f248bc61817db7e5faea4a3d8310db50

SHA256
8dd37d3721e25c32c5bf878b6dba9e61d04b7ce8aec45bdf703a41bc41802dfa

SHA512
3e25c10e3a5830584c608b9178ab062e93e0e9009a7d897bb5e3561180b0b0910bd4178063d982eb33806a005c93931ae2ec5be520ec0d0c9a7c452cb78fd6a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi77D6.tmp\ui\res\SP_computer.png

Filesize
66KB

MD5
873b7c34ced38adaa2d01752099c09df

SHA1
e659d094f6e3fe6f71a3f1b047b75206bab168a0

SHA256
aced6376065f2c71b4b619823f735bbdcac967a5113cd4e6b978298a58c927c9

SHA512
a8d54d52bb5ec4502cd4bb829eef23c1b2edff9daeeca0f4fb7dbaa0cabdcac763a60aedc8393ba12a393a8263a5c06d3555d7b165cf9927dd9cc18d68b9e510

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi77D6.tmp\ui\res\Speccy_Logo_72px.png

Filesize
8KB

MD5
1787175d95eab213cf5a8bc25e252676

SHA1
1d4bd97b2bcaabd26f2ef7781b91233575e1ba0f

SHA256
65fa6baa9d140251d04069cf538f3262ebbb0e4e62d58d06cc58ad8b22085a83

SHA512
de1df226bb9bf84305aea43c237ea76937a9df0c56ecd9afeee1920c3f4d600fde0cc0c027ca397fb6067ffb1a7fe8c03496d82ed844bb4f47f32b2b30eda52f

Download Submit
C:\Users\Admin\AppData\Local\Temp\sce42605.tmp

Filesize
12KB

MD5
009819c0abc869038a9d184bd7a9b6c7

SHA1
3ce497bc1ce7cb35209fd2a8556dabae7ee3adfe

SHA256
2fd69eb9a60ae80b0168ff8f4656e5981701f1558bf5707997b1ee9ba35c3185

SHA512
3fe0065e16ade01bda35f0c850b6a67cfbd0e3377e7470c67680f2502b76444261f6abc4dbd6ea2822d1a76f3d386c6f7af7aa5bd8f32659d15912428ec7b23d

Download Submit
memory/4648-282-0x0000000007530000-0x0000000007538000-memory.dmp

Filesize
32KB

Download
memory/4648-234-0x00000000064D0000-0x00000000064E0000-memory.dmp

Filesize
64KB

Download
memory/4648-284-0x0000000007560000-0x0000000007568000-memory.dmp

Filesize
32KB

Download
memory/4648-285-0x0000000007560000-0x0000000007568000-memory.dmp

Filesize
32KB

Download
memory/4648-288-0x0000000007480000-0x0000000007481000-memory.dmp

Filesize
4KB

Download
memory/4648-292-0x0000000007440000-0x0000000007441000-memory.dmp

Filesize
4KB

Download
memory/4648-338-0x0000000007670000-0x0000000007678000-memory.dmp

Filesize
32KB

Download
memory/4648-270-0x0000000007440000-0x0000000007441000-memory.dmp

Filesize
4KB

Download
memory/4648-340-0x00000000076F0000-0x00000000076F8000-memory.dmp

Filesize
32KB

Download
memory/4648-240-0x0000000006670000-0x0000000006680000-memory.dmp

Filesize
64KB

Download
memory/4648-258-0x00000000076F0000-0x00000000076F8000-memory.dmp

Filesize
32KB

Download
memory/4648-260-0x0000000007790000-0x0000000007798000-memory.dmp

Filesize
32KB

Download
memory/4648-267-0x0000000007480000-0x0000000007488000-memory.dmp

Filesize
32KB

Download
memory/4648-264-0x0000000007490000-0x0000000007498000-memory.dmp

Filesize
32KB

Download
memory/4648-262-0x0000000007480000-0x0000000007481000-memory.dmp

Filesize
4KB

Download
memory/4648-261-0x0000000007490000-0x0000000007498000-memory.dmp

Filesize
32KB

Download