Resubmissions

03-07-2023 18:01

230703-wlzj7sah3w 7

03-07-2023 17:59

230703-wkw3pahe28 7

Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20230703-en
  • resource tags

    arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
  • submitted
    03-07-2023 18:01

General

  • Target

    spsetup132.exe

  • Size

    8.6MB

  • MD5

    2e57838af780fba75f9085a67cde99e4

  • SHA1

    8070b4e5c50a4a981f6dcf78ffd424c065182b09

  • SHA256

    0a9e739910578192e2ad3f8f805a863d5cbcacbc38cde6488d7bbef5395dba87

  • SHA512

    84d58581d306c568db4ce572c509f69751932fe9293218f531e4d92951dd7d804756aeca8ede459c0a634e6f140fd9455693955325739657b5699d5d48d0ce63

  • SSDEEP

    196608:FuYr1j0wlfy/tycs/bZ6ctLCyoZcmtZs47ctad+UK7HZDLtHw57I:FuYr5ik/TtLCfXOad+/ZHs7I

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 37 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 51 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 11 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\spsetup132.exe
    "C:\Users\Admin\AppData\Local\Temp\spsetup132.exe"
    1⤵
    • Drops file in Program Files directory
    • Loads dropped DLL
    • Modifies registry class
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2200
    • C:\Program Files\Speccy\Speccy64.exe
      "C:\Program Files\Speccy\Speccy64.exe"
      2⤵
      • Checks whether UAC is enabled
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system certificate store
      PID:1056
      • C:\Program Files\Java\jre7\bin\java.exe
        "C:\Program Files\Java\jre7\bin\java" -version
        3⤵
          PID:2556
        • C:\Program Files\Java\jdk1.7.0_80\bin\java.exe
          "C:\Program Files\Java\jdk1.7.0_80\bin\java" -version
          3⤵
            PID:2472
          • C:\Windows\system32\secedit.exe
            /export /cfg "C:\Users\Admin\AppData\Local\Temp\spc_se.txt" /quiet /areas SECURITYPOLICY
            3⤵
              PID:2236
        • C:\Windows\system32\wbem\WmiApSrv.exe
          C:\Windows\system32\wbem\WmiApSrv.exe
          1⤵
            PID:2928

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files\Speccy\Speccy64.exe

            Filesize

            7.3MB

            MD5

            d41812a78894d4e47df163db19d354e6

            SHA1

            580a2d42799843fb213c91d730d850c5db997363

            SHA256

            5465297f50aa45b3d19c721259f38452b533e4569e85fef7568867303a7bc3ee

            SHA512

            a5957c9502cf4ba650f204808f37c116aaaec4e26fadff2db3c1e331f73c8cdf76ade248ee8a548196f4083624c2640efd5bdf4f7e85d777973a1bd6fa83f10f

          • C:\Program Files\Speccy\Speccy64.exe

            Filesize

            7.3MB

            MD5

            d41812a78894d4e47df163db19d354e6

            SHA1

            580a2d42799843fb213c91d730d850c5db997363

            SHA256

            5465297f50aa45b3d19c721259f38452b533e4569e85fef7568867303a7bc3ee

            SHA512

            a5957c9502cf4ba650f204808f37c116aaaec4e26fadff2db3c1e331f73c8cdf76ade248ee8a548196f4083624c2640efd5bdf4f7e85d777973a1bd6fa83f10f

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\V01.log

            Filesize

            512KB

            MD5

            360d0f5553bd3bfb86a10c87bf6d93f3

            SHA1

            6ab27e912a0be836af039f8ad549f173f587b7db

            SHA256

            458122a98abb1c2fa44f47882ae5ae96657353e77d53213fde57d4e99adcd54b

            SHA512

            3fe7760b02cfd8777c592b34abeb29c060fd4a73d41ef3a0c5308eee33b82afb1a5f26be37cf93632cb2ba6a2d9f6bc1fd098e440e960e9105921ada53c3a640

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat

            Filesize

            20.1MB

            MD5

            649eb98c1f9405e2b172fca1a48415e2

            SHA1

            edf7f7fc540531c8d42145263d529f29e033e393

            SHA256

            7e33b5bef750725e0c7f46e11d517752c6e4d16191388889145e3ce5ad63dd82

            SHA512

            c0aa1c56029485510c252b5170d03317c63301b77b6a9122e6f78951c98c9b11bf321c472e9ca03f632f6e348e2f9c7bf7ce97edded82c46fcd30201306dbeca

          • C:\Users\Admin\AppData\Local\Temp\nsj1F37.tmp\ButtonEvent.dll

            Filesize

            5KB

            MD5

            c24568a3b0d7c8d7761e684eb77252b5

            SHA1

            66db7f147cbc2309d8d78fdce54660041acbc60d

            SHA256

            e2da6d8b73b5954d58baa89a949aacece0527dfb940ca130ac6d3fd992d0909d

            SHA512

            5d43e4c838fd7f4c6a4ab6cc6d63e0f81d765d9ca33d9278d082c4f75f9416907df10b003e10edc1b5ef39535f722d8dbfab114775ac67da7f9390dcc2b4b443

          • C:\Users\Admin\AppData\Local\Temp\nsj1F37.tmp\System.dll

            Filesize

            11KB

            MD5

            41a3c964232edd2d7d5edea53e8245cd

            SHA1

            76d7e1fbf15cc3da4dd63a063d6ab2f0868a2206

            SHA256

            8b65fec615c7b371c23f8f7f344b12dc5085e40a556f96db318ed757494d62d5

            SHA512

            fa16bd9d020602e3065afd5c0638bc37775b40eb18bfa33b4ca5babcc3e6f112ae7d43457a6e9685ddbe6e94b954a1dc43d1da7af9ca7464019a3f110af549c1

          • C:\Users\Admin\AppData\Local\Temp\nsj1F37.tmp\UserInfo.dll

            Filesize

            4KB

            MD5

            c1f778a6d65178d34bde4206161a98e0

            SHA1

            29719fffef1ab6fe2df47e5ed258a5e3b3a11cfc

            SHA256

            9caf7a78f750713180cf64d18967a2b803b5580e636e59279dcaaf18ba0daa87

            SHA512

            9c3cf25cf43f85a5f9c9ed555f12f3626ef9daeeedd4d366ada58748ead1f6e279fea977c76ae8bae1dc49bfd852e899cb137c4a006c13e9fcebf6e5e2926a4d

          • C:\Users\Admin\AppData\Local\Temp\nsj1F37.tmp\g\gcapi_dll.dll

            Filesize

            348KB

            MD5

            2973af8515effd0a3bfc7a43b03b3fcc

            SHA1

            4209cded0caac7c5cb07bcb29f1ee0dc5ac211ee

            SHA256

            d0e4581210a22135ce5deb47d9df4d636a94b3813e0649aab84822c9f08af2a0

            SHA512

            b6f9653142ec00b2e0a5045f0f2c7ba5dbbda8ef39edf14c80a24ecab3c41f081eb466994aaf0879ac96b201ba5c02d478275710e4d08b3debc739063d177f7e

          • C:\Users\Admin\AppData\Local\Temp\nsj1F37.tmp\inetc.dll

            Filesize

            23KB

            MD5

            7760daf1b6a7f13f06b25b5a09137ca1

            SHA1

            cc5a98ea3aa582de5428c819731e1faeccfcf33a

            SHA256

            5233110ed8e95a4a1042f57d9b2dc72bc253e8cb5282437637a51e4e9fcb9079

            SHA512

            d038bea292ffa2f2f44c85305350645d504be5c45a9d1b30db6d9708bfac27e2ff1e41a76c844d9231d465f31d502a5313dfded6309326d6dfbe30e51a76fdb5

          • C:\Users\Admin\AppData\Local\Temp\nsj1F37.tmp\nsDialogs.dll

            Filesize

            9KB

            MD5

            2aba8f16eca82517460013a3de7cbf67

            SHA1

            3812192fa7b873f426c4b0d0d822b3c9d51aa164

            SHA256

            60b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d

            SHA512

            4e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0

          • C:\Users\Admin\AppData\Local\Temp\nsj1F37.tmp\ui\pfUI.dll

            Filesize

            13.6MB

            MD5

            1bfa036321fcb209564549538345a289

            SHA1

            8ede722a5cc6135847ad5276f30143022fa7bacf

            SHA256

            547e48f35a1c38362cfa71a3ffe1b81cc8d61eb204157828e2ec58a80f3e4b2e

            SHA512

            9729cc5ca18dbd58b516169de053d50e0df9288fc2d91cbbbd887573fe006c5f506789f23a09a73dfcf75fa71b9cff88e0f59da550263d877939be8c4f996d92

          • C:\Users\Admin\AppData\Local\Temp\nsj1F37.tmp\ui\res\Montserrat-Regular.otf

            Filesize

            44KB

            MD5

            27e50ffd6a14cbc8221c9dbd3b5208dc

            SHA1

            713c997ce002a4d8762c2dcc405213061233e4bc

            SHA256

            40fc1142200a5c1c18f80b6915257083c528c7f7fd2b00a552aeebc42898d428

            SHA512

            0a602f88cfba906b41719943465edb09917c447d746bfed5c9ce9c75d077f6aed2f8146697acd74557359f1ae267ca2a8e3a2ca40fb1633bde8e6114261abd90

          • C:\Users\Admin\AppData\Local\Temp\nsj1F37.tmp\ui\res\PF_logo.png

            Filesize

            3KB

            MD5

            079cca30760cca3c01863b6b96e87848

            SHA1

            98c2ca01f248bc61817db7e5faea4a3d8310db50

            SHA256

            8dd37d3721e25c32c5bf878b6dba9e61d04b7ce8aec45bdf703a41bc41802dfa

            SHA512

            3e25c10e3a5830584c608b9178ab062e93e0e9009a7d897bb5e3561180b0b0910bd4178063d982eb33806a005c93931ae2ec5be520ec0d0c9a7c452cb78fd6a8

          • C:\Users\Admin\AppData\Local\Temp\nsj1F37.tmp\ui\res\SP_computer.png

            Filesize

            66KB

            MD5

            873b7c34ced38adaa2d01752099c09df

            SHA1

            e659d094f6e3fe6f71a3f1b047b75206bab168a0

            SHA256

            aced6376065f2c71b4b619823f735bbdcac967a5113cd4e6b978298a58c927c9

            SHA512

            a8d54d52bb5ec4502cd4bb829eef23c1b2edff9daeeca0f4fb7dbaa0cabdcac763a60aedc8393ba12a393a8263a5c06d3555d7b165cf9927dd9cc18d68b9e510

          • C:\Users\Admin\AppData\Local\Temp\nsj1F37.tmp\ui\res\Speccy_Logo_72px.png

            Filesize

            8KB

            MD5

            1787175d95eab213cf5a8bc25e252676

            SHA1

            1d4bd97b2bcaabd26f2ef7781b91233575e1ba0f

            SHA256

            65fa6baa9d140251d04069cf538f3262ebbb0e4e62d58d06cc58ad8b22085a83

            SHA512

            de1df226bb9bf84305aea43c237ea76937a9df0c56ecd9afeee1920c3f4d600fde0cc0c027ca397fb6067ffb1a7fe8c03496d82ed844bb4f47f32b2b30eda52f

          • C:\Users\Admin\AppData\Local\Temp\sce10010.tmp

            Filesize

            12KB

            MD5

            dc505882bcd8807dbe21ff2ba0e48826

            SHA1

            83b732cfe3fa5830779c0a1be554e01deda066d1

            SHA256

            dd280e08bfad952f40388b31a2641bf9888f2ace821e39d9bbceac3f487ff134

            SHA512

            4ff9a96ba2a08e249d2cd43bc7d1f8d8f7f378189f5fd9b48ed0079be16ad0e57add876c2a964c69be429935b8f7df9b8f380bfd8a0e35ad4911e8c1cb2453e4

          • \Program Files\Speccy\Lang\lang-1026.dll

            Filesize

            78KB

            MD5

            4679b87ceb52b6a2c4f58fbc4f81b903

            SHA1

            7c655ecd763cf44ff7217f17c700186e6bf53e1b

            SHA256

            0eaaf207d8bf0ce106bc357c2e388384cd49d8eb3deda1d471274d141ffc63fd

            SHA512

            fa4d40a7ac5d41c8f495b263b2f241c55815337b41760383d9e2b3fe317a385d3a3da9b2436c55c3541e8f235450348c3bc101e0ddae4961081d74c1ed647299

          • \Program Files\Speccy\Lang\lang-1031.dll

            Filesize

            78KB

            MD5

            fbe8a53b36d7ba86bfc7d0c3a1d7659f

            SHA1

            1ced3b3d2af5250289080f524c41de2ef484eaac

            SHA256

            2c8095af8905d8b72204bd896e7865b91f6f77c375a5a1c9cffa0e3887ba8577

            SHA512

            f8de0d37e3ef3972504e6a05c58ce3d3a3ce13e8f55fac7795fde468add2648305f055aa7b6de47fab23e5446a22748da989dbaf1bf189a006fbc70efe0f475d

          • \Program Files\Speccy\Lang\lang-1034.dll

            Filesize

            86KB

            MD5

            52e6a2417cb6855d34b2c29e8c46a7cf

            SHA1

            9fe0c63039728334f023b8b08f3d45c3c3b739a2

            SHA256

            a84dbfab73568b73ee5f94bce0b43cc2487638962d3e500d1fdb1d666ec1e024

            SHA512

            d1161a7cb8b1e7cda982ca96758c0ef3e2ad039fe1f5b913c704c189bf960a9e02cdeae310512227881d559fa3cee226e5c4616b3279198c38a983102750ad35

          • \Program Files\Speccy\Lang\lang-1035.dll

            Filesize

            83KB

            MD5

            17aa2f62022349d437c88fa20e4a2614

            SHA1

            9a42e8eb8fd0cccf90ea090c22221078f85f005f

            SHA256

            3e85a29e06e9b3249f07f01f5b1d28bc9596d3c5a3e9a1c0f59ab4febede2af0

            SHA512

            fc2f49fdc448ddad09db040cb549139c971db92f9379fb19fc3b3bc5afeb7aaf236a3ff9e844246515d80bfbf892619129219020bc391fb200d43803242938f0

          • \Program Files\Speccy\Lang\lang-1036.dll

            Filesize

            83KB

            MD5

            b1284354327ef02b49e544ac793f6133

            SHA1

            19099eac446b960bd15a2585030355bfc1a661e4

            SHA256

            854c2e3e288ea5197fc84842107c991d081794ea6a72bcb92a0696f1f64b056c

            SHA512

            f78930cbb75c1ed46ccafef428d664b4e6f248d3e1cf54604e838216795608df58cb250e6e2360d509e1db0ad342a8a234cec3ae19cd140ff055079bd435d97c

          • \Program Files\Speccy\Lang\lang-1037.dll

            Filesize

            66KB

            MD5

            ebefa147111fde9b5201b44022c6dfaa

            SHA1

            c7c0a4010fcd09ac9cceb122e468f7e672c946b5

            SHA256

            01d24790c1aa19b18a58ad491de497e5d97551e4e69f72c4981d551d8ac28fd2

            SHA512

            549019de74a55553eb39c5cf68b0de87f382abf7fb857c721a20bd7797e35d424838c4fd11328950b6311a8db0a84b9280c28b539c5c93283cbd526fe2584ef9

          • \Program Files\Speccy\Lang\lang-1038.dll

            Filesize

            81KB

            MD5

            16e8b36b7d32c9ba1244acc916f61875

            SHA1

            3e87cedec5899f7d35121b07faa1bb1b00a5bcd4

            SHA256

            007d6edd16d867fd90ef10ba1e0dbdbc3a1d00f675df8c58a654dd1c3633689d

            SHA512

            5db00a5ddae227cf7c4b99dbe8ccb3a7a4bff55ed902bd349c343a33668a3b19ec63f322ad9eb7b3a5a62944bfb39f7ac8225b6410b1d1e202f1f7246b9a2e68

          • \Program Files\Speccy\Lang\lang-1040.dll

            Filesize

            81KB

            MD5

            0bbd0dd2123f0134289e1899beeadcfa

            SHA1

            c1b0d49f4d5c24b5f0605b3a514fe8b3cb5de02c

            SHA256

            e3b75bd3ffaa7a165adaf2101bbd0190afc7515194069856edc3397959f3a0a4

            SHA512

            4c85aedc57025c89d9f7719f96fc7cda02fb4bc57e506ade8cbb03cd77c5bab3ba358b3925cf2fccc9bdc4f8f1b9ae0be5840f91e351ae1b3d62b44a27bfbe87

          • \Program Files\Speccy\Lang\lang-1041.dll

            Filesize

            55KB

            MD5

            e4ae139f1191415dfa94906870ab28b5

            SHA1

            83f7f161eef6c09ca8485b5dcba95b898c973b2d

            SHA256

            4ab959ee29db99f381aa37e4b05fa33cb87a5c31b76e236ab0c29bd9f1d4538d

            SHA512

            cd002a81a9a139b71bde764820536693bdf1fd763eb23023982a55a754cdde9461b773d3ab590e339f6fd27ac84e17d633f068586e0f9b7e34a5b5887daec6c8

          • \Program Files\Speccy\Lang\lang-1043.dll

            Filesize

            82KB

            MD5

            ffb6e35bc7a5998ff5d5ba24a869f466

            SHA1

            d5a642bb6aa88fff2459cda34fbda8b4cd816f23

            SHA256

            4fd71f7dc6932583940f26c87032fd370999ef92ddaa828d6298984850348701

            SHA512

            30c3282538c6b599d4d469e5ab7558a24f5f781627d40211b00f1ad88df619ba8d199e000c3ab87d5be40760272aac389ee31a48ff2784e22312519770a49b1a

          • \Program Files\Speccy\Lang\lang-1045.dll

            Filesize

            81KB

            MD5

            0c56b1b96b3be18b7ec58b1c663a524c

            SHA1

            64159f43ce937b180b71e331693671631df07168

            SHA256

            c578d97c07dd5422fdd2a73e66c3555fbf302e25c85dd9a15e9c75120930402b

            SHA512

            031d6d25416e5a0a9a7a911a850d90e98eea174e1e630e3e7292feb5e5831e131b996b0cd7b72048fbebb90db7922fca1e4401b74d76ee5b849e8ca4421e49bc

          • \Program Files\Speccy\Lang\lang-1046.dll

            Filesize

            78KB

            MD5

            1ff7950eeeeeac8ae4a0eaea33ee7b42

            SHA1

            918cb4b578f579f0aeb59aea3d64aa918c43f964

            SHA256

            e4f747fc2c6d19f38aa0b04852e9ab8152bb4b04468d6115bb76cb5d06b46031

            SHA512

            f6fb85e66e56320bf93e38abcce29bf6a67a8df7f6a5cb1a9abd9aa794394d302f7bbf7a0249f6c8552517ed9eed960e08c21f73fda883fd52a983c841fd2ff6

          • \Program Files\Speccy\Lang\lang-1049.dll

            Filesize

            77KB

            MD5

            6fbe3b991761678df3943a4fdacd53b4

            SHA1

            23121473e2b0356ea46ee4105813c2bb6d4a1d8e

            SHA256

            1ace20196a9ba651d8267314fdce3686eddb82c47a8f97593a865daa18c2e7bd

            SHA512

            5b5632a05b50ac6d7159c7bade950c9c11d04d4d2f6e7520a612680bc6d253492da21c5bd561c2d7301fd39715021915b8d91d92146da8f0557c6d2adf4e4795

          • \Program Files\Speccy\Lang\lang-1050.dll

            Filesize

            85KB

            MD5

            9151b422df85c5332162254567c0c9d0

            SHA1

            8cb5a1b093bdd7338010d44dd954b4ca0f26f67d

            SHA256

            d9fb740bb46df481c44356684fe644fc945bc57ff269f8b619419a26b11d3d35

            SHA512

            8660a05b82de92582cbe46e79f1801c9c0516d9465ac2b6ad3417face79e1b1471fb03c9ce07927e87c03a0ee0f26237c11d3a3e333dfa8a1794718bc5344c47

          • \Program Files\Speccy\Lang\lang-1051.dll

            Filesize

            73KB

            MD5

            e9e5e0b4e27a260a0a5ae43bda4a1812

            SHA1

            c814f9172c24a5ce58374999264af02b99b828f7

            SHA256

            5858f1ad625b3934cb6bdf1c5a14b4368da94c0cb97d0d1b65b6985d23450b59

            SHA512

            311093dfa8ec36a98b0f308f8cc752797e0f2e40c6b0fb541510dcd61f33ddc135dcd6a7b0dc3982a813d499d9d685c6e5ef80080547f6f756c2db5f22f8eedd

          • \Program Files\Speccy\Lang\lang-1052.dll

            Filesize

            79KB

            MD5

            c4ed5ea4876722b228d9a189386e2654

            SHA1

            89dfdc5d45913db12a6b3cc2684ae7ab09c74994

            SHA256

            68f5a8b4cabf62a0c5eefb02478416240992d08dbb3214765ba341dc4cbd3b0d

            SHA512

            1a2f07592773b1d55ce9b20b7a67f369cfab29e07cb0ce55ec3b43d8e6dd4d784568b35d24260890c5c368daabfd1d2459bb2030d08a4ce4542af6cac5defdf7

          • \Program Files\Speccy\Lang\lang-1053.dll

            Filesize

            79KB

            MD5

            4c52e7bf6f2bd64645e4af60cd7e39e8

            SHA1

            35c5556cb008b5fb6b0e26d42e7a07204811e5ab

            SHA256

            3d2820baf75f7229eb57baf008f9505a7a613b0229ad3c83cf745703e67345a0

            SHA512

            95d4f508c411c3319ef5613eca7e26ea8158e84624a3410e94606b43bbff301fb90f11156521d7884359e6c4945fa00a1f25c28097cf399678e82485ca452433

          • \Program Files\Speccy\Lang\lang-1055.dll

            Filesize

            75KB

            MD5

            e03e2f7176cfbc86332dc3ed312ad03c

            SHA1

            9a984b788ff70f38717ce9ff4900cb482bf4d054

            SHA256

            9cd49db479ff2cc0e987fcd56262b761b82f0dfd346619c340cd79344953e52a

            SHA512

            9a006470c293afc142b3a6bb2342d06291be7fcf9ebf3b6875bfdd4656822966f1d15a93c8b6d91cb725f68324d7d991317d96b078156876dd83be48e8d19105

          • \Program Files\Speccy\Lang\lang-1058.dll

            Filesize

            79KB

            MD5

            64c197b062298b2bbf9520f535d88095

            SHA1

            9acfaf1fdf59e28b8263d9306aa062add65caf69

            SHA256

            a45739720f6e1e11a61301513f75dfc135a207082634162fa2d8329792463c54

            SHA512

            8e8468decb81b41572f25dd3270ef9f8a39e2c93d1a1659b599bde759f55dc8355030f32a84f3ef87b79e076b0430c257daf8a444a974371a2ac4c61cefc45dd

          • \Program Files\Speccy\Lang\lang-1059.dll

            Filesize

            79KB

            MD5

            f7fdaf3ed7cd4dbdf0bcb24dac4a9659

            SHA1

            887e84c97d3ef2e8d69dcbf78307fc6195d4c7f6

            SHA256

            c373bc81f8416b9bdea4a2e4e021fc2ec913600654309e396d95c844c52c1a5b

            SHA512

            5860560fb647daf29796daee9a968037cde25ca10eaf40f5b7e17ec5bc35f76170c6d37efe3e69ddab3aecf4dc69177252d57f0ac3221f4dfded5c0dd9b77646

          • \Program Files\Speccy\Lang\lang-1060.dll

            Filesize

            77KB

            MD5

            12971a2ec93885fd2054634f8f8f51af

            SHA1

            7fe6cbad7465c625d7668c50ecae655b37ae7085

            SHA256

            6a2f7d25001e283d1115953b37ae93564ec60d2109f1f3337b236db316a1ba1c

            SHA512

            e7b5aca36fc3fd64c34ac9ef2d75d5c7d1cb03f8b05670a8aa6aa19f4bd80a914939006f643a064bf8c5f0d1f9dd970ae727669676819981bc8ca7105c6cdba1

          • \Program Files\Speccy\Lang\lang-1062.dll

            Filesize

            80KB

            MD5

            474d91596088208a0f864f2bf5663a45

            SHA1

            c40294b095e970cf3bb50c345f999b3c8b487e71

            SHA256

            2b8a0323ea0b74d094c95aecfcb30e3a3fc27eeb6fdf9f68fd7a4863e821595f

            SHA512

            a8bb210d31c73c563fe5c8e3b2f6adf7cd907f94c822a1fa159e642ecd08754477d67cd5faa6cd4c83c8d152b5e75ff4fb336da0b923b72dc6ccb8ad4a4bc466

          • \Program Files\Speccy\Lang\lang-1066.dll

            Filesize

            75KB

            MD5

            a108374df95031fe05e73299684a8659

            SHA1

            c7db3e8002c3451c7be9f21b96fbe1c398af73b7

            SHA256

            0bb150db0e1fe099c699a3842d0cd47087bff5411c614b8a7c04c052a0219c48

            SHA512

            f30f8370bccd674c3be81de899379305acade4f0cb55295074182f89094e20e6b011f29350626d6f31467cbe9acd02dbe69d87288866493c7e9dc32295b3ab3b

          • \Program Files\Speccy\Lang\lang-1067.dll

            Filesize

            75KB

            MD5

            87305b988fde67885065fb6e82f1c7ff

            SHA1

            16e303462995bce923417e8cd0609acd9a29a4ea

            SHA256

            9754d5364c1d73975ee25a4371f1e953b3774d9c725642e43665d60b24730031

            SHA512

            6162b24f59a4a5fe1d377a1e296643e56d0ca9eb0637843807ed03956ea15f90f9eb7c5bb667ec9e9aa0703c519f11b82524f2b9dcefc007f494dd6a78515939

          • \Program Files\Speccy\Lang\lang-1068.dll

            Filesize

            76KB

            MD5

            c5c28cf23cbb2d78e05c0334bed121fb

            SHA1

            3b5d5e2a3591fec78992665ac8af98e6ebd76c94

            SHA256

            67231f5d3bf0da8922dbcb87aee46447a088d8a2e7bd0efa08ec2c721a0ef018

            SHA512

            8c7f66b31515fcacf1d1d070da43bed385915e0ad676b3fc27ac678183cf4c86704328539510e1a6c42ddf8a580848563e33cc91a6e58bf2573fae743db90f3f

          • \Program Files\Speccy\Lang\lang-1071.dll

            Filesize

            78KB

            MD5

            0d4d9b89b5ee6b7eb2fd57a8dfcd491c

            SHA1

            ffaa15693cf3a61010379cbbdac8715ac26707f0

            SHA256

            2a6484281499400ebb8a0ac198dcbbadc49295f60573fdfc1733d996bf338a74

            SHA512

            b269672f4382338496556e113e18125dd4c89e25fb5ad3b9e6a29f7976bcf19eb0e7603e0970132789711100f165aeeeaffe232bd38c4bff6fce14d278f70813

          • \Program Files\Speccy\Lang\lang-1079.dll

            Filesize

            80KB

            MD5

            072631f399a59b231e28f8b5fb47d9e0

            SHA1

            4e9a5d407d5568002729380d0d80f26b13a3b9cf

            SHA256

            02f08c2c07d95a37c6e1ee5170d6b6ffcd7732a2193fc1c5a7a2746443a325bf

            SHA512

            5171b9a03bc6473a65529d51be3686713539878c815329601ae86e00c86cddf989fecd08dee537470762e721f573bb018bc14509ee9904ec0dda5c89ceafe961

          • \Program Files\Speccy\Lang\lang-1102.dll

            Filesize

            76KB

            MD5

            cef54c23539b646065a84fda058a27de

            SHA1

            e04e48ba7a1d5b54a5844d9c135aef410dab2c7c

            SHA256

            ce834f37a5b280cb9324b239b3daa5f486f48a178fb63ee7c5ee24224b0655d7

            SHA512

            a7622f64be97eb3812c717967a03cc3516e30ddc9584d10a1de0ce006d125709a071afb9665407b25fc24e7fa533b8be2112de407b9542c816df3d2750c38b8a

          • \Program Files\Speccy\Lang\lang-2052.dll

            Filesize

            41KB

            MD5

            dc8504a287425b65761932ad5e8f6c3d

            SHA1

            1453a4a55a35a90646bf23aad2c8efbdd27e404b

            SHA256

            79323010ae3e47c39b67d2c1c5452c6059625482c526316abe3a5f13294bfd44

            SHA512

            5555f8795b87f29ccec2dfaaa3435976fed368373236bbb3eafd352bb1dc207b6351ac3873e5f4f7826e84d4df611aac04f216d7fe6947ac28528684818bb63a

          • \Program Files\Speccy\Lang\lang-2070.dll

            Filesize

            77KB

            MD5

            fd36b8d5352df10db2d75eab23ec3e0b

            SHA1

            572f8dab7057d5f835f80beedfa2e5e6f5c8a5b6

            SHA256

            b48faeb0f74feb6a81bbe6cc5e2499b635c215db6810c4389c0734c62622274e

            SHA512

            fadebcd7102c5d08e83bcc09b8ac35a8818e9b52e3cb541e73f0b118e7e48c44f79872d8baf625454a8d4c5b094ea612198dffb49d79074e8683deb8c7e46147

          • \Program Files\Speccy\Lang\lang-2074.dll

            Filesize

            78KB

            MD5

            c66b78c47c6006e97ffe0d55827170bb

            SHA1

            2ddcc11fb93727f4c04a0414d4a0a2eba73eeb34

            SHA256

            12ca61b90dac3131ec025c3784a50f9ed890ca3f2328e7c35d7f23c369ea9cbe

            SHA512

            4e3db46823c3fd42384d8a0c7f51c1dd8d2c6282d772c253b73eba836e21b207fad8623310ca5b63aec4a0c4c9aab8237fbd114bed5a2501f14ea9e147789a6a

          • \Program Files\Speccy\Lang\lang-3098.dll

            Filesize

            78KB

            MD5

            be7d42a3bb58bae6db186852d78ffdbd

            SHA1

            f4af3281f2aef5f15b7aa7c9ae2ad6a5f3ccdee7

            SHA256

            4448420893c052529a669b4aac27326c53b4fc718fb1b19768d3748d4011d860

            SHA512

            3013e93fdcef7d078e8346309770beba496335880177ac0d9d0775a6b18078b4643d189ff8856d43ff0bf7784eb3e6cdc57eaa24e2e4cd9f0d81274e9c0f5c74

          • \Program Files\Speccy\Lang\lang-5146.dll

            Filesize

            76KB

            MD5

            954e81490165153d34abfc7498459179

            SHA1

            44628fa4ee2556b3f0a5ea4505a964f2175e1cdf

            SHA256

            0a8f446e4758663b220cd05e822a1d22b1dc7ae91db84c8133cd69a112e245eb

            SHA512

            205bc8d691c49a1736f719bc8503d207ac23b5f07c91a6c7ac1593b1eddb5e44ca6ee2b9a9296a094c37f1a188a571f721f62da450c331a83b5d155f75ca416e

          • \Program Files\Speccy\Lang\lang-9999.dll

            Filesize

            75KB

            MD5

            e0c6926124f7c0ef0996b2eefdd7cbf4

            SHA1

            632288b14983edec7bfbb168e3e0d17a69d39491

            SHA256

            81620f8219ffbf554637113f1f8e50fe29abacfa1be25117f4b77a4713f227eb

            SHA512

            c0a9fe774a3cb0b2751e361fcf844c0439916c1e6454d5846560676b9db0e4e388cd4e69be8a7b1469410d87d46f9a675ebaeca9ce62d8dc4f19eb46f150a8f1

          • \Program Files\Speccy\Speccy64.exe

            Filesize

            7.3MB

            MD5

            d41812a78894d4e47df163db19d354e6

            SHA1

            580a2d42799843fb213c91d730d850c5db997363

            SHA256

            5465297f50aa45b3d19c721259f38452b533e4569e85fef7568867303a7bc3ee

            SHA512

            a5957c9502cf4ba650f204808f37c116aaaec4e26fadff2db3c1e331f73c8cdf76ade248ee8a548196f4083624c2640efd5bdf4f7e85d777973a1bd6fa83f10f

          • \Program Files\Speccy\Speccy64.exe

            Filesize

            7.3MB

            MD5

            d41812a78894d4e47df163db19d354e6

            SHA1

            580a2d42799843fb213c91d730d850c5db997363

            SHA256

            5465297f50aa45b3d19c721259f38452b533e4569e85fef7568867303a7bc3ee

            SHA512

            a5957c9502cf4ba650f204808f37c116aaaec4e26fadff2db3c1e331f73c8cdf76ade248ee8a548196f4083624c2640efd5bdf4f7e85d777973a1bd6fa83f10f

          • \Program Files\Speccy\Speccy64.exe

            Filesize

            7.3MB

            MD5

            d41812a78894d4e47df163db19d354e6

            SHA1

            580a2d42799843fb213c91d730d850c5db997363

            SHA256

            5465297f50aa45b3d19c721259f38452b533e4569e85fef7568867303a7bc3ee

            SHA512

            a5957c9502cf4ba650f204808f37c116aaaec4e26fadff2db3c1e331f73c8cdf76ade248ee8a548196f4083624c2640efd5bdf4f7e85d777973a1bd6fa83f10f

          • \Program Files\Speccy\Speccy64.exe

            Filesize

            7.3MB

            MD5

            d41812a78894d4e47df163db19d354e6

            SHA1

            580a2d42799843fb213c91d730d850c5db997363

            SHA256

            5465297f50aa45b3d19c721259f38452b533e4569e85fef7568867303a7bc3ee

            SHA512

            a5957c9502cf4ba650f204808f37c116aaaec4e26fadff2db3c1e331f73c8cdf76ade248ee8a548196f4083624c2640efd5bdf4f7e85d777973a1bd6fa83f10f

          • \Program Files\Speccy\Speccy64.exe

            Filesize

            7.3MB

            MD5

            d41812a78894d4e47df163db19d354e6

            SHA1

            580a2d42799843fb213c91d730d850c5db997363

            SHA256

            5465297f50aa45b3d19c721259f38452b533e4569e85fef7568867303a7bc3ee

            SHA512

            a5957c9502cf4ba650f204808f37c116aaaec4e26fadff2db3c1e331f73c8cdf76ade248ee8a548196f4083624c2640efd5bdf4f7e85d777973a1bd6fa83f10f

          • \Program Files\Speccy\Speccy64.exe

            Filesize

            7.3MB

            MD5

            d41812a78894d4e47df163db19d354e6

            SHA1

            580a2d42799843fb213c91d730d850c5db997363

            SHA256

            5465297f50aa45b3d19c721259f38452b533e4569e85fef7568867303a7bc3ee

            SHA512

            a5957c9502cf4ba650f204808f37c116aaaec4e26fadff2db3c1e331f73c8cdf76ade248ee8a548196f4083624c2640efd5bdf4f7e85d777973a1bd6fa83f10f

          • \Program Files\Speccy\Speccy64.exe

            Filesize

            7.3MB

            MD5

            d41812a78894d4e47df163db19d354e6

            SHA1

            580a2d42799843fb213c91d730d850c5db997363

            SHA256

            5465297f50aa45b3d19c721259f38452b533e4569e85fef7568867303a7bc3ee

            SHA512

            a5957c9502cf4ba650f204808f37c116aaaec4e26fadff2db3c1e331f73c8cdf76ade248ee8a548196f4083624c2640efd5bdf4f7e85d777973a1bd6fa83f10f

          • \Users\Admin\AppData\Local\Temp\nsj1F37.tmp\ButtonEvent.dll

            Filesize

            5KB

            MD5

            c24568a3b0d7c8d7761e684eb77252b5

            SHA1

            66db7f147cbc2309d8d78fdce54660041acbc60d

            SHA256

            e2da6d8b73b5954d58baa89a949aacece0527dfb940ca130ac6d3fd992d0909d

            SHA512

            5d43e4c838fd7f4c6a4ab6cc6d63e0f81d765d9ca33d9278d082c4f75f9416907df10b003e10edc1b5ef39535f722d8dbfab114775ac67da7f9390dcc2b4b443

          • \Users\Admin\AppData\Local\Temp\nsj1F37.tmp\System.dll

            Filesize

            11KB

            MD5

            41a3c964232edd2d7d5edea53e8245cd

            SHA1

            76d7e1fbf15cc3da4dd63a063d6ab2f0868a2206

            SHA256

            8b65fec615c7b371c23f8f7f344b12dc5085e40a556f96db318ed757494d62d5

            SHA512

            fa16bd9d020602e3065afd5c0638bc37775b40eb18bfa33b4ca5babcc3e6f112ae7d43457a6e9685ddbe6e94b954a1dc43d1da7af9ca7464019a3f110af549c1

          • \Users\Admin\AppData\Local\Temp\nsj1F37.tmp\System.dll

            Filesize

            11KB

            MD5

            41a3c964232edd2d7d5edea53e8245cd

            SHA1

            76d7e1fbf15cc3da4dd63a063d6ab2f0868a2206

            SHA256

            8b65fec615c7b371c23f8f7f344b12dc5085e40a556f96db318ed757494d62d5

            SHA512

            fa16bd9d020602e3065afd5c0638bc37775b40eb18bfa33b4ca5babcc3e6f112ae7d43457a6e9685ddbe6e94b954a1dc43d1da7af9ca7464019a3f110af549c1

          • \Users\Admin\AppData\Local\Temp\nsj1F37.tmp\UserInfo.dll

            Filesize

            4KB

            MD5

            c1f778a6d65178d34bde4206161a98e0

            SHA1

            29719fffef1ab6fe2df47e5ed258a5e3b3a11cfc

            SHA256

            9caf7a78f750713180cf64d18967a2b803b5580e636e59279dcaaf18ba0daa87

            SHA512

            9c3cf25cf43f85a5f9c9ed555f12f3626ef9daeeedd4d366ada58748ead1f6e279fea977c76ae8bae1dc49bfd852e899cb137c4a006c13e9fcebf6e5e2926a4d

          • \Users\Admin\AppData\Local\Temp\nsj1F37.tmp\g\gcapi_dll.dll

            Filesize

            348KB

            MD5

            2973af8515effd0a3bfc7a43b03b3fcc

            SHA1

            4209cded0caac7c5cb07bcb29f1ee0dc5ac211ee

            SHA256

            d0e4581210a22135ce5deb47d9df4d636a94b3813e0649aab84822c9f08af2a0

            SHA512

            b6f9653142ec00b2e0a5045f0f2c7ba5dbbda8ef39edf14c80a24ecab3c41f081eb466994aaf0879ac96b201ba5c02d478275710e4d08b3debc739063d177f7e

          • \Users\Admin\AppData\Local\Temp\nsj1F37.tmp\g\gcapi_dll.dll

            Filesize

            348KB

            MD5

            2973af8515effd0a3bfc7a43b03b3fcc

            SHA1

            4209cded0caac7c5cb07bcb29f1ee0dc5ac211ee

            SHA256

            d0e4581210a22135ce5deb47d9df4d636a94b3813e0649aab84822c9f08af2a0

            SHA512

            b6f9653142ec00b2e0a5045f0f2c7ba5dbbda8ef39edf14c80a24ecab3c41f081eb466994aaf0879ac96b201ba5c02d478275710e4d08b3debc739063d177f7e

          • \Users\Admin\AppData\Local\Temp\nsj1F37.tmp\inetc.dll

            Filesize

            23KB

            MD5

            7760daf1b6a7f13f06b25b5a09137ca1

            SHA1

            cc5a98ea3aa582de5428c819731e1faeccfcf33a

            SHA256

            5233110ed8e95a4a1042f57d9b2dc72bc253e8cb5282437637a51e4e9fcb9079

            SHA512

            d038bea292ffa2f2f44c85305350645d504be5c45a9d1b30db6d9708bfac27e2ff1e41a76c844d9231d465f31d502a5313dfded6309326d6dfbe30e51a76fdb5

          • \Users\Admin\AppData\Local\Temp\nsj1F37.tmp\nsDialogs.dll

            Filesize

            9KB

            MD5

            2aba8f16eca82517460013a3de7cbf67

            SHA1

            3812192fa7b873f426c4b0d0d822b3c9d51aa164

            SHA256

            60b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d

            SHA512

            4e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0

          • \Users\Admin\AppData\Local\Temp\nsj1F37.tmp\nsDialogs.dll

            Filesize

            9KB

            MD5

            2aba8f16eca82517460013a3de7cbf67

            SHA1

            3812192fa7b873f426c4b0d0d822b3c9d51aa164

            SHA256

            60b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d

            SHA512

            4e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0

          • \Users\Admin\AppData\Local\Temp\nsj1F37.tmp\nsDialogs.dll

            Filesize

            9KB

            MD5

            2aba8f16eca82517460013a3de7cbf67

            SHA1

            3812192fa7b873f426c4b0d0d822b3c9d51aa164

            SHA256

            60b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d

            SHA512

            4e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0

          • \Users\Admin\AppData\Local\Temp\nsj1F37.tmp\ui\pfUI.dll

            Filesize

            13.6MB

            MD5

            1bfa036321fcb209564549538345a289

            SHA1

            8ede722a5cc6135847ad5276f30143022fa7bacf

            SHA256

            547e48f35a1c38362cfa71a3ffe1b81cc8d61eb204157828e2ec58a80f3e4b2e

            SHA512

            9729cc5ca18dbd58b516169de053d50e0df9288fc2d91cbbbd887573fe006c5f506789f23a09a73dfcf75fa71b9cff88e0f59da550263d877939be8c4f996d92

          • memory/2200-194-0x0000000006B40000-0x0000000006B48000-memory.dmp

            Filesize

            32KB

          • memory/2200-196-0x0000000006AD0000-0x0000000006AD1000-memory.dmp

            Filesize

            4KB

          • memory/2200-182-0x0000000006B70000-0x0000000006B78000-memory.dmp

            Filesize

            32KB

          • memory/2200-157-0x00000000044F0000-0x0000000004500000-memory.dmp

            Filesize

            64KB

          • memory/2200-151-0x0000000003F10000-0x0000000003F20000-memory.dmp

            Filesize

            64KB

          • memory/2200-150-0x0000000000790000-0x0000000000791000-memory.dmp

            Filesize

            4KB

          • memory/2200-149-0x0000000000790000-0x0000000000791000-memory.dmp

            Filesize

            4KB

          • memory/2200-188-0x0000000006B40000-0x0000000006B41000-memory.dmp

            Filesize

            4KB

          • memory/2200-205-0x0000000006AE0000-0x0000000006AE8000-memory.dmp

            Filesize

            32KB

          • memory/2200-208-0x0000000006F30000-0x0000000006F38000-memory.dmp

            Filesize

            32KB

          • memory/2200-210-0x0000000006AB0000-0x0000000006AB1000-memory.dmp

            Filesize

            4KB

          • memory/2200-215-0x0000000006AD0000-0x0000000006AD1000-memory.dmp

            Filesize

            4KB

          • memory/2200-260-0x0000000006B30000-0x0000000006B38000-memory.dmp

            Filesize

            32KB

          • memory/2200-263-0x0000000006F30000-0x0000000006F38000-memory.dmp

            Filesize

            32KB

          • memory/2200-265-0x0000000006B20000-0x0000000006B21000-memory.dmp

            Filesize

            4KB