Analysis

  • max time kernel
    18s
  • max time network
    38s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-07-2023 12:46

General

  • Target

    spsetup132.exe

  • Size

    8.6MB

  • MD5

    2e57838af780fba75f9085a67cde99e4

  • SHA1

    8070b4e5c50a4a981f6dcf78ffd424c065182b09

  • SHA256

    0a9e739910578192e2ad3f8f805a863d5cbcacbc38cde6488d7bbef5395dba87

  • SHA512

    84d58581d306c568db4ce572c509f69751932fe9293218f531e4d92951dd7d804756aeca8ede459c0a634e6f140fd9455693955325739657b5699d5d48d0ce63

  • SSDEEP

    196608:FuYr1j0wlfy/tycs/bZ6ctLCyoZcmtZs47ctad+UK7HZDLtHw57I:FuYr5ik/TtLCfXOad+/ZHs7I

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 37 IoCs
  • Loads dropped DLL 16 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\spsetup132.exe
    "C:\Users\Admin\AppData\Local\Temp\spsetup132.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Loads dropped DLL
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3976
    • C:\Program Files\Speccy\Speccy64.exe
      "C:\Program Files\Speccy\Speccy64.exe"
      2⤵
        PID:2484

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Speccy\Lang\lang-1034.dll

      Filesize

      86KB

      MD5

      52e6a2417cb6855d34b2c29e8c46a7cf

      SHA1

      9fe0c63039728334f023b8b08f3d45c3c3b739a2

      SHA256

      a84dbfab73568b73ee5f94bce0b43cc2487638962d3e500d1fdb1d666ec1e024

      SHA512

      d1161a7cb8b1e7cda982ca96758c0ef3e2ad039fe1f5b913c704c189bf960a9e02cdeae310512227881d559fa3cee226e5c4616b3279198c38a983102750ad35

    • C:\Program Files\Speccy\Lang\lang-1034.dll

      Filesize

      86KB

      MD5

      52e6a2417cb6855d34b2c29e8c46a7cf

      SHA1

      9fe0c63039728334f023b8b08f3d45c3c3b739a2

      SHA256

      a84dbfab73568b73ee5f94bce0b43cc2487638962d3e500d1fdb1d666ec1e024

      SHA512

      d1161a7cb8b1e7cda982ca96758c0ef3e2ad039fe1f5b913c704c189bf960a9e02cdeae310512227881d559fa3cee226e5c4616b3279198c38a983102750ad35

    • C:\Program Files\Speccy\Lang\lang-1035.dll

      Filesize

      83KB

      MD5

      17aa2f62022349d437c88fa20e4a2614

      SHA1

      9a42e8eb8fd0cccf90ea090c22221078f85f005f

      SHA256

      3e85a29e06e9b3249f07f01f5b1d28bc9596d3c5a3e9a1c0f59ab4febede2af0

      SHA512

      fc2f49fdc448ddad09db040cb549139c971db92f9379fb19fc3b3bc5afeb7aaf236a3ff9e844246515d80bfbf892619129219020bc391fb200d43803242938f0

    • C:\Program Files\Speccy\Lang\lang-1035.dll

      Filesize

      83KB

      MD5

      17aa2f62022349d437c88fa20e4a2614

      SHA1

      9a42e8eb8fd0cccf90ea090c22221078f85f005f

      SHA256

      3e85a29e06e9b3249f07f01f5b1d28bc9596d3c5a3e9a1c0f59ab4febede2af0

      SHA512

      fc2f49fdc448ddad09db040cb549139c971db92f9379fb19fc3b3bc5afeb7aaf236a3ff9e844246515d80bfbf892619129219020bc391fb200d43803242938f0

    • C:\Program Files\Speccy\Lang\lang-1036.dll

      Filesize

      83KB

      MD5

      b1284354327ef02b49e544ac793f6133

      SHA1

      19099eac446b960bd15a2585030355bfc1a661e4

      SHA256

      854c2e3e288ea5197fc84842107c991d081794ea6a72bcb92a0696f1f64b056c

      SHA512

      f78930cbb75c1ed46ccafef428d664b4e6f248d3e1cf54604e838216795608df58cb250e6e2360d509e1db0ad342a8a234cec3ae19cd140ff055079bd435d97c

    • C:\Program Files\Speccy\Lang\lang-1036.dll

      Filesize

      83KB

      MD5

      b1284354327ef02b49e544ac793f6133

      SHA1

      19099eac446b960bd15a2585030355bfc1a661e4

      SHA256

      854c2e3e288ea5197fc84842107c991d081794ea6a72bcb92a0696f1f64b056c

      SHA512

      f78930cbb75c1ed46ccafef428d664b4e6f248d3e1cf54604e838216795608df58cb250e6e2360d509e1db0ad342a8a234cec3ae19cd140ff055079bd435d97c

    • C:\Program Files\Speccy\Lang\lang-1037.dll

      Filesize

      66KB

      MD5

      ebefa147111fde9b5201b44022c6dfaa

      SHA1

      c7c0a4010fcd09ac9cceb122e468f7e672c946b5

      SHA256

      01d24790c1aa19b18a58ad491de497e5d97551e4e69f72c4981d551d8ac28fd2

      SHA512

      549019de74a55553eb39c5cf68b0de87f382abf7fb857c721a20bd7797e35d424838c4fd11328950b6311a8db0a84b9280c28b539c5c93283cbd526fe2584ef9

    • C:\Program Files\Speccy\Lang\lang-1037.dll

      Filesize

      66KB

      MD5

      ebefa147111fde9b5201b44022c6dfaa

      SHA1

      c7c0a4010fcd09ac9cceb122e468f7e672c946b5

      SHA256

      01d24790c1aa19b18a58ad491de497e5d97551e4e69f72c4981d551d8ac28fd2

      SHA512

      549019de74a55553eb39c5cf68b0de87f382abf7fb857c721a20bd7797e35d424838c4fd11328950b6311a8db0a84b9280c28b539c5c93283cbd526fe2584ef9

    • C:\Program Files\Speccy\Lang\lang-1038.dll

      Filesize

      81KB

      MD5

      16e8b36b7d32c9ba1244acc916f61875

      SHA1

      3e87cedec5899f7d35121b07faa1bb1b00a5bcd4

      SHA256

      007d6edd16d867fd90ef10ba1e0dbdbc3a1d00f675df8c58a654dd1c3633689d

      SHA512

      5db00a5ddae227cf7c4b99dbe8ccb3a7a4bff55ed902bd349c343a33668a3b19ec63f322ad9eb7b3a5a62944bfb39f7ac8225b6410b1d1e202f1f7246b9a2e68

    • C:\Program Files\Speccy\Lang\lang-1038.dll

      Filesize

      81KB

      MD5

      16e8b36b7d32c9ba1244acc916f61875

      SHA1

      3e87cedec5899f7d35121b07faa1bb1b00a5bcd4

      SHA256

      007d6edd16d867fd90ef10ba1e0dbdbc3a1d00f675df8c58a654dd1c3633689d

      SHA512

      5db00a5ddae227cf7c4b99dbe8ccb3a7a4bff55ed902bd349c343a33668a3b19ec63f322ad9eb7b3a5a62944bfb39f7ac8225b6410b1d1e202f1f7246b9a2e68

    • C:\Program Files\Speccy\Lang\lang-1040.dll

      Filesize

      81KB

      MD5

      0bbd0dd2123f0134289e1899beeadcfa

      SHA1

      c1b0d49f4d5c24b5f0605b3a514fe8b3cb5de02c

      SHA256

      e3b75bd3ffaa7a165adaf2101bbd0190afc7515194069856edc3397959f3a0a4

      SHA512

      4c85aedc57025c89d9f7719f96fc7cda02fb4bc57e506ade8cbb03cd77c5bab3ba358b3925cf2fccc9bdc4f8f1b9ae0be5840f91e351ae1b3d62b44a27bfbe87

    • C:\Program Files\Speccy\Lang\lang-1040.dll

      Filesize

      81KB

      MD5

      0bbd0dd2123f0134289e1899beeadcfa

      SHA1

      c1b0d49f4d5c24b5f0605b3a514fe8b3cb5de02c

      SHA256

      e3b75bd3ffaa7a165adaf2101bbd0190afc7515194069856edc3397959f3a0a4

      SHA512

      4c85aedc57025c89d9f7719f96fc7cda02fb4bc57e506ade8cbb03cd77c5bab3ba358b3925cf2fccc9bdc4f8f1b9ae0be5840f91e351ae1b3d62b44a27bfbe87

    • C:\Program Files\Speccy\Lang\lang-1041.dll

      Filesize

      55KB

      MD5

      e4ae139f1191415dfa94906870ab28b5

      SHA1

      83f7f161eef6c09ca8485b5dcba95b898c973b2d

      SHA256

      4ab959ee29db99f381aa37e4b05fa33cb87a5c31b76e236ab0c29bd9f1d4538d

      SHA512

      cd002a81a9a139b71bde764820536693bdf1fd763eb23023982a55a754cdde9461b773d3ab590e339f6fd27ac84e17d633f068586e0f9b7e34a5b5887daec6c8

    • C:\Program Files\Speccy\Lang\lang-1041.dll

      Filesize

      55KB

      MD5

      e4ae139f1191415dfa94906870ab28b5

      SHA1

      83f7f161eef6c09ca8485b5dcba95b898c973b2d

      SHA256

      4ab959ee29db99f381aa37e4b05fa33cb87a5c31b76e236ab0c29bd9f1d4538d

      SHA512

      cd002a81a9a139b71bde764820536693bdf1fd763eb23023982a55a754cdde9461b773d3ab590e339f6fd27ac84e17d633f068586e0f9b7e34a5b5887daec6c8

    • C:\Program Files\Speccy\Lang\lang-1043.dll

      Filesize

      82KB

      MD5

      ffb6e35bc7a5998ff5d5ba24a869f466

      SHA1

      d5a642bb6aa88fff2459cda34fbda8b4cd816f23

      SHA256

      4fd71f7dc6932583940f26c87032fd370999ef92ddaa828d6298984850348701

      SHA512

      30c3282538c6b599d4d469e5ab7558a24f5f781627d40211b00f1ad88df619ba8d199e000c3ab87d5be40760272aac389ee31a48ff2784e22312519770a49b1a

    • C:\Program Files\Speccy\Lang\lang-1043.dll

      Filesize

      82KB

      MD5

      ffb6e35bc7a5998ff5d5ba24a869f466

      SHA1

      d5a642bb6aa88fff2459cda34fbda8b4cd816f23

      SHA256

      4fd71f7dc6932583940f26c87032fd370999ef92ddaa828d6298984850348701

      SHA512

      30c3282538c6b599d4d469e5ab7558a24f5f781627d40211b00f1ad88df619ba8d199e000c3ab87d5be40760272aac389ee31a48ff2784e22312519770a49b1a

    • C:\Program Files\Speccy\Lang\lang-1045.dll

      Filesize

      81KB

      MD5

      0c56b1b96b3be18b7ec58b1c663a524c

      SHA1

      64159f43ce937b180b71e331693671631df07168

      SHA256

      c578d97c07dd5422fdd2a73e66c3555fbf302e25c85dd9a15e9c75120930402b

      SHA512

      031d6d25416e5a0a9a7a911a850d90e98eea174e1e630e3e7292feb5e5831e131b996b0cd7b72048fbebb90db7922fca1e4401b74d76ee5b849e8ca4421e49bc

    • C:\Program Files\Speccy\Lang\lang-1045.dll

      Filesize

      81KB

      MD5

      0c56b1b96b3be18b7ec58b1c663a524c

      SHA1

      64159f43ce937b180b71e331693671631df07168

      SHA256

      c578d97c07dd5422fdd2a73e66c3555fbf302e25c85dd9a15e9c75120930402b

      SHA512

      031d6d25416e5a0a9a7a911a850d90e98eea174e1e630e3e7292feb5e5831e131b996b0cd7b72048fbebb90db7922fca1e4401b74d76ee5b849e8ca4421e49bc

    • C:\Program Files\Speccy\Lang\lang-1046.dll

      Filesize

      78KB

      MD5

      1ff7950eeeeeac8ae4a0eaea33ee7b42

      SHA1

      918cb4b578f579f0aeb59aea3d64aa918c43f964

      SHA256

      e4f747fc2c6d19f38aa0b04852e9ab8152bb4b04468d6115bb76cb5d06b46031

      SHA512

      f6fb85e66e56320bf93e38abcce29bf6a67a8df7f6a5cb1a9abd9aa794394d302f7bbf7a0249f6c8552517ed9eed960e08c21f73fda883fd52a983c841fd2ff6

    • C:\Program Files\Speccy\Lang\lang-1046.dll

      Filesize

      78KB

      MD5

      1ff7950eeeeeac8ae4a0eaea33ee7b42

      SHA1

      918cb4b578f579f0aeb59aea3d64aa918c43f964

      SHA256

      e4f747fc2c6d19f38aa0b04852e9ab8152bb4b04468d6115bb76cb5d06b46031

      SHA512

      f6fb85e66e56320bf93e38abcce29bf6a67a8df7f6a5cb1a9abd9aa794394d302f7bbf7a0249f6c8552517ed9eed960e08c21f73fda883fd52a983c841fd2ff6

    • C:\Program Files\Speccy\Lang\lang-1049.dll

      Filesize

      77KB

      MD5

      6fbe3b991761678df3943a4fdacd53b4

      SHA1

      23121473e2b0356ea46ee4105813c2bb6d4a1d8e

      SHA256

      1ace20196a9ba651d8267314fdce3686eddb82c47a8f97593a865daa18c2e7bd

      SHA512

      5b5632a05b50ac6d7159c7bade950c9c11d04d4d2f6e7520a612680bc6d253492da21c5bd561c2d7301fd39715021915b8d91d92146da8f0557c6d2adf4e4795

    • C:\Program Files\Speccy\Lang\lang-1049.dll

      Filesize

      77KB

      MD5

      6fbe3b991761678df3943a4fdacd53b4

      SHA1

      23121473e2b0356ea46ee4105813c2bb6d4a1d8e

      SHA256

      1ace20196a9ba651d8267314fdce3686eddb82c47a8f97593a865daa18c2e7bd

      SHA512

      5b5632a05b50ac6d7159c7bade950c9c11d04d4d2f6e7520a612680bc6d253492da21c5bd561c2d7301fd39715021915b8d91d92146da8f0557c6d2adf4e4795

    • C:\Program Files\Speccy\Lang\lang-1050.dll

      Filesize

      85KB

      MD5

      9151b422df85c5332162254567c0c9d0

      SHA1

      8cb5a1b093bdd7338010d44dd954b4ca0f26f67d

      SHA256

      d9fb740bb46df481c44356684fe644fc945bc57ff269f8b619419a26b11d3d35

      SHA512

      8660a05b82de92582cbe46e79f1801c9c0516d9465ac2b6ad3417face79e1b1471fb03c9ce07927e87c03a0ee0f26237c11d3a3e333dfa8a1794718bc5344c47

    • C:\Program Files\Speccy\Lang\lang-1050.dll

      Filesize

      85KB

      MD5

      9151b422df85c5332162254567c0c9d0

      SHA1

      8cb5a1b093bdd7338010d44dd954b4ca0f26f67d

      SHA256

      d9fb740bb46df481c44356684fe644fc945bc57ff269f8b619419a26b11d3d35

      SHA512

      8660a05b82de92582cbe46e79f1801c9c0516d9465ac2b6ad3417face79e1b1471fb03c9ce07927e87c03a0ee0f26237c11d3a3e333dfa8a1794718bc5344c47

    • C:\Program Files\Speccy\Lang\lang-1051.dll

      Filesize

      73KB

      MD5

      e9e5e0b4e27a260a0a5ae43bda4a1812

      SHA1

      c814f9172c24a5ce58374999264af02b99b828f7

      SHA256

      5858f1ad625b3934cb6bdf1c5a14b4368da94c0cb97d0d1b65b6985d23450b59

      SHA512

      311093dfa8ec36a98b0f308f8cc752797e0f2e40c6b0fb541510dcd61f33ddc135dcd6a7b0dc3982a813d499d9d685c6e5ef80080547f6f756c2db5f22f8eedd

    • C:\Program Files\Speccy\Lang\lang-1051.dll

      Filesize

      73KB

      MD5

      e9e5e0b4e27a260a0a5ae43bda4a1812

      SHA1

      c814f9172c24a5ce58374999264af02b99b828f7

      SHA256

      5858f1ad625b3934cb6bdf1c5a14b4368da94c0cb97d0d1b65b6985d23450b59

      SHA512

      311093dfa8ec36a98b0f308f8cc752797e0f2e40c6b0fb541510dcd61f33ddc135dcd6a7b0dc3982a813d499d9d685c6e5ef80080547f6f756c2db5f22f8eedd

    • C:\Program Files\Speccy\Speccy64.exe

      Filesize

      7.3MB

      MD5

      d41812a78894d4e47df163db19d354e6

      SHA1

      580a2d42799843fb213c91d730d850c5db997363

      SHA256

      5465297f50aa45b3d19c721259f38452b533e4569e85fef7568867303a7bc3ee

      SHA512

      a5957c9502cf4ba650f204808f37c116aaaec4e26fadff2db3c1e331f73c8cdf76ade248ee8a548196f4083624c2640efd5bdf4f7e85d777973a1bd6fa83f10f

    • C:\Program Files\Speccy\Speccy64.exe

      Filesize

      2.1MB

      MD5

      daae3df706a4ffa554a1585d918cf2a3

      SHA1

      4b34a5d16af9cdd07042d083d1d302af97688e93

      SHA256

      1a1240a5adf58e5a77f32f52c8a87ae6cdb9a99095c2dc085a9570861bb38e18

      SHA512

      cdf0fb96d514ff6f056f70e24ab3a49c45667cb123e723b96792dfb40559e56a8a6ca10b9c25f64505724f28a475f6c67f751b677e08d9e6a221c76fbedbba50

    • C:\Program Files\Speccy\Speccy64.exe

      Filesize

      3.1MB

      MD5

      9dc653bc7df975c3602e3dda8dbcf552

      SHA1

      f4040c270a54f3c11385bbd10bc43f252bba5a3a

      SHA256

      ae55e5d78fd3afa13d729beac7ee466796bf533684b9d3d8e1e259d5bcab4b50

      SHA512

      76ebc30e29dc5b5e4e896733dc324c47d04d56a41884e54d38173cb2d67c656df097948dfef6ccde1d1da5702f4c20dc5b058ba0add4a14cda40b31ef3b4b188

    • C:\Program Files\Speccy\lang\lang-1034.dll

      Filesize

      86KB

      MD5

      52e6a2417cb6855d34b2c29e8c46a7cf

      SHA1

      9fe0c63039728334f023b8b08f3d45c3c3b739a2

      SHA256

      a84dbfab73568b73ee5f94bce0b43cc2487638962d3e500d1fdb1d666ec1e024

      SHA512

      d1161a7cb8b1e7cda982ca96758c0ef3e2ad039fe1f5b913c704c189bf960a9e02cdeae310512227881d559fa3cee226e5c4616b3279198c38a983102750ad35

    • C:\Program Files\Speccy\lang\lang-1035.dll

      Filesize

      83KB

      MD5

      17aa2f62022349d437c88fa20e4a2614

      SHA1

      9a42e8eb8fd0cccf90ea090c22221078f85f005f

      SHA256

      3e85a29e06e9b3249f07f01f5b1d28bc9596d3c5a3e9a1c0f59ab4febede2af0

      SHA512

      fc2f49fdc448ddad09db040cb549139c971db92f9379fb19fc3b3bc5afeb7aaf236a3ff9e844246515d80bfbf892619129219020bc391fb200d43803242938f0

    • C:\Program Files\Speccy\lang\lang-1036.dll

      Filesize

      83KB

      MD5

      b1284354327ef02b49e544ac793f6133

      SHA1

      19099eac446b960bd15a2585030355bfc1a661e4

      SHA256

      854c2e3e288ea5197fc84842107c991d081794ea6a72bcb92a0696f1f64b056c

      SHA512

      f78930cbb75c1ed46ccafef428d664b4e6f248d3e1cf54604e838216795608df58cb250e6e2360d509e1db0ad342a8a234cec3ae19cd140ff055079bd435d97c

    • C:\Program Files\Speccy\lang\lang-1037.dll

      Filesize

      66KB

      MD5

      ebefa147111fde9b5201b44022c6dfaa

      SHA1

      c7c0a4010fcd09ac9cceb122e468f7e672c946b5

      SHA256

      01d24790c1aa19b18a58ad491de497e5d97551e4e69f72c4981d551d8ac28fd2

      SHA512

      549019de74a55553eb39c5cf68b0de87f382abf7fb857c721a20bd7797e35d424838c4fd11328950b6311a8db0a84b9280c28b539c5c93283cbd526fe2584ef9

    • C:\Program Files\Speccy\lang\lang-1038.dll

      Filesize

      81KB

      MD5

      16e8b36b7d32c9ba1244acc916f61875

      SHA1

      3e87cedec5899f7d35121b07faa1bb1b00a5bcd4

      SHA256

      007d6edd16d867fd90ef10ba1e0dbdbc3a1d00f675df8c58a654dd1c3633689d

      SHA512

      5db00a5ddae227cf7c4b99dbe8ccb3a7a4bff55ed902bd349c343a33668a3b19ec63f322ad9eb7b3a5a62944bfb39f7ac8225b6410b1d1e202f1f7246b9a2e68

    • C:\Program Files\Speccy\lang\lang-1040.dll

      Filesize

      81KB

      MD5

      0bbd0dd2123f0134289e1899beeadcfa

      SHA1

      c1b0d49f4d5c24b5f0605b3a514fe8b3cb5de02c

      SHA256

      e3b75bd3ffaa7a165adaf2101bbd0190afc7515194069856edc3397959f3a0a4

      SHA512

      4c85aedc57025c89d9f7719f96fc7cda02fb4bc57e506ade8cbb03cd77c5bab3ba358b3925cf2fccc9bdc4f8f1b9ae0be5840f91e351ae1b3d62b44a27bfbe87

    • C:\Program Files\Speccy\lang\lang-1041.dll

      Filesize

      55KB

      MD5

      e4ae139f1191415dfa94906870ab28b5

      SHA1

      83f7f161eef6c09ca8485b5dcba95b898c973b2d

      SHA256

      4ab959ee29db99f381aa37e4b05fa33cb87a5c31b76e236ab0c29bd9f1d4538d

      SHA512

      cd002a81a9a139b71bde764820536693bdf1fd763eb23023982a55a754cdde9461b773d3ab590e339f6fd27ac84e17d633f068586e0f9b7e34a5b5887daec6c8

    • C:\Program Files\Speccy\lang\lang-1043.dll

      Filesize

      82KB

      MD5

      ffb6e35bc7a5998ff5d5ba24a869f466

      SHA1

      d5a642bb6aa88fff2459cda34fbda8b4cd816f23

      SHA256

      4fd71f7dc6932583940f26c87032fd370999ef92ddaa828d6298984850348701

      SHA512

      30c3282538c6b599d4d469e5ab7558a24f5f781627d40211b00f1ad88df619ba8d199e000c3ab87d5be40760272aac389ee31a48ff2784e22312519770a49b1a

    • C:\Program Files\Speccy\lang\lang-1045.dll

      Filesize

      81KB

      MD5

      0c56b1b96b3be18b7ec58b1c663a524c

      SHA1

      64159f43ce937b180b71e331693671631df07168

      SHA256

      c578d97c07dd5422fdd2a73e66c3555fbf302e25c85dd9a15e9c75120930402b

      SHA512

      031d6d25416e5a0a9a7a911a850d90e98eea174e1e630e3e7292feb5e5831e131b996b0cd7b72048fbebb90db7922fca1e4401b74d76ee5b849e8ca4421e49bc

    • C:\Program Files\Speccy\lang\lang-1046.dll

      Filesize

      78KB

      MD5

      1ff7950eeeeeac8ae4a0eaea33ee7b42

      SHA1

      918cb4b578f579f0aeb59aea3d64aa918c43f964

      SHA256

      e4f747fc2c6d19f38aa0b04852e9ab8152bb4b04468d6115bb76cb5d06b46031

      SHA512

      f6fb85e66e56320bf93e38abcce29bf6a67a8df7f6a5cb1a9abd9aa794394d302f7bbf7a0249f6c8552517ed9eed960e08c21f73fda883fd52a983c841fd2ff6

    • C:\Program Files\Speccy\lang\lang-1049.dll

      Filesize

      77KB

      MD5

      6fbe3b991761678df3943a4fdacd53b4

      SHA1

      23121473e2b0356ea46ee4105813c2bb6d4a1d8e

      SHA256

      1ace20196a9ba651d8267314fdce3686eddb82c47a8f97593a865daa18c2e7bd

      SHA512

      5b5632a05b50ac6d7159c7bade950c9c11d04d4d2f6e7520a612680bc6d253492da21c5bd561c2d7301fd39715021915b8d91d92146da8f0557c6d2adf4e4795

    • C:\Program Files\Speccy\lang\lang-1050.dll

      Filesize

      85KB

      MD5

      9151b422df85c5332162254567c0c9d0

      SHA1

      8cb5a1b093bdd7338010d44dd954b4ca0f26f67d

      SHA256

      d9fb740bb46df481c44356684fe644fc945bc57ff269f8b619419a26b11d3d35

      SHA512

      8660a05b82de92582cbe46e79f1801c9c0516d9465ac2b6ad3417face79e1b1471fb03c9ce07927e87c03a0ee0f26237c11d3a3e333dfa8a1794718bc5344c47

    • C:\Program Files\Speccy\lang\lang-1051.dll

      Filesize

      73KB

      MD5

      e9e5e0b4e27a260a0a5ae43bda4a1812

      SHA1

      c814f9172c24a5ce58374999264af02b99b828f7

      SHA256

      5858f1ad625b3934cb6bdf1c5a14b4368da94c0cb97d0d1b65b6985d23450b59

      SHA512

      311093dfa8ec36a98b0f308f8cc752797e0f2e40c6b0fb541510dcd61f33ddc135dcd6a7b0dc3982a813d499d9d685c6e5ef80080547f6f756c2db5f22f8eedd

    • C:\Program Files\Speccy\lang\lang-1052.dll

      Filesize

      79KB

      MD5

      c4ed5ea4876722b228d9a189386e2654

      SHA1

      89dfdc5d45913db12a6b3cc2684ae7ab09c74994

      SHA256

      68f5a8b4cabf62a0c5eefb02478416240992d08dbb3214765ba341dc4cbd3b0d

      SHA512

      1a2f07592773b1d55ce9b20b7a67f369cfab29e07cb0ce55ec3b43d8e6dd4d784568b35d24260890c5c368daabfd1d2459bb2030d08a4ce4542af6cac5defdf7

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\V01.log

      Filesize

      512KB

      MD5

      26c4feeaef837b17805c1232fdd6fd8c

      SHA1

      1a0eed4e853dbcef873bd25b8aad65a776951488

      SHA256

      59e18ee3b9a9b9226e637282a3bf3f2a5222738dfe5882a39da832bc9e4637bf

      SHA512

      618b50b98fd7cb7786ef3cff75d20a2e1172fa58e937616532e0850a1d0f6ef06b45862bd6edc8af583b6eeab00b7628f582372de301ab1df018da350ffce91f

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat

      Filesize

      14.0MB

      MD5

      424c6738d0c6ef30638c8c68f90a4a2b

      SHA1

      02c9cc883cad4db25167c34a46c1680e548d3d6a

      SHA256

      eeac50f4d275bbc253b1e28acf04eeef7f665ec6c857aa71866ea18b3fb16826

      SHA512

      b4b2ed61590014dfcc6346b8b9790dfda9ce95c555d8aa27ec6ab7c75db5342f30e0589abcc29bc2d78f3e331f181a7aeb4de2d73e1cfdf2f8f0cdd3c9cca19f

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm

      Filesize

      16KB

      MD5

      b3d37640faa34e2d758db0060d4160c6

      SHA1

      9ac9d3d16293ab4811641979ece2e98a3a5a2dd4

      SHA256

      0ffd9933fbe8ed20d991d0fd1187407056ef3d36e6dae132dea9b9b72bccac3f

      SHA512

      65df8bfbbbd676f7bfaeaea48978dc2f45ef454688b213c1e69a96177187e37bc5ced74ddb0ee0cf010460626baaaebc3f27c6d643fbec25dd308c9f279c53af

    • C:\Users\Admin\AppData\Local\Temp\nsh8B2B.tmp\ButtonEvent.dll

      Filesize

      5KB

      MD5

      c24568a3b0d7c8d7761e684eb77252b5

      SHA1

      66db7f147cbc2309d8d78fdce54660041acbc60d

      SHA256

      e2da6d8b73b5954d58baa89a949aacece0527dfb940ca130ac6d3fd992d0909d

      SHA512

      5d43e4c838fd7f4c6a4ab6cc6d63e0f81d765d9ca33d9278d082c4f75f9416907df10b003e10edc1b5ef39535f722d8dbfab114775ac67da7f9390dcc2b4b443

    • C:\Users\Admin\AppData\Local\Temp\nsh8B2B.tmp\ButtonEvent.dll

      Filesize

      5KB

      MD5

      c24568a3b0d7c8d7761e684eb77252b5

      SHA1

      66db7f147cbc2309d8d78fdce54660041acbc60d

      SHA256

      e2da6d8b73b5954d58baa89a949aacece0527dfb940ca130ac6d3fd992d0909d

      SHA512

      5d43e4c838fd7f4c6a4ab6cc6d63e0f81d765d9ca33d9278d082c4f75f9416907df10b003e10edc1b5ef39535f722d8dbfab114775ac67da7f9390dcc2b4b443

    • C:\Users\Admin\AppData\Local\Temp\nsh8B2B.tmp\System.dll

      Filesize

      11KB

      MD5

      41a3c964232edd2d7d5edea53e8245cd

      SHA1

      76d7e1fbf15cc3da4dd63a063d6ab2f0868a2206

      SHA256

      8b65fec615c7b371c23f8f7f344b12dc5085e40a556f96db318ed757494d62d5

      SHA512

      fa16bd9d020602e3065afd5c0638bc37775b40eb18bfa33b4ca5babcc3e6f112ae7d43457a6e9685ddbe6e94b954a1dc43d1da7af9ca7464019a3f110af549c1

    • C:\Users\Admin\AppData\Local\Temp\nsh8B2B.tmp\System.dll

      Filesize

      11KB

      MD5

      41a3c964232edd2d7d5edea53e8245cd

      SHA1

      76d7e1fbf15cc3da4dd63a063d6ab2f0868a2206

      SHA256

      8b65fec615c7b371c23f8f7f344b12dc5085e40a556f96db318ed757494d62d5

      SHA512

      fa16bd9d020602e3065afd5c0638bc37775b40eb18bfa33b4ca5babcc3e6f112ae7d43457a6e9685ddbe6e94b954a1dc43d1da7af9ca7464019a3f110af549c1

    • C:\Users\Admin\AppData\Local\Temp\nsh8B2B.tmp\System.dll

      Filesize

      11KB

      MD5

      41a3c964232edd2d7d5edea53e8245cd

      SHA1

      76d7e1fbf15cc3da4dd63a063d6ab2f0868a2206

      SHA256

      8b65fec615c7b371c23f8f7f344b12dc5085e40a556f96db318ed757494d62d5

      SHA512

      fa16bd9d020602e3065afd5c0638bc37775b40eb18bfa33b4ca5babcc3e6f112ae7d43457a6e9685ddbe6e94b954a1dc43d1da7af9ca7464019a3f110af549c1

    • C:\Users\Admin\AppData\Local\Temp\nsh8B2B.tmp\UserInfo.dll

      Filesize

      4KB

      MD5

      c1f778a6d65178d34bde4206161a98e0

      SHA1

      29719fffef1ab6fe2df47e5ed258a5e3b3a11cfc

      SHA256

      9caf7a78f750713180cf64d18967a2b803b5580e636e59279dcaaf18ba0daa87

      SHA512

      9c3cf25cf43f85a5f9c9ed555f12f3626ef9daeeedd4d366ada58748ead1f6e279fea977c76ae8bae1dc49bfd852e899cb137c4a006c13e9fcebf6e5e2926a4d

    • C:\Users\Admin\AppData\Local\Temp\nsh8B2B.tmp\UserInfo.dll

      Filesize

      4KB

      MD5

      c1f778a6d65178d34bde4206161a98e0

      SHA1

      29719fffef1ab6fe2df47e5ed258a5e3b3a11cfc

      SHA256

      9caf7a78f750713180cf64d18967a2b803b5580e636e59279dcaaf18ba0daa87

      SHA512

      9c3cf25cf43f85a5f9c9ed555f12f3626ef9daeeedd4d366ada58748ead1f6e279fea977c76ae8bae1dc49bfd852e899cb137c4a006c13e9fcebf6e5e2926a4d

    • C:\Users\Admin\AppData\Local\Temp\nsh8B2B.tmp\UserInfo.dll

      Filesize

      4KB

      MD5

      c1f778a6d65178d34bde4206161a98e0

      SHA1

      29719fffef1ab6fe2df47e5ed258a5e3b3a11cfc

      SHA256

      9caf7a78f750713180cf64d18967a2b803b5580e636e59279dcaaf18ba0daa87

      SHA512

      9c3cf25cf43f85a5f9c9ed555f12f3626ef9daeeedd4d366ada58748ead1f6e279fea977c76ae8bae1dc49bfd852e899cb137c4a006c13e9fcebf6e5e2926a4d

    • C:\Users\Admin\AppData\Local\Temp\nsh8B2B.tmp\g\gcapi_dll.dll

      Filesize

      348KB

      MD5

      2973af8515effd0a3bfc7a43b03b3fcc

      SHA1

      4209cded0caac7c5cb07bcb29f1ee0dc5ac211ee

      SHA256

      d0e4581210a22135ce5deb47d9df4d636a94b3813e0649aab84822c9f08af2a0

      SHA512

      b6f9653142ec00b2e0a5045f0f2c7ba5dbbda8ef39edf14c80a24ecab3c41f081eb466994aaf0879ac96b201ba5c02d478275710e4d08b3debc739063d177f7e

    • C:\Users\Admin\AppData\Local\Temp\nsh8B2B.tmp\g\gcapi_dll.dll

      Filesize

      348KB

      MD5

      2973af8515effd0a3bfc7a43b03b3fcc

      SHA1

      4209cded0caac7c5cb07bcb29f1ee0dc5ac211ee

      SHA256

      d0e4581210a22135ce5deb47d9df4d636a94b3813e0649aab84822c9f08af2a0

      SHA512

      b6f9653142ec00b2e0a5045f0f2c7ba5dbbda8ef39edf14c80a24ecab3c41f081eb466994aaf0879ac96b201ba5c02d478275710e4d08b3debc739063d177f7e

    • C:\Users\Admin\AppData\Local\Temp\nsh8B2B.tmp\g\gcapi_dll.dll

      Filesize

      348KB

      MD5

      2973af8515effd0a3bfc7a43b03b3fcc

      SHA1

      4209cded0caac7c5cb07bcb29f1ee0dc5ac211ee

      SHA256

      d0e4581210a22135ce5deb47d9df4d636a94b3813e0649aab84822c9f08af2a0

      SHA512

      b6f9653142ec00b2e0a5045f0f2c7ba5dbbda8ef39edf14c80a24ecab3c41f081eb466994aaf0879ac96b201ba5c02d478275710e4d08b3debc739063d177f7e

    • C:\Users\Admin\AppData\Local\Temp\nsh8B2B.tmp\inetc.dll

      Filesize

      23KB

      MD5

      7760daf1b6a7f13f06b25b5a09137ca1

      SHA1

      cc5a98ea3aa582de5428c819731e1faeccfcf33a

      SHA256

      5233110ed8e95a4a1042f57d9b2dc72bc253e8cb5282437637a51e4e9fcb9079

      SHA512

      d038bea292ffa2f2f44c85305350645d504be5c45a9d1b30db6d9708bfac27e2ff1e41a76c844d9231d465f31d502a5313dfded6309326d6dfbe30e51a76fdb5

    • C:\Users\Admin\AppData\Local\Temp\nsh8B2B.tmp\inetc.dll

      Filesize

      23KB

      MD5

      7760daf1b6a7f13f06b25b5a09137ca1

      SHA1

      cc5a98ea3aa582de5428c819731e1faeccfcf33a

      SHA256

      5233110ed8e95a4a1042f57d9b2dc72bc253e8cb5282437637a51e4e9fcb9079

      SHA512

      d038bea292ffa2f2f44c85305350645d504be5c45a9d1b30db6d9708bfac27e2ff1e41a76c844d9231d465f31d502a5313dfded6309326d6dfbe30e51a76fdb5

    • C:\Users\Admin\AppData\Local\Temp\nsh8B2B.tmp\inetc.dll

      Filesize

      23KB

      MD5

      7760daf1b6a7f13f06b25b5a09137ca1

      SHA1

      cc5a98ea3aa582de5428c819731e1faeccfcf33a

      SHA256

      5233110ed8e95a4a1042f57d9b2dc72bc253e8cb5282437637a51e4e9fcb9079

      SHA512

      d038bea292ffa2f2f44c85305350645d504be5c45a9d1b30db6d9708bfac27e2ff1e41a76c844d9231d465f31d502a5313dfded6309326d6dfbe30e51a76fdb5

    • C:\Users\Admin\AppData\Local\Temp\nsh8B2B.tmp\nsDialogs.dll

      Filesize

      9KB

      MD5

      2aba8f16eca82517460013a3de7cbf67

      SHA1

      3812192fa7b873f426c4b0d0d822b3c9d51aa164

      SHA256

      60b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d

      SHA512

      4e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0

    • C:\Users\Admin\AppData\Local\Temp\nsh8B2B.tmp\nsDialogs.dll

      Filesize

      9KB

      MD5

      2aba8f16eca82517460013a3de7cbf67

      SHA1

      3812192fa7b873f426c4b0d0d822b3c9d51aa164

      SHA256

      60b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d

      SHA512

      4e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0

    • C:\Users\Admin\AppData\Local\Temp\nsh8B2B.tmp\nsDialogs.dll

      Filesize

      9KB

      MD5

      2aba8f16eca82517460013a3de7cbf67

      SHA1

      3812192fa7b873f426c4b0d0d822b3c9d51aa164

      SHA256

      60b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d

      SHA512

      4e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0

    • C:\Users\Admin\AppData\Local\Temp\nsh8B2B.tmp\nsDialogs.dll

      Filesize

      9KB

      MD5

      2aba8f16eca82517460013a3de7cbf67

      SHA1

      3812192fa7b873f426c4b0d0d822b3c9d51aa164

      SHA256

      60b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d

      SHA512

      4e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0

    • C:\Users\Admin\AppData\Local\Temp\nsh8B2B.tmp\nsDialogs.dll

      Filesize

      9KB

      MD5

      2aba8f16eca82517460013a3de7cbf67

      SHA1

      3812192fa7b873f426c4b0d0d822b3c9d51aa164

      SHA256

      60b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d

      SHA512

      4e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0

    • C:\Users\Admin\AppData\Local\Temp\nsh8B2B.tmp\nsDialogs.dll

      Filesize

      9KB

      MD5

      2aba8f16eca82517460013a3de7cbf67

      SHA1

      3812192fa7b873f426c4b0d0d822b3c9d51aa164

      SHA256

      60b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d

      SHA512

      4e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0

    • C:\Users\Admin\AppData\Local\Temp\nsh8B2B.tmp\nsDialogs.dll

      Filesize

      9KB

      MD5

      2aba8f16eca82517460013a3de7cbf67

      SHA1

      3812192fa7b873f426c4b0d0d822b3c9d51aa164

      SHA256

      60b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d

      SHA512

      4e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0

    • C:\Users\Admin\AppData\Local\Temp\nsh8B2B.tmp\ui\pfUI.dll

      Filesize

      13.6MB

      MD5

      1bfa036321fcb209564549538345a289

      SHA1

      8ede722a5cc6135847ad5276f30143022fa7bacf

      SHA256

      547e48f35a1c38362cfa71a3ffe1b81cc8d61eb204157828e2ec58a80f3e4b2e

      SHA512

      9729cc5ca18dbd58b516169de053d50e0df9288fc2d91cbbbd887573fe006c5f506789f23a09a73dfcf75fa71b9cff88e0f59da550263d877939be8c4f996d92

    • C:\Users\Admin\AppData\Local\Temp\nsh8B2B.tmp\ui\pfUI.dll

      Filesize

      13.6MB

      MD5

      1bfa036321fcb209564549538345a289

      SHA1

      8ede722a5cc6135847ad5276f30143022fa7bacf

      SHA256

      547e48f35a1c38362cfa71a3ffe1b81cc8d61eb204157828e2ec58a80f3e4b2e

      SHA512

      9729cc5ca18dbd58b516169de053d50e0df9288fc2d91cbbbd887573fe006c5f506789f23a09a73dfcf75fa71b9cff88e0f59da550263d877939be8c4f996d92

    • C:\Users\Admin\AppData\Local\Temp\nsh8B2B.tmp\ui\res\Montserrat-Regular.otf

      Filesize

      44KB

      MD5

      27e50ffd6a14cbc8221c9dbd3b5208dc

      SHA1

      713c997ce002a4d8762c2dcc405213061233e4bc

      SHA256

      40fc1142200a5c1c18f80b6915257083c528c7f7fd2b00a552aeebc42898d428

      SHA512

      0a602f88cfba906b41719943465edb09917c447d746bfed5c9ce9c75d077f6aed2f8146697acd74557359f1ae267ca2a8e3a2ca40fb1633bde8e6114261abd90

    • C:\Users\Admin\AppData\Local\Temp\nsh8B2B.tmp\ui\res\PF_logo.png

      Filesize

      3KB

      MD5

      079cca30760cca3c01863b6b96e87848

      SHA1

      98c2ca01f248bc61817db7e5faea4a3d8310db50

      SHA256

      8dd37d3721e25c32c5bf878b6dba9e61d04b7ce8aec45bdf703a41bc41802dfa

      SHA512

      3e25c10e3a5830584c608b9178ab062e93e0e9009a7d897bb5e3561180b0b0910bd4178063d982eb33806a005c93931ae2ec5be520ec0d0c9a7c452cb78fd6a8

    • C:\Users\Admin\AppData\Local\Temp\nsh8B2B.tmp\ui\res\SP_computer.png

      Filesize

      66KB

      MD5

      873b7c34ced38adaa2d01752099c09df

      SHA1

      e659d094f6e3fe6f71a3f1b047b75206bab168a0

      SHA256

      aced6376065f2c71b4b619823f735bbdcac967a5113cd4e6b978298a58c927c9

      SHA512

      a8d54d52bb5ec4502cd4bb829eef23c1b2edff9daeeca0f4fb7dbaa0cabdcac763a60aedc8393ba12a393a8263a5c06d3555d7b165cf9927dd9cc18d68b9e510

    • C:\Users\Admin\AppData\Local\Temp\nsh8B2B.tmp\ui\res\Speccy_Logo_72px.png

      Filesize

      8KB

      MD5

      1787175d95eab213cf5a8bc25e252676

      SHA1

      1d4bd97b2bcaabd26f2ef7781b91233575e1ba0f

      SHA256

      65fa6baa9d140251d04069cf538f3262ebbb0e4e62d58d06cc58ad8b22085a83

      SHA512

      de1df226bb9bf84305aea43c237ea76937a9df0c56ecd9afeee1920c3f4d600fde0cc0c027ca397fb6067ffb1a7fe8c03496d82ed844bb4f47f32b2b30eda52f

    • memory/3976-268-0x0000000007110000-0x0000000007111000-memory.dmp

      Filesize

      4KB

    • memory/3976-259-0x0000000007160000-0x0000000007168000-memory.dmp

      Filesize

      32KB

    • memory/3976-280-0x0000000007200000-0x0000000007208000-memory.dmp

      Filesize

      32KB

    • memory/3976-283-0x0000000007240000-0x0000000007248000-memory.dmp

      Filesize

      32KB

    • memory/3976-265-0x0000000007150000-0x0000000007158000-memory.dmp

      Filesize

      32KB

    • memory/3976-262-0x0000000007160000-0x0000000007168000-memory.dmp

      Filesize

      32KB

    • memory/3976-260-0x0000000007150000-0x0000000007151000-memory.dmp

      Filesize

      4KB

    • memory/3976-282-0x0000000007240000-0x0000000007248000-memory.dmp

      Filesize

      32KB

    • memory/3976-258-0x00000000073C0000-0x00000000073C8000-memory.dmp

      Filesize

      32KB

    • memory/3976-240-0x0000000006350000-0x0000000006360000-memory.dmp

      Filesize

      64KB

    • memory/3976-234-0x00000000061B0000-0x00000000061C0000-memory.dmp

      Filesize

      64KB

    • memory/3976-286-0x0000000007150000-0x0000000007151000-memory.dmp

      Filesize

      4KB

    • memory/3976-290-0x0000000007110000-0x0000000007111000-memory.dmp

      Filesize

      4KB

    • memory/3976-336-0x0000000007340000-0x0000000007348000-memory.dmp

      Filesize

      32KB

    • memory/3976-338-0x00000000073C0000-0x00000000073C8000-memory.dmp

      Filesize

      32KB

    • memory/3976-341-0x0000000007160000-0x0000000007161000-memory.dmp

      Filesize

      4KB