Resubmissions

28-03-2023 03:34

230328-d4zntaaf4s 7

28-03-2023 03:31

230328-d27awaaf3y 7

Analysis

  • max time kernel
    61s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    28-03-2023 03:34

General

  • Target

    CrystalDiskInfo8_17_5.exe

  • Size

    5.0MB

  • MD5

    8360ed8f8351c16f6259b88ce8c86353

  • SHA1

    ceaa5c1bddbb1486826ca3427bbb0450e5ad8bcf

  • SHA256

    892fad32d6aa24b24dbdd5757ba026206f24a7e78b84ffc1a579510c5a294137

  • SHA512

    8bbeecb698c00a7c992a4c08ebf0565f6edd2a08b45ddbc5bd1762e42175a38767400b3e5d9db8b5b1e08e2a899a5d00dd6f4e107babd4c18f4ed4b00b65f610

  • SSDEEP

    98304:ikLKxHcD7YjjIygnuXRv9ERNcM3dyMEBWdpObW:tKpcD7YXmSqRMMqEObW

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 9 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CrystalDiskInfo8_17_5.exe
    "C:\Users\Admin\AppData\Local\Temp\CrystalDiskInfo8_17_5.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Users\Admin\AppData\Local\Temp\is-GSSKT.tmp\CrystalDiskInfo8_17_5.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-GSSKT.tmp\CrystalDiskInfo8_17_5.tmp" /SL5="$70120,4163908,857600,C:\Users\Admin\AppData\Local\Temp\CrystalDiskInfo8_17_5.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1528
      • C:\Program Files\CrystalDiskInfo\DiskInfo64.exe
        "C:\Program Files\CrystalDiskInfo\DiskInfo64.exe"
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Writes to the Master Boot Record (MBR)
        • Drops file in Program Files directory
        • Suspicious use of SetWindowsHookEx
        PID:300

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Bootkit

1
T1067

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\CrystalDiskInfo\CdiResource\dialog\Graph.html
    Filesize

    8KB

    MD5

    8f1697ee6ec9064c8f34e987e1492b23

    SHA1

    1055e314e088f5a21d8b0e49b10ce4e8bdd3b2de

    SHA256

    93abe1dedcec0cc9cee33562d2e9b4990e67186a171e9eb7ad0354818c071f06

    SHA512

    f313b3a7bd973cdc724033802a901a4dc0f6646c35d8987048829ecafb865ab08364a816be9367b9a0ec3dc7e97ed4720cacf37303f70a14c99b7167ba65eb77

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Arabic.lang
    Filesize

    76KB

    MD5

    ca14440d70f4d35a3b859864941f6979

    SHA1

    8f86510477b8eecc242087974b3eb7280d922262

    SHA256

    bb9020c1961a422adc215e6d123b63a9da897b0c060f86818088379b0abcb9f2

    SHA512

    6e198de5ffdee3a9628542bd699fb88fcacbf4cdf7c8700030933466a8337bc6d35c44a6866ee289e02ffe1aae27ed829b008990c35812259d20666102e2bc2e

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Armenian.lang
    Filesize

    79KB

    MD5

    ce6ce165dd0d60542e3ab3c8a4951482

    SHA1

    8dbdccc7940d0ac28f6f07bdad9f9c49ced202aa

    SHA256

    b73a449ffe1c6667376e4273c0769854e8c66a9f708438c2553cd81c821f8e99

    SHA512

    b92ce44bd2a2369e5753de879ff1fea4c729976df36854e5ad64c3684fa5bd4b27ce67993c5923781518f2c4f6f48cbe27b4893e82210fae5b404aa5a63f4448

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Azeri.lang
    Filesize

    76KB

    MD5

    e89ebb4f803a0c9d895c7f3858502791

    SHA1

    7177cf59eb4b36dcfa2179ad2ace265589783aa6

    SHA256

    42bbc4cf3eefdc2012b339cff623fd1a891ee4166c5cce1f0ac88c15ea893306

    SHA512

    d583de381703dccab574eaad8270c6d673b968c048d3660cb9b0e6a6737a68c759726a2326d7b16da4963c32f82f9c7850ca5ed530006b202d6b49fbb2e3f5fc

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Bulgarian.lang
    Filesize

    80KB

    MD5

    9b9af57e856bf8d4a67043e4fa57ced1

    SHA1

    55d12ad3e2bcb0365693350e28c51c73d60ec8ad

    SHA256

    2c639663dc5373825a1d22aa6c42f264e9c8bae334c550c0885f5b470f5af1fa

    SHA512

    ed3004f8ed24dd4d0279cd2dec1c79153553c44741c57c5ec7d70bd377dce01b8740a0991b6858b2edb974c3a1f66ce1ed121f2e7b5490e0629181ad452cf93c

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Czech.lang
    Filesize

    82KB

    MD5

    a558801f86b4bc3228f72ffa3803d621

    SHA1

    a6d881d785a15ee66e11bb777b3cca9da54d2eb5

    SHA256

    8c347117c0b958260a183b589b7d56d0dfbd986397cebbd58af7f76efbb7abd3

    SHA512

    326ff7a83323d70913d55a9f7900e935da55724308ebe02521df8cb087a63be5771b757619f19d4bc4066813d0799021abb639bd8fad97eab6d7ff876eacc520

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Danish.lang
    Filesize

    76KB

    MD5

    8947b8fbfd576280a9a084fdfb865791

    SHA1

    c76bb9b340b2d8f2f4d7cb102d9f02a580c9f7b0

    SHA256

    044f85d597d0dc14e164e6b2f6fdde167ffb27b342a6f37870a6e635d60c9e23

    SHA512

    1d2497ca866621de61bf011c1b8e8667fad2e6bd9c919ca1ee9d977f1cf1f009936845ab7c2b04e7a0684b6a8cc2b14412a98a6cd291582d2f34268d25fe91a5

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Dutch.lang
    Filesize

    77KB

    MD5

    a60f46d91a5bf2cf122f4e5b728973a1

    SHA1

    067016e3e79aeaff36334449cb557a8bfc1fc9aa

    SHA256

    94aae90539777651dc26a26a5c89cebbfcd82672bd49988b22d8bdf7538589a3

    SHA512

    19accd0dbd7bdcd6fa61168b48f684c1bec4999c64477b72fc7945d846af8c6884396cb20545f733eb8f7f599594d54e11f852333e064cf1a10433a4976063a3

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\English.lang
    Filesize

    79KB

    MD5

    094e471e82d830d87fa943ef5ad998f5

    SHA1

    dfc2679d67623e49ddd1b7e545098e37a1ea23b2

    SHA256

    c74f644c0fb2ad41b2fc8b9909e7585f7d72cd60d7897ad6dc21044f9581259b

    SHA512

    9108ba04977cc45b5c947ce58ea9eb8e60c38ba46321c42c4eb69ab3131f5b00c5efd02e5165dcd9ca91e19347fe70b91cf369aa8f6904cf054c6c1056a6d6e7

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Filipino.lang
    Filesize

    78KB

    MD5

    03897554cf3f5cf535c7df3d61473ad4

    SHA1

    f2c4e55436a147b3f51f7a4f1b905347cc9acadc

    SHA256

    3aca0891350f6a33710833236034dc344bf936eb497a7eeb3b32f58e08bc78e2

    SHA512

    b761990dbcb9465a8a5db8b16f33a1dc6cd0b541f45a90562c925c440caa703dbad4dcd29e84da9ab5164b11ccda6e2abeac840e932a9bb584e7fe63e89388f1

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Finnish.lang
    Filesize

    82KB

    MD5

    e89b84e56fa3d48d4aa36fc646b77698

    SHA1

    e1b619c1be303839763d88d434fb7e8cf2004952

    SHA256

    d9bb16129a8dbe61ffe252accda764142dbbdac86b83b8834cf7d4dd37d6e35b

    SHA512

    4d40f355a360d51f62db869419f7584371bae6ffa538cd4fdb17418c4577dc3ea850d490948b55050dea7084a954fffe94fec909b598f68016f1122715e7ec13

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\French.lang
    Filesize

    92KB

    MD5

    e219694addcadb1123d6fc59a8e42752

    SHA1

    8ba768017bfeceacdd44445c565c5d3ea23163ae

    SHA256

    c7c8de716212154b417bc728ed3d45ae983e7eb0b6d872cb0432bdcdc74a750b

    SHA512

    640fb89882beff67f18dca1d5ff37975cf54ebceba00f4bbeeefbe9a3109de5bb78f24700343d9dcdb8563ec9668a4f05481bf2e73a4c4534983daf6da27760f

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Galician.lang
    Filesize

    91KB

    MD5

    c29435fa924e71b6202e72399db5ff4b

    SHA1

    92393a61f627c19cdb42b553b2cba07c782c90ec

    SHA256

    d95d01b81dcc20607d3ef5fbcd6eab328b7c19248d0222f8937929489917a80e

    SHA512

    a4c8798461acb8895d823868a6b405c43db32524036531dfff450c82880bdcb1af58a1c0cc582fc14f497d88b8e0de6cbb5d8689694ea09c797b7ad1d4ba1a2c

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\German.lang
    Filesize

    79KB

    MD5

    2fd8ec42284b83f325b5d7ed610f4899

    SHA1

    11f665a87bdf0218cf255f9d3ae41d076a848e2f

    SHA256

    45d4cf36e64abd09a6a06d8b3144eeae066a5e5642b3fa200cb1cb3d88601af6

    SHA512

    ddc9442da679b118b8ddf740b995afb187c76cba3af00ffdb3845f20a295d855f8c50370d908a3bfc471667d62cf15d19c998269ebc7285a85dbac2422f007a7

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Greek.lang
    Filesize

    78KB

    MD5

    316fccc9e1af005e5ff23d743c143eb5

    SHA1

    1eb6141cb6ea26a3a8b18fd06896f560720c6a54

    SHA256

    7e5afbdaa76c73068cf760d16dfaa4a508e76b1ab49344ae9210fdc208f29fa4

    SHA512

    1f6efeba28e3bdc86c53cd29b7fb08a2d8c17cac5a2a48b25dab0d2788d585b118468f8f24738dbcf6a34db4f2b46d19e8bcdff1938a37f73a9770603e6af2c4

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Hungarian.lang
    Filesize

    83KB

    MD5

    b870233c0af48f0230de74cfba404b1c

    SHA1

    bbbd7f9ee30246b669a2249b9584ee1fbeadf7c8

    SHA256

    d62beb47bc194ae1731b10961da11713d5a829b18fb9fe1f3434fef8aae7a398

    SHA512

    52d31e0dbbb063f81598f65d1f95b9974ac200d8c3e98a7306d7eda143a381f0db4fc990bdd1cd00794a77bb32d96e582f49b27dc26804866a98a5fc46294230

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Italian.lang
    Filesize

    79KB

    MD5

    be3e2271389f6b200f955e4bed9b0dcf

    SHA1

    1d247875722d40739ddf4a95de93f11dff12814d

    SHA256

    7b055669dc1e197ad393785638eab5993f6f35816c4425f44c2b63946fb85fca

    SHA512

    eda48038a903616c7a7ddbc2ed26632e4c1862a3e1cdba78dd1f701c1d31c31e90aa87c8ff508623ca49b69b6920f20dc091b2f471f9b4c00bdd60db8f913570

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Japanese.lang
    Filesize

    50KB

    MD5

    68bbce950f1fd2364b518b2484c90e2d

    SHA1

    d00d87a6d5d8cf82b0a80ec50f5bbe350e2ddc66

    SHA256

    54167cd8e2c3bbc84f2b818908c72710c9e88adfb09765eaa5fc7789dc93ff9d

    SHA512

    925fc74a948ccd830d4534a96984ea43754f08c3666bff0f3fd0092f3d4d6f5d8375b5282388866cedae25a5f2c18c2c1fc32d0ecce5fde6feab7ab6ee2b986b

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Korean.lang
    Filesize

    52KB

    MD5

    a68cdd82ed7942020c4cfa8bce71c7e6

    SHA1

    39cb90e0eeab05e75b19f11520311857857a04c0

    SHA256

    82a85265ce62c0778f9acd824f2b5222d7b8946615c250dd7d3dc33fc1cfe540

    SHA512

    de159b9e2626a600f7594fe21633c15a9bb5330a349f44841874aa16040173ac1f3e6a57377ce777739aa3bf9029f1dfab4e2708248803114190a71aaf43f2cd

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Lithuanian.lang
    Filesize

    76KB

    MD5

    ed203e61bb87be8f42136009b4acb351

    SHA1

    4787b752651198142dd4ff14a9e3da7c0638a060

    SHA256

    5266f29845c0f0a1a663b3f4ad128cb9b33aa8c3c945eabc200968b26ad3aed2

    SHA512

    8e49a0e231f83b1e86c048d56b183b829219745e13e927c07905bc44ac8b6a0f41edd4afb67f9715f68f5cd60526b107bdaa111b2ca08e45d5b752cf498cd491

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Norwegian.lang
    Filesize

    75KB

    MD5

    35c2d53d9d789f3ae76e4f109704ecc8

    SHA1

    5e6bca57afe718d6bf1441e74b478d8f0ceab6eb

    SHA256

    9ef245d39785b013d704a062608febde2b73c80b147b2db22c3bcea820e68160

    SHA512

    a543ad0f368229280f3585401088a3b8fa394d5ea1de6038bd7055b01287b4468b0bc5de6dfbd65eb93b61e69fd0529889cc0184c8071c49831c796b4517a114

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Polish.lang
    Filesize

    83KB

    MD5

    83c42f157576c7265097fe78d79cf46e

    SHA1

    546576401159d0521782e214e86f3d9894c7ba1b

    SHA256

    034bbd5a980af97531c8830c09190c48b134a75e62e48032d232e281687e7d96

    SHA512

    02d884d310eb7228adf9aae1e44552e47e2589eaca2d59a85a391e352a9726362ad817083d32be686d184adaf8a3ff005c88ba57ff5baa247dab235ce0401aa1

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Portuguese.lang
    Filesize

    76KB

    MD5

    1b3274944ff33e8037ea13b042f20321

    SHA1

    4132a805fb6362db869b38eadff26f110b8c7915

    SHA256

    292d6d4a492879ae409b1fee4cfb5496b731eeef14a547488989c04378689378

    SHA512

    342e3cd59c743995a4ed7dd3e2b883a36f2fb649cda37f337d3a6e71730b0f99b52bb8ab270ac6630ad03fc59069af2ee5c4a4f337568f56953efb87507eab72

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Romanian.lang
    Filesize

    78KB

    MD5

    9a73063c6838f4ad4de8b79ae208841f

    SHA1

    ca1ae002ab3af6c5aec07f1c7980f91a8df267f1

    SHA256

    d68c102b477f67d07e2bb67659bd77af458f47179abb07f0e1306a21ae633e20

    SHA512

    d0beb79eccdd6254d0542b5bd7b7cda0226f910ae1b70a2a48c67cdcfa87321df99acfcd0332baad9df42429f42496152656dec81457a3f078671b3ccd26917a

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Russian.lang
    Filesize

    82KB

    MD5

    4fedb2460091d1fd093e4f7d21127b1e

    SHA1

    9bc21b57de21fb43941941c5baf1999a001b5ed3

    SHA256

    6639a32c8468a150ab86d19170775c60d3e866127f96bbdfaa77a52a7dd5c016

    SHA512

    28ce86251155c0249dc3d49b4c96251a27c0901f3533ef10590fc923a2cf879eeed8cb9e05730301100241f106441dcb616e8d62f1ac24e901f27674146ae962

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Serbian.lang
    Filesize

    76KB

    MD5

    96da7d4d6578fea00129eeedfc352a78

    SHA1

    af9fc5d3cc36f5acdbbaf7414337adc49999ec1e

    SHA256

    40edbac7f9c6eedaf57860f54a2875d814e2697ae65d703d60791539d4f09606

    SHA512

    12f297bb98294ba817887c0c1f67985ec80fb6e871de760ce35a7b3294a34c9ba43f40649e10f8b9c23dfe160be93cb0717139d8921f27897db2d0a4dfd8d4d9

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Simplified Chinese.lang
    Filesize

    51KB

    MD5

    910c670d6e23b6d2343634ef20d8e1ae

    SHA1

    d43e678c3138c81a2df2f887b2f280a393f1b1d9

    SHA256

    43af775c4e798947a4f61c7a8770655e3f80e73d50f80bb53db66a713a4ce04b

    SHA512

    9473be1623c7a57b0523a855ad8af301a19192ddc9b352752cedd96ea02843942e783c82f246fc1a125f892acbab02e4fe45b1bdc22f687b99e239371033b5f0

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Slovak.lang
    Filesize

    94KB

    MD5

    dc5266e3e9e62398ef43f6067d694bee

    SHA1

    083341f195923b94d6c247803968b50ec031e297

    SHA256

    b31cde68e66bec44c7c3ba4f1e756c5500285fe548442439909c6407a743b47a

    SHA512

    0e7204d47b1b9f0c84b512fe35825447a68491bfd894a4b03665702436544d880c73b251daf5e93f82c9fbb79a00b3499c8f28be071a5fb904cbf9a4e2b375f7

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Slovenian.lang
    Filesize

    91KB

    MD5

    b61824d7da04ab177781f6368213e19e

    SHA1

    8659765b863ac291bf3d47aff97e06703df58127

    SHA256

    323303e7697eec7494dbadd89ec31feca5e81b270a31ee7e8cd3926f58ae8ec4

    SHA512

    f1a0a2d881cb0f59f307bd031d6dfdbd5d7650884d64ac55be955f4dc701fcae03951df97d61fc12a2100de0e70cf3f99ef61136697c5368420a8918be879c1d

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Spanish.lang
    Filesize

    77KB

    MD5

    95c0c56c7eadd9290c2cbcb56a38a715

    SHA1

    68a718f2249fdea16f589dac2d1e18a50b30f5e8

    SHA256

    d6b7f7ba940a70008dccce49f3a5248110611292c7d2dc4b21bb50fbe3385bef

    SHA512

    1017f334c414cfbd361aa90336cfb6db7f7bb24e7cb916a875c5bbba4724b350db9ed29270b21c40f7121245ea5ed64e2bc20027ff7821e76328a9108709f5a4

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Swedish.lang
    Filesize

    76KB

    MD5

    aa9acb848d6daacd313890102e38e1e5

    SHA1

    69e0e25865df11683cc9d1b3dbe819ef43160a74

    SHA256

    e0f2bb875f5aabd5e108086f0b3987f13d3ddb6f7d85e14e8afbcb2d97d6cef2

    SHA512

    ebcd70ea3ac9c42d0f3ee05694493f856cb52a74d2017327c00241fa37f90701671021284d4a86ac4ea920bf55935de542e0018214b5c722aa7c7633c2909fda

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Thai.lang
    Filesize

    79KB

    MD5

    10ff670e423638e284953ef81476bcdb

    SHA1

    fae824348ffc0ace167252c957e058e2fe29839b

    SHA256

    c3d07f5841a30ffe5839ba148a02ae31e7bca35ea278bce18a02480029cc4f2d

    SHA512

    70d61f91a2e44ba69cdd617b3ac89175d880a2fbc4444d3a19dadfa108a76e20c2b6d605ff923e00ac9b4ad70f426df1c960cd9023346e7dc22974e732e8c18a

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Traditional Chinese.lang
    Filesize

    46KB

    MD5

    c172edcbd66d89230c6d5a9dce40b208

    SHA1

    712db52a7daf330c713ed60749ee856fb4b00c20

    SHA256

    5e21f054f549a46577fd05842f57b1a97c51043679b79494c2d076e467d56d2a

    SHA512

    63b1c9d691d381c328297f475a325479e511bbab3ee0d353b82272d65407f962969383ea6cc79934c84caaa521495217b22767c1df037cec669bfd9498805650

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Turkish.lang
    Filesize

    87KB

    MD5

    8f469b2b9d190772cf44e3a865a63095

    SHA1

    03848ef40e855ce3e4034bf91681682e4d4e2d97

    SHA256

    8a0b28447feb9da7498a839b68e1505231c0807f4e6b776d583021a1d8a1187f

    SHA512

    c90c05f704f59e499633c05348f9f6ea897974faf34cd29901fc23cf0093672c4addaaea3ffe9ac99a8e5eea926a5d38e0180293bf3d38c3d4a2a26d8790ce55

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Ukrainian.lang
    Filesize

    76KB

    MD5

    0a2571eac71e3fdc669fa9b456eaf3c6

    SHA1

    25417cd4ba593bd7f2d62b175009cdfc31382168

    SHA256

    208bdd6fb9726336c11379e142b0846bcb0f00aff0455fba1ca17e1f429ba05e

    SHA512

    0d2d609e3283d85f96626f0cf44528d099b2c553ff659f9d535cc189442e9e9c33c67d2bbd1e7e7dea06a256e7e2b636fcd18f1a0b4ccb870049317fb845d361

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Vietnamese.lang
    Filesize

    76KB

    MD5

    0fb6ca41a11c1677ffee9578ffe9649e

    SHA1

    a9f7518e46723fb5444598baa21c5f3a45ec8761

    SHA256

    f27917ccac55a17d0705f07b9653a7601f180fb28ca87e73e558a7e21e950c80

    SHA512

    158888399555b575413a339757c7d9e5ff2835aa37f3d1b584e3b0df1205cc304935e73d1e6ba031dc9fadf5464125b960198bfd1c247d15d9e8f5ea54525af3

  • C:\Program Files\CrystalDiskInfo\CdiResource\themes\Default\Background-300.png
    Filesize

    29KB

    MD5

    77767641110eb0eb62cd38ac3494fd24

    SHA1

    2d6c0cedf6b9a96292695ebd3e829e6f47dbfc45

    SHA256

    8717fdc9d5f8a4c200d38dac5178b31e1157d7a1f4f389c839dae74198d35e10

    SHA512

    0e0bf2ecf9c765ae0265706f19218ede958c65cab79743fcc2785bccef824200f06ce0543a8b1a765681ee9846a5c911548f8e1f5f25310aaa1122d22601b3ae

  • C:\Program Files\CrystalDiskInfo\CdiResource\themes\Default\diskGood-100.png
    Filesize

    1KB

    MD5

    c0e81a6dd776dcedbe2107bcad87bdcd

    SHA1

    1d1bbc27de9329d287179b36cdcaad1083359ea3

    SHA256

    41e8e14948103b7ba676fceaccef1f6b4fb08b70ea6f207f4d6fb6aef3f1e71f

    SHA512

    38b57f9cee97ac10b61a2fe9222c0085b0e6ffe18ac6457963a5a5e21ff5b602350204675f1ff9606c384d5b8484e4588ad9bac9208aeaf0008215c6fae678b6

  • C:\Program Files\CrystalDiskInfo\CdiResource\themes\Default\diskStatusGood-100.png
    Filesize

    918B

    MD5

    ad2e97a4c59814858876abad24002ffd

    SHA1

    7636bf632981a0d6ccbf3adcdc78d2715f9f359e

    SHA256

    e290f8d7031f82007b91cf3082825540f0a6585065dd0ae8f467fefe4d81e4fc

    SHA512

    09a1485cb7c4580e5094c4d6f08c5b10c567b6ffa6a6b7f7b80d8fcc5ee0ba88091432530f1b01ee09b0cd15a6e387e5557d843d91b0273bd0a6bb1a550f2efc

  • C:\Program Files\CrystalDiskInfo\CdiResource\themes\Default\nextDisk-100.png
    Filesize

    1KB

    MD5

    dc3be62f884c9b96af9a3d5b2a937cb6

    SHA1

    7a06d204ea1bb9130845305face66d7f74efa2e5

    SHA256

    cb9099db8ccb5d69db902858ebdd0657667fdc4c2ac1b8211b0d2503be18639a

    SHA512

    2b8163d191793ddda76ce36c08d87b343dd528ca042cfb795a816b96c8d7be90d584a34e4734d217a24ed54db1ce11332108540bd34baa64778f785c0bcd4a19

  • C:\Program Files\CrystalDiskInfo\CdiResource\themes\Default\noDisk-100.png
    Filesize

    137B

    MD5

    aca9c4d69b8c4779167452f77f415a9a

    SHA1

    d40806f8ef1a7cb989dfbe9cfb4b3be717a47292

    SHA256

    0229291a30857f8ce7499e7f9a6ac30be452419bd5327b98468deba097ae76ee

    SHA512

    91652e2bdb710a11c25e78a8192c0da52538690e2743ba2f228e29279e0175d02e30ee01e4213b866552c4cf4e8c18ce687da13bd64d4ee554054f2efbc2df8a

  • C:\Program Files\CrystalDiskInfo\CdiResource\themes\Default\preDisk-100.png
    Filesize

    1KB

    MD5

    b49a97118724c54530d4c4eaefd729c8

    SHA1

    102187b9534a2c6359d37b68f9509e0fd227b473

    SHA256

    4358ec9b50bf01820f6037299941916c196616fa08d8150b57607957cecda485

    SHA512

    5a5ab0d9cec7aa61b99cb1b3742df2acdadff43cb12dcdc48cfea95eb9479ae4c5673870f2b85560ed3285961837fe0c4eed3e31f1ada33fdcdcd23336dc236c

  • C:\Program Files\CrystalDiskInfo\CdiResource\themes\Default\temperatureGood-100.png
    Filesize

    2KB

    MD5

    f8f84f5782ae011b707822d8ac8ee4d6

    SHA1

    fa9fceedd5066b2e97ef2774a4315c9ecb71f897

    SHA256

    26d0fdec518f2a16d535306d81459746811882da15c691113134d82442f5d58a

    SHA512

    ace2ceb3289ce68a8bcf2f18a040afee31138683656d8adb24a305f6b9f0bc32a34db4b2c681a538a634a3e6a36b2481cea282b61edbd5f2c5bf62066b5e402d

  • C:\Program Files\CrystalDiskInfo\CdiResource\themes\Default\theme.ini
    Filesize

    263B

    MD5

    13ad481754e04748b701e99dba1590d6

    SHA1

    e3acda213a1e905177a700f2c051b3f646da9237

    SHA256

    b9f6949d00fe5da3508e363b970435bc8d4c34761dca6e84b651459ad9cabfb9

    SHA512

    b734653b9ce95f9752f749c2cf686c4e82459cb3b8b47a8f46aadcf87042dc70f5c3ded20a884be04033aec39fd00f9c1fa27039f64335b3e19d89f2198b371a

  • C:\Program Files\CrystalDiskInfo\CdiResource\themes\Simplicity\is-3IL95.tmp
    Filesize

    1KB

    MD5

    e8799e2989a9ec24ea55195adf9d2e89

    SHA1

    3ba12b043c5d27b56b9691271d53d037dbe0f410

    SHA256

    3ff066b7b8d75fa423837c5880f45727b86e1f2366852c399d672c3dcf6a80ae

    SHA512

    05b854ac0c5faef1f255e2d24c1923c40019f1eef8d4a77215469ecba004720e6f781f84a872e790a9163799be6cd7cec088e04200e15aed5b7ada174b2436b7

  • C:\Program Files\CrystalDiskInfo\CdiResource\themes\Simplicity\is-3TL7G.tmp
    Filesize

    1KB

    MD5

    8d1ad40d84930c904a3c46a2e876110e

    SHA1

    b49b07507ded62c5be9db303de3c0ac129eeb89c

    SHA256

    d7ad392146e0be9b808bf4568cf9e10d8f6c20c2055aee1f26763118fd6d422a

    SHA512

    d8f63bacd180132d4d63a9ef40fea46c0b2a712ccfca9b05814ebecd300e31e2f55a72dec9a7fe18c150866a0abf0eb88aceed5ff6c856895dfc2ed0cd052137

  • C:\Program Files\CrystalDiskInfo\CdiResource\themes\Simplicity\is-3UGCD.tmp
    Filesize

    1KB

    MD5

    cd53ebbeedfcdbe04ac94f0323440d83

    SHA1

    2249087471df17ab704b9e24c620a7d7f9e406d9

    SHA256

    16e367b75d0cb12efeb05cf23e696c06941e319509302bd99942b06d8daa4cb6

    SHA512

    07bbf2cfff944579a68dc337ecf7ededebd408ba7849f58e4de6215656f94f04d6af3b197c00b147092cb018dfaf196b1fbdd384360319fb1367fc55c77e2ee6

  • C:\Program Files\CrystalDiskInfo\CdiResource\themes\Simplicity\is-AAA7V.tmp
    Filesize

    923B

    MD5

    dce02b9a45fba2a70042c8c1e03d9b94

    SHA1

    978e46984c3122ca2ecc5392b6b6f877dbe178b3

    SHA256

    0b0106761cac0e726c84c5883c989fae0e33c9ec90f3951e9a16e0e6128c183f

    SHA512

    476d6d814e6d5402d33748469d4cc86acb41aa79b9e4ce851c1531fb6706b9adcf1386b44cb293c8abb0b11768fb004ba89814a0caaab4579538d35edfa3060f

  • C:\Program Files\CrystalDiskInfo\CdiResource\themes\Simplicity\is-QUAHP.tmp
    Filesize

    1KB

    MD5

    f8b559a259cfe0f8eb39d1596f371767

    SHA1

    fdb89b6a1f08f7d8e83fd862403da71e110f737f

    SHA256

    c964d3efbe51d9c9ceb113d6eee196e1fd19938cadd733011c24b91d093f16de

    SHA512

    d8ab05bfac764187049cc0ca3c7a5e7112e5bd685b083d01fee6ea1939b8ff53c1a316e549f3a4c2a1e011fea101155fe36109c875593884972dbb0fbbef171a

  • C:\Program Files\CrystalDiskInfo\DiskInfo.ini
    Filesize

    285B

    MD5

    e47dfcb8d63fb4fec259a2302f2aaadd

    SHA1

    a224f39bc24a512f22da4b3f269d40f7b7635e1a

    SHA256

    85c1e4cef908c7548cac9c8ea5ecb70071554942cc687e49d249fdb53aa78eac

    SHA512

    031835b6e12ef2f0f16ee26834e0b84c7b8c4302753ece221a1d300a8e716f62e95f1804e2214cae8c72d1bfd2ced7de075a7a59064a3856d580db703bc8bc5d

  • C:\Program Files\CrystalDiskInfo\DiskInfo.ini
    Filesize

    301B

    MD5

    1e3d4ffe3b23d47c50079ed84f6b4c33

    SHA1

    d1622991e8a5e10196abfb09ae9c6117e4d1ca5b

    SHA256

    87e5c9f693b6f0d89696e210afa52125364d792f84a046bcb02af506dcfe6cf9

    SHA512

    359f669da3eee2b960e2516b299c087cdb37eb85be86e1b43835e74df2861d8a37b3e594cedc6611aeea68a3e21a9de6c14dbd2689c20f4cf8cd66ce9f760ce3

  • C:\Program Files\CrystalDiskInfo\DiskInfo.ini
    Filesize

    52B

    MD5

    edd394c4f2662892177e0e3ffae7793a

    SHA1

    062335a5de7f2b957daa95e7a3232b6cdc27ab2c

    SHA256

    31159fa2aedcf19bc8399c5e83b5f5c4bff7be5a4a1379aebef40f655250cc90

    SHA512

    ec18b35285283f086d794ab82a4b3176c1afc44f784051aae2cc9b8ca2f8b6619bc4344969f3a81f303f315edf80ce56b7db0199e1315534b7d81a5ed26d37b1

  • C:\Program Files\CrystalDiskInfo\DiskInfo64.exe
    Filesize

    2.7MB

    MD5

    4d02f1b59c8e224216b2219bd99f9546

    SHA1

    da6bba4a3738263c14d99538be3ddc28d17bdb6f

    SHA256

    7211f990c24732bb70aa9df130745a5a6edd80f6f6fadbfffa1b7b7c3267c19e

    SHA512

    5ac3ca578ce1b369be33deb35529bfc379634c87decc7128396050fe55e4f41aef78c9f8c5fd69dd8a629174758ee0c5617df9800c65d109c41092fbe8e94b2d

  • C:\Program Files\CrystalDiskInfo\DiskInfo64.exe
    Filesize

    2.7MB

    MD5

    4d02f1b59c8e224216b2219bd99f9546

    SHA1

    da6bba4a3738263c14d99538be3ddc28d17bdb6f

    SHA256

    7211f990c24732bb70aa9df130745a5a6edd80f6f6fadbfffa1b7b7c3267c19e

    SHA512

    5ac3ca578ce1b369be33deb35529bfc379634c87decc7128396050fe55e4f41aef78c9f8c5fd69dd8a629174758ee0c5617df9800c65d109c41092fbe8e94b2d

  • C:\Program Files\CrystalDiskInfo\Smart\DADY HARDDISKQM00013\09.csv
    Filesize

    25B

    MD5

    8aa3aa595ac6478805f4a4fc9305a0c1

    SHA1

    cc6e77516f7a9d62b14b14654650bbdfb1591e55

    SHA256

    2a3b9d2a36fb0478596f66dad751e6353ccca7602bce55562c5ef38fbeb72dc9

    SHA512

    728f0d0785a9b39991dc415ca97ac567995e1aa6c9a0140253f8e5775161578ce58e45bd263c290f512297d0d9b016c7d2c9f75faa08f2ec16f0fd813eb0b8dd

  • C:\Program Files\CrystalDiskInfo\Smart\DADY HARDDISKQM00013\Smart.ini
    Filesize

    230B

    MD5

    0819ec7ea9f018f8c7c691dc7f962d8f

    SHA1

    f884107b8aa33087d27f5cd6059c420a4b1be67b

    SHA256

    d13c4dc05c274ed0edece4562f44e8c3cd76cb59d494493a7523990e202c498d

    SHA512

    3e051a12462a94f98032edee7760ee44905dadfb7a59463cc5a08cf3783e3baa87eb9c6e6d350ff65c2152e7325a7850f7c94d6955de356bc53a0ca15dde87d9

  • C:\Program Files\CrystalDiskInfo\Smart\DADY HARDDISKQM00013\Smart.ini
    Filesize

    307B

    MD5

    7c2b2a87eddd8a576bc92f58f4691769

    SHA1

    3940e41a1caa9932b487eb60d3cfe7558b0065a7

    SHA256

    1150f3a7c174d81fd1304eb604750ee5fa33940778e77131ec8114f7b1aea11f

    SHA512

    6f9418bf93af945b4af8cf0d38cecaeb459c4ecfa71396efca1addabbe5afd45c4b99d2ef5a70adc1b8be9d67f837de3b25e9edc74656c3cfb0581242f6fc620

  • C:\Program Files\CrystalDiskInfo\Smart\DADY HARDDISKQM00013\Smart.ini
    Filesize

    472B

    MD5

    2b5d3926319c44f03571b3a4b8a6a1db

    SHA1

    03a9c755eb4341dbe9659a26ac3b11a8cf33c31f

    SHA256

    48508ea736b0ea7b6bca19e6dc7b90c1f37fe7e99be358b9755beb1a4755c197

    SHA512

    ef7e4d593e9141d3f3b4770a1da969b6b77f79f9ef227547cb041df6f8c0f940c33f0134636051fb2fc7d5678b14544c6b4ccc79b4792e068bad177b246ada05

  • C:\Program Files\CrystalDiskInfo\unins000.exe
    Filesize

    3.1MB

    MD5

    1ba538756b5bd8fd4c9296f0cd461a5c

    SHA1

    38bc3f16a7d054ed5368dff5726d16b23580129b

    SHA256

    f946d2ec91242ba4ff46c3e73c1f51f885391f1f56f5689ea973bafcc584a8ae

    SHA512

    fd1effa65a993604894e575b7617d8f32a0eb839fb08f58625c2485795dce369e3cdf15608974d4ff8a09c6867a24861f002f9ceee8d81677220d696b45bedb6

  • C:\Users\Admin\AppData\Local\Temp\is-GSSKT.tmp\CrystalDiskInfo8_17_5.tmp
    Filesize

    3.1MB

    MD5

    1ba538756b5bd8fd4c9296f0cd461a5c

    SHA1

    38bc3f16a7d054ed5368dff5726d16b23580129b

    SHA256

    f946d2ec91242ba4ff46c3e73c1f51f885391f1f56f5689ea973bafcc584a8ae

    SHA512

    fd1effa65a993604894e575b7617d8f32a0eb839fb08f58625c2485795dce369e3cdf15608974d4ff8a09c6867a24861f002f9ceee8d81677220d696b45bedb6

  • C:\Users\Admin\AppData\Local\Temp\is-GSSKT.tmp\CrystalDiskInfo8_17_5.tmp
    Filesize

    3.1MB

    MD5

    1ba538756b5bd8fd4c9296f0cd461a5c

    SHA1

    38bc3f16a7d054ed5368dff5726d16b23580129b

    SHA256

    f946d2ec91242ba4ff46c3e73c1f51f885391f1f56f5689ea973bafcc584a8ae

    SHA512

    fd1effa65a993604894e575b7617d8f32a0eb839fb08f58625c2485795dce369e3cdf15608974d4ff8a09c6867a24861f002f9ceee8d81677220d696b45bedb6

  • \Program Files\CrystalDiskInfo\DiskInfo32.exe
    Filesize

    2.5MB

    MD5

    80bff73c6e61647a327b227130d0a8f3

    SHA1

    2a15c2f0271dfdd7027e6be438dfc993671e4ce4

    SHA256

    28a06d450d6b52c78777d2af878761557cb121d5318aad65c5c31bddaa3ccc50

    SHA512

    4a3209875fe6b967d205c712e6a1f06e0196c975daefe09844ec34fb52a2bcb6f942e2ed5b633d03b0cd566489e6b8f9936689d75b5d1d6d76d6b5899fdfe058

  • \Program Files\CrystalDiskInfo\DiskInfo64.exe
    Filesize

    2.7MB

    MD5

    4d02f1b59c8e224216b2219bd99f9546

    SHA1

    da6bba4a3738263c14d99538be3ddc28d17bdb6f

    SHA256

    7211f990c24732bb70aa9df130745a5a6edd80f6f6fadbfffa1b7b7c3267c19e

    SHA512

    5ac3ca578ce1b369be33deb35529bfc379634c87decc7128396050fe55e4f41aef78c9f8c5fd69dd8a629174758ee0c5617df9800c65d109c41092fbe8e94b2d

  • \Program Files\CrystalDiskInfo\DiskInfo64.exe
    Filesize

    2.7MB

    MD5

    4d02f1b59c8e224216b2219bd99f9546

    SHA1

    da6bba4a3738263c14d99538be3ddc28d17bdb6f

    SHA256

    7211f990c24732bb70aa9df130745a5a6edd80f6f6fadbfffa1b7b7c3267c19e

    SHA512

    5ac3ca578ce1b369be33deb35529bfc379634c87decc7128396050fe55e4f41aef78c9f8c5fd69dd8a629174758ee0c5617df9800c65d109c41092fbe8e94b2d

  • \Program Files\CrystalDiskInfo\DiskInfo64.exe
    Filesize

    2.7MB

    MD5

    4d02f1b59c8e224216b2219bd99f9546

    SHA1

    da6bba4a3738263c14d99538be3ddc28d17bdb6f

    SHA256

    7211f990c24732bb70aa9df130745a5a6edd80f6f6fadbfffa1b7b7c3267c19e

    SHA512

    5ac3ca578ce1b369be33deb35529bfc379634c87decc7128396050fe55e4f41aef78c9f8c5fd69dd8a629174758ee0c5617df9800c65d109c41092fbe8e94b2d

  • \Program Files\CrystalDiskInfo\DiskInfo64.exe
    Filesize

    2.7MB

    MD5

    4d02f1b59c8e224216b2219bd99f9546

    SHA1

    da6bba4a3738263c14d99538be3ddc28d17bdb6f

    SHA256

    7211f990c24732bb70aa9df130745a5a6edd80f6f6fadbfffa1b7b7c3267c19e

    SHA512

    5ac3ca578ce1b369be33deb35529bfc379634c87decc7128396050fe55e4f41aef78c9f8c5fd69dd8a629174758ee0c5617df9800c65d109c41092fbe8e94b2d

  • \Program Files\CrystalDiskInfo\DiskInfo64.exe
    Filesize

    2.7MB

    MD5

    4d02f1b59c8e224216b2219bd99f9546

    SHA1

    da6bba4a3738263c14d99538be3ddc28d17bdb6f

    SHA256

    7211f990c24732bb70aa9df130745a5a6edd80f6f6fadbfffa1b7b7c3267c19e

    SHA512

    5ac3ca578ce1b369be33deb35529bfc379634c87decc7128396050fe55e4f41aef78c9f8c5fd69dd8a629174758ee0c5617df9800c65d109c41092fbe8e94b2d

  • \Program Files\CrystalDiskInfo\DiskInfo64.exe
    Filesize

    2.7MB

    MD5

    4d02f1b59c8e224216b2219bd99f9546

    SHA1

    da6bba4a3738263c14d99538be3ddc28d17bdb6f

    SHA256

    7211f990c24732bb70aa9df130745a5a6edd80f6f6fadbfffa1b7b7c3267c19e

    SHA512

    5ac3ca578ce1b369be33deb35529bfc379634c87decc7128396050fe55e4f41aef78c9f8c5fd69dd8a629174758ee0c5617df9800c65d109c41092fbe8e94b2d

  • \Program Files\CrystalDiskInfo\DiskInfo64.exe
    Filesize

    2.7MB

    MD5

    4d02f1b59c8e224216b2219bd99f9546

    SHA1

    da6bba4a3738263c14d99538be3ddc28d17bdb6f

    SHA256

    7211f990c24732bb70aa9df130745a5a6edd80f6f6fadbfffa1b7b7c3267c19e

    SHA512

    5ac3ca578ce1b369be33deb35529bfc379634c87decc7128396050fe55e4f41aef78c9f8c5fd69dd8a629174758ee0c5617df9800c65d109c41092fbe8e94b2d

  • \Users\Admin\AppData\Local\Temp\is-GSSKT.tmp\CrystalDiskInfo8_17_5.tmp
    Filesize

    3.1MB

    MD5

    1ba538756b5bd8fd4c9296f0cd461a5c

    SHA1

    38bc3f16a7d054ed5368dff5726d16b23580129b

    SHA256

    f946d2ec91242ba4ff46c3e73c1f51f885391f1f56f5689ea973bafcc584a8ae

    SHA512

    fd1effa65a993604894e575b7617d8f32a0eb839fb08f58625c2485795dce369e3cdf15608974d4ff8a09c6867a24861f002f9ceee8d81677220d696b45bedb6

  • memory/1528-1086-0x0000000000400000-0x0000000000719000-memory.dmp
    Filesize

    3.1MB

  • memory/1528-267-0x0000000000400000-0x0000000000719000-memory.dmp
    Filesize

    3.1MB

  • memory/1528-968-0x00000000002C0000-0x00000000002C1000-memory.dmp
    Filesize

    4KB

  • memory/1528-970-0x0000000000400000-0x0000000000719000-memory.dmp
    Filesize

    3.1MB

  • memory/1528-62-0x00000000002C0000-0x00000000002C1000-memory.dmp
    Filesize

    4KB

  • memory/1712-1087-0x0000000000400000-0x00000000004DF000-memory.dmp
    Filesize

    892KB

  • memory/1712-250-0x0000000000400000-0x00000000004DF000-memory.dmp
    Filesize

    892KB

  • memory/1712-54-0x0000000000400000-0x00000000004DF000-memory.dmp
    Filesize

    892KB