Analysis

  • max time kernel
    73s
  • max time network
    77s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    03-04-2023 14:49

General

  • Target

    CrystalDiskInfo8_17_14.exe

  • Size

    5.0MB

  • MD5

    79cead4c2efd357a242ad9e102ab1686

  • SHA1

    a8f57052d20044972df6757dfaed2d9263138774

  • SHA256

    f004c98f0011b2289d929448bad26a49664d51143bf8fb949ae1c5645d716aed

  • SHA512

    f75f51a52f3352a6c9160f43c947a3e2204828e3ab956d07b1294e52b06aa910d7fd99a33bb8c5175876915d678d4149947583d78f5a9cbf48499853e1b726d3

  • SSDEEP

    98304:AkLgt49pH80N0IOAULF4SwU07QUXymV95zfRcI9iX9FQktWqdBLmn:fL8M0IOAELqXrVHfRcqiX9+kIEy

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 9 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CrystalDiskInfo8_17_14.exe
    "C:\Users\Admin\AppData\Local\Temp\CrystalDiskInfo8_17_14.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1236
    • C:\Users\Admin\AppData\Local\Temp\is-92R5U.tmp\CrystalDiskInfo8_17_14.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-92R5U.tmp\CrystalDiskInfo8_17_14.tmp" /SL5="$70124,4174245,857600,C:\Users\Admin\AppData\Local\Temp\CrystalDiskInfo8_17_14.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2040
      • C:\Program Files\CrystalDiskInfo\DiskInfo64.exe
        "C:\Program Files\CrystalDiskInfo\DiskInfo64.exe"
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Writes to the Master Boot Record (MBR)
        • Suspicious use of SetWindowsHookEx
        PID:1768

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Bootkit

1
T1067

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\CrystalDiskInfo\CdiResource\dialog\Graph.html
    Filesize

    8KB

    MD5

    8f1697ee6ec9064c8f34e987e1492b23

    SHA1

    1055e314e088f5a21d8b0e49b10ce4e8bdd3b2de

    SHA256

    93abe1dedcec0cc9cee33562d2e9b4990e67186a171e9eb7ad0354818c071f06

    SHA512

    f313b3a7bd973cdc724033802a901a4dc0f6646c35d8987048829ecafb865ab08364a816be9367b9a0ec3dc7e97ed4720cacf37303f70a14c99b7167ba65eb77

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Arabic.lang
    Filesize

    76KB

    MD5

    d20ca5cee6219453f6ebb75a136525a9

    SHA1

    cfb344e75738d298040318a37161110969f07cad

    SHA256

    f6effdd4d3f47bcc06af49594f41429bec567d476c263e33519febd9e3f46887

    SHA512

    6f4d2cc94a21af6e732c8ec62e3abe5973d0c30ac631c9f8229657cb72dd541f0bb3c075f16962e828b57666d7efe0eac765c3fef5a0a4d494e1fa1a4077c175

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Armenian.lang
    Filesize

    79KB

    MD5

    73939fc23e538a1acf5a4caef2590ca9

    SHA1

    32cc9d36ea5d1614850bec8d80fe8280988bc703

    SHA256

    15d88e2a91ed9f9b746153a0d8256c7aba8df0f0a9cddebeb27bea285117e528

    SHA512

    d733c3debe0b9a50fc110de2d1eac567c60daa6a7affcd2aa07d8dba20244e6e0d184d6fe8401ccc3d12503c63c7897f9a141597bcbdf305c030138774133591

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Azeri.lang
    Filesize

    76KB

    MD5

    7a0d6dca965de560743240e0b8e69747

    SHA1

    61f8e9dc2f127afa4668b9293a17cf80db97e677

    SHA256

    59315c854fe0c87345924987d7ba05bbd108faedd0fac5f44064055d5b12df15

    SHA512

    a545a47c4a26e25b65a71e09049a7f51ee27d97794470274b57e9c77048eb7f1ec28383c922891a6d7560b72bb7eb134eecea94c9817af0e82e00e25bf408ed4

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Bulgarian.lang
    Filesize

    80KB

    MD5

    360e78f507b4a016f1595e4a26c4b377

    SHA1

    4638be5515c430d33875fc8bf0df7d9f8f230c75

    SHA256

    c48e13da3b4bab3bd0faace164aeb17718e2cb83690e02c0b4ab3639f45e1440

    SHA512

    ecece6604b486261c9c3dc09b32b18887b4fa3a52d4e2b2b2bfd427e8345c3be9d8381685f81df7fcfd004276e081add7a040df899fb79850112d1f8edabe214

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Czech.lang
    Filesize

    82KB

    MD5

    a558801f86b4bc3228f72ffa3803d621

    SHA1

    a6d881d785a15ee66e11bb777b3cca9da54d2eb5

    SHA256

    8c347117c0b958260a183b589b7d56d0dfbd986397cebbd58af7f76efbb7abd3

    SHA512

    326ff7a83323d70913d55a9f7900e935da55724308ebe02521df8cb087a63be5771b757619f19d4bc4066813d0799021abb639bd8fad97eab6d7ff876eacc520

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Danish.lang
    Filesize

    76KB

    MD5

    7887bf085da37d3cf705a0fba85426b2

    SHA1

    6e8a2a10ae6a185ba6bc9d897b8f8ad8caeed13d

    SHA256

    66bc6f7b0ebf705ae91b97bf4a5b6d109e031ef449b7832cc0fad4dadc252e8d

    SHA512

    43f6eb3bb511c89ff5785ae52c7672797837284f0321096d1d33a56537b5de301672373da327d0307da30bfdfe46ea37e62140d1794b68b48a3b2fb91bede925

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Dutch.lang
    Filesize

    77KB

    MD5

    c7e33940a24c0d801bf5507674291955

    SHA1

    ef8317a2d7e56cd3537326e6fa30b5fc8ca2612f

    SHA256

    5b7816b707eed28e2f1ac262360f1d6c9b6ccd66853424bb330ddd3d6de4edb4

    SHA512

    e9f58824e13992bf41534342facb20ef7b9aef6559cb26a23892c774afabf928d5be3f6a542f09188a5aee5179de2c9819da9e2702315fa2f9e322b39766cf1e

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\English.lang
    Filesize

    79KB

    MD5

    295dc87e2f2dd0ce282e124e2d637ade

    SHA1

    97cf293fd09a5c5eb0f90b7eb165372bcb648181

    SHA256

    0e2119bb896ce25c6010a910ead02b98aaf7a06921acdf74259dedf388e4e708

    SHA512

    31add625a0aa1117eaa6591b8c66b28f3ef86d848200fef7c067fa0e8056c48fe215bac9d3229ef92e8d1bd1775fa3517c9c5ed2f442cbb8c5c24a3472bcc75c

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Filipino.lang
    Filesize

    78KB

    MD5

    4d5c0f0d252b20ac4f5ad82375869d60

    SHA1

    8e6c8254e30dac0ead9a0c063eb6cba602a8cbcc

    SHA256

    c3d16ee64e956b83de3755ab10b144d1195cf782967793d0fb6052e992916e5a

    SHA512

    be000c09a52353e8a44db5d6e2598009f62975dffbb85a595c15bb6f82870fee35aa3f34cdc624739c4e1ee59f97c8e6011693ec32b376c12113d5983d1ec6a7

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Finnish.lang
    Filesize

    82KB

    MD5

    5cdac129a9053baf9475f5023da583a9

    SHA1

    6554dc3e38b3074331dae2afcc30a02e5e96b7d1

    SHA256

    b1b09e9a309bcba0dfb020612f30b89359e6941327c14a548e1f68904b1d5fce

    SHA512

    229926fccd018107252b1695d5195a743d04d71cac8d5cbfc0965df38345c85e77d4610c4db7ee652871bb61739e8c59cf96fc02add749dd6a09db605ba6e731

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\French.lang
    Filesize

    92KB

    MD5

    e219694addcadb1123d6fc59a8e42752

    SHA1

    8ba768017bfeceacdd44445c565c5d3ea23163ae

    SHA256

    c7c8de716212154b417bc728ed3d45ae983e7eb0b6d872cb0432bdcdc74a750b

    SHA512

    640fb89882beff67f18dca1d5ff37975cf54ebceba00f4bbeeefbe9a3109de5bb78f24700343d9dcdb8563ec9668a4f05481bf2e73a4c4534983daf6da27760f

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Galician.lang
    Filesize

    91KB

    MD5

    c29435fa924e71b6202e72399db5ff4b

    SHA1

    92393a61f627c19cdb42b553b2cba07c782c90ec

    SHA256

    d95d01b81dcc20607d3ef5fbcd6eab328b7c19248d0222f8937929489917a80e

    SHA512

    a4c8798461acb8895d823868a6b405c43db32524036531dfff450c82880bdcb1af58a1c0cc582fc14f497d88b8e0de6cbb5d8689694ea09c797b7ad1d4ba1a2c

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\German.lang
    Filesize

    79KB

    MD5

    2fd8ec42284b83f325b5d7ed610f4899

    SHA1

    11f665a87bdf0218cf255f9d3ae41d076a848e2f

    SHA256

    45d4cf36e64abd09a6a06d8b3144eeae066a5e5642b3fa200cb1cb3d88601af6

    SHA512

    ddc9442da679b118b8ddf740b995afb187c76cba3af00ffdb3845f20a295d855f8c50370d908a3bfc471667d62cf15d19c998269ebc7285a85dbac2422f007a7

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Greek.lang
    Filesize

    78KB

    MD5

    caf01dbd6a05f0082156ec1dcb60c720

    SHA1

    0d7b9a168ab7912e54cce8529db7e34288fbcc55

    SHA256

    3e94ff18c419016c5b4c7e45180de5a0724a665d3bacef2a46cb17e47e6c102b

    SHA512

    0eb489d1ef2a441a4d6983ba8164a865ca753965c3ddf68d6497fc73aad60e0ce98b97128edcdb8fb842a2e297d4b00f197e1899e88f8a34dee1cc5f92960e90

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Hungarian.lang
    Filesize

    83KB

    MD5

    64c8457a205d7217ffca199e834123a1

    SHA1

    a98dfd395a79df1a35dbff7682bfb64905ad3728

    SHA256

    b70c3ae5dfcd12fbc0fbd145722e3af797fb9020554bae5c5c177de5ad72e799

    SHA512

    9797fe916fbde9be60d6725d62142937850f5f0a4efd093fada941a97aec0780baf6b0a0a9fc0bdb2714df267efa2bc755536cd6bc812c4db2822692341a4db8

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Italian.lang
    Filesize

    79KB

    MD5

    d5ab32ec3dd8c24f4e855b94aeacd42c

    SHA1

    9981271786aac9d3078d0d8eade42f5f6be7b842

    SHA256

    151b70e5e1feb6ab82a7e1e8e8ad4ba3fb72e7119c3d3727fc77d00f2d774a7f

    SHA512

    4192ecd522bdc4f0146fdb3ea7e7d3fb88ae08573ce9bea5bae10e275f0aa1df6f8d6b72892a09f5c77a72402af0ad56e17b46ef3de1d13fd0cfa8637856ecd6

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Japanese.lang
    Filesize

    50KB

    MD5

    68bbce950f1fd2364b518b2484c90e2d

    SHA1

    d00d87a6d5d8cf82b0a80ec50f5bbe350e2ddc66

    SHA256

    54167cd8e2c3bbc84f2b818908c72710c9e88adfb09765eaa5fc7789dc93ff9d

    SHA512

    925fc74a948ccd830d4534a96984ea43754f08c3666bff0f3fd0092f3d4d6f5d8375b5282388866cedae25a5f2c18c2c1fc32d0ecce5fde6feab7ab6ee2b986b

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Korean.lang
    Filesize

    51KB

    MD5

    f7b7f9190f1c50bd41faa9e76ccf3b66

    SHA1

    1183aa3db07c9224cd62d57372eb0da720e1ab90

    SHA256

    5653785adce86cbc783515c42a9cb10255e3ff0db7aa6fb548eed21ae496faa1

    SHA512

    d08540e1c6a59cd1138deb48e1b2d6575622df5c575df3b184d2efd080ee8bd2c45004815af590fb8b0855765d2d9949c87679b62ff82a28cb458788a6b38dd0

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Lithuanian.lang
    Filesize

    76KB

    MD5

    f03ed74fc526bfa8012ec36c22339ccd

    SHA1

    1cb4c42f0e9826aa5aafcc20598f48e04dbd0b03

    SHA256

    4b191b4214871baa6d41e11d334ce120ae41607df514862181c7830e71b1e9e2

    SHA512

    8183eca164fa0aba79cdb5eec1948af2a857be2101b2395214918ef4f8d1c0a3d2e344e93b6fbfe5f39c61c9e696db30d1db86061e7174581009b1372ad96064

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Norwegian.lang
    Filesize

    75KB

    MD5

    3a3b3f3316d0e8c35f30205ce362b437

    SHA1

    2d8bc8a98e86e662a006fcbe3e5fe06889c070f4

    SHA256

    7ce77377abf066d7210626f604c4f0346dc44d1c26c4a2387cf863076d84e2a2

    SHA512

    8753dc482462d0636bcdb8aae956ec707438362ec241fe178b9d378ab46b6b20657dbedc5f8538a243d7b7ca0fe05f5e2a80cf5e73e5220a968449b42db5b817

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Polish.lang
    Filesize

    83KB

    MD5

    83c42f157576c7265097fe78d79cf46e

    SHA1

    546576401159d0521782e214e86f3d9894c7ba1b

    SHA256

    034bbd5a980af97531c8830c09190c48b134a75e62e48032d232e281687e7d96

    SHA512

    02d884d310eb7228adf9aae1e44552e47e2589eaca2d59a85a391e352a9726362ad817083d32be686d184adaf8a3ff005c88ba57ff5baa247dab235ce0401aa1

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Portuguese.lang
    Filesize

    76KB

    MD5

    c6dbc3ed740c2af2fa14d7cadde8b0c4

    SHA1

    564d25dbffcacf1468819c059cd3478897fccd8a

    SHA256

    b03ec23835ff849835ba869f22cc279543b85b2933c204fb77c04aec514694a3

    SHA512

    00ea67e973bb8280b9589fb4fbd777d054659e3f850d15c8eb56af302d642e023a55b67bb33a74cafcf01925c125d80e8a93fcd5db16a03a6d943b5851f79a27

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Romanian.lang
    Filesize

    78KB

    MD5

    641723eb4db6a008baee347c271adc3a

    SHA1

    cd647d48a127f5dde085734600846b10518d4990

    SHA256

    ca241bb5ded3827c3b2948c9d94363cb1f38c9a2c48d9a237f73fdaeb132838c

    SHA512

    8fc6ff4d1c62bfa6b460ce3dabf6543062b3e6f3c8f4c427c9b841f626d1ffd4047d7a3ccd2f0b6eb7a0814e9c0069f4d1ba5a97cb6c4e8e17f097b42f72398d

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Russian.lang
    Filesize

    82KB

    MD5

    91d248f608006e27676fbb09f243d47c

    SHA1

    812a6794c08a37a10ab7d99221305f8d7e217970

    SHA256

    56bb07f8a61e29907415b6172182d078f51cf5819bebaba4dac3d8a58f7e34ca

    SHA512

    67535b662a0e330a6b31a88fb91440c07f7cd0d1720c6e545d11e6bf1396ec128dae6ae1be70046e33a5d4cd33b979e5addc479b29a3d067461f4bf765daf542

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Serbian.lang
    Filesize

    76KB

    MD5

    aedc3c1c7b311e9b987216600b6ca080

    SHA1

    de329e8b9b8a17f0fa0274c1e09ad3bd472a2d76

    SHA256

    b7409694c17f2d2a4d732ce2bd8d1dcd3cd0d35f619843191f7d48031ad87522

    SHA512

    af8d425bddab7ad041bff8c6baf17819714bce021428abc0fda143acc6e2b44bf9a2a1407426f86338be3bbdfc29adcc51cae4495b153fe2e36876d4a5519c0d

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Simplified Chinese.lang
    Filesize

    46KB

    MD5

    e2e76626502b8437877fd2fe9323715c

    SHA1

    d024590dacf577ec5aee68eaa9ac90c5f917fe63

    SHA256

    a7eced5dc7563a179be590a2799f29890b65b6e473aa1619a62e58d011cbc597

    SHA512

    3d3d2326aca7f22077312b5f59bf63821c5a21fd54d4ced5d9a07abadbfc9a0b5f45e8b7eb6af3eef0d03e9bb9c30c58832db990ff837208b2d563b26eb92812

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Slovak.lang
    Filesize

    94KB

    MD5

    dc5266e3e9e62398ef43f6067d694bee

    SHA1

    083341f195923b94d6c247803968b50ec031e297

    SHA256

    b31cde68e66bec44c7c3ba4f1e756c5500285fe548442439909c6407a743b47a

    SHA512

    0e7204d47b1b9f0c84b512fe35825447a68491bfd894a4b03665702436544d880c73b251daf5e93f82c9fbb79a00b3499c8f28be071a5fb904cbf9a4e2b375f7

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Slovenian.lang
    Filesize

    91KB

    MD5

    198b054e74e3abf906d586ace5030356

    SHA1

    8d2849e5defd40b9f0289444d7d692c62fa7b0c6

    SHA256

    5e0bbf53cb019f4145d4769fdcd4ce0d5f15c92bc07e4ae546c3754fd5ce6eea

    SHA512

    5c78911802b3b34d6dc80f4fe7c6e4bb5e0de0c7d011796e7c711fd83e8907af18b98f8adac53994864a1e0fadac640cdeb20e0e36c5a891e54b248eaf99b092

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Spanish.lang
    Filesize

    102KB

    MD5

    a216058325db3f021fce820ba77753b9

    SHA1

    c826996b17dcd9e487d2fd9bf970bb19a5a0300e

    SHA256

    04174bcfc9082140829b98cac7e2c4a5eacbc9a4b12fd00f4b585e09a1dbc976

    SHA512

    343c93448439e0272efd51eca50d8cf633c0347158bc47befa5077cdcf6bfa88c93c6734216a05a8dfc9d7d3728551edf723d02e9a2b6edce2d70f93b2ecd75b

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Swedish.lang
    Filesize

    76KB

    MD5

    daceb9d0a6efcfabae02644dffafe719

    SHA1

    3f66d36e91f4cd5ae1228e4d889375aea861e7ce

    SHA256

    9afa95dc9c4fc157da2373f48a54e391688f91bcfa662ddc292847b7afb7afaa

    SHA512

    14073b4888c235d075b409275bd5a127cacec815526174cce47aaff8c70e4a200385ff27f71162667ce56de342185a1793819893cda700a09fb30779678fc043

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Thai.lang
    Filesize

    79KB

    MD5

    70020b6c7d2f86d170eb3cbcaca1cfdf

    SHA1

    f0106ccac85b8bba41877f76d27abe0f511581a3

    SHA256

    770727bb0a743472533edd7e72b6db0bb0dfdb8456686ab41915f20ee8cdeac8

    SHA512

    e82fc59db8fdb9ca9f953069f18ac1b2f4a2d6e9a08f478b6263e565ed3721c3c5838044cb4ac4bb1e461e05e795cf5d8d2e3fbb1c8e5109d560991ac492cd1b

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Traditional Chinese.lang
    Filesize

    46KB

    MD5

    76a4ece1e506887641bb551dca60b264

    SHA1

    80a4f9484715bda8e7b6f2c333ba173e45a348bb

    SHA256

    a3e711e505cdc9486cd97b2dabdde72c6f7fa3014eae3eed9fc7194224db9e77

    SHA512

    6ba2b23f0b9f958753cebc5dd9549605cb231c13ebbb07bb6af04190978ff412e7453c2c3d9b4616e7dbcee249eec841d29cb3ca9901f1d3a74cd45414703374

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Turkish.lang
    Filesize

    87KB

    MD5

    3112b3255638d5a688319e36eb7f35d8

    SHA1

    c24b77dc166639bdc076c1cfe7c947ed5e81e036

    SHA256

    8a56884685561ba7fff01dfd1ffd8f9c08cd1e1f5da6559ed726b542ce17ef8f

    SHA512

    360f6a61893b56200744492fde93d59df91151542bcc76e5e915829c2f5ce958f63e17885a0d8d4b5c860577af38a90d95d08b7df9f7c6ef498f2b797ab1a6ac

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Ukrainian.lang
    Filesize

    76KB

    MD5

    0a2571eac71e3fdc669fa9b456eaf3c6

    SHA1

    25417cd4ba593bd7f2d62b175009cdfc31382168

    SHA256

    208bdd6fb9726336c11379e142b0846bcb0f00aff0455fba1ca17e1f429ba05e

    SHA512

    0d2d609e3283d85f96626f0cf44528d099b2c553ff659f9d535cc189442e9e9c33c67d2bbd1e7e7dea06a256e7e2b636fcd18f1a0b4ccb870049317fb845d361

  • C:\Program Files\CrystalDiskInfo\CdiResource\language\Vietnamese.lang
    Filesize

    76KB

    MD5

    9c8037ff016bdd166729091451c38af6

    SHA1

    7eabaac3f45195f905e7ddc9e6328be1d5693216

    SHA256

    25fb768aaa40117d1232819144cb8d90343d4b801a302390c330dd877e1973cf

    SHA512

    b697ec4a4232b66a56860464b54ecf46b7ddf1fcadfbd3916dedbae7be6b0169b6225b977c6234022f7d6203da933ff8a697d261b807432b4786e26eeba20cbd

  • C:\Program Files\CrystalDiskInfo\CdiResource\themes\Default\Background-300.png
    Filesize

    29KB

    MD5

    77767641110eb0eb62cd38ac3494fd24

    SHA1

    2d6c0cedf6b9a96292695ebd3e829e6f47dbfc45

    SHA256

    8717fdc9d5f8a4c200d38dac5178b31e1157d7a1f4f389c839dae74198d35e10

    SHA512

    0e0bf2ecf9c765ae0265706f19218ede958c65cab79743fcc2785bccef824200f06ce0543a8b1a765681ee9846a5c911548f8e1f5f25310aaa1122d22601b3ae

  • C:\Program Files\CrystalDiskInfo\CdiResource\themes\Default\diskGood-100.png
    Filesize

    1KB

    MD5

    c0e81a6dd776dcedbe2107bcad87bdcd

    SHA1

    1d1bbc27de9329d287179b36cdcaad1083359ea3

    SHA256

    41e8e14948103b7ba676fceaccef1f6b4fb08b70ea6f207f4d6fb6aef3f1e71f

    SHA512

    38b57f9cee97ac10b61a2fe9222c0085b0e6ffe18ac6457963a5a5e21ff5b602350204675f1ff9606c384d5b8484e4588ad9bac9208aeaf0008215c6fae678b6

  • C:\Program Files\CrystalDiskInfo\CdiResource\themes\Default\diskStatusGood-100.png
    Filesize

    918B

    MD5

    ad2e97a4c59814858876abad24002ffd

    SHA1

    7636bf632981a0d6ccbf3adcdc78d2715f9f359e

    SHA256

    e290f8d7031f82007b91cf3082825540f0a6585065dd0ae8f467fefe4d81e4fc

    SHA512

    09a1485cb7c4580e5094c4d6f08c5b10c567b6ffa6a6b7f7b80d8fcc5ee0ba88091432530f1b01ee09b0cd15a6e387e5557d843d91b0273bd0a6bb1a550f2efc

  • C:\Program Files\CrystalDiskInfo\CdiResource\themes\Default\nextDisk-100.png
    Filesize

    1KB

    MD5

    dc3be62f884c9b96af9a3d5b2a937cb6

    SHA1

    7a06d204ea1bb9130845305face66d7f74efa2e5

    SHA256

    cb9099db8ccb5d69db902858ebdd0657667fdc4c2ac1b8211b0d2503be18639a

    SHA512

    2b8163d191793ddda76ce36c08d87b343dd528ca042cfb795a816b96c8d7be90d584a34e4734d217a24ed54db1ce11332108540bd34baa64778f785c0bcd4a19

  • C:\Program Files\CrystalDiskInfo\CdiResource\themes\Default\noDisk-100.png
    Filesize

    137B

    MD5

    aca9c4d69b8c4779167452f77f415a9a

    SHA1

    d40806f8ef1a7cb989dfbe9cfb4b3be717a47292

    SHA256

    0229291a30857f8ce7499e7f9a6ac30be452419bd5327b98468deba097ae76ee

    SHA512

    91652e2bdb710a11c25e78a8192c0da52538690e2743ba2f228e29279e0175d02e30ee01e4213b866552c4cf4e8c18ce687da13bd64d4ee554054f2efbc2df8a

  • C:\Program Files\CrystalDiskInfo\CdiResource\themes\Default\preDisk-100.png
    Filesize

    1KB

    MD5

    b49a97118724c54530d4c4eaefd729c8

    SHA1

    102187b9534a2c6359d37b68f9509e0fd227b473

    SHA256

    4358ec9b50bf01820f6037299941916c196616fa08d8150b57607957cecda485

    SHA512

    5a5ab0d9cec7aa61b99cb1b3742df2acdadff43cb12dcdc48cfea95eb9479ae4c5673870f2b85560ed3285961837fe0c4eed3e31f1ada33fdcdcd23336dc236c

  • C:\Program Files\CrystalDiskInfo\CdiResource\themes\Default\temperatureGood-100.png
    Filesize

    2KB

    MD5

    f8f84f5782ae011b707822d8ac8ee4d6

    SHA1

    fa9fceedd5066b2e97ef2774a4315c9ecb71f897

    SHA256

    26d0fdec518f2a16d535306d81459746811882da15c691113134d82442f5d58a

    SHA512

    ace2ceb3289ce68a8bcf2f18a040afee31138683656d8adb24a305f6b9f0bc32a34db4b2c681a538a634a3e6a36b2481cea282b61edbd5f2c5bf62066b5e402d

  • C:\Program Files\CrystalDiskInfo\CdiResource\themes\Default\theme.ini
    Filesize

    263B

    MD5

    13ad481754e04748b701e99dba1590d6

    SHA1

    e3acda213a1e905177a700f2c051b3f646da9237

    SHA256

    b9f6949d00fe5da3508e363b970435bc8d4c34761dca6e84b651459ad9cabfb9

    SHA512

    b734653b9ce95f9752f749c2cf686c4e82459cb3b8b47a8f46aadcf87042dc70f5c3ded20a884be04033aec39fd00f9c1fa27039f64335b3e19d89f2198b371a

  • C:\Program Files\CrystalDiskInfo\CdiResource\themes\Simplicity\is-2EI01.tmp
    Filesize

    1KB

    MD5

    cd53ebbeedfcdbe04ac94f0323440d83

    SHA1

    2249087471df17ab704b9e24c620a7d7f9e406d9

    SHA256

    16e367b75d0cb12efeb05cf23e696c06941e319509302bd99942b06d8daa4cb6

    SHA512

    07bbf2cfff944579a68dc337ecf7ededebd408ba7849f58e4de6215656f94f04d6af3b197c00b147092cb018dfaf196b1fbdd384360319fb1367fc55c77e2ee6

  • C:\Program Files\CrystalDiskInfo\CdiResource\themes\Simplicity\is-8IL2J.tmp
    Filesize

    1KB

    MD5

    e8799e2989a9ec24ea55195adf9d2e89

    SHA1

    3ba12b043c5d27b56b9691271d53d037dbe0f410

    SHA256

    3ff066b7b8d75fa423837c5880f45727b86e1f2366852c399d672c3dcf6a80ae

    SHA512

    05b854ac0c5faef1f255e2d24c1923c40019f1eef8d4a77215469ecba004720e6f781f84a872e790a9163799be6cd7cec088e04200e15aed5b7ada174b2436b7

  • C:\Program Files\CrystalDiskInfo\CdiResource\themes\Simplicity\is-A85I5.tmp
    Filesize

    1KB

    MD5

    8d1ad40d84930c904a3c46a2e876110e

    SHA1

    b49b07507ded62c5be9db303de3c0ac129eeb89c

    SHA256

    d7ad392146e0be9b808bf4568cf9e10d8f6c20c2055aee1f26763118fd6d422a

    SHA512

    d8f63bacd180132d4d63a9ef40fea46c0b2a712ccfca9b05814ebecd300e31e2f55a72dec9a7fe18c150866a0abf0eb88aceed5ff6c856895dfc2ed0cd052137

  • C:\Program Files\CrystalDiskInfo\CdiResource\themes\Simplicity\is-T5VOH.tmp
    Filesize

    1KB

    MD5

    f8b559a259cfe0f8eb39d1596f371767

    SHA1

    fdb89b6a1f08f7d8e83fd862403da71e110f737f

    SHA256

    c964d3efbe51d9c9ceb113d6eee196e1fd19938cadd733011c24b91d093f16de

    SHA512

    d8ab05bfac764187049cc0ca3c7a5e7112e5bd685b083d01fee6ea1939b8ff53c1a316e549f3a4c2a1e011fea101155fe36109c875593884972dbb0fbbef171a

  • C:\Program Files\CrystalDiskInfo\CdiResource\themes\Simplicity\is-UT9BE.tmp
    Filesize

    923B

    MD5

    dce02b9a45fba2a70042c8c1e03d9b94

    SHA1

    978e46984c3122ca2ecc5392b6b6f877dbe178b3

    SHA256

    0b0106761cac0e726c84c5883c989fae0e33c9ec90f3951e9a16e0e6128c183f

    SHA512

    476d6d814e6d5402d33748469d4cc86acb41aa79b9e4ce851c1531fb6706b9adcf1386b44cb293c8abb0b11768fb004ba89814a0caaab4579538d35edfa3060f

  • C:\Program Files\CrystalDiskInfo\DiskInfo.ini
    Filesize

    189B

    MD5

    b1d2ad7354f706edcb60ebdc3c0a893d

    SHA1

    7c380f6cd8aab95c086644a1caf7c3848aa4f9e5

    SHA256

    06641b1ede6028844b78b5a0db9d1406817a86a48d2afad84639e3ba997eef89

    SHA512

    96fef4aefb1e60b26328a3a8ba8889272cf1f0ed718b68d7a71289c144e0a26ae6c5f2564a69f3cc6cf9eb1a9768bc8fa301f83fdf3e403859c4893e9802ea4e

  • C:\Program Files\CrystalDiskInfo\DiskInfo.ini
    Filesize

    323B

    MD5

    2658c9051165b87d45f8f72d6aeaeaf3

    SHA1

    a01d328a112a5aef7ec2f8dbb22dd89c16638844

    SHA256

    9bf2cd7154cd6291d5fb2fcc0deb5ede354bd2f14a574428465e1e6ec7e5081c

    SHA512

    4540d2c299487a3f6da9bca914d9ed14e2ed788cd64cd7a353079587ed67cf38576fb572f27ae9f020fced44b433ed2444478f60d44cdaba616d1c846f49a424

  • C:\Program Files\CrystalDiskInfo\DiskInfo.ini
    Filesize

    341B

    MD5

    60c6c6cdf940d0d0d198ccbf6c01ccd0

    SHA1

    e6a2bb9399677648a2b7387ea760f03968b5af5c

    SHA256

    61d880ad85851e6bcd6dce2070e619b5f18a6de20e4b26ccdd587f87f7cfa1c3

    SHA512

    eddd397b353c43bc76fb80fa67141b5554a0910335dacfa09e6d6c296d2bfa0f0a93b9ace3473ab41ed9d3a3da3b6c6bd0a15a3ab91d9156554959ada7a554d2

  • C:\Program Files\CrystalDiskInfo\DiskInfo.ini
    Filesize

    56B

    MD5

    639b21ec594fd6ec5802c828dd4ff54a

    SHA1

    74ce0add6ab4393ec10564121e3e11927f845cf6

    SHA256

    14d1c79e51df74708de3a6868d6fdd3dd30a33867051a7c60f0746ffc977003a

    SHA512

    89e36f93a2afec70873e4a6735db00cfbf01715888bab35cc7feab68e5a353495b2269f47b6cb2f4ecfd2faedc66367c1bbb157757a6dea0f91f93c0b99522d1

  • C:\Program Files\CrystalDiskInfo\DiskInfo64.exe
    Filesize

    2.7MB

    MD5

    290b9d139ca0057e5970d02bab50ee1e

    SHA1

    19416e9b9e66b29bfbcd2be8d4051025e1370904

    SHA256

    d6d7dde91c5d873778c7cfe300c4cd325cf827b522dbdd9834a2c636dcbd99d9

    SHA512

    eab988fedf1d7988ec475f18d171f342d7c5ec6ca357f67041848f9eb018996ff8a36a8f3aa348c84f9a545c584118c899052ebd0ff656b06664e31cde58cde4

  • C:\Program Files\CrystalDiskInfo\DiskInfo64.exe
    Filesize

    2.7MB

    MD5

    290b9d139ca0057e5970d02bab50ee1e

    SHA1

    19416e9b9e66b29bfbcd2be8d4051025e1370904

    SHA256

    d6d7dde91c5d873778c7cfe300c4cd325cf827b522dbdd9834a2c636dcbd99d9

    SHA512

    eab988fedf1d7988ec475f18d171f342d7c5ec6ca357f67041848f9eb018996ff8a36a8f3aa348c84f9a545c584118c899052ebd0ff656b06664e31cde58cde4

  • C:\Program Files\CrystalDiskInfo\Smart\DADY HARDDISKQM00013\09.csv
    Filesize

    25B

    MD5

    2d30188c570aa328ea88734e49254d19

    SHA1

    98759628c804b42c5f9dfbb1b89403c82ef87905

    SHA256

    6b9c2fd3a6bfe56c975315e8ef5b2ba0f08c4407b56e33f07535a9d2600935c5

    SHA512

    a8ec5d8d80d9c169c3d40b166e33092e03c60a9d1ea4b9f90bc3736bdb3e0c5bc82568f86a318c3f05bb9c004b97921d439b6cbb95d6ead473570fbf8f407d04

  • C:\Program Files\CrystalDiskInfo\unins000.exe
    Filesize

    3.1MB

    MD5

    c0aed0028248ea26b82324d86cd726ae

    SHA1

    c472104146b6732ece046aef174a11d5797ccbbd

    SHA256

    f0bfd340ee800b2837cd60c6428b45bcce4b9f1e2c09008d51ebf817601533ce

    SHA512

    3fea283f9e438bb8a1957e64c637ebfd3c7f9b486ca7eb712d826cb71f2fd70833c804de23878e221eb2158a5a5c877ba30e6bc5a5a8069c38d7408cb14b5f6a

  • C:\Users\Admin\AppData\Local\Temp\is-92R5U.tmp\CrystalDiskInfo8_17_14.tmp
    Filesize

    3.1MB

    MD5

    c0aed0028248ea26b82324d86cd726ae

    SHA1

    c472104146b6732ece046aef174a11d5797ccbbd

    SHA256

    f0bfd340ee800b2837cd60c6428b45bcce4b9f1e2c09008d51ebf817601533ce

    SHA512

    3fea283f9e438bb8a1957e64c637ebfd3c7f9b486ca7eb712d826cb71f2fd70833c804de23878e221eb2158a5a5c877ba30e6bc5a5a8069c38d7408cb14b5f6a

  • C:\Users\Admin\AppData\Local\Temp\is-92R5U.tmp\CrystalDiskInfo8_17_14.tmp
    Filesize

    3.1MB

    MD5

    c0aed0028248ea26b82324d86cd726ae

    SHA1

    c472104146b6732ece046aef174a11d5797ccbbd

    SHA256

    f0bfd340ee800b2837cd60c6428b45bcce4b9f1e2c09008d51ebf817601533ce

    SHA512

    3fea283f9e438bb8a1957e64c637ebfd3c7f9b486ca7eb712d826cb71f2fd70833c804de23878e221eb2158a5a5c877ba30e6bc5a5a8069c38d7408cb14b5f6a

  • \Program Files\CrystalDiskInfo\DiskInfo32.exe
    Filesize

    2.5MB

    MD5

    c5d0557fb26679b38851dbecae8dedbb

    SHA1

    2b924a911fa36ec34963f66a108cf790a8cb4796

    SHA256

    4cbc4be268d1913f1e566ecb36cbe06f7c0326874ab1b5546df3b3d943304bdd

    SHA512

    2c65c076dca18ece9ab328ed70895b4fb6675935dfc9821f4cf54eaaa358d9c32ccd967787c93c3aaba528200e086927cc73c588dea18b86301763f49ae266d4

  • \Program Files\CrystalDiskInfo\DiskInfo64.exe
    Filesize

    2.7MB

    MD5

    290b9d139ca0057e5970d02bab50ee1e

    SHA1

    19416e9b9e66b29bfbcd2be8d4051025e1370904

    SHA256

    d6d7dde91c5d873778c7cfe300c4cd325cf827b522dbdd9834a2c636dcbd99d9

    SHA512

    eab988fedf1d7988ec475f18d171f342d7c5ec6ca357f67041848f9eb018996ff8a36a8f3aa348c84f9a545c584118c899052ebd0ff656b06664e31cde58cde4

  • \Program Files\CrystalDiskInfo\DiskInfo64.exe
    Filesize

    2.7MB

    MD5

    290b9d139ca0057e5970d02bab50ee1e

    SHA1

    19416e9b9e66b29bfbcd2be8d4051025e1370904

    SHA256

    d6d7dde91c5d873778c7cfe300c4cd325cf827b522dbdd9834a2c636dcbd99d9

    SHA512

    eab988fedf1d7988ec475f18d171f342d7c5ec6ca357f67041848f9eb018996ff8a36a8f3aa348c84f9a545c584118c899052ebd0ff656b06664e31cde58cde4

  • \Program Files\CrystalDiskInfo\DiskInfo64.exe
    Filesize

    2.7MB

    MD5

    290b9d139ca0057e5970d02bab50ee1e

    SHA1

    19416e9b9e66b29bfbcd2be8d4051025e1370904

    SHA256

    d6d7dde91c5d873778c7cfe300c4cd325cf827b522dbdd9834a2c636dcbd99d9

    SHA512

    eab988fedf1d7988ec475f18d171f342d7c5ec6ca357f67041848f9eb018996ff8a36a8f3aa348c84f9a545c584118c899052ebd0ff656b06664e31cde58cde4

  • \Program Files\CrystalDiskInfo\DiskInfo64.exe
    Filesize

    2.7MB

    MD5

    290b9d139ca0057e5970d02bab50ee1e

    SHA1

    19416e9b9e66b29bfbcd2be8d4051025e1370904

    SHA256

    d6d7dde91c5d873778c7cfe300c4cd325cf827b522dbdd9834a2c636dcbd99d9

    SHA512

    eab988fedf1d7988ec475f18d171f342d7c5ec6ca357f67041848f9eb018996ff8a36a8f3aa348c84f9a545c584118c899052ebd0ff656b06664e31cde58cde4

  • \Program Files\CrystalDiskInfo\DiskInfo64.exe
    Filesize

    2.7MB

    MD5

    290b9d139ca0057e5970d02bab50ee1e

    SHA1

    19416e9b9e66b29bfbcd2be8d4051025e1370904

    SHA256

    d6d7dde91c5d873778c7cfe300c4cd325cf827b522dbdd9834a2c636dcbd99d9

    SHA512

    eab988fedf1d7988ec475f18d171f342d7c5ec6ca357f67041848f9eb018996ff8a36a8f3aa348c84f9a545c584118c899052ebd0ff656b06664e31cde58cde4

  • \Program Files\CrystalDiskInfo\DiskInfo64.exe
    Filesize

    2.7MB

    MD5

    290b9d139ca0057e5970d02bab50ee1e

    SHA1

    19416e9b9e66b29bfbcd2be8d4051025e1370904

    SHA256

    d6d7dde91c5d873778c7cfe300c4cd325cf827b522dbdd9834a2c636dcbd99d9

    SHA512

    eab988fedf1d7988ec475f18d171f342d7c5ec6ca357f67041848f9eb018996ff8a36a8f3aa348c84f9a545c584118c899052ebd0ff656b06664e31cde58cde4

  • \Program Files\CrystalDiskInfo\DiskInfo64.exe
    Filesize

    2.7MB

    MD5

    290b9d139ca0057e5970d02bab50ee1e

    SHA1

    19416e9b9e66b29bfbcd2be8d4051025e1370904

    SHA256

    d6d7dde91c5d873778c7cfe300c4cd325cf827b522dbdd9834a2c636dcbd99d9

    SHA512

    eab988fedf1d7988ec475f18d171f342d7c5ec6ca357f67041848f9eb018996ff8a36a8f3aa348c84f9a545c584118c899052ebd0ff656b06664e31cde58cde4

  • \Users\Admin\AppData\Local\Temp\is-92R5U.tmp\CrystalDiskInfo8_17_14.tmp
    Filesize

    3.1MB

    MD5

    c0aed0028248ea26b82324d86cd726ae

    SHA1

    c472104146b6732ece046aef174a11d5797ccbbd

    SHA256

    f0bfd340ee800b2837cd60c6428b45bcce4b9f1e2c09008d51ebf817601533ce

    SHA512

    3fea283f9e438bb8a1957e64c637ebfd3c7f9b486ca7eb712d826cb71f2fd70833c804de23878e221eb2158a5a5c877ba30e6bc5a5a8069c38d7408cb14b5f6a

  • memory/1236-1091-0x0000000000400000-0x00000000004DF000-memory.dmp
    Filesize

    892KB

  • memory/1236-63-0x0000000000400000-0x00000000004DF000-memory.dmp
    Filesize

    892KB

  • memory/1236-54-0x0000000000400000-0x00000000004DF000-memory.dmp
    Filesize

    892KB

  • memory/2040-64-0x0000000000400000-0x0000000000719000-memory.dmp
    Filesize

    3.1MB

  • memory/2040-1090-0x0000000000400000-0x0000000000719000-memory.dmp
    Filesize

    3.1MB

  • memory/2040-1088-0x0000000000400000-0x0000000000719000-memory.dmp
    Filesize

    3.1MB

  • memory/2040-62-0x0000000000240000-0x0000000000241000-memory.dmp
    Filesize

    4KB

  • memory/2040-65-0x0000000000240000-0x0000000000241000-memory.dmp
    Filesize

    4KB

  • memory/2040-67-0x0000000000400000-0x0000000000719000-memory.dmp
    Filesize

    3.1MB

  • memory/2040-214-0x0000000000400000-0x0000000000719000-memory.dmp
    Filesize

    3.1MB