Analysis

  • user interaction
    yes
  • max time kernel
    38s
  • max time network
    38s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    15/04/2026, 21:44

General

  • Target
    CrystalDiskMark9_0_2.exe
  • Size 4.3MB
  • Sample260415-1ls5msax6k
  • SHA256 ac7bb07c02bf26786ce194d0455b65c194f743ff1e887cdaf03af4de88aa2567
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

  • Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

    Inno Setup installer

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CrystalDiskMark9_0_2.exe
    "C:\Users\Admin\AppData\Local\Temp\CrystalDiskMark9_0_2.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4320
    • C:\Users\Admin\AppData\Local\Temp\is-B9HQG.tmp\CrystalDiskMark9_0_2.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-B9HQG.tmp\CrystalDiskMark9_0_2.tmp" /SL5="$A0092,3438376,857600,C:\Users\Admin\AppData\Local\Temp\CrystalDiskMark9_0_2.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4332
      • C:\Program Files\CrystalDiskMark9\DiskMark64.exe
        "C:\Program Files\CrystalDiskMark9\DiskMark64.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3192
        • C:\Program Files\CrystalDiskMark9\CdmResource\diskspd\diskspd64.exe
          "C:\Program Files\CrystalDiskMark9\CdmResource\diskspd\diskspd64.exe" -b1024K -o8 -t1 -W0 -S -w0 -ag -d5 -A3192 -L "C:\CrystalDiskMark0E585200\CrystalDiskMark0E585201.tmp"
          4⤵
          • Executes dropped EXE
          PID:2636
        • C:\Program Files\CrystalDiskMark9\CdmResource\diskspd\diskspd64.exe
          "C:\Program Files\CrystalDiskMark9\CdmResource\diskspd\diskspd64.exe" -b1024K -o8 -t1 -W0 -S -w0 -ag -d5 -A3192 -L "C:\CrystalDiskMark0E585200\CrystalDiskMark0E585201.tmp"
          4⤵
          • Executes dropped EXE
          PID:668
        • C:\Program Files\CrystalDiskMark9\CdmResource\diskspd\diskspd64.exe
          "C:\Program Files\CrystalDiskMark9\CdmResource\diskspd\diskspd64.exe" -b1024K -o8 -t1 -W0 -S -w0 -ag -d5 -A3192 -L "C:\CrystalDiskMark0E585200\CrystalDiskMark0E585201.tmp"
          4⤵
          • Executes dropped EXE
          PID:3824
        • C:\Program Files\CrystalDiskMark9\CdmResource\diskspd\diskspd64.exe
          "C:\Program Files\CrystalDiskMark9\CdmResource\diskspd\diskspd64.exe" -b1024K -o8 -t1 -W0 -S -w0 -ag -d5 -A3192 -L "C:\CrystalDiskMark0E585200\CrystalDiskMark0E585201.tmp"
          4⤵
          • Executes dropped EXE
          PID:1540
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://crystalmark.info/
        3⤵
        • Enumerates system info in registry
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4032
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7fffef87c188,0x7fffef87c194,0x7fffef87c1a0
          4⤵
            PID:3464
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,8122147413095493942,5155080609310766136,524288 --field-trial-handle=2360,i,5576265476617790101,818042570927634342,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:3
            4⤵
            • System Time Discovery
            PID:720
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,2355310030669198326,8396040466009307786,262144 --field-trial-handle=2360,i,5576265476617790101,818042570927634342,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
            4⤵
              PID:4272
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,2479372925035942646,10297184350725339446,524288 --field-trial-handle=2360,i,5576265476617790101,818042570927634342,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
              4⤵
                PID:4212
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,857354944763443880,2709246087351813671,2097152 --field-trial-handle=2360,i,5576265476617790101,818042570927634342,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
                4⤵
                  PID:3764
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,14796288289359523918,13031184866110073013,2097152 --field-trial-handle=2360,i,5576265476617790101,818042570927634342,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
                  4⤵
                    PID:2576
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,18290775864358686201,14768586139257164245,2097152 --field-trial-handle=2360,i,5576265476617790101,818042570927634342,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
                    4⤵
                      PID:612
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,649887012572856933,7087960923524730126,2097152 --field-trial-handle=2360,i,5576265476617790101,818042570927634342,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
                      4⤵
                        PID:4820
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,8776270467555530243,5687214162796996166,524288 --field-trial-handle=2360,i,5576265476617790101,818042570927634342,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:8
                        4⤵
                          PID:2068
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,9751718997828043521,11254501210132778953,524288 --field-trial-handle=2360,i,5576265476617790101,818042570927634342,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
                          4⤵
                            PID:3288
                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                      1⤵
                        PID:2792

                      Network

                            MITRE ATT&CK Enterprise v16

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            Arabic.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Arabic.lang
                            • Size 4KB
                            • SHA256 ccc67733403709efff376b8bd298d18de2eec9cd20942d136a86884cf6eb419e
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Armenian.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Armenian.lang
                            • Size 4KB
                            • SHA256 52738bbe3026767e63e734d5eea79abfae1dcb617de4501a4b1033e8fecacc0d
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Azeri.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Azeri.lang
                            • Size 3KB
                            • SHA256 dc88ac25c3ea853f3cc05823af0ce3982b186a23ead357f7134115665efb3ef7
                            • MD5 SHA1 SHA512 TLSH

                            Belarussian.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Belarussian.lang
                            • Size 4KB
                            • SHA256 af6d0672dcd319f8903534a3f5085ca0562b6a50533401d9abaf6e8d6ec3448d
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Bulgarian.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Bulgarian.lang
                            • Size 3KB
                            • SHA256 7489cd9151f6788572350402f0dae0c04ef6b5d1e6745a3e936e4518db5f47b3
                            • MD5 SHA1 SHA512 TLSH

                            Catalan.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Catalan.lang
                            • Size 3KB
                            • SHA256 26727d1c99ac220ab6c5646bc0c0c326bb616f18352a63e1f346f8e7f60ddfc2
                            • MD5 SHA1 SHA512 TLSH

                            Croatian.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Croatian.lang
                            • Size 3KB
                            • SHA256 9323bf79553c6f687b8a5e356598624e483d13635efd30063efb0e7eedc02b77
                            • MD5 SHA1 SHA512 TLSH

                            Czech.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Czech.lang
                            • Size 4KB
                            • SHA256 8c711d030d19f3d87e7887d45df008b77961baa781046c8504a7f3316b1bbea6
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Danish.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Danish.lang
                            • Size 3KB
                            • SHA256 9cfdcb64f1fd56f7d6503b4db33aebfa2ebcc42c5a6aa28ae48d3b1cb20aa1c2
                            • MD5 SHA1 SHA512 TLSH

                            Dutch.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Dutch.lang
                            • Size 4KB
                            • SHA256 9c87ea9ec12dfce3e842f0603f0c85e6825cd077ba47b516b7b2595410898c10
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            English.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\English.lang
                            • Size 4KB
                            • SHA256 be2124a48cac5de5d70b3a993471f0f4c1b66d331c067d34ff4de7974d16ae23
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Estonia.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Estonia.lang
                            • Size 3KB
                            • SHA256 67cbb3a1d166bb6321175089e12ea273ca51184fb2d1fcf59c3fb149b9fe1a8d
                            • MD5 SHA1 SHA512 TLSH

                            Finnish.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Finnish.lang
                            • Size 4KB
                            • SHA256 a01f47cc9c35af057d5f8afec6f7aa565c1a49e710f442b3f927bc7b174122a0
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            French.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\French.lang
                            • Size 4KB
                            • SHA256 de8ad447496c75b93fdf8010cfc8f5fb8e7dcdea2fb8523a599654126fd95012
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Galician.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Galician.lang
                            • Size 4KB
                            • SHA256 ced16eb348d8b8c8427dcf31ba00cbd09bff4341e68eb3a08c2acafa772b4f98
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Georgian.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Georgian.lang
                            • Size 4KB
                            • SHA256 ad8fe01ca5bbe3c4207b4708447b26e29a7dcb3c3df4bcd3de10f889393f0b4e
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            German.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\German.lang
                            • Size 4KB
                            • SHA256 0a38ac1056acaa5dbcf3a65ef99cd28140a65346f600e332daed76241b12ee37
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Greek.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Greek.lang
                            • Size 4KB
                            • SHA256 b3f66c1ac7fec1258966b78586b8ed2e47d3d4e940fc0dc86a58f3eb3f0ed619
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Hebrew.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Hebrew.lang
                            • Size 3KB
                            • SHA256 1bab9e0bc42f9006ea34bb37eb02828922052e1f1a945057bec730fbcc576015
                            • MD5 SHA1 SHA512 TLSH

                            Hindi.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Hindi.lang
                            • Size 3KB
                            • SHA256 af7c63f92abc0d26d8d2013e7bc50f1c42d9fef2cf3321573a5c9a99289855b2
                            • MD5 SHA1 SHA512 TLSH

                            Hungarian.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Hungarian.lang
                            • Size 3KB
                            • SHA256 b3e355c9b3573a8c278b6b753cf048124f1df25facb62cf2b51fa818eeb1f524
                            • MD5 SHA1 SHA512 TLSH

                            Indonesian.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Indonesian.lang
                            • Size 3KB
                            • SHA256 c3df2e0897ee37048d4967a19eddf8889d5c00326088cae5fd48cfb6c0e44e86
                            • MD5 SHA1 SHA512 TLSH

                            Italian.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Italian.lang
                            • Size 4KB
                            • SHA256 f9718155144e4ef0204a6ffdd942800813f0b29ff6d11c0a32cdb31227f4b310
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Japanese.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Japanese.lang
                            • Size 3KB
                            • SHA256 abb620bb1fb8427f1aaa0f9b8d3595645d965c9d0d0a87f5fd680176ac598d9b
                            • MD5 SHA1 SHA512 TLSH

                            Kannada.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Kannada.lang
                            • Size 4KB
                            • SHA256 df519b1d31611e4c701e5a8f211431d99e5809bbe9d4db739b471ad5bd45d2a0
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Korean.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Korean.lang
                            • Size 3KB
                            • SHA256 93d17b6f27d8cabae89ec3f1d4d3ed081c358a81a680e5e12455825394d79534
                            • MD5 SHA1 SHA512 TLSH

                            Latvian.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Latvian.lang
                            • Size 4KB
                            • SHA256 eb122edc980f610b8b8a01e079ffdbdbaa96ac9cc52950662dac2df9c72ab47d
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Lithuanian.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Lithuanian.lang
                            • Size 3KB
                            • SHA256 651d296720a025c1bc525cabc7b318bfe2d31b3057828e7e579a61336f87daa4
                            • MD5 SHA1 SHA512 TLSH

                            Macedonian.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Macedonian.lang
                            • Size 3KB
                            • SHA256 67e86c7637054cba0a7305120ed5fef59f0a94d015269655c46592df42b55434
                            • MD5 SHA1 SHA512 TLSH

                            Nepali.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Nepali.lang
                            • Size 4KB
                            • SHA256 f0cc624aa41a4aa4c86682861088407a935a2f9ace33058be615f6c75f198b46
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Norwegian.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Norwegian.lang
                            • Size 4KB
                            • SHA256 01399d4b424acc486ac3bb39f39558df4d99e3643158ee809f93c07ba8273b9d
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Persian.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Persian.lang
                            • Size 4KB
                            • SHA256 a2069554f942f64158945dd29296ee9f8b06123e3655e9e398fa11da767d55a8
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Polish.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Polish.lang
                            • Size 4KB
                            • SHA256 b503a29f5db48b49f0d93b7f1ccdbfdbfcc4164c254fc6697047f868190a552b
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Portuguese.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Portuguese.lang
                            • Size 4KB
                            • SHA256 6102c21fdf3045e2707eac0b9871a7b853a2b56004e5de4eee0223a5b2a9704d
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            PortuguesePT.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\PortuguesePT.lang
                            • Size 4KB
                            • SHA256 b9ef35cbee85285b270aeb0f543bb357d3007f8edcac43271fc7953ca66fa80b
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Romanian.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Romanian.lang
                            • Size 4KB
                            • SHA256 ba37cb8508307d2e7962a8e4ae8ee27de8767f16d28a6f8b874aba9509c6f5e1
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Russian.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Russian.lang
                            • Size 4KB
                            • SHA256 378037af5cb3fb9336402da7c3736c10e5c83381250fc78ca0f85213e0a5ca91
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Serbian.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Serbian.lang
                            • Size 4KB
                            • SHA256 cafabc59e9a3bfd867259812d9f8b63f0968390f28edac45ac3c6a6739fcb5a9
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            SimplifiedChinese.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\SimplifiedChinese.lang
                            • Size 3KB
                            • SHA256 325ced8308a299bc9f69d69e27a3e8776adf15f9b32013be019b713a055d4a42
                            • MD5 SHA1 SHA512 TLSH

                            Slovak.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Slovak.lang
                            • Size 4KB
                            • SHA256 afe4238ddf08a381d45b1b187a1f611fa7a038b6f9657cc572f29ed48f32c384
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Slovenian.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Slovenian.lang
                            • Size 4KB
                            • SHA256 bd5db4767da33a7b26d0498c7be446012a594325c8256c76becedd7c2a887b0a
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Spanish.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Spanish.lang
                            • Size 4KB
                            • SHA256 0f99c1a1b75354783a606fd1867e91adc3f87c8cc65dfbe4c0ec2060f23d5f52
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Swedish.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Swedish.lang
                            • Size 3KB
                            • SHA256 57388348dbeec37743358aa76d323eaa2dbbe4882dffd2226df1b570234530b3
                            • MD5 SHA1 SHA512 TLSH

                            Telugu.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Telugu.lang
                            • Size 4KB
                            • SHA256 4da7de722a79c040a53af31b90c251ef3adaa634ec4fcb3d3487652428038731
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Thai.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Thai.lang
                            • Size 3KB
                            • SHA256 677a0154b0821e1039c2ba918632575455bbd388fd40f185b4863f271d4b0d89
                            • MD5 SHA1 SHA512 TLSH

                            TraditionalChinese.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\TraditionalChinese.lang
                            • Size 3KB
                            • SHA256 45c52ab725efdbe5a9631f469c20917b1d5733ea0038a008a8ca633c7a9c49d1
                            • MD5 SHA1 SHA512 TLSH

                            Turkish.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Turkish.lang
                            • Size 4KB
                            • SHA256 0e46cd274f695ba6a1cd960b0cef86274a0a029de12554e312348c86c90688b8
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Ukrainian.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Ukrainian.lang
                            • Size 4KB
                            • SHA256 b2f534718ec446338faafc84874b6adbece1b7fb25f8b31ebb807de894829a83
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Vietnamese.lang

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\language\Vietnamese.lang
                            • Size 3KB
                            • SHA256 205f9a2aa22900207ecdb5d65f80db4ba4648adacd1fb39c94113c859ce95f17
                            • MD5 SHA1 SHA512 TLSH

                            Background-300.png

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\themes\Default\Background-300.png
                            • Size 317B
                            • SHA256 66ca57706e6dc57bc89f82ffe8f675f6be003cce667bdb0dc6cfe34a49dbc120
                            • MD5 SHA1 SHA512 TLSH

                            Button-100.png

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\themes\Default\Button-100.png
                            • Size 1KB
                            • SHA256 d34134c2f432f00306082c4d3a7b56fb7966d96640fec5b7aefc4093de5c650a
                            • MD5 SHA1 SHA512 TLSH

                            Comment-100.png

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\themes\Default\Comment-100.png
                            • Size 245B
                            • SHA256 1e7908295e89cadba211f69bad196d297a73c3d72b82b54b093a892c1e7e8c98
                            • MD5 SHA1 SHA512 TLSH

                            Meter-100.png

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\themes\Default\Meter-100.png
                            • Size 883B
                            • SHA256 d73ef7f87bf706c2dbfc9a72fa993fd5186d9f2f0d860840cbfa7b44a6331e50
                            • MD5 SHA1 SHA512 TLSH

                            theme.ini

                            • Path C:\Program Files\CrystalDiskMark9\CdmResource\themes\Default\theme.ini
                            • Size 359B
                            • SHA256 89d5db85fd9d65fa71ca43924bef20f433845e9e160420c4ab50a40194288a9f
                            • MD5 SHA1 SHA512 TLSH

                            DiskMark64.exe

                            • Path C:\Program Files\CrystalDiskMark9\DiskMark64.exe
                            • Size 846KB
                            • SHA256 58ff40838f2d23f619ca2220dd0806774de1ba6da795eb28c5bc476bb564d824
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            DiskMark64.ini

                            • Path C:\Program Files\CrystalDiskMark9\DiskMark64.ini
                            • Size 65B
                            • SHA256 20495311dd3fe12dd93872d5cb566655dbd7cda18fc50b839110f31c257974bc
                            • MD5 SHA1 SHA512 TLSH

                            settings.dat

                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                            • Size 280B
                            • SHA256 2d812d63b94e52acac0ff3d23d196b3c185f5ddb1e01deeb75aec3c1bafd468e
                            • MD5 SHA1 SHA512 TLSH

                            settings.dat

                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                            • Size 280B
                            • SHA256 e8b794ddae1c182cd5bdf3280502fc20e0d1bbb83fa98695dd9554e580b515db
                            • MD5 SHA1 SHA512 TLSH

                            settings.dat

                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                            • Size 280B
                            • SHA256 58677a577dcf11ba96e255ad6dc59ffde2fcfea96db6fe3102a0182a37ee927c
                            • MD5 SHA1 SHA512 TLSH

                            BookmarkMergedSurfaceOrdering

                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                            • Size 6B
                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                            • MD5 SHA1 SHA512

                            the-real-index

                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                            • Size 3KB
                            • SHA256 d829ce7e9bda26c48f1a0826aa95457102db23b115891367891b8a8990e5a78d
                            • MD5 SHA1 SHA512 TLSH

                            the-real-index~RFe58466a.TMP

                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58466a.TMP
                            • Size 3KB
                            • SHA256 1905425069a2329f96570dfc671e175d14bc3156e16d4a5b0340680a9595d5f1
                            • MD5 SHA1 SHA512 TLSH

                            SiteList-Enterprise.json

                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                            • Size 2B
                            • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                            • MD5 SHA1 SHA512

                            Edge Profile.ico

                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                            • Size 70KB
                            • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Network Persistent State

                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                            • Size 1KB
                            • SHA256 ad968531d488d1421433a568ba60fc0ea51077bfe192cb09eaf437a4b705ba32
                            • MD5 SHA1 SHA512 TLSH

                            SCT Auditing Pending Reports

                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                            • Size 2B
                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                            • MD5 SHA1 SHA512

                            Preferences

                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                            • Size 13KB
                            • SHA256 7e3ae4ff037162cf4984e3f431cae3c4922408d8c85642e5b903bb5e613ad976
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Secure Preferences

                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                            • Size 30KB
                            • SHA256 8fd6546dbdeed804eaaebbd1addf2996b9f356a63dd713827bcb796373ef50cc
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Local State

                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                            • Size 8KB
                            • SHA256 82b4c864c57a17cea3f8c280c1827e003c682739fb243be035c4706fc2b77afa
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Local State

                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                            • Size 17KB
                            • SHA256 d094b4304fa7d81a736ec09cebce4b6880c60f7593ff97c8092a7c979f441952
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Local State

                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                            • Size 8KB
                            • SHA256 124f75e95032359494fb2cad449d8620f592c8534249b1890f911ec08d1a0592
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            data_1

                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
                            • Size 264KB
                            • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                            • MD5 SHA1 SHA512 SSDEEP

                            c4aebfa6-d978-4f88-be05-8567bf338355.tmp

                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c4aebfa6-d978-4f88-be05-8567bf338355.tmp
                            • Size 13B
                            • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                            • MD5 SHA1 SHA512

                            CrystalDiskMark9_0_2.tmp

                            • Path C:\Users\Admin\AppData\Local\Temp\is-B9HQG.tmp\CrystalDiskMark9_0_2.tmp
                            • Size 3.1MB
                            • SHA256 ede1b76aecf70a9eb1c2c8cc353724fee963edb21e728d8d8921ce55582b25ec
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            memory/668-795-0x0000016EAED10000-0x0000016EAEEB1000-memory.dmp

                            memory/1540-797-0x000001E001B50000-0x000001E001CF1000-memory.dmp

                            memory/2636-794-0x0000026CCD380000-0x0000026CCD521000-memory.dmp

                            memory/2792-648-0x0000019419600000-0x00000194197A1000-memory.dmp

                            memory/3824-796-0x00000284F39A0000-0x00000284F3B41000-memory.dmp

                            memory/4320-607-0x0000000000B20000-0x0000000000BDF000-memory.dmp

                            memory/4320-606-0x0000000000400000-0x00000000004DF000-memory.dmp

                            memory/4320-1-0x0000000000400000-0x00000000004DF000-memory.dmp

                            memory/4332-604-0x0000000000400000-0x000000000071A000-memory.dmp

                            memory/4332-605-0x0000000002740000-0x0000000002759000-memory.dmp

                            memory/4332-5-0x0000000000BE0000-0x0000000000BE1000-memory.dmp