3a8318628d0faf7f59bce86b16f2314c76baa3b051c347596b0062fff0038a0d

Resubmissions

01-05-2022 09:04

220501-k11j9shefq 10

01-05-2022 08:46

220501-kps12shdhr 8

Analysis

max time kernel
68s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
01-05-2022 09:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cristalix_updater-1.0.8-setup.exe
Size

79.0MB
MD5

992a47967462b1d3025239af460b42cb
SHA1

b334dc686981f931976ecb4528806742ed9b40aa
SHA256

3a8318628d0faf7f59bce86b16f2314c76baa3b051c347596b0062fff0038a0d
SHA512

b612dff0b16d3f3b0d265f5658d28058baa390b2860a3d6067cfb134cda3e2c6fb12e7fac1bac72d3937b8e2b68cc188e617c0d17e5e8c8eab3b0a23bd262d50

Score

8^/10

discovery

Malware Config

Signatures

Executes dropped EXE 11 IoCs

Processes:

Update.exeSquirrel.exeCristalix.exeUpdate.exeCristalix.exeCristalix.exeUpdate.exeCristalix.exeCristalix.exeCristalix.exeCristalix.exe

pid	process
3616	Update.exe
4344	Squirrel.exe
792	Cristalix.exe
2124	Update.exe
3852	Cristalix.exe
4988	Cristalix.exe
2208	Update.exe
1636	Cristalix.exe
4192	Cristalix.exe
1592	Cristalix.exe
4144	Cristalix.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Cristalix.exeCristalix.exeUpdate.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	Cristalix.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	Cristalix.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	Update.exe

Loads dropped DLL 12 IoCs

Processes:

Cristalix.exeCristalix.exeCristalix.exeCristalix.exeCristalix.exeCristalix.exeCristalix.exe

pid	process
792	Cristalix.exe
3852	Cristalix.exe
4988	Cristalix.exe
1636	Cristalix.exe
1636	Cristalix.exe
1636	Cristalix.exe
1636	Cristalix.exe
1636	Cristalix.exe
4192	Cristalix.exe
1592	Cristalix.exe
4144	Cristalix.exe
4144	Cristalix.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Update.exe

pid process

3616 Update.exe
3616 Update.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Cristalix.exeUpdate.exe

description	pid	process
Token: SeShutdownPrivilege	4988	Cristalix.exe
Token: SeCreatePagefilePrivilege	4988	Cristalix.exe
Token: SeDebugPrivilege	2208	Update.exe
Token: SeShutdownPrivilege	4988	Cristalix.exe
Token: SeCreatePagefilePrivilege	4988	Cristalix.exe
Token: SeShutdownPrivilege	4988	Cristalix.exe
Token: SeCreatePagefilePrivilege	4988	Cristalix.exe
Token: SeShutdownPrivilege	4988	Cristalix.exe
Token: SeCreatePagefilePrivilege	4988	Cristalix.exe
Token: SeShutdownPrivilege	4988	Cristalix.exe
Token: SeCreatePagefilePrivilege	4988	Cristalix.exe
Token: SeShutdownPrivilege	4988	Cristalix.exe
Token: SeCreatePagefilePrivilege	4988	Cristalix.exe
Token: SeShutdownPrivilege	4988	Cristalix.exe
Token: SeCreatePagefilePrivilege	4988	Cristalix.exe
Token: SeShutdownPrivilege	4988	Cristalix.exe
Token: SeCreatePagefilePrivilege	4988	Cristalix.exe
Token: SeShutdownPrivilege	4988	Cristalix.exe
Token: SeCreatePagefilePrivilege	4988	Cristalix.exe
Token: SeShutdownPrivilege	4988	Cristalix.exe
Token: SeCreatePagefilePrivilege	4988	Cristalix.exe
Token: SeShutdownPrivilege	4988	Cristalix.exe
Token: SeCreatePagefilePrivilege	4988	Cristalix.exe
Token: SeShutdownPrivilege	4988	Cristalix.exe
Token: SeCreatePagefilePrivilege	4988	Cristalix.exe
Token: SeShutdownPrivilege	4988	Cristalix.exe
Token: SeCreatePagefilePrivilege	4988	Cristalix.exe
Token: SeShutdownPrivilege	4988	Cristalix.exe
Token: SeCreatePagefilePrivilege	4988	Cristalix.exe
Token: SeShutdownPrivilege	4988	Cristalix.exe
Token: SeCreatePagefilePrivilege	4988	Cristalix.exe
Token: SeShutdownPrivilege	4988	Cristalix.exe
Token: SeCreatePagefilePrivilege	4988	Cristalix.exe
Token: SeShutdownPrivilege	4988	Cristalix.exe
Token: SeCreatePagefilePrivilege	4988	Cristalix.exe
Token: SeShutdownPrivilege	4988	Cristalix.exe
Token: SeCreatePagefilePrivilege	4988	Cristalix.exe
Token: SeShutdownPrivilege	4988	Cristalix.exe
Token: SeCreatePagefilePrivilege	4988	Cristalix.exe
Token: SeShutdownPrivilege	4988	Cristalix.exe
Token: SeCreatePagefilePrivilege	4988	Cristalix.exe
Token: SeShutdownPrivilege	4988	Cristalix.exe
Token: SeCreatePagefilePrivilege	4988	Cristalix.exe
Token: SeShutdownPrivilege	4988	Cristalix.exe
Token: SeCreatePagefilePrivilege	4988	Cristalix.exe
Token: SeShutdownPrivilege	4988	Cristalix.exe
Token: SeCreatePagefilePrivilege	4988	Cristalix.exe
Token: SeShutdownPrivilege	4988	Cristalix.exe
Token: SeCreatePagefilePrivilege	4988	Cristalix.exe
Token: SeShutdownPrivilege	4988	Cristalix.exe
Token: SeCreatePagefilePrivilege	4988	Cristalix.exe
Token: SeShutdownPrivilege	4988	Cristalix.exe
Token: SeCreatePagefilePrivilege	4988	Cristalix.exe
Token: SeShutdownPrivilege	4988	Cristalix.exe
Token: SeCreatePagefilePrivilege	4988	Cristalix.exe
Token: SeShutdownPrivilege	4988	Cristalix.exe
Token: SeCreatePagefilePrivilege	4988	Cristalix.exe
Token: SeShutdownPrivilege	4988	Cristalix.exe
Token: SeCreatePagefilePrivilege	4988	Cristalix.exe
Token: SeShutdownPrivilege	4988	Cristalix.exe
Token: SeCreatePagefilePrivilege	4988	Cristalix.exe
Token: SeShutdownPrivilege	4988	Cristalix.exe
Token: SeCreatePagefilePrivilege	4988	Cristalix.exe
Token: SeShutdownPrivilege	4988	Cristalix.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Update.exe

pid process

3616 Update.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cristalix_updater-1.0.8-setup.exeUpdate.exeCristalix.exeCristalix.exe

description	pid	process	target process
PID 2236 wrote to memory of 3616	2236	cristalix_updater-1.0.8-setup.exe	Update.exe
PID 2236 wrote to memory of 3616	2236	cristalix_updater-1.0.8-setup.exe	Update.exe
PID 2236 wrote to memory of 3616	2236	cristalix_updater-1.0.8-setup.exe	Update.exe
PID 3616 wrote to memory of 4344	3616	Update.exe	Squirrel.exe
PID 3616 wrote to memory of 4344	3616	Update.exe	Squirrel.exe
PID 3616 wrote to memory of 4344	3616	Update.exe	Squirrel.exe
PID 3616 wrote to memory of 792	3616	Update.exe	Cristalix.exe
PID 3616 wrote to memory of 792	3616	Update.exe	Cristalix.exe
PID 3616 wrote to memory of 792	3616	Update.exe	Cristalix.exe
PID 792 wrote to memory of 2124	792	Cristalix.exe	Update.exe
PID 792 wrote to memory of 2124	792	Cristalix.exe	Update.exe
PID 792 wrote to memory of 2124	792	Cristalix.exe	Update.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 792 wrote to memory of 3852	792	Cristalix.exe	Cristalix.exe
PID 3616 wrote to memory of 4988	3616	Update.exe	Cristalix.exe
PID 3616 wrote to memory of 4988	3616	Update.exe	Cristalix.exe
PID 3616 wrote to memory of 4988	3616	Update.exe	Cristalix.exe
PID 4988 wrote to memory of 1636	4988	Cristalix.exe	Cristalix.exe
PID 4988 wrote to memory of 1636	4988	Cristalix.exe	Cristalix.exe
PID 4988 wrote to memory of 1636	4988	Cristalix.exe	Cristalix.exe
PID 4988 wrote to memory of 1636	4988	Cristalix.exe	Cristalix.exe
PID 4988 wrote to memory of 1636	4988	Cristalix.exe	Cristalix.exe
PID 4988 wrote to memory of 1636	4988	Cristalix.exe	Cristalix.exe
PID 4988 wrote to memory of 1636	4988	Cristalix.exe	Cristalix.exe
PID 4988 wrote to memory of 1636	4988	Cristalix.exe	Cristalix.exe
PID 4988 wrote to memory of 1636	4988	Cristalix.exe	Cristalix.exe
PID 4988 wrote to memory of 1636	4988	Cristalix.exe	Cristalix.exe

C:\Users\Admin\AppData\Local\Temp\cristalix_updater-1.0.8-setup.exe
"C:\Users\Admin\AppData\Local\Temp\cristalix_updater-1.0.8-setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2236

C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
"C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3616

C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Squirrel.exe
"C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
3⤵
- Executes dropped EXE
PID:4344

C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Cristalix.exe
"C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Cristalix.exe" --squirrel-install 1.0.7
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:792

C:\Users\Admin\AppData\Local\cristalix_updater\Update.exe
C:\Users\Admin\AppData\Local\cristalix_updater\Update.exe --createShortcut Cristalix.exe
4⤵
- Executes dropped EXE
PID:2124

C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Cristalix.exe
"C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Cristalix.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\cristalix_updater" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1824,i,14247191172259950141,9953336627706343611,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3852

C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Cristalix.exe
"C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Cristalix.exe" --squirrel-firstrun
3⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4988

C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Cristalix.exe
"C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Cristalix.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\cristalix_updater" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1528 --field-trial-handle=1740,i,12360964755665700684,8053812442627266838,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636

C:\Users\Admin\AppData\Local\cristalix_updater\Update.exe
C:\Users\Admin\AppData\Local\cristalix_updater\Update.exe --checkForUpdate https://storage.c7x.dev/rigb0s/launcher_updater/v1/release/win32
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2208

C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Cristalix.exe
"C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Cristalix.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\cristalix_updater" --mojo-platform-channel-handle=2088 --field-trial-handle=1740,i,12360964755665700684,8053812442627266838,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4192

C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Cristalix.exe
"C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Cristalix.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\cristalix_updater" --app-user-model-id=com.squirrel.cristalix_updater.Cristalix --app-path="C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --mojo-platform-channel-handle=2336 --field-trial-handle=1740,i,12360964755665700684,8053812442627266838,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
4⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
PID:1592

C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Cristalix.exe
"C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Cristalix.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\cristalix_updater" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=2212 --field-trial-handle=1740,i,12360964755665700684,8053812442627266838,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4144

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\.cristalix\.machine\corretto_jvm\bin\java-rmi.exe -jar C:\Users\Admin\.cristalix\.machine\CristalixLauncher.jar"
4⤵
PID:1152

C:\Users\Admin\.cristalix\.machine\corretto_jvm\bin\java-rmi.exe
C:\Users\Admin\.cristalix\.machine\corretto_jvm\bin\java-rmi.exe -jar C:\Users\Admin\.cristalix\.machine\CristalixLauncher.jar
5⤵
PID:4920

C:\Users\Admin\AppData\Local\cristalix_updater\Cristalix.exe
"C:\Users\Admin\AppData\Local\cristalix_updater\Cristalix.exe"
1⤵
PID:4752

C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Cristalix.exe
"C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Cristalix.exe"
2⤵
PID:4088

C:\Users\Admin\AppData\Local\cristalix_updater\Update.exe
C:\Users\Admin\AppData\Local\cristalix_updater\Update.exe --checkForUpdate https://storage.c7x.dev/rigb0s/launcher_updater/v1/release/win32
3⤵
PID:1636

C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Cristalix.exe
"C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Cristalix.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\cristalix_updater" --mojo-platform-channel-handle=2100 --field-trial-handle=1764,i,10398795903956499361,5517326557649494396,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
3⤵
PID:3000

C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Cristalix.exe
"C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Cristalix.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\cristalix_updater" --app-user-model-id=com.squirrel.cristalix_updater.Cristalix --app-path="C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --mojo-platform-channel-handle=2240 --field-trial-handle=1764,i,10398795903956499361,5517326557649494396,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
3⤵
PID:400

C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Cristalix.exe
"C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Cristalix.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\cristalix_updater" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1680 --field-trial-handle=1764,i,10398795903956499361,5517326557649494396,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
3⤵
PID:4552

C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Cristalix.exe
"C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Cristalix.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\cristalix_updater" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=2296 --field-trial-handle=1764,i,10398795903956499361,5517326557649494396,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
3⤵
PID:2792

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\.cristalix\.machine\corretto_jvm\bin\java-rmi.exe -jar C:\Users\Admin\.cristalix\.machine\CristalixLauncher.jar"
3⤵
PID:4220

C:\Users\Admin\.cristalix\.machine\corretto_jvm\bin\java-rmi.exe
C:\Users\Admin\.cristalix\.machine\corretto_jvm\bin\java-rmi.exe -jar C:\Users\Admin\.cristalix\.machine\CristalixLauncher.jar
4⤵
PID:4940

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\.cristalix\.machine\CristalixLauncher.jar
Filesize
1.1MB

MD5
27072fea75299d18742e2ca640824c51

SHA1
804d8b649896b74c1e568385fadb43ae4f1533e9

SHA256
8f73b871c93163822ab54919a0b8fe7ba88db5388cd7f4aa8aaf32a5381f0093

SHA512
a2d16520439046b6723697f514aa3b77b6c8e1b56ee592aa8c3b760d82e8a6cadbea036e3331f9cf853f9005ff36fff008bbf0ef1c0a205851c0223e3d6cade9

Download Submit
C:\Users\Admin\.cristalix\.machine\corretto_jvm\bin\MSVCR120.dll
Filesize
942KB

MD5
c8da740fbd38c7ac60ba3563a9241c3c

SHA1
a4e804a3e0af697a9394ccf3c79016d568cabe11

SHA256
0832995575ca4622c0df16792cbd4551f2464918546b8e1ab0e37522732645e4

SHA512
38da4381535369ddca4810fab271f527e2ec1e9a83eb2161f2aec26beeaa41f515ff658c44f5e2fcf3b7976fca74ac70993f57133fc8404b8cb2b79024e4a3eb

Download Submit
C:\Users\Admin\.cristalix\.machine\corretto_jvm\bin\java-rmi.exe
Filesize
19KB

MD5
2627f1822c40aba6a9aafa280e64a348

SHA1
0e9d9e0d4d5100ceb3c42907d7663a99f0679667

SHA256
02fa1654027e895500784d5152e2b021bb11633ca308808f10dcdcfa69220815

SHA512
956ae7baff28c69dd09157a192a31bcb0f081dc1d72c262f89e6be11e862eaa8b703338327f05b2366ff8f5238a5328fc749896702025bd91c257fc27d6df987

Download Submit
C:\Users\Admin\.cristalix\.machine\corretto_jvm\bin\jli.dll
Filesize
195KB

MD5
a8e4750d8b99f6d2b48166aa23dabff7

SHA1
4604cb508ccbefb37aa29789173e198bc975d906

SHA256
483f9017931599a22f43825393e882773315264f5f8bd5a9bea863d01302643d

SHA512
6f58c552d2e4383260152d76433b7fd2949812279129043e1192e15f17484c5ef72df3744e1c086066eec9d42978f254a88789df55efe60b6dad4f3fa7628376

Download Submit
C:\Users\Admin\.cristalix\.machine\corretto_jvm\bin\jli.dll
Filesize
195KB

MD5
a8e4750d8b99f6d2b48166aa23dabff7

SHA1
4604cb508ccbefb37aa29789173e198bc975d906

SHA256
483f9017931599a22f43825393e882773315264f5f8bd5a9bea863d01302643d

SHA512
6f58c552d2e4383260152d76433b7fd2949812279129043e1192e15f17484c5ef72df3744e1c086066eec9d42978f254a88789df55efe60b6dad4f3fa7628376

Download Submit
C:\Users\Admin\.cristalix\.machine\corretto_jvm\bin\msvcr120.dll
Filesize
942KB

MD5
c8da740fbd38c7ac60ba3563a9241c3c

SHA1
a4e804a3e0af697a9394ccf3c79016d568cabe11

SHA256
0832995575ca4622c0df16792cbd4551f2464918546b8e1ab0e37522732645e4

SHA512
38da4381535369ddca4810fab271f527e2ec1e9a83eb2161f2aec26beeaa41f515ff658c44f5e2fcf3b7976fca74ac70993f57133fc8404b8cb2b79024e4a3eb

Download Submit
C:\Users\Admin\.cristalix\.machine\corretto_jvm\jre\bin\msvcp120.dll
Filesize
643KB

MD5
6de2c5fb11467b3ffb041a4c38f4aa07

SHA1
04ccb0a25e437e0eab43e0bde734c60013cca9f3

SHA256
8f0e25ffb8352a2160bfb2b0ab46358cc4d4cbd81292b1d13abbc5276e503ebb

SHA512
d49fd60d92aa787cedd5975a9f6830c1cc6512b98c4448a9686ba84aa93c8fff5ac4b60c95e9357926365a7ba954768941f15ba6089fb14c81698255114c36e5

Download Submit
C:\Users\Admin\.cristalix\.machine\corretto_jvm\jre\bin\msvcp120.dll
Filesize
643KB

MD5
6de2c5fb11467b3ffb041a4c38f4aa07

SHA1
04ccb0a25e437e0eab43e0bde734c60013cca9f3

SHA256
8f0e25ffb8352a2160bfb2b0ab46358cc4d4cbd81292b1d13abbc5276e503ebb

SHA512
d49fd60d92aa787cedd5975a9f6830c1cc6512b98c4448a9686ba84aa93c8fff5ac4b60c95e9357926365a7ba954768941f15ba6089fb14c81698255114c36e5

Download Submit
C:\Users\Admin\.cristalix\.machine\corretto_jvm\jre\bin\msvcr120.dll
Filesize
942KB

MD5
a98dd3fc94effc2d699eea06cddaab3c

SHA1
14e9faa7adf90ac873c229e92a430f692686593a

SHA256
d6e3749259a0d1b8f859810a74733fe7495586393a37591ee1fa03d77782893d

SHA512
5c04863c4e1d9e4a927eb439c1c484b6f3655516278c0bb2e7485bca75c1d397a929676b229460ad3d6c31639732531e909f853e4bfa54ea52ca2f48af7cc8a7

Download Submit
C:\Users\Admin\.cristalix\.machine\corretto_jvm\jre\bin\msvcr120.dll
Filesize
942KB

MD5
a98dd3fc94effc2d699eea06cddaab3c

SHA1
14e9faa7adf90ac873c229e92a430f692686593a

SHA256
d6e3749259a0d1b8f859810a74733fe7495586393a37591ee1fa03d77782893d

SHA512
5c04863c4e1d9e4a927eb439c1c484b6f3655516278c0bb2e7485bca75c1d397a929676b229460ad3d6c31639732531e909f853e4bfa54ea52ca2f48af7cc8a7

Download Submit
C:\Users\Admin\.cristalix\.machine\corretto_jvm\jre\bin\server\jvm.dll
Filesize
8.4MB

MD5
9018be9ffb5a9d06adcbce88d9877811

SHA1
74720c61941a5e58ad3a5f58fed2674cef5a37ee

SHA256
2d9b331aa5b406110179a5626661f60d55434e2311b63976a8262e2f53619aa9

SHA512
f91aef539bb3630ef0d2fb6cb2d0401eee5e066cd1e993f2a4cb1c6dc1a83c8dac18bb439c52f9c45dcca085169175c1339f101b4b0c734e6b38cf5cdcd4bee3

Download Submit
C:\Users\Admin\.cristalix\.machine\corretto_jvm\jre\lib\amd64\jvm.cfg
Filesize
1KB

MD5
c60e77ff5f3887c743971e73e6f0e0b1

SHA1
9b0cfd38ec5b7bd5bd1c364dee2e1b452a063c02

SHA256
23f728cc2bf14e62d454190ea0139f159031b5bd9c3f141ca9237c4c5c96ec1d

SHA512
07aca3de1a03a3b64b691fd41e35e6596760baf24c4f24e86fca87d2acf3a4814b17cd9751adc2dcd0689848f3d582fb3ee01d413e3a61d1d98397d72fe545e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Update.exe.log
Filesize
1KB

MD5
6eb96c16eb677b6a8c1df381a0497a1a

SHA1
d4596baadc2d4bee89d57e1718ab30c0b7d563ec

SHA256
e96331392d474ca0fbc51036c7d55aa3a37aae6b074d50ebd106a277b0cb4097

SHA512
3d472d56ceb73a3df3f65eff6af088b3a81ab553153cbda925091500a6543cf83e84872f2bc81f218deddecd8f3c9868d784c2fe08ece95f915138becaecfb0b

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Filesize
87B

MD5
0a772f07cffa2629a97281662a01fde2

SHA1
f8733cded019579e4c8dd0df1f0e6cff8e05069d

SHA256
7922ea84dfee5b0b44f5cf7686fd57d0aec862f6ba894b27eb04b0c8b37371db

SHA512
efdc8f9f86a0bd5bc0f2b1b8144b5761b409e5a19457b80ef0b1a4577f416a68941e069cfabb0942c94f967aeb28af471928832c7338019780983b098989d2aa

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Filesize
1.7MB

MD5
c5f6cda4976ae38cd9fba3d1e5ebd244

SHA1
2006c37f01d010963a4331c42e579b87a2d16039

SHA256
dae7bd888b715b8e215482bc5ea6f028ded32a3ad88bf4acb6431d2a62ffe3f4

SHA512
a1a7529b0ceb3df471e803eac1d9256c009a9c8252884f64a28a59d59753c75e1bff726a35af02db5bdf20a2d194850bfdbed163722b09465ca32d10d059524d

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Filesize
1.7MB

MD5
c5f6cda4976ae38cd9fba3d1e5ebd244

SHA1
2006c37f01d010963a4331c42e579b87a2d16039

SHA256
dae7bd888b715b8e215482bc5ea6f028ded32a3ad88bf4acb6431d2a62ffe3f4

SHA512
a1a7529b0ceb3df471e803eac1d9256c009a9c8252884f64a28a59d59753c75e1bff726a35af02db5bdf20a2d194850bfdbed163722b09465ca32d10d059524d

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\background.gif
Filesize
36KB

MD5
f990f0a4129dc1dfafc9a564a06f4cd7

SHA1
89ed80b7f01fe76f062144dba81c63b8ab665186

SHA256
f3fdb765264ef30f3ae9c7f993e7afe84b97b7b5d0802c7c48770d2247d3d3c8

SHA512
812ee63be2825ced202a65a3fba03dc67c93636358fee09d0ccdabef65bd2e30a0ae5d2a77fd54aea2fe02bf7f781280e09a1a812b3085fda43abab70523038e

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\cristalix_updater-1.0.7-full.nupkg
Filesize
78.2MB

MD5
755de7a6b68dd06b1aa2165dcbeacfc7

SHA1
25e2c5821f579e1ac588e4a78f50f614f723f784

SHA256
019dc3fcabf509908d339b058d4300d010a9bb4891ba92630144a074f101b90f

SHA512
f028a77f1e83a005943fb20b78df87b88ade96983f9a6e61f08ab0ab198cb41f8c68d6e2be01930e7b5066feff8bb8e185e65dd41d5ebca55dd81ae5d74002c9

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\setupIcon.ico
Filesize
14KB

MD5
b6b1f4d602483023ebe1dfc3b57d49aa

SHA1
23c29b8277c2d3bf11e40d9d4cf61d6b73ea1595

SHA256
12977d5e1d4daecc7e855ff7ccf3a6c8b1382ed9c1a0729f05197ed10cc43214

SHA512
9d964d59a1f90b211009aa6c2ca65bd66e9989f42b1261706194804bd46f39d579a7165487386fc5939f000d5d18c42a4dfdd6e0bafc1a09902d61e3ec7c2a55

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\Cristalix.exe
Filesize
296KB

MD5
e4288cfe1e38c21cbd5a6104481c9bb6

SHA1
4e19208bb8fdbe915b4ee7f397bde1a8b0a7ce03

SHA256
7f02cacde5dd50b945ab80c60eed70c8a8f0117d25ba397b0421cd22dba943a0

SHA512
1c3d92f79b1a219a6780dc3ef3e260819fdea25f0cd5f86890e04d4227d0da076199bae8d501cd1305f115a84d707a7f7cb985a13d465d6949e1c0892df40fd6

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\SquirrelSetup.log
Filesize
1KB

MD5
74c66de95d2036118e34473d64302905

SHA1
f54ccd9e9bcbb0a2a4c319c67eae44a9100ff9f3

SHA256
f49fb9b584b75e18595fdcf4339a7d1c5538dbd3e19ef6845a48617a942d5d3f

SHA512
25ac04afaa7ab9093e199c074c076273a30e3fd7e8362321f43a4b4cb49df8a1eade13ac89ef342bc4d1f9ef61c5a607f50e4b3416c02bfb185b70f8698cad69

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\Update.exe
Filesize
1.7MB

MD5
c5f6cda4976ae38cd9fba3d1e5ebd244

SHA1
2006c37f01d010963a4331c42e579b87a2d16039

SHA256
dae7bd888b715b8e215482bc5ea6f028ded32a3ad88bf4acb6431d2a62ffe3f4

SHA512
a1a7529b0ceb3df471e803eac1d9256c009a9c8252884f64a28a59d59753c75e1bff726a35af02db5bdf20a2d194850bfdbed163722b09465ca32d10d059524d

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\Update.exe
Filesize
1.7MB

MD5
c5f6cda4976ae38cd9fba3d1e5ebd244

SHA1
2006c37f01d010963a4331c42e579b87a2d16039

SHA256
dae7bd888b715b8e215482bc5ea6f028ded32a3ad88bf4acb6431d2a62ffe3f4

SHA512
a1a7529b0ceb3df471e803eac1d9256c009a9c8252884f64a28a59d59753c75e1bff726a35af02db5bdf20a2d194850bfdbed163722b09465ca32d10d059524d

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\Update.exe
Filesize
1.7MB

MD5
c5f6cda4976ae38cd9fba3d1e5ebd244

SHA1
2006c37f01d010963a4331c42e579b87a2d16039

SHA256
dae7bd888b715b8e215482bc5ea6f028ded32a3ad88bf4acb6431d2a62ffe3f4

SHA512
a1a7529b0ceb3df471e803eac1d9256c009a9c8252884f64a28a59d59753c75e1bff726a35af02db5bdf20a2d194850bfdbed163722b09465ca32d10d059524d

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Cristalix.exe
Filesize
122.5MB

MD5
03a6a89b0d05799f48310ed1ee9809ec

SHA1
5851c8cdccffc7834002a3f1d7a8c48059f13266

SHA256
64ab9fe412cfed9897fb86319ad901b5633a52c0874bb378c189522869e3b547

SHA512
c921f634cc0a2e05bd5a4a81e1a6e503e06a8d51b6670524fee15b2afba7a219ccd53b10e8738d943082112c284a77bae4373217f931d5fb55b78a1b23ca8f4d

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Cristalix.exe
Filesize
118.0MB

MD5
02932bbffeac9e93e1ea647d63d7154d

SHA1
108f3371a0bc5c6c651c932c4100f46502a32561

SHA256
7ea516b34433286dfd536a5d5945068cd1e4e795e04296777ec8f710de126ea3

SHA512
d53c162046cbc04cc3612b0de28a0e1d7053bd6e56e18cf6586e33cacb0f127e5b94ccb1808a53d728ac81dda14cfce9ddfd735394c33f209cf5bb369e8ca402

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Cristalix.exe
Filesize
118.6MB

MD5
8eb2755b4d7e5b26a5e78c2ff172a18f

SHA1
77c32db34beb3a1171b71483e7107d9813a09550

SHA256
5e2ed006d2f554545335ea397ff30c55d59ec2e63c0a5c740775b639cfbfee7c

SHA512
a13fabd65dbf27213b9e8b1619b6ffa77aa4245eaa95b1da66e26b5e9f48e3de41d2adfe683e0e7a97a3dd239ad93538fb559d0fd61234bd7c522fedc75452e6

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Cristalix.exe
Filesize
111.2MB

MD5
83045d11bfe0a09aa3b193ef92cf16b8

SHA1
82f110f43f30365fd2cc2092a64e1306c9d91662

SHA256
19a63d86ad7181720832b36ebe867a8c3e6fe3f5c9c81198b845e920b64faba3

SHA512
1071547bd2840968a8f3b64fa22f383cd309d7f15331b97b6424396943d5a514ae8ff662ac4986c0b97b94712f9ce9bc2e1938561b4ac20985aa5ac5059a8d88

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Cristalix.exe
Filesize
110.9MB

MD5
bfd87b4da73773199f6a7ef5bd4dff6f

SHA1
aa10ba74a72d6bd930b91ca6bd325d451421e37e

SHA256
fe5a84f94fdbbc6e74feacb8d1e11bd3bbab1ffa1fd5f32dda0d028ebe667f9a

SHA512
eeafc6a5d0420b2c43d2968a4d1d6aecd485ffcb91110b0012b14f3cdcbb2de815f4a95d0e43346d24ebb797ed6ca72a5d971a93154fd691d331290dde24c354

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Cristalix.exe
Filesize
108.6MB

MD5
363c04ce49f40228e41c2e1f0380458d

SHA1
5b0e26cd81de4d28b06a3064f574cc6546a5067f

SHA256
9838a8d609f55d70df0cde705da3932ff64a2aef232141205375ced2da88ae7c

SHA512
41b50a6d5ae92729da3ffb4ad5fea8cc9ec466e28b77005118bc8afd460b8e250e338b5a573ea64c9c2db539ebe76b27f9072970dd44b8d346244d2059edb4db

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Cristalix.exe
Filesize
109.1MB

MD5
ea4e74aa3ca3a24f79f2f044569a18f1

SHA1
b0980c90886065a4ef25bcd2415d7eee60e5c000

SHA256
86d660747d552ed6d0500afa5cd68bed5d4ea012ea994026f739ca5de17dff09

SHA512
940072e10c44fcbc08647fbc9bbbf3e74ff35602189e84f4aeb120fd3bda1b8e37e7122d2ed750fa58bce216ae0204fa18966e1c95e63de428a19c7db2d32c70

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Cristalix.exe
Filesize
113.6MB

MD5
86e3b8d2fff4b6dc0d541c7e695b4999

SHA1
d84c7b080b95b9f5d400b39b05617167fd1bd012

SHA256
a0279a01e770c1a2eefc23ba78e55a3a9813c7f121f556fbe52647b92f38a6d6

SHA512
92dc0a90e48c9cda340fe1ce7b9498edf41241daa1aa55b25236ee884439d9e5e34707dcbe134224ce3acf4689e23ea222989466254109f551e531cccfbddb5e

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\D3DCompiler_47.dll
Filesize
3.5MB

MD5
2f2e363c9a9baa0a9626db374cc4e8a4

SHA1
17f405e81e5fce4c5a02ca049f7bd48b31674c8f

SHA256
2630f4188bd2ea5451ca61d83869bf7068a4f0440401c949a9feb9fb476e15df

SHA512
e668a5d1f5e6f821ebfa0913e201f0dfd8da2f96605701f8db18d14ea4fdeac73aeb9b4fe1f22eaeffcdd1c0f73a6701763727d5b09775666f82b678404e4924

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\Squirrel.exe
Filesize
1.7MB

MD5
c5f6cda4976ae38cd9fba3d1e5ebd244

SHA1
2006c37f01d010963a4331c42e579b87a2d16039

SHA256
dae7bd888b715b8e215482bc5ea6f028ded32a3ad88bf4acb6431d2a62ffe3f4

SHA512
a1a7529b0ceb3df471e803eac1d9256c009a9c8252884f64a28a59d59753c75e1bff726a35af02db5bdf20a2d194850bfdbed163722b09465ca32d10d059524d

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\chrome_100_percent.pak
Filesize
145KB

MD5
237ca1be894f5e09fd1ccb934229c33b

SHA1
f0dfcf6db1481315054efb690df282ffe53e9fa1

SHA256
f14362449e2a7c940c095eda9c41aad5f1e0b1a1b21d1dc911558291c0c36dd2

SHA512
1e52782db4a397e27ce92412192e4de6d7398effaf8c7acabc9c06a317c2f69ee5c35da1070eb94020ed89779344b957edb6b40f871b8a15f969ef787fbb2bca

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\chrome_200_percent.pak
Filesize
214KB

MD5
7059af03603f93898f66981feb737064

SHA1
668e41a728d2295a455e5e0f0a8d2fee1781c538

SHA256
04d699cfc36565fa9c06206ba1c0c51474612c8fe481c6fd1807197dc70661e6

SHA512
435329d58b56607a2097d82644be932c60727be4ae95bc2bcf10b747b7658918073319dfa1386b514d84090304a95fcf19d56827c4b196e4d348745565441544

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\d3dcompiler_47.dll
Filesize
3.5MB

MD5
2f2e363c9a9baa0a9626db374cc4e8a4

SHA1
17f405e81e5fce4c5a02ca049f7bd48b31674c8f

SHA256
2630f4188bd2ea5451ca61d83869bf7068a4f0440401c949a9feb9fb476e15df

SHA512
e668a5d1f5e6f821ebfa0913e201f0dfd8da2f96605701f8db18d14ea4fdeac73aeb9b4fe1f22eaeffcdd1c0f73a6701763727d5b09775666f82b678404e4924

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\ffmpeg.dll
Filesize
2.5MB

MD5
d3ffc36ddd21357320e256314ba0bbed

SHA1
b0aa24771ccea0ffec089cd7aa5a6a2f2203c1f0

SHA256
226b591f952480fda136a0831800417339d5b5786d865278707fd57bc6e099da

SHA512
bf193b2244f18521e8fc548308a64b3018d0838c0664a7620c3c55a100032af8399ad8ba7a6b9d301bd01ac3bb72c8f2d32f516d8296829dbd710fdff8823b1a

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\ffmpeg.dll
Filesize
2.5MB

MD5
d3ffc36ddd21357320e256314ba0bbed

SHA1
b0aa24771ccea0ffec089cd7aa5a6a2f2203c1f0

SHA256
226b591f952480fda136a0831800417339d5b5786d865278707fd57bc6e099da

SHA512
bf193b2244f18521e8fc548308a64b3018d0838c0664a7620c3c55a100032af8399ad8ba7a6b9d301bd01ac3bb72c8f2d32f516d8296829dbd710fdff8823b1a

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\ffmpeg.dll
Filesize
2.5MB

MD5
d3ffc36ddd21357320e256314ba0bbed

SHA1
b0aa24771ccea0ffec089cd7aa5a6a2f2203c1f0

SHA256
226b591f952480fda136a0831800417339d5b5786d865278707fd57bc6e099da

SHA512
bf193b2244f18521e8fc548308a64b3018d0838c0664a7620c3c55a100032af8399ad8ba7a6b9d301bd01ac3bb72c8f2d32f516d8296829dbd710fdff8823b1a

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\ffmpeg.dll
Filesize
2.5MB

MD5
d3ffc36ddd21357320e256314ba0bbed

SHA1
b0aa24771ccea0ffec089cd7aa5a6a2f2203c1f0

SHA256
226b591f952480fda136a0831800417339d5b5786d865278707fd57bc6e099da

SHA512
bf193b2244f18521e8fc548308a64b3018d0838c0664a7620c3c55a100032af8399ad8ba7a6b9d301bd01ac3bb72c8f2d32f516d8296829dbd710fdff8823b1a

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\ffmpeg.dll
Filesize
2.5MB

MD5
d3ffc36ddd21357320e256314ba0bbed

SHA1
b0aa24771ccea0ffec089cd7aa5a6a2f2203c1f0

SHA256
226b591f952480fda136a0831800417339d5b5786d865278707fd57bc6e099da

SHA512
bf193b2244f18521e8fc548308a64b3018d0838c0664a7620c3c55a100032af8399ad8ba7a6b9d301bd01ac3bb72c8f2d32f516d8296829dbd710fdff8823b1a

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\ffmpeg.dll
Filesize
2.5MB

MD5
d3ffc36ddd21357320e256314ba0bbed

SHA1
b0aa24771ccea0ffec089cd7aa5a6a2f2203c1f0

SHA256
226b591f952480fda136a0831800417339d5b5786d865278707fd57bc6e099da

SHA512
bf193b2244f18521e8fc548308a64b3018d0838c0664a7620c3c55a100032af8399ad8ba7a6b9d301bd01ac3bb72c8f2d32f516d8296829dbd710fdff8823b1a

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\ffmpeg.dll
Filesize
2.5MB

MD5
d3ffc36ddd21357320e256314ba0bbed

SHA1
b0aa24771ccea0ffec089cd7aa5a6a2f2203c1f0

SHA256
226b591f952480fda136a0831800417339d5b5786d865278707fd57bc6e099da

SHA512
bf193b2244f18521e8fc548308a64b3018d0838c0664a7620c3c55a100032af8399ad8ba7a6b9d301bd01ac3bb72c8f2d32f516d8296829dbd710fdff8823b1a

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\ffmpeg.dll
Filesize
2.5MB

MD5
d3ffc36ddd21357320e256314ba0bbed

SHA1
b0aa24771ccea0ffec089cd7aa5a6a2f2203c1f0

SHA256
226b591f952480fda136a0831800417339d5b5786d865278707fd57bc6e099da

SHA512
bf193b2244f18521e8fc548308a64b3018d0838c0664a7620c3c55a100032af8399ad8ba7a6b9d301bd01ac3bb72c8f2d32f516d8296829dbd710fdff8823b1a

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\icudtl.dat
Filesize
9.8MB

MD5
d866d68e4a3eae8cdbfd5fc7a9967d20

SHA1
42a5033597e4be36ccfa16d19890049ba0e25a56

SHA256
c61704cc9cf5797bf32301a2b3312158af3fe86eadc913d937031cf594760c2d

SHA512
4cc04e708b9c3d854147b097e44ff795f956b8a714ab61ddd5434119ade768eb4da4b28938a9477e4cb0d63106cce09fd1ec86f33af1c864f4ea599f8d999b97

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\libEGL.dll
Filesize
365KB

MD5
0387de184059e5aed5b19da1450a40ca

SHA1
75d7e35f4091595cfd68525b8300e33e0a2aed63

SHA256
cc3ffc27c7d079f20795c5e49d0dc9361eaa313c0dc1b8d8cb5b35248cd1d314

SHA512
371825236c4195bf07bdfd72ea09df8b5ae64587499a7f6a32a4ef8a645d17f42899903c7e5c7a502b2d7047a24c844950a97f65d4ce0ccf48bce00a762147e9

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\libGLESv2.dll
Filesize
6.0MB

MD5
690895b04139b3ba5b423bb54ee0ccb7

SHA1
74892cd69ddcd113e0726fcb581c99c3b75129fe

SHA256
4f40ffe4beaf8add8b349287439a2ed4cdd732b508c9812979091d09a7b20915

SHA512
eafd6b6c51890c7e49591e84b0ad98ec7aafb8333df5c2459317af1101bddd0bd50a86b4f2329ce7f5cf96716cd25bd0a503ea0df8d8d6f9cbfa77b0e1e78785

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\libegl.dll
Filesize
365KB

MD5
0387de184059e5aed5b19da1450a40ca

SHA1
75d7e35f4091595cfd68525b8300e33e0a2aed63

SHA256
cc3ffc27c7d079f20795c5e49d0dc9361eaa313c0dc1b8d8cb5b35248cd1d314

SHA512
371825236c4195bf07bdfd72ea09df8b5ae64587499a7f6a32a4ef8a645d17f42899903c7e5c7a502b2d7047a24c844950a97f65d4ce0ccf48bce00a762147e9

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\libglesv2.dll
Filesize
6.0MB

MD5
690895b04139b3ba5b423bb54ee0ccb7

SHA1
74892cd69ddcd113e0726fcb581c99c3b75129fe

SHA256
4f40ffe4beaf8add8b349287439a2ed4cdd732b508c9812979091d09a7b20915

SHA512
eafd6b6c51890c7e49591e84b0ad98ec7aafb8333df5c2459317af1101bddd0bd50a86b4f2329ce7f5cf96716cd25bd0a503ea0df8d8d6f9cbfa77b0e1e78785

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\locales\en-US.pak
Filesize
110KB

MD5
5cc884bf0ec1c702240173b35a421d1b

SHA1
19bdfb0b31dc4a75e7c135d1a8ef76f5f6cc3a31

SHA256
9f0c75c84381360677055d6197812c7a6c42dbfc6134eb8212d8a60ed1ca1601

SHA512
48772f50f6b0d846084a0cfb0d6433f2fbf73677b557b022d0d73d04790636c0c40ed873c32fd037013e943fb7c24816efdcde38429520895c00c2d85a17ea5c

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\resources.pak
Filesize
4.9MB

MD5
39933b34aac7271db1be82d4bd9f50e6

SHA1
959b95de58c4b362e6695130545de86a08ae7b62

SHA256
38bb20864e6bf51708caf55a886e79070adb416a55e8fb3ab7901e8a03cd1ad7

SHA512
3ec3877b4f1e3dd50a943e58271467de26b3d6fbdd49b5a229578f16ac5beaffc6e4d9ea69ba23abcd630dcb998fe2588fe210dd84d3473a459462e50655eff5

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\resources\app.asar
Filesize
5.6MB

MD5
a261f0a6f53189360a3bcb7f0c4b8f9a

SHA1
15153a90286104ad998a063edd499fbd84986aac

SHA256
9f4a6b1d7d61f16b1574d230f2e53051994f01cd86f06c455b7362346ebca1dd

SHA512
7472053be9d5128f8b8ec46131c5f609d20f64b181fb9986c1cecbf41643bae0e832622c9b867d8ec4f0b020a8d0aa43559452bb6a5dd3d2931b0613e4481333

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\squirrel.exe
Filesize
1.7MB

MD5
c5f6cda4976ae38cd9fba3d1e5ebd244

SHA1
2006c37f01d010963a4331c42e579b87a2d16039

SHA256
dae7bd888b715b8e215482bc5ea6f028ded32a3ad88bf4acb6431d2a62ffe3f4

SHA512
a1a7529b0ceb3df471e803eac1d9256c009a9c8252884f64a28a59d59753c75e1bff726a35af02db5bdf20a2d194850bfdbed163722b09465ca32d10d059524d

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\v8_context_snapshot.bin
Filesize
592KB

MD5
74b5a5a3fe1bc0f54d065027db8f702b

SHA1
c279ab276ab96f6449c67e7abbeebf9f088b6b52

SHA256
d7d7b42c11b1301f9f8add3a5da03d948b8800164492b595c8df97b68657620e

SHA512
2362e93536f4f7edbfc2a518470d517f800bdc82baa90d91a8d0d2baba882ff8493c90c24e2508be51ebe1b420386cabda8c7aa7fbb16676703cd1475bd33f7e

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\vk_swiftshader.dll
Filesize
3.9MB

MD5
935c465318047ffcab2e687555de2f41

SHA1
fa9defbcc976ebbdaf1b36459912763661a6982c

SHA256
eaa3fb30cc2540258d2eaacf30cd130e67367f18a525fe2e0c2a3a49a4680f3b

SHA512
2429f387a2d6909acd9383102f73029a1a73619b49363304a7cfe32e19558cebbf4a21a74cb2f0e9afc57dd829cc08a460c41b20a88e4e3fdf7a5c24ce0cb9ad

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\vk_swiftshader.dll
Filesize
3.9MB

MD5
935c465318047ffcab2e687555de2f41

SHA1
fa9defbcc976ebbdaf1b36459912763661a6982c

SHA256
eaa3fb30cc2540258d2eaacf30cd130e67367f18a525fe2e0c2a3a49a4680f3b

SHA512
2429f387a2d6909acd9383102f73029a1a73619b49363304a7cfe32e19558cebbf4a21a74cb2f0e9afc57dd829cc08a460c41b20a88e4e3fdf7a5c24ce0cb9ad

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\vulkan-1.dll
Filesize
741KB

MD5
eeb339d04719e60ee8efd8830274ee76

SHA1
f49d308fd02cb7899930d449cfda176d2b2e5d1a

SHA256
6c3c0e85e75bd9b02ed304bdfdc6282297a9736ceae926e6fcae0b426d3d6620

SHA512
f19cca74edf6ae8c10dff0e6f2fbd61ec680411b3fffe5dc2bcfd94848a0ab997dc5d8f47412e7d516b8f334163fcd3714425219ea72ebcc2429589b2fbbdb07

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\app-1.0.7\vulkan-1.dll
Filesize
741KB

MD5
eeb339d04719e60ee8efd8830274ee76

SHA1
f49d308fd02cb7899930d449cfda176d2b2e5d1a

SHA256
6c3c0e85e75bd9b02ed304bdfdc6282297a9736ceae926e6fcae0b426d3d6620

SHA512
f19cca74edf6ae8c10dff0e6f2fbd61ec680411b3fffe5dc2bcfd94848a0ab997dc5d8f47412e7d516b8f334163fcd3714425219ea72ebcc2429589b2fbbdb07

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\packages\RELEASES
Filesize
87B

MD5
0a772f07cffa2629a97281662a01fde2

SHA1
f8733cded019579e4c8dd0df1f0e6cff8e05069d

SHA256
7922ea84dfee5b0b44f5cf7686fd57d0aec862f6ba894b27eb04b0c8b37371db

SHA512
efdc8f9f86a0bd5bc0f2b1b8144b5761b409e5a19457b80ef0b1a4577f416a68941e069cfabb0942c94f967aeb28af471928832c7338019780983b098989d2aa

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\packages\RELEASES
Filesize
87B

MD5
0a772f07cffa2629a97281662a01fde2

SHA1
f8733cded019579e4c8dd0df1f0e6cff8e05069d

SHA256
7922ea84dfee5b0b44f5cf7686fd57d0aec862f6ba894b27eb04b0c8b37371db

SHA512
efdc8f9f86a0bd5bc0f2b1b8144b5761b409e5a19457b80ef0b1a4577f416a68941e069cfabb0942c94f967aeb28af471928832c7338019780983b098989d2aa

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\packages\cristalix_updater-1.0.7-full.nupkg
Filesize
78.2MB

MD5
755de7a6b68dd06b1aa2165dcbeacfc7

SHA1
25e2c5821f579e1ac588e4a78f50f614f723f784

SHA256
019dc3fcabf509908d339b058d4300d010a9bb4891ba92630144a074f101b90f

SHA512
f028a77f1e83a005943fb20b78df87b88ade96983f9a6e61f08ab0ab198cb41f8c68d6e2be01930e7b5066feff8bb8e185e65dd41d5ebca55dd81ae5d74002c9

Download Submit
C:\Users\Admin\AppData\Local\cristalix_updater\update.exe
Filesize
1.7MB

MD5
c5f6cda4976ae38cd9fba3d1e5ebd244

SHA1
2006c37f01d010963a4331c42e579b87a2d16039

SHA256
dae7bd888b715b8e215482bc5ea6f028ded32a3ad88bf4acb6431d2a62ffe3f4

SHA512
a1a7529b0ceb3df471e803eac1d9256c009a9c8252884f64a28a59d59753c75e1bff726a35af02db5bdf20a2d194850bfdbed163722b09465ca32d10d059524d

Download Submit
C:\Users\Admin\AppData\Roaming\cristalix_updater\Local State
Filesize
389B

MD5
a16771af63f64b008ad99207dc998a55

SHA1
8d06bdf166d378c9fad66f2b8641cd813df034bd

SHA256
ea9bb4b32dbbffc744264c064625586800235f47fa4edd22b6473ab74aea9173

SHA512
3356bbbde263559fbf98ead0184ee2c6ed3a57ba760f53ca289ed6378c2b03fb1ec2f461668354826e47e937afdc9f988babfdbd831ae4f61d9abaf0e0ff8d3e

Download Submit
memory/400-244-0x0000000000000000-mapping.dmp

Download
memory/792-143-0x0000000000000000-mapping.dmp

Download
memory/1152-205-0x0000000000000000-mapping.dmp

Download
memory/1592-181-0x0000000000000000-mapping.dmp

Download
memory/1636-174-0x0000000000000000-mapping.dmp

Download
memory/1636-240-0x0000000000000000-mapping.dmp

Download
memory/2124-155-0x0000000004DE0000-0x0000000004E00000-memory.dmp

Filesize
128KB

Download
memory/2124-151-0x0000000000000000-mapping.dmp

Download
memory/2208-175-0x0000000000000000-mapping.dmp

Download
memory/2208-197-0x0000000005900000-0x0000000005E2C000-memory.dmp

Filesize
5.2MB

Download
memory/2792-246-0x0000000000000000-mapping.dmp

Download
memory/3000-243-0x0000000000000000-mapping.dmp

Download
memory/3616-130-0x0000000000000000-mapping.dmp

Download
memory/3616-139-0x000000000A990000-0x000000000A99E000-memory.dmp

Filesize
56KB

Download
memory/3616-138-0x000000000A9D0000-0x000000000AA08000-memory.dmp

Filesize
224KB

Download
memory/3616-133-0x00000000006D0000-0x0000000000894000-memory.dmp

Filesize
1.8MB

Download
memory/3616-170-0x00000000062A0000-0x0000000006332000-memory.dmp

Filesize
584KB

Download
memory/3852-163-0x0000000000000000-mapping.dmp

Download
memory/4088-238-0x0000000000000000-mapping.dmp

Download
memory/4144-199-0x0000000000000000-mapping.dmp

Download
memory/4192-180-0x0000000000000000-mapping.dmp

Download
memory/4220-248-0x0000000000000000-mapping.dmp

Download
memory/4344-140-0x0000000000000000-mapping.dmp

Download
memory/4552-241-0x0000000000000000-mapping.dmp

Download
memory/4920-206-0x0000000000000000-mapping.dmp

Download
memory/4920-237-0x00000206ABC90000-0x00000206ACC90000-memory.dmp

Filesize
16.0MB

Download
memory/4920-236-0x00000206ABC90000-0x00000206ACC90000-memory.dmp

Filesize
16.0MB

Download
memory/4920-234-0x00000206ABC90000-0x00000206ACC90000-memory.dmp

Filesize
16.0MB

Download
memory/4920-228-0x00000206ABC90000-0x00000206ACC90000-memory.dmp

Filesize
16.0MB

Download
memory/4940-280-0x00000225276A0000-0x00000225286A0000-memory.dmp

Filesize
16.0MB

Download
memory/4940-249-0x0000000000000000-mapping.dmp

Download
memory/4940-259-0x00000225276A0000-0x00000225286A0000-memory.dmp

Filesize
16.0MB

Download
memory/4940-266-0x00000225276A0000-0x00000225286A0000-memory.dmp

Filesize
16.0MB

Download
memory/4940-268-0x00000225276A0000-0x00000225286A0000-memory.dmp

Filesize
16.0MB

Download
memory/4940-269-0x00000225276A0000-0x00000225286A0000-memory.dmp

Filesize
16.0MB

Download
memory/4940-270-0x00000225276A0000-0x00000225286A0000-memory.dmp

Filesize
16.0MB

Download
memory/4940-277-0x00000225276A0000-0x00000225286A0000-memory.dmp

Filesize
16.0MB

Download
memory/4940-283-0x00000225276A0000-0x00000225286A0000-memory.dmp

Filesize
16.0MB

Download
memory/4940-285-0x00000225276A0000-0x00000225286A0000-memory.dmp

Filesize
16.0MB

Download
memory/4940-286-0x00000225276A0000-0x00000225286A0000-memory.dmp

Filesize
16.0MB

Download
memory/4940-289-0x00000225276A0000-0x00000225286A0000-memory.dmp

Filesize
16.0MB

Download
memory/4988-167-0x0000000000000000-mapping.dmp

Download