Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

02/02/2023, 18:40

230202-xbpgxscg53 7

02/02/2023, 18:33

230202-w7pl5afc2x 7

02/02/2023, 18:29

230202-w455psbf99 3

Analysis

  • max time kernel
    145s
  • max time network
    211s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/02/2023, 18:40

General

  • Target

    CrystalLauncherN.exe

  • Size

    1.5MB

  • MD5

    71ce62ad6a1da34bcc3a0bca71f1e2df

  • SHA1

    c5080fcb7b9ca8a8a267e217a4df2170eafc2bb2

  • SHA256

    7f13bb7a4b4fdab3ee99aa40599314fb2ab48f17c02736e06894c2578b3c0a36

  • SHA512

    f519cae4b8a71700bda63672219e1a9cf15e5a94cc2d7f1b96799144f91bd2d1e6782d637b935051ba2d08d59bf84d363921420b624fcaed21518f19b1fc1d8b

  • SSDEEP

    12288:qXlhhEayVkv/JBdBS4msNUCe65frHMnz2R9aty+v54BgC:qXlhhUQ/bdo4mz1U8z22y+vLC

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CrystalLauncherN.exe
    "C:\Users\Admin\AppData\Local\Temp\CrystalLauncherN.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4408
    • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\javaw.exe
      "C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\javaw.exe" -Dfile.encoding="UTF-8" -Dcrystal.windowsEngine="true" -Djava.net.preferIPv4Stack=true -Xmx256M -Xms128M -Dcrystal.wrapper.graphicscard=4D6963726F736F667420426173696320446973706C61792041646170746572 -Dcrystal.wrapper.version=34 -Dcrystal.runtimedir=jdk-17.0.1+12 -cp "C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcher.jar" ovh.leszczu8023.crystalwrapper.Main
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      • Suspicious use of WriteProcessMemory
      PID:4764
      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\java.exe
        C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\java -cp C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcher.jar ovh.leszczu8023.crystalwrapper.SubProcessMain
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        PID:4800
  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcher.exe
    "C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcher.exe" /nosetup
    1⤵
      PID:2628
      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\javaw.exe
        "C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\javaw.exe" -Dfile.encoding="UTF-8" -Dcrystal.windowsEngine="true" -Djava.net.preferIPv4Stack=true -Xmx256M -Xms128M -Dcrystal.wrapper.graphicscard=4D6963726F736F667420426173696320446973706C61792041646170746572 -Dcrystal.wrapper.version=34 -Dcrystal.runtimedir=jdk-17.0.1+12 -cp "C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcher.jar" ovh.leszczu8023.crystalwrapper.Main
        2⤵
          PID:4720

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\CrystalLauncherInstallerNX\crystalRuntime

        Filesize

        907B

        MD5

        2e3287aaf04853614df94851955cfbe4

        SHA1

        88d5590856976b67ac11a1f4b25f8fad6c133eaa

        SHA256

        a865bfc17913dacddfaed4bfbaabb9a690061153a50cd418dbb0822c7150e960

        SHA512

        fbdcef2062ec54a216df184572752a483c5e6c2c06a40b1f6fdc455538e606a79ec05ee645e0977b380588d462df239236be53f2800865a91e26a5404d3a4bcd

      • C:\Users\Admin\AppData\Local\CrystalLauncherInstallerNX\crystalRuntimeBranch

        Filesize

        8B

        MD5

        c00f0c4675b91fb8b918e4079a0b1bac

        SHA1

        f410e0466ae4b065bfa4d9010ad6056864ed4e50

        SHA256

        fe6d3468cf5c74d8ec2a95b40f2e05338c37a4202f8fad692d2b64a9cf9b468a

        SHA512

        ab1a941f8f3b436262bad2fa7b5eb3d025fe25f54b137129fd733efd5c86b1ce97b587bcfa4986ada5530e25015d9001c819b71786e91ef4e4a33aee953b591f

      • C:\Users\Admin\AppData\Local\CrystalLauncherInstallerNX\language.flag

        Filesize

        2B

        MD5

        9cfefed8fb9497baa5cd519d7d2bb5d7

        SHA1

        094b0fe0e302854af1311afab85b5203ba457a3b

        SHA256

        dbd3a49d0d906b4ed9216b73330d2fb080ef2f758c12f3885068222e5e17151c

        SHA512

        41dd75307a2e7c49caf53fff15aada688275ef4d7950bedf028612b73f343ed45cf51fe1d4d27f58ed12e93e0fd0ae7f69428db169211554d1b380c91aa5cd01

      • C:\Users\Admin\AppData\Local\CrystalLauncherInstallerNX\launcherChecksum

        Filesize

        32B

        MD5

        a78189c9d8b135210c30512c862ba731

        SHA1

        8452ebed38b89ee2aaf758ba837e034e93bc0c2c

        SHA256

        1b3d2d823dea92381ae7a683f85d8f5f61b624e1cc22073cf1be89b5130f3498

        SHA512

        25a17abc0883bd36ce850449e4d2f97ad4125ea13694f20856011d1457bfd35666fbe6fcf839538ac954050c8212acba8311035a610d4159cceaac51cc73c912

      • C:\Users\Admin\AppData\Local\CrystalLauncherInstallerNX\launchlog.txt

        Filesize

        8KB

        MD5

        2b723cd537548d7efd0b2fc1f38c4f54

        SHA1

        9ed60bb3aca3656bf06bfa0a9d9babf237734dfc

        SHA256

        c14a30e9879bb72a8b7830d660fb4f41c966d4266576221cd6622f27f60a6c9f

        SHA512

        44d1fcbf21bc3d3f49cc9cc92045e2c57736b484260c4ffb8eaecf82094bb86d43ea4a4a914ec660a432ea923a1fc4889fba637ac11e911ebadc88cd8ade806c

      • C:\Users\Admin\AppData\Local\CrystalLauncherInstallerNX\libChecksums

        Filesize

        17B

        MD5

        745aeedf75582605d2ad5a2ba5afe2d4

        SHA1

        336a731daeb9336e25205a47e206175ac591221a

        SHA256

        69d7834399c58d1b9971c6465137f77445a697c131c487ce1683cceff5e056aa

        SHA512

        89e46fc1235aeabe66f285af1a7950acc398eb514d7147cfd69a9a59f4ca243df69af3df9701767e344a9f3f4bb57e8446db17d9e48ccc84d9704fb6cdc56ba3

      • C:\Users\Admin\AppData\Roaming\.crystalinst

        Filesize

        47B

        MD5

        2749fa9b45b9755eefafbf5517c74614

        SHA1

        fb0b300aa4bb371f71b4fb0e7092d1911a1f976b

        SHA256

        f7b96d33e37ab4efee43ea4a9d4c872a2194d288954553c6e3bb7926e2a7287c

        SHA512

        ad1ea746af6e8ef14edd20ecc17304fae591d3696a0f0fdab264b7a039e600f50add376356c68813c72376160c6c89ec1af2e33a9a7cc185a896b85d8d7e0180

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\config.prop

        Filesize

        52B

        MD5

        cdc1c4ce58783e4309e2e80f509be8f3

        SHA1

        df064fc7e5b8e32c67b395fde03f94c5ae07939f

        SHA256

        bc1ff800476aea55ac5db9462f0a19262b9ced8919c40ea0a50ac1a8a1af6cb8

        SHA512

        83fc913b13afc65019054928239364c1715dd644df0f78960ac9af898562ae9c274bf78e9397a291230841b0e209785b61f76d978c5e4cc55934600fd98eea25

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcher.exe

        Filesize

        1.5MB

        MD5

        71ce62ad6a1da34bcc3a0bca71f1e2df

        SHA1

        c5080fcb7b9ca8a8a267e217a4df2170eafc2bb2

        SHA256

        7f13bb7a4b4fdab3ee99aa40599314fb2ab48f17c02736e06894c2578b3c0a36

        SHA512

        f519cae4b8a71700bda63672219e1a9cf15e5a94cc2d7f1b96799144f91bd2d1e6782d637b935051ba2d08d59bf84d363921420b624fcaed21518f19b1fc1d8b

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcher.exe

        Filesize

        1.5MB

        MD5

        71ce62ad6a1da34bcc3a0bca71f1e2df

        SHA1

        c5080fcb7b9ca8a8a267e217a4df2170eafc2bb2

        SHA256

        7f13bb7a4b4fdab3ee99aa40599314fb2ab48f17c02736e06894c2578b3c0a36

        SHA512

        f519cae4b8a71700bda63672219e1a9cf15e5a94cc2d7f1b96799144f91bd2d1e6782d637b935051ba2d08d59bf84d363921420b624fcaed21518f19b1fc1d8b

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcher.jar

        Filesize

        5.3MB

        MD5

        df2c77dd0ddb7ec2d05c99436b3f5a44

        SHA1

        a9a5f67662cde55173875b0d380e2b1039fcfae8

        SHA256

        e9eacb799ed31b66854eb9266e126719b83afcb11e586181e9ddc19ded6c10e3

        SHA512

        6616542ba5513df4c88aa831393285d9241ddea09555016fe0b00943308a3a69699e9c7d6767b6e016dc7b3bf6149c48d25096d33fd4e97a25833bddaac25766

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\VCRUNTIME140.dll

        Filesize

        94KB

        MD5

        e41f7041c95a33c5a6e02048232d1246

        SHA1

        8f1f3865281e80f099087e1cb395a8803fa51bc9

        SHA256

        70128415dae505b4bd7e3b63e82355dd4bd783226363a7b58b01145afef94e76

        SHA512

        cd17b910468dd4cc3e220c05cd64318c41bff46d67d0a5320aff2ed7a95621df43707249f2dd5dabf813400b5d57edf183ee144942779102ec427c04bf2b1302

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\awt.dll

        Filesize

        1.4MB

        MD5

        92c706b661a8daa740c819af4a80f4b7

        SHA1

        2f7f4f72e4a827d2cb39f794889c0faafebc55b1

        SHA256

        f8e565fd04710ca339fe3b756903a8e6f411e5b560db2daa2a2fa1bae517a205

        SHA512

        f9eafe825f31eac93fdeff6fc47deed620136623b5f7eb13d33841dc07103700f9c21e54ec094c7f6805802c27a82d0f32efb4893024b12d787f299c05064478

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\awt.dll

        Filesize

        1.4MB

        MD5

        92c706b661a8daa740c819af4a80f4b7

        SHA1

        2f7f4f72e4a827d2cb39f794889c0faafebc55b1

        SHA256

        f8e565fd04710ca339fe3b756903a8e6f411e5b560db2daa2a2fa1bae517a205

        SHA512

        f9eafe825f31eac93fdeff6fc47deed620136623b5f7eb13d33841dc07103700f9c21e54ec094c7f6805802c27a82d0f32efb4893024b12d787f299c05064478

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\java.dll

        Filesize

        141KB

        MD5

        38111e5139434cf879a94e702376fd81

        SHA1

        995d5f3fae928818ed0ce0c253dde966c95850ca

        SHA256

        7a66cc03683eda0c2a9f23dbabb4ee4a42252ece743ad5fee60fc1f74f15abb2

        SHA512

        9a6272b13c34d39a692df82e84a0937e33258318b664162884f0389392e6b47be72cd4c79b865a870590f567f21b4bc155e3cd570da9a3ab94a9d427ae7e2b45

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\java.dll

        Filesize

        141KB

        MD5

        38111e5139434cf879a94e702376fd81

        SHA1

        995d5f3fae928818ed0ce0c253dde966c95850ca

        SHA256

        7a66cc03683eda0c2a9f23dbabb4ee4a42252ece743ad5fee60fc1f74f15abb2

        SHA512

        9a6272b13c34d39a692df82e84a0937e33258318b664162884f0389392e6b47be72cd4c79b865a870590f567f21b4bc155e3cd570da9a3ab94a9d427ae7e2b45

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\java.dll

        Filesize

        141KB

        MD5

        38111e5139434cf879a94e702376fd81

        SHA1

        995d5f3fae928818ed0ce0c253dde966c95850ca

        SHA256

        7a66cc03683eda0c2a9f23dbabb4ee4a42252ece743ad5fee60fc1f74f15abb2

        SHA512

        9a6272b13c34d39a692df82e84a0937e33258318b664162884f0389392e6b47be72cd4c79b865a870590f567f21b4bc155e3cd570da9a3ab94a9d427ae7e2b45

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\java.exe

        Filesize

        47KB

        MD5

        8d86c867407b649ce70d9b205f6680e0

        SHA1

        cd67d2487802c9a912662f80f1027345365bc35b

        SHA256

        fafa615b1e9c3732cd0976563cf630ac316f795807567fdf0b812ea1c5a5f972

        SHA512

        db3c22ebb82a09f257f5e869983dd9d355e20f26784f7818f1e393ece179c8550962c16060fd5622a6ee3eeaa9be6ba6da2ada6b7563cc6fa64b2f8be55b7bcc

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\java.exe

        Filesize

        47KB

        MD5

        8d86c867407b649ce70d9b205f6680e0

        SHA1

        cd67d2487802c9a912662f80f1027345365bc35b

        SHA256

        fafa615b1e9c3732cd0976563cf630ac316f795807567fdf0b812ea1c5a5f972

        SHA512

        db3c22ebb82a09f257f5e869983dd9d355e20f26784f7818f1e393ece179c8550962c16060fd5622a6ee3eeaa9be6ba6da2ada6b7563cc6fa64b2f8be55b7bcc

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\javaw.exe

        Filesize

        47KB

        MD5

        ff2d3a19fe47fa88419716c79ac3e7c1

        SHA1

        506d95d54b49fb4ef021274605d62bb514b2b24a

        SHA256

        aabc670f4aad59906236a0aa4e465c9f8b65ac86a15c6d0a2eae950890e8c693

        SHA512

        130562020d250c3e7ff18801f931a69371b6c7e858a0c294b0408b096e19fce300ed6bf1d3c07ce59e5f4ccec9f67fd304fa9bf29efcf6a455d30fcec53d3ad9

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\javaw.exe

        Filesize

        47KB

        MD5

        ff2d3a19fe47fa88419716c79ac3e7c1

        SHA1

        506d95d54b49fb4ef021274605d62bb514b2b24a

        SHA256

        aabc670f4aad59906236a0aa4e465c9f8b65ac86a15c6d0a2eae950890e8c693

        SHA512

        130562020d250c3e7ff18801f931a69371b6c7e858a0c294b0408b096e19fce300ed6bf1d3c07ce59e5f4ccec9f67fd304fa9bf29efcf6a455d30fcec53d3ad9

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\jimage.dll

        Filesize

        31KB

        MD5

        e4cbd8fd2e2c55a531a0699f4ee82e0b

        SHA1

        deeabbeccedd12279536dcf3f0dd928b05937914

        SHA256

        b0060bd198f6f721b098b8305c9f257adeccf68eddfa2e7a59f831f2131f736e

        SHA512

        0e6e290fb4870e2264b358d2232d9b5a28e08964e25da8085718589181b7a225b8487bf99c180acf6c3e22c1c8726540acf26a2b35a5c24130cf80a4b3daec24

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\jimage.dll

        Filesize

        31KB

        MD5

        e4cbd8fd2e2c55a531a0699f4ee82e0b

        SHA1

        deeabbeccedd12279536dcf3f0dd928b05937914

        SHA256

        b0060bd198f6f721b098b8305c9f257adeccf68eddfa2e7a59f831f2131f736e

        SHA512

        0e6e290fb4870e2264b358d2232d9b5a28e08964e25da8085718589181b7a225b8487bf99c180acf6c3e22c1c8726540acf26a2b35a5c24130cf80a4b3daec24

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\jimage.dll

        Filesize

        31KB

        MD5

        e4cbd8fd2e2c55a531a0699f4ee82e0b

        SHA1

        deeabbeccedd12279536dcf3f0dd928b05937914

        SHA256

        b0060bd198f6f721b098b8305c9f257adeccf68eddfa2e7a59f831f2131f736e

        SHA512

        0e6e290fb4870e2264b358d2232d9b5a28e08964e25da8085718589181b7a225b8487bf99c180acf6c3e22c1c8726540acf26a2b35a5c24130cf80a4b3daec24

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\jli.dll

        Filesize

        84KB

        MD5

        ce96e51eddd76d8ca575746f0d63fac6

        SHA1

        3d3f8258eb7fb5ad89b631cceca15477f9f6c0e6

        SHA256

        eebb77c2c07cd19c6c168fd0ea09698f45b711658a3fb782fbf78b28af3cfda9

        SHA512

        4a67ab3baca5725f4af8bfdb2ad240d4daf65cd03b61a180732b467b8c6e12dad4b3362c51332a27bddff94b15660a07481be85fe4d5428a603aa77e3827384a

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\jli.dll

        Filesize

        84KB

        MD5

        ce96e51eddd76d8ca575746f0d63fac6

        SHA1

        3d3f8258eb7fb5ad89b631cceca15477f9f6c0e6

        SHA256

        eebb77c2c07cd19c6c168fd0ea09698f45b711658a3fb782fbf78b28af3cfda9

        SHA512

        4a67ab3baca5725f4af8bfdb2ad240d4daf65cd03b61a180732b467b8c6e12dad4b3362c51332a27bddff94b15660a07481be85fe4d5428a603aa77e3827384a

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\jli.dll

        Filesize

        84KB

        MD5

        ce96e51eddd76d8ca575746f0d63fac6

        SHA1

        3d3f8258eb7fb5ad89b631cceca15477f9f6c0e6

        SHA256

        eebb77c2c07cd19c6c168fd0ea09698f45b711658a3fb782fbf78b28af3cfda9

        SHA512

        4a67ab3baca5725f4af8bfdb2ad240d4daf65cd03b61a180732b467b8c6e12dad4b3362c51332a27bddff94b15660a07481be85fe4d5428a603aa77e3827384a

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\msvcp140.dll

        Filesize

        552KB

        MD5

        f062fc66916d97955b1cae44f4de7844

        SHA1

        a726b68ae22c302be2a9c6f36158b261af2d3140

        SHA256

        78e8a75fe76172363d6e2a8ca455a995e414d376d06e2194482ad88f7459aa8d

        SHA512

        a1b3707c061aa5833396a2a8e2ef46cffc621af99b3d2bcd570bedf6a4ab96bd2464587c5ccf962239c2974caf4882e7729f13f025b0c03ca52bc0fc7ef2a56d

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\msvcp140.dll

        Filesize

        552KB

        MD5

        f062fc66916d97955b1cae44f4de7844

        SHA1

        a726b68ae22c302be2a9c6f36158b261af2d3140

        SHA256

        78e8a75fe76172363d6e2a8ca455a995e414d376d06e2194482ad88f7459aa8d

        SHA512

        a1b3707c061aa5833396a2a8e2ef46cffc621af99b3d2bcd570bedf6a4ab96bd2464587c5ccf962239c2974caf4882e7729f13f025b0c03ca52bc0fc7ef2a56d

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\msvcp140.dll

        Filesize

        552KB

        MD5

        f062fc66916d97955b1cae44f4de7844

        SHA1

        a726b68ae22c302be2a9c6f36158b261af2d3140

        SHA256

        78e8a75fe76172363d6e2a8ca455a995e414d376d06e2194482ad88f7459aa8d

        SHA512

        a1b3707c061aa5833396a2a8e2ef46cffc621af99b3d2bcd570bedf6a4ab96bd2464587c5ccf962239c2974caf4882e7729f13f025b0c03ca52bc0fc7ef2a56d

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\net.dll

        Filesize

        93KB

        MD5

        a0e62ab9b86e3f73f8e98b05fd248b6b

        SHA1

        19d0671bd3c4e50168fb483123e5115cb0fbbf80

        SHA256

        dfef189785804970ed46cea809788398136fd6b07eb52ff95a5f7286d8c66eb2

        SHA512

        eb24a24adcd06a282582da3d7f4e0ef980c405d8219b11e5278ce653517ce4d9422ee45bd9d833cc7a7d22b934a379e2eff03f960bf677dff5176e2c54a99ebf

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\net.dll

        Filesize

        93KB

        MD5

        a0e62ab9b86e3f73f8e98b05fd248b6b

        SHA1

        19d0671bd3c4e50168fb483123e5115cb0fbbf80

        SHA256

        dfef189785804970ed46cea809788398136fd6b07eb52ff95a5f7286d8c66eb2

        SHA512

        eb24a24adcd06a282582da3d7f4e0ef980c405d8219b11e5278ce653517ce4d9422ee45bd9d833cc7a7d22b934a379e2eff03f960bf677dff5176e2c54a99ebf

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\net.dll

        Filesize

        93KB

        MD5

        a0e62ab9b86e3f73f8e98b05fd248b6b

        SHA1

        19d0671bd3c4e50168fb483123e5115cb0fbbf80

        SHA256

        dfef189785804970ed46cea809788398136fd6b07eb52ff95a5f7286d8c66eb2

        SHA512

        eb24a24adcd06a282582da3d7f4e0ef980c405d8219b11e5278ce653517ce4d9422ee45bd9d833cc7a7d22b934a379e2eff03f960bf677dff5176e2c54a99ebf

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\nio.dll

        Filesize

        76KB

        MD5

        20ff398354be25f4bf06885cabdd72ba

        SHA1

        e95718876f4c0833224bc36f038211ab3e630218

        SHA256

        b573c12c57e52f8fb0b959403a5d8f35b10da61c8ff007f194d5e9bf628807a5

        SHA512

        14e247e541d1d778c7ff61e78563e5660fc2e6215531af16cdb73967fe7f040b48ef90a3608cac97de29c5661a121b6d4bce96fe13c546043f31e8eaa161c401

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\nio.dll

        Filesize

        76KB

        MD5

        20ff398354be25f4bf06885cabdd72ba

        SHA1

        e95718876f4c0833224bc36f038211ab3e630218

        SHA256

        b573c12c57e52f8fb0b959403a5d8f35b10da61c8ff007f194d5e9bf628807a5

        SHA512

        14e247e541d1d778c7ff61e78563e5660fc2e6215531af16cdb73967fe7f040b48ef90a3608cac97de29c5661a121b6d4bce96fe13c546043f31e8eaa161c401

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\nio.dll

        Filesize

        76KB

        MD5

        20ff398354be25f4bf06885cabdd72ba

        SHA1

        e95718876f4c0833224bc36f038211ab3e630218

        SHA256

        b573c12c57e52f8fb0b959403a5d8f35b10da61c8ff007f194d5e9bf628807a5

        SHA512

        14e247e541d1d778c7ff61e78563e5660fc2e6215531af16cdb73967fe7f040b48ef90a3608cac97de29c5661a121b6d4bce96fe13c546043f31e8eaa161c401

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\server\classes.jsa

        Filesize

        12.0MB

        MD5

        21a39604169e0573f840d59aaa53e1f7

        SHA1

        ccc50e0787d86bf9fa6e8d53d57b37e75c56913b

        SHA256

        b6048262ea0105fe150df9251695a0c0040f300a9cbd6a82743a397aa8c030bb

        SHA512

        19100c29240b0f85d5b7a3efc28f6a9540e4fba3276a5ceade937a8b8ef0548213bb1ec43731b855a20579fe469f2edb65738e1d9f95e3cbe24610f37531de27

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\server\jvm.dll

        Filesize

        12.0MB

        MD5

        6f8d2dd56671d1b96d4ec752cb326b85

        SHA1

        66aac967cff1463a3d65823d56065e10d75109ee

        SHA256

        321361921d63e2f13a2f13d8a74ce7d72f6aed1f157be5d5aa2a3a50006833fd

        SHA512

        b71e573a5378f564524fe186e507d55a9e65e9dad98190381acad922723af42700d959656ddb028e746b7dad9e84f38e5443cf5e7ece31a7afdfbeb21f8edf88

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\server\jvm.dll

        Filesize

        12.0MB

        MD5

        6f8d2dd56671d1b96d4ec752cb326b85

        SHA1

        66aac967cff1463a3d65823d56065e10d75109ee

        SHA256

        321361921d63e2f13a2f13d8a74ce7d72f6aed1f157be5d5aa2a3a50006833fd

        SHA512

        b71e573a5378f564524fe186e507d55a9e65e9dad98190381acad922723af42700d959656ddb028e746b7dad9e84f38e5443cf5e7ece31a7afdfbeb21f8edf88

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\server\jvm.dll

        Filesize

        12.0MB

        MD5

        6f8d2dd56671d1b96d4ec752cb326b85

        SHA1

        66aac967cff1463a3d65823d56065e10d75109ee

        SHA256

        321361921d63e2f13a2f13d8a74ce7d72f6aed1f157be5d5aa2a3a50006833fd

        SHA512

        b71e573a5378f564524fe186e507d55a9e65e9dad98190381acad922723af42700d959656ddb028e746b7dad9e84f38e5443cf5e7ece31a7afdfbeb21f8edf88

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\sunmscapi.dll

        Filesize

        44KB

        MD5

        81c34a344640a6a98476d0b0d0bf7c40

        SHA1

        7593267c12b7887530c601b82402579f74365be2

        SHA256

        ac5008e013c15b5945358f4eb22811949de01e8de60048c0620413afc74aefc3

        SHA512

        6f0ee62baa1229c29a0cb010914af226cdc6276198298bd1b5f32fa72da171e6e75477eacaf86588fa626c61d276b4e6825e10d0efc0089cbc57533f602b33f3

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\sunmscapi.dll

        Filesize

        44KB

        MD5

        81c34a344640a6a98476d0b0d0bf7c40

        SHA1

        7593267c12b7887530c601b82402579f74365be2

        SHA256

        ac5008e013c15b5945358f4eb22811949de01e8de60048c0620413afc74aefc3

        SHA512

        6f0ee62baa1229c29a0cb010914af226cdc6276198298bd1b5f32fa72da171e6e75477eacaf86588fa626c61d276b4e6825e10d0efc0089cbc57533f602b33f3

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\svml.dll

        Filesize

        847KB

        MD5

        98817cdd235d859cc482725af2b32b0b

        SHA1

        a9c3779a493775c0f96a9ac71267f7a72a82bada

        SHA256

        d8cb9603e4fec3ac5b77130c4932bc113cbd95a38bd284abb4319fa6d5451aee

        SHA512

        64719489e7e03327ca0385aa82fbc5c8c31bb1b3a33ee11ec3cbbfad85e5e329b8330ded639ce0062875cef9334604375511896c94c69801d453e775dd7a36dd

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\svml.dll

        Filesize

        847KB

        MD5

        98817cdd235d859cc482725af2b32b0b

        SHA1

        a9c3779a493775c0f96a9ac71267f7a72a82bada

        SHA256

        d8cb9603e4fec3ac5b77130c4932bc113cbd95a38bd284abb4319fa6d5451aee

        SHA512

        64719489e7e03327ca0385aa82fbc5c8c31bb1b3a33ee11ec3cbbfad85e5e329b8330ded639ce0062875cef9334604375511896c94c69801d453e775dd7a36dd

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\svml.dll

        Filesize

        847KB

        MD5

        98817cdd235d859cc482725af2b32b0b

        SHA1

        a9c3779a493775c0f96a9ac71267f7a72a82bada

        SHA256

        d8cb9603e4fec3ac5b77130c4932bc113cbd95a38bd284abb4319fa6d5451aee

        SHA512

        64719489e7e03327ca0385aa82fbc5c8c31bb1b3a33ee11ec3cbbfad85e5e329b8330ded639ce0062875cef9334604375511896c94c69801d453e775dd7a36dd

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\vcruntime140.dll

        Filesize

        94KB

        MD5

        e41f7041c95a33c5a6e02048232d1246

        SHA1

        8f1f3865281e80f099087e1cb395a8803fa51bc9

        SHA256

        70128415dae505b4bd7e3b63e82355dd4bd783226363a7b58b01145afef94e76

        SHA512

        cd17b910468dd4cc3e220c05cd64318c41bff46d67d0a5320aff2ed7a95621df43707249f2dd5dabf813400b5d57edf183ee144942779102ec427c04bf2b1302

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\vcruntime140.dll

        Filesize

        94KB

        MD5

        e41f7041c95a33c5a6e02048232d1246

        SHA1

        8f1f3865281e80f099087e1cb395a8803fa51bc9

        SHA256

        70128415dae505b4bd7e3b63e82355dd4bd783226363a7b58b01145afef94e76

        SHA512

        cd17b910468dd4cc3e220c05cd64318c41bff46d67d0a5320aff2ed7a95621df43707249f2dd5dabf813400b5d57edf183ee144942779102ec427c04bf2b1302

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\vcruntime140_1.dll

        Filesize

        36KB

        MD5

        fcda026792268accd2a47f3cfb66debf

        SHA1

        66d406b0f27f62f0d29e3e6dcc90935db3e9595d

        SHA256

        52beaeed839f64a6b3796ff1233f1215bdf9582dd427b82ccd91b56c44d52644

        SHA512

        3d33cd6e97c59dbe4b3f531b8c4144b111462c07460a014259578ab8f3319ac821ccea9de2e9a5929c86533922dec17aa8a69e4e0c96e5311e5a24589fafb191

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\vcruntime140_1.dll

        Filesize

        36KB

        MD5

        fcda026792268accd2a47f3cfb66debf

        SHA1

        66d406b0f27f62f0d29e3e6dcc90935db3e9595d

        SHA256

        52beaeed839f64a6b3796ff1233f1215bdf9582dd427b82ccd91b56c44d52644

        SHA512

        3d33cd6e97c59dbe4b3f531b8c4144b111462c07460a014259578ab8f3319ac821ccea9de2e9a5929c86533922dec17aa8a69e4e0c96e5311e5a24589fafb191

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\vcruntime140_1.dll

        Filesize

        36KB

        MD5

        fcda026792268accd2a47f3cfb66debf

        SHA1

        66d406b0f27f62f0d29e3e6dcc90935db3e9595d

        SHA256

        52beaeed839f64a6b3796ff1233f1215bdf9582dd427b82ccd91b56c44d52644

        SHA512

        3d33cd6e97c59dbe4b3f531b8c4144b111462c07460a014259578ab8f3319ac821ccea9de2e9a5929c86533922dec17aa8a69e4e0c96e5311e5a24589fafb191

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\zip.dll

        Filesize

        83KB

        MD5

        52516d2bb7fcae734a142426685c5b56

        SHA1

        ee20f8f0b1293460b6b9c0ee115d594dc02ab6f5

        SHA256

        fed1d03f0a4e5846c1e69a1b0d4df8db9832fe6e7a4dcdc944b8880740b3316a

        SHA512

        ce47262718f13e7fc4bb419608f054f1866bc904a0e51b272d1efa342e3ae574f79f4c47af7ac2c395dba57d86cc707302c9bccaa561da0e21d4a846b876ad73

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\zip.dll

        Filesize

        83KB

        MD5

        52516d2bb7fcae734a142426685c5b56

        SHA1

        ee20f8f0b1293460b6b9c0ee115d594dc02ab6f5

        SHA256

        fed1d03f0a4e5846c1e69a1b0d4df8db9832fe6e7a4dcdc944b8880740b3316a

        SHA512

        ce47262718f13e7fc4bb419608f054f1866bc904a0e51b272d1efa342e3ae574f79f4c47af7ac2c395dba57d86cc707302c9bccaa561da0e21d4a846b876ad73

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\zip.dll

        Filesize

        83KB

        MD5

        52516d2bb7fcae734a142426685c5b56

        SHA1

        ee20f8f0b1293460b6b9c0ee115d594dc02ab6f5

        SHA256

        fed1d03f0a4e5846c1e69a1b0d4df8db9832fe6e7a4dcdc944b8880740b3316a

        SHA512

        ce47262718f13e7fc4bb419608f054f1866bc904a0e51b272d1efa342e3ae574f79f4c47af7ac2c395dba57d86cc707302c9bccaa561da0e21d4a846b876ad73

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\conf\logging.properties

        Filesize

        2KB

        MD5

        0f00ec3e7a7767a4efeae1875fb5f3d4

        SHA1

        167808418571e9209b952188ddab2f4e62920e68

        SHA256

        b62d2733ab99556b108a1951d894c5a8d76b1ac7a00c02c388f9eb9be046c56f

        SHA512

        e869f4a3b821a9933796dc9a56ee00483493369dfbfe07b3b1d895cb8318c6821cd44134eb37513f15b830c25861b596646824ed56672d08b678fefe6a4c7504

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\conf\net.properties

        Filesize

        6KB

        MD5

        385443b7e4a37bc277c018cd1d336d49

        SHA1

        b2c0dfb00bf699e817bdd49b14bc24b8d3282c65

        SHA256

        5bc726671936e0af4fdf6bed67d9e3a20a92c30b0ba23673d0314baa5e3ffb08

        SHA512

        260afc7671a1dc0c443564f1d10386f0b241bb53c76df68d8d03f1d0b1ceaf3f68847ab3477732c876c2b01c812ef7521744befe88e312f3aa63164b608b67a1

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\conf\security\java.security

        Filesize

        56KB

        MD5

        00cf40959861f61f17b90c6b6002a9a1

        SHA1

        982e48466428e1f49c1a5941c73afdacefd1d22e

        SHA256

        38166a975348862d693d95de8d676cf19cecccc45af4a1896c73c45f7bd966ef

        SHA512

        bad90152685279d896a4063d76dec5befe14831d3dd3260929b9a639505e898fa996b52aab3821a51c6c9aa09d956a23a8bdd870377a10e75c9399629cab5779

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\conf\security\policy\unlimited\default_US_export.policy

        Filesize

        146B

        MD5

        1a08ffdf0bc871296c8d698fb22f542a

        SHA1

        f3f974d3f6245c50804dcc47173aa29d4d7f0e2c

        SHA256

        758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9

        SHA512

        4cfca5b10cd7addcff887c8f3621d2fbec1b5632436326377b0ce5af1ae3e8b68ac5a743ca6082fc79991b8eec703a6e1dfd5b896153407ad72327753222fdb3

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\conf\security\policy\unlimited\default_local.policy

        Filesize

        193B

        MD5

        2a0f330c51aff13a96af8bd5082c84a8

        SHA1

        ad2509631ed743c882999ac1200fd5fb8a593639

        SHA256

        8d8a318e6d90dfd7e26612d2b6385aa704f686ca6134c551f8928418d92b851a

        SHA512

        2b0385417a3fc2af58b1cbb186dd3e0b0875e42923884153deee0efcb390ca00b326ed5b266b3892d31bf7d40e10969a0b51daa6d0b4ca3183770786925d3cde

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\lib\jvm.cfg

        Filesize

        29B

        MD5

        7ce21bdcfa333c231d74a77394206302

        SHA1

        c5a940d2dee8e7bfc01a87d585ddca420d37e226

        SHA256

        aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0

        SHA512

        8b37a1a5600e0a4e5832021c4db50569e33f1ddc8ac4fc2f38d5439272b955b0e3028ea10dec0743b197aa0def32d9e185066d2bac451f81b99539d34006074b

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\lib\modules

        Filesize

        32.1MB

        MD5

        b166a81a06068a5dd5dc7e03c91c8e63

        SHA1

        d59aeb00c95d8e34790231068e06b7c13d6cbd6d

        SHA256

        b29a94c061d8f36f93d11f03cd236a97a38cf79d9793f6145b7165181edec95e

        SHA512

        dddf9fe3591312f8540b8d34f6f4a5555dd1da8f05110a6d6d153062816b45994c4cb1cf41eddd88f02e1b8548d82630d5b61dd44f1d86b54099516ecee64828

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\lib\security\blocked.certs

        Filesize

        2KB

        MD5

        8273f70416f494f7fa5b6c70a101e00e

        SHA1

        aeaebb14fbf146fbb0aaf347446c08766c86ca7f

        SHA256

        583500b76965eb54b03493372989ab4d3426f85462d1db232c5ae6706a4d6c58

        SHA512

        e697a57d64ace1f302300f83e875c2726407f8daf7c1d38b07ab8b4b11299fd698582d825bee817a1af85a285f27877a9e603e48e01c72e482a04dc7ab12c8da

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\lib\security\cacerts

        Filesize

        151KB

        MD5

        510ce33003cd297c64da765053fa18df

        SHA1

        cc8cf9abbc50a4ee179fb284d970a7623acd7a64

        SHA256

        2c5844eeec3ba02372c0aeaf0ea554d06858aedcb14c33f59b0338689aa6b317

        SHA512

        40db757a74b44e9badda74d51ffdc42c58638dbf1e2f613e3366eb4ddeb6fca4448961a87b8372c515bf0e37c61e43e59646ca686ac862821ddf5af9e9ff1f5c

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\lib\tzdb.dat

        Filesize

        104KB

        MD5

        418ae31029c3c3c75e4b7e015496f35e

        SHA1

        91e9441ffb337c37f72281def08640b33f640064

        SHA256

        dc97b06c5d110f8b0dc877c01e900734702a1636d5db0c01e3a8706b74704606

        SHA512

        5111c4ca248335a9e3569a4f6cbdab0384c92f26553e3cbab60fe259d5e394bc08e1b5a2e42ca72a30e5e68c112329afec267f48992c04f7099a18b1153ea526

      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\lib\tzmappings

        Filesize

        21KB

        MD5

        b02ee240a8db902961fe886a19beba16

        SHA1

        c52c42d591f4c650b629e6b374e967e211fb5aeb

        SHA256

        36dc51c4bf787f640a4b45cbb84ab6954f6e595cbd3617c2f5a4e1e607b38bff

        SHA512

        024811961511b7182860ed03a5670f82412a45d005a1db0876f6b0c9af7e96c104566abff0ebbded11a780349444214291f439039d20fb92071c7dd24bda0e23

      • memory/2628-246-0x00007FFD7E0C0000-0x00007FFD7EB81000-memory.dmp

        Filesize

        10.8MB

      • memory/2628-235-0x00007FFD7E0C0000-0x00007FFD7EB81000-memory.dmp

        Filesize

        10.8MB

      • memory/4408-134-0x00007FFD7E010000-0x00007FFD7EAD1000-memory.dmp

        Filesize

        10.8MB

      • memory/4408-133-0x00007FFD7E010000-0x00007FFD7EAD1000-memory.dmp

        Filesize

        10.8MB

      • memory/4408-158-0x00007FFD7E010000-0x00007FFD7EAD1000-memory.dmp

        Filesize

        10.8MB

      • memory/4408-132-0x00000257EF6F0000-0x00000257EF880000-memory.dmp

        Filesize

        1.6MB

      • memory/4764-215-0x0000023FAF600000-0x0000023FB0600000-memory.dmp

        Filesize

        16.0MB

      • memory/4764-199-0x0000023FAF600000-0x0000023FB0600000-memory.dmp

        Filesize

        16.0MB

      • memory/4764-170-0x0000023FAF600000-0x0000023FB0600000-memory.dmp

        Filesize

        16.0MB

      • memory/4800-230-0x000001BD184C0000-0x000001BD194C0000-memory.dmp

        Filesize

        16.0MB

      • memory/4800-238-0x000001BD184C0000-0x000001BD194C0000-memory.dmp

        Filesize

        16.0MB

      • memory/4800-241-0x000001BD184C0000-0x000001BD194C0000-memory.dmp

        Filesize

        16.0MB

      • memory/4800-224-0x000001BD184C0000-0x000001BD194C0000-memory.dmp

        Filesize

        16.0MB