Analysis

  • max time kernel
    85s
  • max time network
    86s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    19/06/2024, 14:45

General

  • Target

    CrystalLauncherN.exe

  • Size

    1.5MB

  • MD5

    71ce62ad6a1da34bcc3a0bca71f1e2df

  • SHA1

    c5080fcb7b9ca8a8a267e217a4df2170eafc2bb2

  • SHA256

    7f13bb7a4b4fdab3ee99aa40599314fb2ab48f17c02736e06894c2578b3c0a36

  • SHA512

    f519cae4b8a71700bda63672219e1a9cf15e5a94cc2d7f1b96799144f91bd2d1e6782d637b935051ba2d08d59bf84d363921420b624fcaed21518f19b1fc1d8b

  • SSDEEP

    12288:qXlhhEayVkv/JBdBS4msNUCe65frHMnz2R9aty+v54BgC:qXlhhUQ/bdo4mz1U8z22y+vLC

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 29 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CrystalLauncherN.exe
    "C:\Users\Admin\AppData\Local\Temp\CrystalLauncherN.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3844
    • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\javaw.exe
      "C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\javaw.exe" -Dfile.encoding="UTF-8" -Dcrystal.windowsEngine="true" -Djava.net.preferIPv4Stack=true -Xmx256M -Xms128M -Dcrystal.wrapper.graphicscard=496E74656C2852292055484420477261706869637320373330 -Dcrystal.wrapper.version=34 -Dcrystal.runtimedir=jdk-17.0.1+12 -cp "C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcher.jar" ovh.leszczu8023.crystalwrapper.Main
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3216
      • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\java.exe
        C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\java -cp C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcher.jar ovh.crystallauncher.crystalwrapper.SubProcessMain
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious use of SetWindowsHookEx
        PID:2908

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\CrystalLauncherInstallerNX\crystalRuntimeBranch

    Filesize

    8B

    MD5

    c00f0c4675b91fb8b918e4079a0b1bac

    SHA1

    f410e0466ae4b065bfa4d9010ad6056864ed4e50

    SHA256

    fe6d3468cf5c74d8ec2a95b40f2e05338c37a4202f8fad692d2b64a9cf9b468a

    SHA512

    ab1a941f8f3b436262bad2fa7b5eb3d025fe25f54b137129fd733efd5c86b1ce97b587bcfa4986ada5530e25015d9001c819b71786e91ef4e4a33aee953b591f

  • C:\Users\Admin\AppData\Local\CrystalLauncherInstallerNX\launchlog.txt

    Filesize

    1KB

    MD5

    eb21663e1d91ae2b3dab7ea9e6441106

    SHA1

    86b1bc3ff56814bc013234bd80188bef8237d529

    SHA256

    d706a83c3b782e0673974b963392223232d295a3f81f25117028b3d3d2ad63c9

    SHA512

    d17396863aa40c7659c7d61fac1a61591c382e33dce9a05cb9a53f16ad7a17cd71f13f35ac265011108699aa39c1b4a9366901ba653d7be2e721db3eefe1fc9a

  • C:\Users\Admin\AppData\Local\CrystalLauncherInstallerNX\launchlog.txt

    Filesize

    3KB

    MD5

    b5d03994851fe8eb9679a6f751ae1f3d

    SHA1

    90129e64e6e5a0f2ce3a58f6de2f321641cc51e1

    SHA256

    453132907972f0137877708346b15cc75f34c4bd4d35ef7ff160d0dff44e9a89

    SHA512

    c62c5f49a415d7ac9e04f3807dca97177b124f7f6d6e60eb7ae52ce632b13d599130d00a4740f208289f1a5be0d4bc40477870ecca475565a83b094d78efcf09

  • C:\Users\Admin\AppData\Local\CrystalLauncherInstallerNX\launchlog.txt

    Filesize

    5KB

    MD5

    9ceb08619ba6050ff89ffcfe8ec74060

    SHA1

    5e2d6f81aeba88c9e415216558bf99b8de4925e2

    SHA256

    c79566bd0e47a9f2128e011e81025d300472d8bc7a38b33fc5222cebdb156465

    SHA512

    94a263744e275cd4a3ab26f736b240f678f88585ce2422be13bdd639d120f2ca86a0c4c0c19d4c4d9737467229276876c204f37020f195aa8239c70583d86790

  • C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna9221145024103891464.dll

    Filesize

    248KB

    MD5

    a57eb3837a7aa2b6f87cf3373c072712

    SHA1

    943cf0cf176a96c11b773d78a6e761be15ac08b0

    SHA256

    2475272f129a0b36bd9bf5ed732aef70d9d9ca726ae2518588cebe298561dce8

    SHA512

    57465c188bac732ab27c283e7469af82ca5393a5c0e144e1e4bf8823ccfa812d3528b31e3362b670ab97f31421ea7addfbc6589d4a997e0855d61a98ed385834

  • C:\Users\Admin\AppData\Roaming\.crystalinst

    Filesize

    47B

    MD5

    2749fa9b45b9755eefafbf5517c74614

    SHA1

    fb0b300aa4bb371f71b4fb0e7092d1911a1f976b

    SHA256

    f7b96d33e37ab4efee43ea4a9d4c872a2194d288954553c6e3bb7926e2a7287c

    SHA512

    ad1ea746af6e8ef14edd20ecc17304fae591d3696a0f0fdab264b7a039e600f50add376356c68813c72376160c6c89ec1af2e33a9a7cc185a896b85d8d7e0180

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\cache\downloads\ef81202dc60d3bfb524d6bcc74f74c50f7e6a1f5.bin

    Filesize

    2.7MB

    MD5

    60631ae0bb42c4c3102d12c26cd30e10

    SHA1

    ef81202dc60d3bfb524d6bcc74f74c50f7e6a1f5

    SHA256

    712c16227afc57aceb9c6602bc4e7075e0737c43dc001e1c8549753cb5c9fbbd

    SHA512

    c7f9091d07de7adef131204d87595e40b574b513bb35d9d8a55d945da1e1af6c790b187a12c8ad1ac3831ce5cbe70b289343b61ad8373964f4db7cdfa6ca7777

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcher.jar

    Filesize

    6.9MB

    MD5

    91d61252a3c9c50b69d72e22b844e965

    SHA1

    cfd7f8470f199d14aeb749369ede04d03b6f4438

    SHA256

    cf9099cd5784fdcc93e87f17a1f0007349ca2ff30dd0d00492aea54e928e3a36

    SHA512

    9bb38f24c10f120d265638c7bc1f5f98d39755229aeea03400b63aaa2b4225f18efad1227df1729ccfb02682fbe4a27e869699f7f9936f4f08eab8771d320d8d

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\AbsoluteLayout-RELEASE126-all.jar

    Filesize

    10KB

    MD5

    091a0a48216020e4074e0bfed0c89edc

    SHA1

    6a5fb031400ea4eedd6407cb6c1dd1930ebde65a

    SHA256

    3be0e26025c0b81a664d9dd3054a3849afd4bdd9972b30506ddb1ec0edd5e9f9

    SHA512

    2e1ea9044244b0e3f103096e3fb55e29b61b5905ab5aeb95ba18eb64cfcb23ec5c1437c7d2a54d069a8a03f06046b0d64711b9e55a6bdc354d0ff4320df47317

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\annotations-13.0-all.jar

    Filesize

    17KB

    MD5

    f4fb462172517b46b6cd90003508515a

    SHA1

    919f0dfe192fb4e063e7dacadee7f8bb9a2672a9

    SHA256

    ace2a10dc8e2d5fd34925ecac03e4988b2c0f851650c94b8cef49ba1bd111478

    SHA512

    5622d0ffe410e7272e2bb9fae1006caedeb86d0c62d2d9f3929a3b3cdcdef1963218fcf0cede82e95ef9f4da3ed4a173fa055ee6e4038886376181e0423e02ff

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\app-locker-1.1.2-all.jar

    Filesize

    19KB

    MD5

    e8a0797a1841d080ce850b731b23daff

    SHA1

    50158017da1ccc0bcb98d094c84b039cf12f36e7

    SHA256

    9b856f7638c0f0db7690032c561120005299b5802aaa1a8a7aa65a939c29bc14

    SHA512

    fc70c3ae413a598233008148ce9afb9247cb397b2626d251bc66417497878952eee98d1b638766db471dbd498077acaead8214c09cb7f114d61cd9addae237c0

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\argo-6.0-all.jar

    Filesize

    121KB

    MD5

    e44f1cd0ef72ae1be207a509e571126e

    SHA1

    91b282f3a05a4f3caf6baa7bb5d03976aee0855a

    SHA256

    c092dae3a116ba9f6f0d3c59a2bb276641e2cbcd769da8c32eeccf95b9a82a81

    SHA512

    39e48ab61a6879e010c35f25996dda1abdc43038b077d36603b870e3772e38f0247f6b9777a6f98d9bc69efa71081828ede5ab19ccc88fcd4d61a254356e2524

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\checker-qual-3.12.0-all.jar

    Filesize

    203KB

    MD5

    ab1ae0e2f2f63601597a5a96fca8a54f

    SHA1

    d5692f0526415fcc6de94bb5bfbd3afd9dd3b3e5

    SHA256

    ff10785ac2a357ec5de9c293cb982a2cbb605c0309ea4cc1cb9b9bc6dbe7f3cb

    SHA512

    ff20c424e130c31c30b4f4f5b4374f8f98f94ddae2b123f3c213f147be6b3de57854ee5651b02dd97d352c1c1df2a8bfeef73d5307a71372f46a6002eab24d78

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\commonmark-0.18.1-all.jar

    Filesize

    164KB

    MD5

    875057f855eb2301dc0a2f65d335307c

    SHA1

    b444a5baadf965189107c73b947069c1395e0dfa

    SHA256

    45e09282c00109bca4ec2c52259871da330251bee33c58b0952f5725eae71457

    SHA512

    50434b4673e4b1e8d63ebb6567cb5638ffab2242a9f2804291ffb10af837fb5869de9876b8453f07606612c8e3478f76dc12e1f43aef1219e0b6d095b065ec90

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\commons-codec-1.15-all.jar

    Filesize

    345KB

    MD5

    303baf002ce6d382198090aedd9d79a2

    SHA1

    49d94806b6e3dc933dacbd8acb0fdbab8ebd1e5d

    SHA256

    b3e9f6d63a790109bf0d056611fbed1cf69055826defeb9894a71369d246ed63

    SHA512

    da30a716770795fce390e4dd340a8b728f220c6572383ffef55bd5839655d5611fcc06128b2144f6cdcb36f53072a12ec80b04afee787665e7ad0b6e888a6787

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\commons-collections4-4.4-all.jar

    Filesize

    734KB

    MD5

    4a37023740719b391f10030362c86be6

    SHA1

    62ebe7544cb7164d87e0637a2a6a2bdc981395e8

    SHA256

    1df8b9430b5c8ed143d7815e403e33ef5371b2400aadbe9bda0883762e0846d1

    SHA512

    5939c9931eb9557caee3b45fe1dd9ce54cabdc4e6182ed7faac77e1a866dd0cb602bfa4ece2f3316d769913366106bd2b61bf3bb5faad1fa7d808124c06dec0f

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\commons-io-2.11.0-all.jar

    Filesize

    319KB

    MD5

    3b4b7ccfaeceeac240b804839ee1a1ca

    SHA1

    a2503f302b11ebde7ebc3df41daebe0e4eea3689

    SHA256

    961b2f6d87dbacc5d54abf45ab7a6e2495f89b75598962d8c723cea9bc210908

    SHA512

    5bd78eed456ede30119319c5bed8e3e4c443b6fd7bdb3a7a5686647bd83094d0c3e2832a7575cfb60e4ef25f08106b93476939d3adcfecf5533cc030b3039e10

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\commons-lang3-3.12.0-all.jar

    Filesize

    573KB

    MD5

    19fe50567358922bdad277959ea69545

    SHA1

    c6842c86792ff03b9f1d1fe2aab8dc23aa6c6f0e

    SHA256

    d919d904486c037f8d193412da0c92e22a9fa24230b9d67a57855c5c31c7e94e

    SHA512

    fbdbc0943cb3498b0148e86a39b773f97c8e6013740f72dbc727faeabea402073e2cc8c4d68198e5fc6b08a13b7700236292e99d4785f2c9989f2e5fac11fd81

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\commons-logging-1.2-all.jar

    Filesize

    60KB

    MD5

    040b4b4d8eac886f6b4a2a3bd2f31b00

    SHA1

    4bfc12adfe4842bf07b657f0369c4cb522955686

    SHA256

    daddea1ea0be0f56978ab3006b8ac92834afeefbd9b7e4e6316fca57df0fa636

    SHA512

    ed00dbfabd9ae00efa26dd400983601d076fe36408b7d6520084b447e5d1fa527ce65bd6afdcb58506c3a808323d28e88f26cb99c6f5db9ff64f6525ecdfa557

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\commons-net-3.8.0-all.jar

    Filesize

    300KB

    MD5

    d4b7197bf50afc96e2fa2657a339f037

    SHA1

    63ea56587c8aaf05adab5cb0397e056bac8a2db0

    SHA256

    352b0ba1c657d8930063a9b83878fb717deef2d29ee25d13943be9beccc64d49

    SHA512

    459c1faa00acdf1337020fa410b24dfeae4c3093aaa47045688e403783bc60918848b4947f38c791608a0165e510a554f0938f02dc3701596973c6742b629d5a

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\commons-text-1.9-all.jar

    Filesize

    211KB

    MD5

    c1c130c369aa86bfe4f7a7a920bc0223

    SHA1

    ba6ac8c2807490944a0a27f6f8e68fb5ed2e80e2

    SHA256

    0812f284ac5dd0d617461d9a2ab6ac6811137f25122dfffd4788a4871e732d00

    SHA512

    ad39787c96445737904e343593c03aa4c4e76bd1516ff45e70fc1efd8a53439b1b104c3b0fed4e431d9291ebabf4bff2e5547e0c6510f59160b8ea620bad2ae2

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\dnsjava-3.5.2-all.jar

    Filesize

    520KB

    MD5

    c074fadb8585b3232e180abc9d33a14c

    SHA1

    f980d4c3360861c5c8f1c7632ec5097d675e78f0

    SHA256

    c7790a69fbacd6e57fd5be53c6af0478bc958700c74a37ec2753909db5785d2b

    SHA512

    a523a1ae5e8c379171d2835411a78cfaaa8c1c4571d2aad0972cb3d9682066dcce45859827170337753241f83fa200fb7986043b2602d4c3e0a90850c0a35bab

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\error_prone_annotations-2.7.1-all.jar

    Filesize

    14KB

    MD5

    5260e1257140bed1936991931cff5ed8

    SHA1

    458d9042f7aa6fa9a634df902b37f544e15aacac

    SHA256

    cd5257c08a246cf8628817ae71cb822be192ef91f6881ca4a3fcff4f1de1cff3

    SHA512

    32747ed9abb289da6ec8f3acb3a3be47c1271323847c8e3c1e9f58e9fc4a211221bdaf988990e8ec97bdba3986927ec81cf9d3f3b5939fff8cbdfb0ec7afc7fe

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\failureaccess-1.0.1-all.jar

    Filesize

    4KB

    MD5

    091883993ef5bfa91da01dcc8fc52236

    SHA1

    1dcf1de382a0bf95a3d8b0849546c88bac1292c9

    SHA256

    a171ee4c734dd2da837e4b16be9df4661afab72a41adaf31eb84dfdaf936ca26

    SHA512

    f8d59b808d6ba617252305b66d5590937da9b2b843d492d06b8d0b1b1f397e39f360d5817707797b979a5bf20bf21987b35333e7a15c44ed7401fea2d2119cae

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\flatlaf-1.6.5-all.jar

    Filesize

    550KB

    MD5

    655814242aa5fa27b4f4eaca9390c951

    SHA1

    54e8fab4749cf268bdd3dc59c5635ce3f9368ba7

    SHA256

    532777efdf3310a76c13fc9edfd722ded49bb44977cd77638ec310b4c158bdf3

    SHA512

    e173fb242b8d5e6206decb2f1c8cfdb1d5cb5b3f4dbe8eccb4f57b1018e48bf4337689165bcba63856d915fec74e09398b4faad0c0c603e2f6f917cca7c58df4

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\flatlaf-intellij-themes-1.6.5-all.jar

    Filesize

    315KB

    MD5

    82134debd8d1bb638d00232e1f9fff6b

    SHA1

    978c21c66867eaabfe1fde4c90eb1d56aaae72b2

    SHA256

    a8f260b77ea6255c23f272440effb203e056e6ede41d9b77617d6b8ae0bf387a

    SHA512

    b68b706760e27ca9ce4e05b722c8411da29ca252d7e148bdeadc2fb0d516d3ccc11f1dad5531233ac7a3ab49d77cbc2a65a9a160474a4cddb1bf664ebbe4c177

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\awt.dll

    Filesize

    1.4MB

    MD5

    92c706b661a8daa740c819af4a80f4b7

    SHA1

    2f7f4f72e4a827d2cb39f794889c0faafebc55b1

    SHA256

    f8e565fd04710ca339fe3b756903a8e6f411e5b560db2daa2a2fa1bae517a205

    SHA512

    f9eafe825f31eac93fdeff6fc47deed620136623b5f7eb13d33841dc07103700f9c21e54ec094c7f6805802c27a82d0f32efb4893024b12d787f299c05064478

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\fontmanager.dll

    Filesize

    659KB

    MD5

    c7a52595e2d7190e9edb393caceec1bf

    SHA1

    42d51dc448ccfec66fdb09660d40abc7e1c9359a

    SHA256

    7b008938d5d05f4d98601f63a0d2c7e7c8e28cb1deac6c69e4547d3b41f3c910

    SHA512

    f9e8c7bb8259d21ce8e6e0668914eff62d5de12888df516fe795f3fa525bccc3f6970a896df8ad8250bec39cc0de870238fa3fd232b72afeba38d7dde2af3f56

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\freetype.dll

    Filesize

    539KB

    MD5

    06de61402c2fd20e2bb7561bbf68f1a4

    SHA1

    2cd38cec8303083cc7e93fdd7f5a893372a13844

    SHA256

    a5bb16f67187c1eda8d362c74f26f054a6dfecf66557d95c28111e1c3a8b7ff3

    SHA512

    bde4dacdd9d635b7157798101369439a09be93ef8c7636001a2f4132d91b09f3b8dda14c4ba5b6aaab1704391f64a932346df95850003e83097b5b273c48672b

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\java.dll

    Filesize

    141KB

    MD5

    38111e5139434cf879a94e702376fd81

    SHA1

    995d5f3fae928818ed0ce0c253dde966c95850ca

    SHA256

    7a66cc03683eda0c2a9f23dbabb4ee4a42252ece743ad5fee60fc1f74f15abb2

    SHA512

    9a6272b13c34d39a692df82e84a0937e33258318b664162884f0389392e6b47be72cd4c79b865a870590f567f21b4bc155e3cd570da9a3ab94a9d427ae7e2b45

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\java.exe

    Filesize

    47KB

    MD5

    8d86c867407b649ce70d9b205f6680e0

    SHA1

    cd67d2487802c9a912662f80f1027345365bc35b

    SHA256

    fafa615b1e9c3732cd0976563cf630ac316f795807567fdf0b812ea1c5a5f972

    SHA512

    db3c22ebb82a09f257f5e869983dd9d355e20f26784f7818f1e393ece179c8550962c16060fd5622a6ee3eeaa9be6ba6da2ada6b7563cc6fa64b2f8be55b7bcc

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\javaw.exe

    Filesize

    47KB

    MD5

    ff2d3a19fe47fa88419716c79ac3e7c1

    SHA1

    506d95d54b49fb4ef021274605d62bb514b2b24a

    SHA256

    aabc670f4aad59906236a0aa4e465c9f8b65ac86a15c6d0a2eae950890e8c693

    SHA512

    130562020d250c3e7ff18801f931a69371b6c7e858a0c294b0408b096e19fce300ed6bf1d3c07ce59e5f4ccec9f67fd304fa9bf29efcf6a455d30fcec53d3ad9

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\jawt.dll

    Filesize

    19KB

    MD5

    5b952a3964a4c8b55d040b12967e8caf

    SHA1

    0540a38cd568e7da7287383fa844b0e17a4f6f31

    SHA256

    684c7231cc6550730193e9f20a66c0ccfea317d021b655a73ccff8b27486d59c

    SHA512

    9354e248276a4a6a44817e6b9646e22fcdfd2ed345b4a6c040c686118787ff47db1c3676ea1d7bf8f40191b7f8a4247006990b8b1c58874fbafc6c9b2bd68d60

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\jimage.dll

    Filesize

    31KB

    MD5

    e4cbd8fd2e2c55a531a0699f4ee82e0b

    SHA1

    deeabbeccedd12279536dcf3f0dd928b05937914

    SHA256

    b0060bd198f6f721b098b8305c9f257adeccf68eddfa2e7a59f831f2131f736e

    SHA512

    0e6e290fb4870e2264b358d2232d9b5a28e08964e25da8085718589181b7a225b8487bf99c180acf6c3e22c1c8726540acf26a2b35a5c24130cf80a4b3daec24

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\jli.dll

    Filesize

    84KB

    MD5

    ce96e51eddd76d8ca575746f0d63fac6

    SHA1

    3d3f8258eb7fb5ad89b631cceca15477f9f6c0e6

    SHA256

    eebb77c2c07cd19c6c168fd0ea09698f45b711658a3fb782fbf78b28af3cfda9

    SHA512

    4a67ab3baca5725f4af8bfdb2ad240d4daf65cd03b61a180732b467b8c6e12dad4b3362c51332a27bddff94b15660a07481be85fe4d5428a603aa77e3827384a

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\msvcp140.dll

    Filesize

    552KB

    MD5

    f062fc66916d97955b1cae44f4de7844

    SHA1

    a726b68ae22c302be2a9c6f36158b261af2d3140

    SHA256

    78e8a75fe76172363d6e2a8ca455a995e414d376d06e2194482ad88f7459aa8d

    SHA512

    a1b3707c061aa5833396a2a8e2ef46cffc621af99b3d2bcd570bedf6a4ab96bd2464587c5ccf962239c2974caf4882e7729f13f025b0c03ca52bc0fc7ef2a56d

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\net.dll

    Filesize

    93KB

    MD5

    a0e62ab9b86e3f73f8e98b05fd248b6b

    SHA1

    19d0671bd3c4e50168fb483123e5115cb0fbbf80

    SHA256

    dfef189785804970ed46cea809788398136fd6b07eb52ff95a5f7286d8c66eb2

    SHA512

    eb24a24adcd06a282582da3d7f4e0ef980c405d8219b11e5278ce653517ce4d9422ee45bd9d833cc7a7d22b934a379e2eff03f960bf677dff5176e2c54a99ebf

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\nio.dll

    Filesize

    76KB

    MD5

    20ff398354be25f4bf06885cabdd72ba

    SHA1

    e95718876f4c0833224bc36f038211ab3e630218

    SHA256

    b573c12c57e52f8fb0b959403a5d8f35b10da61c8ff007f194d5e9bf628807a5

    SHA512

    14e247e541d1d778c7ff61e78563e5660fc2e6215531af16cdb73967fe7f040b48ef90a3608cac97de29c5661a121b6d4bce96fe13c546043f31e8eaa161c401

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\server\classes.jsa

    Filesize

    12.0MB

    MD5

    21a39604169e0573f840d59aaa53e1f7

    SHA1

    ccc50e0787d86bf9fa6e8d53d57b37e75c56913b

    SHA256

    b6048262ea0105fe150df9251695a0c0040f300a9cbd6a82743a397aa8c030bb

    SHA512

    19100c29240b0f85d5b7a3efc28f6a9540e4fba3276a5ceade937a8b8ef0548213bb1ec43731b855a20579fe469f2edb65738e1d9f95e3cbe24610f37531de27

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\server\jvm.dll

    Filesize

    12.0MB

    MD5

    6f8d2dd56671d1b96d4ec752cb326b85

    SHA1

    66aac967cff1463a3d65823d56065e10d75109ee

    SHA256

    321361921d63e2f13a2f13d8a74ce7d72f6aed1f157be5d5aa2a3a50006833fd

    SHA512

    b71e573a5378f564524fe186e507d55a9e65e9dad98190381acad922723af42700d959656ddb028e746b7dad9e84f38e5443cf5e7ece31a7afdfbeb21f8edf88

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\sunmscapi.dll

    Filesize

    44KB

    MD5

    81c34a344640a6a98476d0b0d0bf7c40

    SHA1

    7593267c12b7887530c601b82402579f74365be2

    SHA256

    ac5008e013c15b5945358f4eb22811949de01e8de60048c0620413afc74aefc3

    SHA512

    6f0ee62baa1229c29a0cb010914af226cdc6276198298bd1b5f32fa72da171e6e75477eacaf86588fa626c61d276b4e6825e10d0efc0089cbc57533f602b33f3

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\svml.dll

    Filesize

    847KB

    MD5

    98817cdd235d859cc482725af2b32b0b

    SHA1

    a9c3779a493775c0f96a9ac71267f7a72a82bada

    SHA256

    d8cb9603e4fec3ac5b77130c4932bc113cbd95a38bd284abb4319fa6d5451aee

    SHA512

    64719489e7e03327ca0385aa82fbc5c8c31bb1b3a33ee11ec3cbbfad85e5e329b8330ded639ce0062875cef9334604375511896c94c69801d453e775dd7a36dd

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\vcruntime140.dll

    Filesize

    94KB

    MD5

    e41f7041c95a33c5a6e02048232d1246

    SHA1

    8f1f3865281e80f099087e1cb395a8803fa51bc9

    SHA256

    70128415dae505b4bd7e3b63e82355dd4bd783226363a7b58b01145afef94e76

    SHA512

    cd17b910468dd4cc3e220c05cd64318c41bff46d67d0a5320aff2ed7a95621df43707249f2dd5dabf813400b5d57edf183ee144942779102ec427c04bf2b1302

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\vcruntime140_1.dll

    Filesize

    36KB

    MD5

    fcda026792268accd2a47f3cfb66debf

    SHA1

    66d406b0f27f62f0d29e3e6dcc90935db3e9595d

    SHA256

    52beaeed839f64a6b3796ff1233f1215bdf9582dd427b82ccd91b56c44d52644

    SHA512

    3d33cd6e97c59dbe4b3f531b8c4144b111462c07460a014259578ab8f3319ac821ccea9de2e9a5929c86533922dec17aa8a69e4e0c96e5311e5a24589fafb191

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\verify.dll

    Filesize

    52KB

    MD5

    53ef3123d6fb26789bd174b92ce23a06

    SHA1

    1798edc4637bdd57d2ec493087200e421ee97a29

    SHA256

    4968fd3e569b9b9bcf54e7785ed008c0476ec92d4b72986c6ef579bdc31a4a4b

    SHA512

    f8b1e6682a50712c45634d18813ec143a30946c0644ed48eb1d876a7f66598aa363f02ad9b73e8f7d754f16d02bac19150e50ccff00bb4181763e09de3eda219

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\zip.dll

    Filesize

    83KB

    MD5

    52516d2bb7fcae734a142426685c5b56

    SHA1

    ee20f8f0b1293460b6b9c0ee115d594dc02ab6f5

    SHA256

    fed1d03f0a4e5846c1e69a1b0d4df8db9832fe6e7a4dcdc944b8880740b3316a

    SHA512

    ce47262718f13e7fc4bb419608f054f1866bc904a0e51b272d1efa342e3ae574f79f4c47af7ac2c395dba57d86cc707302c9bccaa561da0e21d4a846b876ad73

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\conf\logging.properties

    Filesize

    2KB

    MD5

    0f00ec3e7a7767a4efeae1875fb5f3d4

    SHA1

    167808418571e9209b952188ddab2f4e62920e68

    SHA256

    b62d2733ab99556b108a1951d894c5a8d76b1ac7a00c02c388f9eb9be046c56f

    SHA512

    e869f4a3b821a9933796dc9a56ee00483493369dfbfe07b3b1d895cb8318c6821cd44134eb37513f15b830c25861b596646824ed56672d08b678fefe6a4c7504

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\conf\net.properties

    Filesize

    6KB

    MD5

    385443b7e4a37bc277c018cd1d336d49

    SHA1

    b2c0dfb00bf699e817bdd49b14bc24b8d3282c65

    SHA256

    5bc726671936e0af4fdf6bed67d9e3a20a92c30b0ba23673d0314baa5e3ffb08

    SHA512

    260afc7671a1dc0c443564f1d10386f0b241bb53c76df68d8d03f1d0b1ceaf3f68847ab3477732c876c2b01c812ef7521744befe88e312f3aa63164b608b67a1

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\conf\security\java.security

    Filesize

    56KB

    MD5

    00cf40959861f61f17b90c6b6002a9a1

    SHA1

    982e48466428e1f49c1a5941c73afdacefd1d22e

    SHA256

    38166a975348862d693d95de8d676cf19cecccc45af4a1896c73c45f7bd966ef

    SHA512

    bad90152685279d896a4063d76dec5befe14831d3dd3260929b9a639505e898fa996b52aab3821a51c6c9aa09d956a23a8bdd870377a10e75c9399629cab5779

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\conf\security\policy\unlimited\default_US_export.policy.tmp

    Filesize

    146B

    MD5

    1a08ffdf0bc871296c8d698fb22f542a

    SHA1

    f3f974d3f6245c50804dcc47173aa29d4d7f0e2c

    SHA256

    758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9

    SHA512

    4cfca5b10cd7addcff887c8f3621d2fbec1b5632436326377b0ce5af1ae3e8b68ac5a743ca6082fc79991b8eec703a6e1dfd5b896153407ad72327753222fdb3

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\conf\security\policy\unlimited\default_local.policy

    Filesize

    193B

    MD5

    2a0f330c51aff13a96af8bd5082c84a8

    SHA1

    ad2509631ed743c882999ac1200fd5fb8a593639

    SHA256

    8d8a318e6d90dfd7e26612d2b6385aa704f686ca6134c551f8928418d92b851a

    SHA512

    2b0385417a3fc2af58b1cbb186dd3e0b0875e42923884153deee0efcb390ca00b326ed5b266b3892d31bf7d40e10969a0b51daa6d0b4ca3183770786925d3cde

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\legal\java.datatransfer\ADDITIONAL_LICENSE_INFO.tmp

    Filesize

    49B

    MD5

    19c9d1d2aad61ce9cb8fb7f20ef1ca98

    SHA1

    2db86ab706d9b73feeb51a904be03b63bee92baf

    SHA256

    ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9

    SHA512

    7ec63b59d8f87a42689f544c2e8e7700da5d8720b37b41216cbd1372c47b1bc3b892020f0dd3a44a05f2a7c07471ff484e4165427f1a9cad0d2393840cd94e5b

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\legal\java.datatransfer\ASSEMBLY_EXCEPTION.tmp

    Filesize

    44B

    MD5

    7caf4cdbb99569deb047c20f1aad47c4

    SHA1

    24e7497426d27fe3c17774242883ccbed8f54b4d

    SHA256

    b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a

    SHA512

    a1435e6f1e4e9285476a0e7bc3b4f645bbafb01b41798a2450390e16b18b242531f346373e01d568f6cc052932a3256e491a65e8b94b118069853f2b0c8cd619

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\legal\java.datatransfer\LICENSE.tmp

    Filesize

    33B

    MD5

    16989bab922811e28b64ac30449a5d05

    SHA1

    51ab20e8c19ee570bf6c496ec7346b7cf17bd04a

    SHA256

    86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192

    SHA512

    86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\lib\fontconfig.bfc

    Filesize

    4KB

    MD5

    0e25b41e6acf99681eaf2e8b572f18d1

    SHA1

    d6b4290da768e050fe6c310366272f87e6c2b6d2

    SHA256

    968ac99bbaaf8a49a474c934e73ad58f88c6c7f2a363cb44771e0378444e36ba

    SHA512

    7c1e98bc6582af9e9c58c13cdc4d257e441a6d48fd395a3601ad558ebd481257f138d6f0dcbfe12735eb6bebeb7c8985b3d8af633b545fa01d56738f56360c08

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\lib\jvm.cfg

    Filesize

    29B

    MD5

    7ce21bdcfa333c231d74a77394206302

    SHA1

    c5a940d2dee8e7bfc01a87d585ddca420d37e226

    SHA256

    aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0

    SHA512

    8b37a1a5600e0a4e5832021c4db50569e33f1ddc8ac4fc2f38d5439272b955b0e3028ea10dec0743b197aa0def32d9e185066d2bac451f81b99539d34006074b

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\lib\security\blocked.certs

    Filesize

    2KB

    MD5

    8273f70416f494f7fa5b6c70a101e00e

    SHA1

    aeaebb14fbf146fbb0aaf347446c08766c86ca7f

    SHA256

    583500b76965eb54b03493372989ab4d3426f85462d1db232c5ae6706a4d6c58

    SHA512

    e697a57d64ace1f302300f83e875c2726407f8daf7c1d38b07ab8b4b11299fd698582d825bee817a1af85a285f27877a9e603e48e01c72e482a04dc7ab12c8da

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\lib\security\cacerts

    Filesize

    151KB

    MD5

    510ce33003cd297c64da765053fa18df

    SHA1

    cc8cf9abbc50a4ee179fb284d970a7623acd7a64

    SHA256

    2c5844eeec3ba02372c0aeaf0ea554d06858aedcb14c33f59b0338689aa6b317

    SHA512

    40db757a74b44e9badda74d51ffdc42c58638dbf1e2f613e3366eb4ddeb6fca4448961a87b8372c515bf0e37c61e43e59646ca686ac862821ddf5af9e9ff1f5c

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\lib\tzdb.dat

    Filesize

    104KB

    MD5

    418ae31029c3c3c75e4b7e015496f35e

    SHA1

    91e9441ffb337c37f72281def08640b33f640064

    SHA256

    dc97b06c5d110f8b0dc877c01e900734702a1636d5db0c01e3a8706b74704606

    SHA512

    5111c4ca248335a9e3569a4f6cbdab0384c92f26553e3cbab60fe259d5e394bc08e1b5a2e42ca72a30e5e68c112329afec267f48992c04f7099a18b1153ea526

  • C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\lib\tzmappings

    Filesize

    21KB

    MD5

    b02ee240a8db902961fe886a19beba16

    SHA1

    c52c42d591f4c650b629e6b374e967e211fb5aeb

    SHA256

    36dc51c4bf787f640a4b45cbb84ab6954f6e595cbd3617c2f5a4e1e607b38bff

    SHA512

    024811961511b7182860ed03a5670f82412a45d005a1db0876f6b0c9af7e96c104566abff0ebbded11a780349444214291f439039d20fb92071c7dd24bda0e23

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3107365284-1576850094-161165143-1000\83aa4cc77f591dfc2374580bbd95f6ba_66fe4e29-79d4-4cb9-9cf5-50b32d670a91

    Filesize

    45B

    MD5

    c8366ae350e7019aefc9d1e6e6a498c6

    SHA1

    5731d8a3e6568a5f2dfbbc87e3db9637df280b61

    SHA256

    11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

    SHA512

    33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

  • memory/3216-2108-0x0000022A93410000-0x0000022A93680000-memory.dmp

    Filesize

    2.4MB

  • memory/3216-2115-0x0000022A9A940000-0x0000022A9ABB0000-memory.dmp

    Filesize

    2.4MB

  • memory/3216-2098-0x0000022A92E80000-0x0000022A930F0000-memory.dmp

    Filesize

    2.4MB

  • memory/3844-2089-0x00007FF8B1190000-0x00007FF8B1C52000-memory.dmp

    Filesize

    10.8MB

  • memory/3844-0-0x00007FF8B1193000-0x00007FF8B1195000-memory.dmp

    Filesize

    8KB

  • memory/3844-59-0x00007FF8B1190000-0x00007FF8B1C52000-memory.dmp

    Filesize

    10.8MB

  • memory/3844-58-0x00007FF8B1190000-0x00007FF8B1C52000-memory.dmp

    Filesize

    10.8MB

  • memory/3844-23-0x00007FF8B1190000-0x00007FF8B1C52000-memory.dmp

    Filesize

    10.8MB

  • memory/3844-22-0x00007FF8B1190000-0x00007FF8B1C52000-memory.dmp

    Filesize

    10.8MB

  • memory/3844-21-0x00007FF8B1193000-0x00007FF8B1195000-memory.dmp

    Filesize

    8KB

  • memory/3844-19-0x00007FF8B1190000-0x00007FF8B1C52000-memory.dmp

    Filesize

    10.8MB

  • memory/3844-15-0x00007FF8B1190000-0x00007FF8B1C52000-memory.dmp

    Filesize

    10.8MB

  • memory/3844-4-0x0000016A80020000-0x0000016A80038000-memory.dmp

    Filesize

    96KB

  • memory/3844-3-0x0000016A80050000-0x0000016A800C8000-memory.dmp

    Filesize

    480KB

  • memory/3844-1-0x0000016AE58E0000-0x0000016AE5A70000-memory.dmp

    Filesize

    1.6MB