24036f23f1be0d4024c16ee49234bbe9df2fbac068ed9df0ed47f56d596d158a

Analysis

max time kernel
600s
max time network
577s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 13:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Crystal-Client-Launcher-setup.exe
Size 62.3MB
Sample260620-qq5dcsfs8j
SHA256 24036f23f1be0d4024c16ee49234bbe9df2fbac068ed9df0ed47f56d596d158a
MD5 a5500512104b581a217258557e64e316
SHA1 047209004cdc244bb26d3429eae157b289d3ccf0
SHA512 f65b11e8b071ba13005d66f796d684811ec83fec366dc3d71a27cb0a4b480d925f7140f6baeb6f81ae46db84630dbd9ed28f93ac7e5b2252f54b252cf52937ec
SSDEEP 1572864:WigU7aTp2fmIqWYIQklIK+Z2m1AoJETV27SlCPZYfDlI0a:WiL7aTp2+IgJMH+Z2m3KTV6SlKZSeN
TLSH
T1CDE7331470B1E676D12A9F35F29869DB4FF47E64053AB791210BCC8FDB3B90B61A8123
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
1736	Crystal Client Launcher.exe
1652	Crystal Client Launcher.exe
1692	Crystal Client Launcher.exe
1316	Crystal Client Launcher.exe
4280	Crystal Client Launcher.exe

Loads dropped DLL 20 IoCs

pid	Process
5808	Crystal-Client-Launcher-setup.exe
5808	Crystal-Client-Launcher-setup.exe
5808	Crystal-Client-Launcher-setup.exe
5808	Crystal-Client-Launcher-setup.exe
5808	Crystal-Client-Launcher-setup.exe
5808	Crystal-Client-Launcher-setup.exe
5808	Crystal-Client-Launcher-setup.exe
5808	Crystal-Client-Launcher-setup.exe
5808	Crystal-Client-Launcher-setup.exe
5808	Crystal-Client-Launcher-setup.exe
1736	Crystal Client Launcher.exe
1652	Crystal Client Launcher.exe
1692	Crystal Client Launcher.exe
1316	Crystal Client Launcher.exe
1652	Crystal Client Launcher.exe
1652	Crystal Client Launcher.exe
1652	Crystal Client Launcher.exe
1652	Crystal Client Launcher.exe
1652	Crystal Client Launcher.exe
4280	Crystal Client Launcher.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
3	discord.com
9	discord.com

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
588	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Crystal Client Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Crystal Client Launcher.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crystal-Client-Launcher-setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	Crystal Client Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	Crystal Client Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Crystal Client Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	Crystal Client Launcher.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5808	Crystal-Client-Launcher-setup.exe
5808	Crystal-Client-Launcher-setup.exe
588	tasklist.exe
588	tasklist.exe
1316	Crystal Client Launcher.exe
1316	Crystal Client Launcher.exe
1692	Crystal Client Launcher.exe
1692	Crystal Client Launcher.exe
1736	Crystal Client Launcher.exe
1736	Crystal Client Launcher.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	588	tasklist.exe
Token: SeSecurityPrivilege	5808	Crystal-Client-Launcher-setup.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5808 wrote to memory of 3944	5808	Crystal-Client-Launcher-setup.exe	88
PID 3944 wrote to memory of 588	3944	cmd.exe	90
PID 3944 wrote to memory of 2608	3944	cmd.exe	91
PID 1736 wrote to memory of 1652	1736	Crystal Client Launcher.exe	95
PID 1736 wrote to memory of 1692	1736	Crystal Client Launcher.exe	96
PID 1736 wrote to memory of 1316	1736	Crystal Client Launcher.exe	97
PID 1736 wrote to memory of 4280	1736	Crystal Client Launcher.exe	99
PID 1736 wrote to memory of 4280	1736	Crystal Client Launcher.exe	99

C:\Users\Admin\AppData\Local\Temp\Crystal-Client-Launcher-setup.exe
"C:\Users\Admin\AppData\Local\Temp\Crystal-Client-Launcher-setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5808
- C:\Windows\SysWOW64\cmd.exe
  cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Crystal Client Launcher.exe" | find "Crystal Client Launcher.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3944
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Crystal Client Launcher.exe"
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:588
- - C:\Windows\SysWOW64\find.exe
    find "Crystal Client Launcher.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2608

C:\Users\Admin\AppData\Local\Programs\Crystal Client Launcher\Crystal Client Launcher.exe
"C:\Users\Admin\AppData\Local\Programs\Crystal Client Launcher\Crystal Client Launcher.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Users\Admin\AppData\Local\Programs\Crystal Client Launcher\Crystal Client Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\Crystal Client Launcher\Crystal Client Launcher.exe" --type=gpu-process --field-trial-handle=1428,13797155058494828996,14765033341551581055,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --user-data-dir="C:\Users\Admin\AppData\Roaming\crystalclient-launcher" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAANAAAAEAAAAAAAAAABAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1432 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1652
- C:\Users\Admin\AppData\Local\Programs\Crystal Client Launcher\Crystal Client Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\Crystal Client Launcher\Crystal Client Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1428,13797155058494828996,14765033341551581055,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\crystalclient-launcher" --mojo-platform-channel-handle=1728 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1692
- C:\Users\Admin\AppData\Local\Programs\Crystal Client Launcher\Crystal Client Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\Crystal Client Launcher\Crystal Client Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\crystalclient-launcher" --app-path="C:\Users\Admin\AppData\Local\Programs\Crystal Client Launcher\resources\app.asar" --no-sandbox --no-zygote --force-device-scale-factor=1 --field-trial-handle=1428,13797155058494828996,14765033341551581055,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2388 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1316
- C:\Users\Admin\AppData\Local\Programs\Crystal Client Launcher\Crystal Client Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\Crystal Client Launcher\Crystal Client Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\crystalclient-launcher" --app-path="C:\Users\Admin\AppData\Local\Programs\Crystal Client Launcher\resources\app.asar" --enable-sandbox --force-device-scale-factor=1 --field-trial-handle=1428,13797155058494828996,14765033341551581055,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Local\Programs\Crystal Client Launcher\D3DCompiler_47.dll
Size 4.3MB
SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
MD5 7641e39b7da4077084d2afe7c31032e0
SHA1 2256644f69435ff2fee76deb04d918083960d1eb
SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
SSDEEP 49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
TLSH
T16F267D5677A840A9C27BC178CA574313EBB1781403349BEF55A0C665EF33BD26E3A728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\Crystal Client Launcher\chrome_100_percent.pak
Size 138KB
SHA256 c48e6d360aee16159d4be43f9144f77d3275a87b3f77eae548e357601c55fc16
MD5 4f7cf265db503b21845d2df4dc903022
SHA1 970b35882db6670c81bd745bdeed11f011c609da
SHA512 5645d2c226697c7ac69ce73e9124630696516fc18286a5579823588f93a936da71084a3850f1f9a7b34c624f4c502957107f5957ffba5e6c1e4da6d8da7d3348
SSDEEP 3072:nKzw9bp66mdgZeMj6g2Z8Gb0+VRLf0ld0GY3cQ3F2DExm/KLQ2I:nKzw986mdgZezgm8Gb0OV8ld0GecQ3m3
TLSH
T155D3D0D3B3F4ED7DCFA756B3A52901B1FCB306691691025A468AD8366E27748DCC8383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\Crystal Client Launcher\chrome_200_percent.pak
Size 202KB
SHA256 b820d19a7a8ce9d12a26837f967f983e45b07550b49e7b9a25e57b417c5f6fd9
MD5 6a7a9dee6b4d47317b4478dba3b2076c
SHA1 e9167673a3d25ad37e2d83e04af92bfda48f0c86
SHA512 67466e21a13ca449b014b511fb49bfc51df841eb5776f93b4bda2e0023da96d368ac5c65de051ed9de1899275b9f33839af2c387be903688cdb48bf08993791e
SSDEEP 6144:XDQYaF+9b16mdgZezVk5GMRejnbdZnVE6Yopym74:8fs1FdgEj6edhVELo374
TLSH
T1E914E1D7A3F49D3CCAB31A73552A05F1ECF6167516A6424B02CBEC347A56B8C88C9283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Programs\Crystal Client Launcher\ffmpeg.dll
Size 2.6MB
SHA256 61c6bd5fee2c150265241a15379c4053b174b1cd7687749629afcdbd1264a02e
MD5 7977f3720aa86e0ec2ad2de44ad42004
SHA1 04a4ef5ccd72aa5d050cc606a7597a3b388c6400
SHA512 8ef3b8f506b5ad7241b96d381a501033266358fb3756a457c46ed499547db1232012f849838e65f916129fab1a0d74711e9851b8e0669831acbbf4c3494e492d
SSDEEP 49152:baOoZks54czfQNk9GSQABmZuZgAp1iJxgG1broIhj4OxSZpSq:it59uEBm8geZz
TLSH
T170C59D17F5A644EDD02DC67487AF9233F930784A4724A5EF1A90DA252F3AFD06A7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Programs\Crystal Client Launcher\icudtl.dat
Size 9.7MB
SHA256 b62b7240837172959299dc3be44fffa83dc374353154eca1612e1bde330aa8fa
MD5 2e7d2f6c3eed51f5eca878a466a1ab4e
SHA1 759bd98d218d7e392819107fab2a8fd1cfc63ddf
SHA512 0f1465e8efe32b0eaba628a30bbb21254a05d80f4407a1434120a55fb928cf575b3879e1b7cf754cd19b23c262ae715fa84a8049073563cb38f1855be7db1124
SSDEEP 196608:GEGwSv9AAQTgyTliXUxR0rHa93WhlU6tgLQH:G4KlQTlliXUxR0rHa93WhlU6tgL4
TLSH
T1BFA63807A2FB4EC2F9FB6F30D9F452679567BD496E32805A11042F3B1C373A086617A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libegl.dll

Path C:\Users\Admin\AppData\Local\Programs\Crystal Client Launcher\libegl.dll
Size 431KB
SHA256 994972c1bc515c199552d50e97ad217ae15a3eed16db06181c7df50e743e8a56
MD5 7b77074945dfe5cf0b1c5a3748058d57
SHA1 fdea507ac2be491b8ad24ddc1030ea9980c94c0d
SHA512 d637b2c7d75723601af099317a39820d3edbd3cea1e1cb20b702deb6ca7fdb0b67e1351cc8fee1c7badff957fffb848a8dce18bb25bfd60c81a588da4f68c1fd
SSDEEP 6144:QpKolEK3EyQVAZvhnzGtMY+3lnLdYcUpwOXW4IUo+lTsRLVDc2/:QBl1EyyAZvJWM936wOJTWVDc
TLSH
T1A0948E16F79448B9D066C074CA634542DF71B8DA0F78EAEF12A482692F77BF45B39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Local\Programs\Crystal Client Launcher\libglesv2.dll
Size 7.6MB
SHA256 1ebc1da8d7e463a5d3dc127a632989ef35cfbd94cb18bf1f8ee790f172d43703
MD5 8c93e19281992a00993fc0f09e272917
SHA1 3a2d12bc85f829775ec8c5c1f8e35a783d37b7a7
SHA512 c4ec65378d83e6645c9128825853de2d3e82c0f430cd28fdc761eaf2d011267c3794b7c1dcef017750323873d7fe976656eebf9ed7c03582741d43738f3e0c7c
SSDEEP 49152:BIgJiNu/CVyS4I+K/UGG7ftgIj4RBrGW+T54vwjKxH33yjsMfRJvLnLBXonnMl9W:mNyUxGDahRNR6gyxQi4Mn0YJ4/qamG
TLSH
T1C8866C07E6A140D9E01DC2B8875BA222FE31BC490774B6CF269476152F77BF06B7AB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Programs\Crystal Client Launcher\locales\en-US.pak
Size 104KB
SHA256 699b6d7f05a484e76d3e1197a656247863e570f03cc02634c9dc42078a5c5007
MD5 0dcd84e9e50a3e0819d5875ea889ced4
SHA1 7c47f6e4e0cafec3a13c07d689d1dd6ff6516b1e
SHA512 153fc15f676d78d5d0f3a6862fc7eaa60c2a659c25ce87485f0253c321d9407a9b799b959104c27a8e7b5487f0de926ae8f375e2c3d313329112e48f2d001a17
SSDEEP 1536:bHsdSwdRt0FASED0FhFL2tr/4Sx5dBqgDSO0JedMVrBnh67VIbVfD3ggl+sZ4pWy:bHsdSc8ASTheZBqgmT65I53ggl+sxwh
TLSH
T124A33D1FE784226906920262FA06A362BF35D0BD937152567C6CC13C37B3B95C277BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Programs\Crystal Client Launcher\resources.pak
Size 4.9MB
SHA256 75ff04d991c2a203105525a1ccb200a461717ce7b86ada4be092fe903d95cdc8
MD5 99c5bf0dcd43f961aa3e177f7dc42d42
SHA1 5618abd2e7b45c50400bb4aa0c455bb0b28bc472
SHA512 2e508c46eb266301f42ee6a7d63494f3856b422df61d0b605096bf4fc4943239d3fba15161adf8cb1cdcfd3bea8608102a0abce636999cc2a9e01bda51cc77ae
SSDEEP 98304:BBlzzhu8t8ikpGseGEaJ1fr+3H/P48h11IUNrwrgcHpsuKen3qKkArjWO9jj4:RhPt8i6pEaHeH48hnIokr1KqpWQjj4
TLSH
T115363360F3AC0837E05D5274C4608233A6FAD91319E5B18C728E736ECB5E35A9DA467F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Programs\Crystal Client Launcher\resources\app.asar
Size 49.4MB
SHA256 4337cf5c5f29de7b001baf1f42e8d4c6cb483d170a54b2ec3494b5dbbf1e0a98
MD5 9e60e2b3d10e5869a6ef22cd039f062d
SHA1 9a352ea401ce3f84cc655b3ed8adc297b94b0b3f
SHA512 355e8c7aaac13ed08d068b4862ad06d5786862982278291da9f1e20f2fff804304418892224695311b8d3d4e53dd7ccbbd312ba0c992538875696312e1d4e16b
SSDEEP 196608:4frAtXIY6wqLLNa2t5s8OmhcDzezvubOKtN9Qz2xodjqweTFM9pE1:4frAlIY6wqLLN1zvubOKh
TLSH
T133B7832867F211336C93A0F9F1CEE89DEA2B909ECD389A97BCDC11109F947F5C992550
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Programs\Crystal Client Launcher\v8_context_snapshot.bin
Size 160KB
SHA256 315f5ed966a1f3a89c94d1b78b9bf70e59a2869601cf6551b2c1fd3e3b008447
MD5 a718c9b6e5e6563e23e450a0d01b932a
SHA1 95ccb1228f024f037259e759dbac464f3c27b8cf
SHA512 b04512e95ab3997bc7d5c65e2f526e124bf1895b139eb2b6c6c7b4a4aa381cd408eb2bba01f44b09b1936d24752baae288f24a32ed84687d3e7e0681b5387d01
SSDEEP 3072:bnJQI92V2IEzZffKvaKY1ApdbZQQWaz2bvHYsqABA4x3/LW4zLlF2:bnJQIIVgVf0aOdb3WxTHnEP4z+
TLSH
T198F31296B7E105FA105D69A1B0DE1B6268F5F0F398037B3707D3BB9B68950390F22639
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Programs\Crystal Client Launcher\vk_swiftshader.dll
Size 4.3MB
SHA256 a648cd4671b12b469c4d2de20c2ba2429c9388c0f9d4b3d9d2244853d0e5acb5
MD5 77f7b4f46cb3e06b53729fd1e562dfef
SHA1 223c09805220ff2b5c1dcbdd5c0396231ea34f11
SHA512 6be9afda9320074c5842419cf8493d715ca65a3362d368d3a35e35a47d36f8197b0f19877485b41a06e21148613a77bb6275b0586c4a38da8a25efe6b5a6b571
SSDEEP 49152:ImuXbIxohwCWtm32rw3lYIDkhUw2B2w/XBnbtZNDNHI6iBewVqlnrSrMrXHYtvQi:Ca9dCeKOB
TLSH
T115263A03F2858099F05DD57D878BB622E672BC811B72B5EF52A02F152E37BE05B39319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Programs\Crystal Client Launcher\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Programs\Crystal Client Launcher\vulkan-1.dll
Size 715KB
SHA256 22bb65dd206ce7ee10c05557933a04a04144e1a8228d2a9d1e9d704b0b1b2f7c
MD5 25afbdf6701013c57b19b92225920915
SHA1 009300dd4ab3b81794388ce7d126ae90ff97535f
SHA512 575e38b60948cb704c355ba9cf3457f2693c30f95e85f10f795e759652bf4317e18ba480bee8aafcea9108415e8e58f674b22c7513a9fabee765142486919a0e
SSDEEP 12288:oYa8yQ628GMAhXhpt1o9Sc4irKabLqYz/oD4C56:ZgQ6jHAhx71o9WirKaqYDa
TLSH
T1C5F48C3A6E94055DF5B6C034DA034621DA71BC624B74B9DF1360131E6FBBBE02B7AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsaE9A1.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsaE9A1.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsaE9A1.tmp\UAC.dll
Size 14KB
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
TLSH
T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinShell.dll

Path C:\Users\Admin\AppData\Local\Temp\nsaE9A1.tmp\WinShell.dll
Size 3KB
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
TLSH
T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
MD5 SHA1 SHA512 TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsaE9A1.tmp\nsDialogs.dll
Size 9KB
SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
TLSH
T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsaE9A1.tmp\nsExec.dll
Size 6KB
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
TLSH
T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsaE9A1.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\crystalclient-launcher\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 dbc54539a9605d3227c8f74d34a545952c5a26c4cde4dffa3942e2d3813b9a35
MD5 9f6cf3ce7787c23473d344cf361ef7da
SHA1 adfe3ae82d3b2818ab4712fd3008a8a13b07731b
SHA512 65c393cafc15cb990770006088e49ff36018fa0510cab0703f62894b8117c96aa4558e116515b7d23a1b4ce69cf9c2ca10b4382760669381580fcee89e1629f4
TLSH
T1AAB001219209150AEA2282B110C6A4963372AD192363CA85A5E086BBE6A0397DA22209
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a771.TMP

Path C:\Users\Admin\AppData\Roaming\crystalclient-launcher\Code Cache\js\index-dir\the-real-index~RFe59a771.TMP
Size 48B
SHA256 2af77e7c89383682d3a178e60b96ef6a7b537a567600c681292563396c58f125
MD5 6fd4afb9bc14846a5fe25a1f698f941a
SHA1 84203b96552744b8506f074b5e44bd86eb3e9f76
SHA512 ef08550123fcb9413d0cd8c9ac7beaefba20e243fbe193e21d543cb9bd5ff079b240a8d19a008c3bb86c479a8fcf167987e63df49580bb15c1657de33cbd17a3
MD5 SHA1 SHA512

Submit Download

Network Persistent State~RFe5a6080.TMP

Path C:\Users\Admin\AppData\Roaming\crystalclient-launcher\Network Persistent State~RFe5a6080.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\crystalclient-launcher\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

b4994f47-7622-4a0e-a6de-bf92cb31defb.tmp

Path C:\Users\Admin\AppData\Roaming\crystalclient-launcher\b4994f47-7622-4a0e-a6de-bf92cb31defb.tmp
Size 1KB
SHA256 c4afc6b1496778326b006c9d065d2c30cbfbda5dc07ae40f451d39e36a537c5a
MD5 65c195767a36a1dd833272724c68b66e
SHA1 9e887c6b42adb22bd80f0b1e268cd460876395e4
SHA512 65819907f4a8ca495ea71e90eb1273f8976c2ed21c67f58617a20e36515728d1db80352f532a69027d095fa91f368cb9b3ce5b5b8768e9a1ad3a5969abc5ff27
TLSH
T170417B87C1D8493D884767F567253B22C56E069C93653C0A8CD9DF4E63E4C77A70188D
MD5 SHA1 SHA512 TLSH

Submit Download

bc2976de-d997-4344-a731-6a53ce2b6297.tmp

Path C:\Users\Admin\AppData\Roaming\crystalclient-launcher\bc2976de-d997-4344-a731-6a53ce2b6297.tmp
Size 57B
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
TLSH
T101900297652634755E1F1D65400B889B5CF905704E0B5E0641D032969A2A45D088705F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1652-498-0x00000299D6100000-0x00000299D612F000-memory.dmp

Download

memory/1652-246-0x00007FFBF11D0000-0x00007FFBF11D1000-memory.dmp

Download

memory/4280-503-0x000002A3C69E0000-0x000002A3C6A0F000-memory.dmp

Download

memory/4280-304-0x00007FFBF1240000-0x00007FFBF1241000-memory.dmp

Download

memory/4280-305-0x00007FFBF10A0000-0x00007FFBF10A1000-memory.dmp

Download