041344a56eecc303e538698321e0d1bd4c0e765691300b699e8d89bcf39dcb4b

Analysis

user interaction
yes
max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Zainstaluj_Crystal_Launcher.exe
Size 1.6MB
Sample260814-e1nb2svthw
SHA256 041344a56eecc303e538698321e0d1bd4c0e765691300b699e8d89bcf39dcb4b
MD5 2bcf8f6eda4deab1666f98ddb6bc974f
SHA1 75b48b1480e7aada99f333684f78af61f2a2aa45
SHA512 1850bfc9fa97a07072297bce46afd148b7fd645b46c13da6c803187785082394584062c532006c285e4ad4b0e5d89f3670a4a999e48fdbe923eb8b6d6a623cdc
SSDEEP 12288:BBChVyzNndzFWPYhv/JBdBS4msNUCe65frHMnz2R9Iyev5whgC:BohondzFWPM/bdo4mz1U8z2MyevjC
TLSH
T1677571841A6AC913DA78C7FF8C6E39FEF2715C11B186D7DE0640B4A534D9E80A7812DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery motw phishing

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	java.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	javaw.exe

Executes dropped EXE 3 IoCs

pid	Process
5636	Install_Crystal_Launcher.exe
5676	javaw.exe
3220	java.exe

Loads dropped DLL 29 IoCs

pid	Process
5676	javaw.exe
5676	javaw.exe
5676	javaw.exe
5676	javaw.exe
5676	javaw.exe
5676	javaw.exe
5676	javaw.exe
5676	javaw.exe
5676	javaw.exe
5676	javaw.exe
5676	javaw.exe
3220	java.exe
3220	java.exe
3220	java.exe
3220	java.exe
3220	java.exe
3220	java.exe
3220	java.exe
3220	java.exe
5676	javaw.exe
3220	java.exe
3220	java.exe
3220	java.exe
3220	java.exe
5676	javaw.exe
3220	java.exe
3220	java.exe
3220	java.exe
3220	java.exe

Mark of the Web detected: This indicates that the page was originally saved or cloned. 2 IoCs

phishing motw

flow	ioc	pid	Process
182	https://www.freevpn.win/lps/gbox-lp/index.html?cid=185764073&kw=PA_POP_2484562	4940	msedge.exe
183	https://www.freevpn.win/lps/gbox-lp/index.html?cid=185764073&kw=PA_POP_2484562	4940	msedge.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5820_223364986\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5820_223364986\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5820_2013315154\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5820_2013315154\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5820_223364986\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5820_223364986\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4940	msedge.exe
5676	javaw.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	java.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311551107348221"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{A7262ED9-D454-48C5-AE36-9FFAB346604C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5496	msedge.exe
5496	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	4800	Zainstaluj_Crystal_Launcher.exe
Token: SeRestorePrivilege	4724	7zG.exe
Token: 35	4724	7zG.exe
Token: SeSecurityPrivilege	4724	7zG.exe
Token: SeSecurityPrivilege	4724	7zG.exe
Token: SeDebugPrivilege	5636	Install_Crystal_Launcher.exe
Token: SeRestorePrivilege	5676	javaw.exe
Token: SeRestorePrivilege	5676	javaw.exe
Token: SeRestorePrivilege	5676	javaw.exe
Token: SeRestorePrivilege	5676	javaw.exe
Token: SeRestorePrivilege	5676	javaw.exe
Token: SeRestorePrivilege	5676	javaw.exe
Token: SeRestorePrivilege	5676	javaw.exe
Token: SeRestorePrivilege	5676	javaw.exe
Token: SeRestorePrivilege	5676	javaw.exe
Token: SeRestorePrivilege	5676	javaw.exe
Token: SeRestorePrivilege	5676	javaw.exe
Token: SeRestorePrivilege	5676	javaw.exe
Token: SeRestorePrivilege	5676	javaw.exe
Token: SeRestorePrivilege	5676	javaw.exe
Token: SeRestorePrivilege	5676	javaw.exe
Token: SeRestorePrivilege	5676	javaw.exe
Token: SeRestorePrivilege	5676	javaw.exe
Token: SeRestorePrivilege	5676	javaw.exe
Token: SeRestorePrivilege	5676	javaw.exe
Token: SeRestorePrivilege	5676	javaw.exe
Token: SeRestorePrivilege	5676	javaw.exe
Token: SeRestorePrivilege	5676	javaw.exe
Token: SeRestorePrivilege	5676	javaw.exe
Token: SeRestorePrivilege	5676	javaw.exe
Token: SeRestorePrivilege	5676	javaw.exe
Token: SeRestorePrivilege	5676	javaw.exe
Token: SeRestorePrivilege	5676	javaw.exe
Token: SeRestorePrivilege	5676	javaw.exe
Token: SeRestorePrivilege	5676	javaw.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
4724	7zG.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3220	java.exe
3220	java.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 5820	4800	Zainstaluj_Crystal_Launcher.exe	93
PID 5820 wrote to memory of 2696	5820	msedge.exe	94
PID 5820 wrote to memory of 4940	5820	msedge.exe	96
PID 5820 wrote to memory of 4104	5820	msedge.exe	97
PID 5820 wrote to memory of 4104	5820	msedge.exe	97
PID 5820 wrote to memory of 4104	5820	msedge.exe	97
PID 5820 wrote to memory of 5264	5820	msedge.exe	98
PID 5820 wrote to memory of 5264	5820	msedge.exe	98
PID 5820 wrote to memory of 5660	5820	msedge.exe	99
PID 5820 wrote to memory of 5660	5820	msedge.exe	99
PID 5820 wrote to memory of 5660	5820	msedge.exe	99
PID 5820 wrote to memory of 4200	5820	msedge.exe	100
PID 5820 wrote to memory of 4200	5820	msedge.exe	100
PID 5820 wrote to memory of 4200	5820	msedge.exe	100
PID 5820 wrote to memory of 1264	5820	msedge.exe	105
PID 5820 wrote to memory of 1264	5820	msedge.exe	105
PID 5820 wrote to memory of 1264	5820	msedge.exe	105
PID 5820 wrote to memory of 2664	5820	msedge.exe	106
PID 5820 wrote to memory of 2664	5820	msedge.exe	106
PID 5820 wrote to memory of 2664	5820	msedge.exe	106
PID 5820 wrote to memory of 4840	5820	msedge.exe	110
PID 5820 wrote to memory of 4840	5820	msedge.exe	110
PID 5820 wrote to memory of 4840	5820	msedge.exe	110
PID 5820 wrote to memory of 1948	5820	msedge.exe	111
PID 5820 wrote to memory of 1948	5820	msedge.exe	111
PID 5820 wrote to memory of 4228	5820	msedge.exe	112
PID 5820 wrote to memory of 4228	5820	msedge.exe	112
PID 5820 wrote to memory of 4404	5820	msedge.exe	114
PID 5820 wrote to memory of 1252	5820	msedge.exe	119
PID 5820 wrote to memory of 1252	5820	msedge.exe	119
PID 5820 wrote to memory of 1252	5820	msedge.exe	119
PID 5820 wrote to memory of 3388	5820	msedge.exe	120
PID 5820 wrote to memory of 3388	5820	msedge.exe	120
PID 5820 wrote to memory of 3388	5820	msedge.exe	120
PID 5820 wrote to memory of 364	5820	msedge.exe	121
PID 5820 wrote to memory of 364	5820	msedge.exe	121
PID 5820 wrote to memory of 364	5820	msedge.exe	121
PID 5820 wrote to memory of 5340	5820	msedge.exe	122
PID 5820 wrote to memory of 5340	5820	msedge.exe	122
PID 5820 wrote to memory of 5340	5820	msedge.exe	122
PID 5820 wrote to memory of 5828	5820	msedge.exe	123
PID 5820 wrote to memory of 5828	5820	msedge.exe	123
PID 5820 wrote to memory of 5828	5820	msedge.exe	123
PID 5820 wrote to memory of 5200	5820	msedge.exe	124
PID 5820 wrote to memory of 3636	5820	msedge.exe	125
PID 5820 wrote to memory of 4732	5820	msedge.exe	126
PID 5820 wrote to memory of 4352	5820	msedge.exe	127
PID 5820 wrote to memory of 4352	5820	msedge.exe	127
PID 5820 wrote to memory of 4352	5820	msedge.exe	127
PID 5820 wrote to memory of 1060	5820	msedge.exe	128
PID 5820 wrote to memory of 1060	5820	msedge.exe	128
PID 5820 wrote to memory of 1060	5820	msedge.exe	128
PID 5820 wrote to memory of 3052	5820	msedge.exe	130
PID 5820 wrote to memory of 3052	5820	msedge.exe	130
PID 5820 wrote to memory of 3052	5820	msedge.exe	130
PID 5820 wrote to memory of 1960	5820	msedge.exe	132
PID 5820 wrote to memory of 1960	5820	msedge.exe	132
PID 5820 wrote to memory of 1960	5820	msedge.exe	132
PID 5820 wrote to memory of 5540	5820	msedge.exe	134
PID 5820 wrote to memory of 3024	5820	msedge.exe	135
PID 5820 wrote to memory of 5540	5820	msedge.exe	134
PID 5820 wrote to memory of 3024	5820	msedge.exe	135
PID 5820 wrote to memory of 3024	5820	msedge.exe	135
PID 5820 wrote to memory of 4900	5820	msedge.exe	136

C:\Users\Admin\AppData\Local\Temp\Zainstaluj_Crystal_Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Zainstaluj_Crystal_Launcher.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://crystal-launcher.net/
  2⤵
  - Drops file in Program Files directory
  - Checks SCSI registry key(s)
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2a0,0x2c4,0x7ffbc0ebc188,0x7ffbc0ebc194,0x7ffbc0ebc1a0
    3⤵
    PID:2696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,10538145872018402547,10401231525355312915,524288 --field-trial-handle=2312,i,10731070846199680642,10780172992199541714,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
    3⤵
    - Mark of the Web detected: This indicates that the page was originally saved or cloned.
    - System Time Discovery
    PID:4940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,10630626432494080757,676860120389371987,262144 --field-trial-handle=2312,i,10731070846199680642,10780172992199541714,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,8840121256021107303,15052012996082537036,524288 --field-trial-handle=2312,i,10731070846199680642,10780172992199541714,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:8
    3⤵
    PID:5264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,7577646395164954225,978269117692363938,2097152 --field-trial-handle=2312,i,10731070846199680642,10780172992199541714,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
    3⤵
    PID:5660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,5459322092416827888,1905381664914025609,2097152 --field-trial-handle=2312,i,10731070846199680642,10780172992199541714,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    PID:4200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4964,i,4877841668385622521,14349686218899466568,2097152 --field-trial-handle=2312,i,10731070846199680642,10780172992199541714,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
    3⤵
    PID:1264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3464,i,17528600069588008691,2141066879882531877,2097152 --field-trial-handle=2312,i,10731070846199680642,10780172992199541714,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
    3⤵
    PID:2664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3708,i,11033023685522734944,2932642233946589583,2097152 --field-trial-handle=2312,i,10731070846199680642,10780172992199541714,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:4840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,10181547950712264823,573870670867999292,524288 --field-trial-handle=2312,i,10731070846199680642,10780172992199541714,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:8
    3⤵
    PID:1948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,9328115954662334594,9028145987273568107,524288 --field-trial-handle=2312,i,10731070846199680642,10780172992199541714,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
    3⤵
    PID:4228
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,5953590517583739486,10528237804110514756,524288 --field-trial-handle=2312,i,10731070846199680642,10780172992199541714,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
    3⤵
    PID:4624
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,5953590517583739486,10528237804110514756,524288 --field-trial-handle=2312,i,10731070846199680642,10780172992199541714,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
    3⤵
    PID:4404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5844,i,1172354557605368013,13161178679575444849,2097152 --field-trial-handle=2312,i,10731070846199680642,10780172992199541714,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
    3⤵
    PID:1252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3516,i,4139767425176658807,9486142172767129942,2097152 --field-trial-handle=2312,i,10731070846199680642,10780172992199541714,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:1
    3⤵
    PID:3388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4184,i,13642218975440470293,7987468659733917625,2097152 --field-trial-handle=2312,i,10731070846199680642,10780172992199541714,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:1
    3⤵
    PID:364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5136,i,16672013309466251288,4130255297142402900,2097152 --field-trial-handle=2312,i,10731070846199680642,10780172992199541714,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:1
    3⤵
    PID:5340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5124,i,12793250138111877269,6372160120527048282,2097152 --field-trial-handle=2312,i,10731070846199680642,10780172992199541714,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:1
    3⤵
    PID:5828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,224776814292049824,18333341843100074076,524288 --field-trial-handle=2312,i,10731070846199680642,10780172992199541714,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:8
    3⤵
    PID:5200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=704,i,14920889310301216623,8612496413297192328,524288 --field-trial-handle=2312,i,10731070846199680642,10780172992199541714,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:8
    3⤵
    PID:3636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,10266037806979715407,11685534546694113810,524288 --field-trial-handle=2312,i,10731070846199680642,10780172992199541714,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:8
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4832,i,2232763104769204803,14165476535923915610,2097152 --field-trial-handle=2312,i,10731070846199680642,10780172992199541714,262144 --variations-seed-version --mojo-platform-channel-handle=704 /prefetch:1
    3⤵
    PID:4352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5132,i,10497463863911700198,18243428027625158177,2097152 --field-trial-handle=2312,i,10731070846199680642,10780172992199541714,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:1060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5264,i,1430351204407966141,14123912291687352318,2097152 --field-trial-handle=2312,i,10731070846199680642,10780172992199541714,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:1
    3⤵
    PID:3052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6968,i,8893769664901583486,7437072879666203032,2097152 --field-trial-handle=2312,i,10731070846199680642,10780172992199541714,262144 --variations-seed-version --mojo-platform-channel-handle=7052 /prefetch:1
    3⤵
    PID:1960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6988,i,8376845331868430660,15689377407780206624,524288 --field-trial-handle=2312,i,10731070846199680642,10780172992199541714,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:8
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7120,i,10099712125957906885,1038348100923240111,2097152 --field-trial-handle=2312,i,10731070846199680642,10780172992199541714,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:1
    3⤵
    PID:3024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,2808777273045848644,16708745584951258752,524288 --field-trial-handle=2312,i,10731070846199680642,10780172992199541714,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:8
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,16348565417140885533,5059540690326765625,524288 --field-trial-handle=2312,i,10731070846199680642,10780172992199541714,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:8
    3⤵
    PID:4720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,7867250922022507407,8473146875763528837,524288 --field-trial-handle=2312,i,10731070846199680642,10780172992199541714,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:8
    3⤵
    PID:1908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6988,i,13343299658347881452,14561926093100897791,524288 --field-trial-handle=2312,i,10731070846199680642,10780172992199541714,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
    3⤵
    PID:1300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5052,i,14973323223854715271,3190435472256150470,262144 --field-trial-handle=2312,i,10731070846199680642,10780172992199541714,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5496

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1276

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:672

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\CrystalLauncherN\" -spe -an -ai#7zMap22237:94:7zEvent15387
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4724

C:\Users\Admin\Downloads\CrystalLauncherN\Install_Crystal_Launcher.exe
"C:\Users\Admin\Downloads\CrystalLauncherN\Install_Crystal_Launcher.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5636
- C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\javaw.exe
  "C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\javaw.exe" -Dfile.encoding="UTF-8" -Dcrystal.windowsEngine="true" -Djava.net.preferIPv4Stack=true -Xmx256M -Xms128M -Dcrystal.wrapper.graphicscard=4E5649444941204765466F7263652032313020 -Dcrystal.wrapper.version=60 -Dcrystal.runtimedir=jdk-17.0.1+12 -Duser.home="C:\Users\Admin\AppData\Roaming\Crystal-Launcher\UserHome" -Djava.io.tmpdir="C:\Users\Admin\AppData\Roaming\Crystal-Launcher\UserHome\Temp" -cp "C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcher.jar" ovh.leszczu8023.crystalwrapper.Main
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Time Discovery
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:5676
- - C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\java.exe
    C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\java -cp C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcher.jar ovh.crystallauncher.crystalwrapper.SubProcessMain
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of SetWindowsHookEx
    PID:3220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5820_223364986\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

crystalRuntime

Path C:\Users\Admin\AppData\Local\CrystalLauncherInstallerNX\crystalRuntime
Size 907B
SHA256 a865bfc17913dacddfaed4bfbaabb9a690061153a50cd418dbb0822c7150e960
MD5 2e3287aaf04853614df94851955cfbe4
SHA1 88d5590856976b67ac11a1f4b25f8fad6c133eaa
SHA512 fbdcef2062ec54a216df184572752a483c5e6c2c06a40b1f6fdc455538e606a79ec05ee645e0977b380588d462df239236be53f2800865a91e26a5404d3a4bcd
TLSH
T13E1124478CC8C4330B73425A9A6E3511EF77431722069048B8FD4A8FBF7A86ADB83856
MD5 SHA1 SHA512 TLSH

Submit Download

crystalRuntimeBranch

Path C:\Users\Admin\AppData\Local\CrystalLauncherInstallerNX\crystalRuntimeBranch
Size 8B
SHA256 fe6d3468cf5c74d8ec2a95b40f2e05338c37a4202f8fad692d2b64a9cf9b468a
MD5 c00f0c4675b91fb8b918e4079a0b1bac
SHA1 f410e0466ae4b065bfa4d9010ad6056864ed4e50
SHA512 ab1a941f8f3b436262bad2fa7b5eb3d025fe25f54b137129fd733efd5c86b1ce97b587bcfa4986ada5530e25015d9001c819b71786e91ef4e4a33aee953b591f
MD5 SHA1 SHA512

Submit Download

language.flag

Path C:\Users\Admin\AppData\Local\CrystalLauncherInstallerNX\language.flag
Size 2B
SHA256 dbd3a49d0d906b4ed9216b73330d2fb080ef2f758c12f3885068222e5e17151c
MD5 9cfefed8fb9497baa5cd519d7d2bb5d7
SHA1 094b0fe0e302854af1311afab85b5203ba457a3b
SHA512 41dd75307a2e7c49caf53fff15aada688275ef4d7950bedf028612b73f343ed45cf51fe1d4d27f58ed12e93e0fd0ae7f69428db169211554d1b380c91aa5cd01
MD5 SHA1 SHA512

Submit Download

launchlog.txt

Path C:\Users\Admin\AppData\Local\CrystalLauncherInstallerNX\launchlog.txt
Size 1KB
SHA256 7364bbd0578848f3add7973a98f0b6f00fcd45919bb00dfe17ea4737fdd511e6
MD5 d2d08eb0d059329435b2bdeff73c06f9
SHA1 0dc2d2eda732c6e945dbe3cbe510dfb706b71596
SHA512 deaef1f14244695ba5034c2778031c956d5604fd37b369d6d7cf9f1c257ee4548de6e355c9dcb84481f538dda55904994c2c10f686992b1db5a02afcb13a48a2
TLSH
T1B41187743A96F1C0A58C16006448E5660DF46BB8B998FCE4F7B429C5D0ABE2E4BFD710
MD5 SHA1 SHA512 TLSH

Submit Download

launchlog.txt

Path C:\Users\Admin\AppData\Local\CrystalLauncherInstallerNX\launchlog.txt
Size 1KB
SHA256 30f17a916e9cc89a9e884edb73b044c08f4b8783ff802cf555a556532a0c08e8
MD5 984f3300b2b1b2248f8a78c0331ce178
SHA1 9862b478a104fce5117f3f99ab33e6483d913b16
SHA512 c15cc0517da966fa6f4c57a91a2f9b361dd5a062f7c96602e60823d3b70f2150718309dc6c03928b0012e4a37030b36953ddde7bd5d37648b8fa40c99e57d5d3
TLSH
T1D921BB743E95F1C0A58C16006448E5660DF46BB8B898FCE4F77429C5D0ABE2E4BFD720
MD5 SHA1 SHA512 TLSH

Submit Download

launchlog.txt

Path C:\Users\Admin\AppData\Local\CrystalLauncherInstallerNX\launchlog.txt
Size 2KB
SHA256 1d948667dd42fb9e67ab82099e4f9deaa64c73c47b85f953bae08babd28ee4d0
MD5 904a9d3ea546b3d7162d3f33a989d41e
SHA1 4363a434d05d79f436d5ad3861166223bdad77ea
SHA512 dd9222a0942b48e363ae3f604e4088362a1a2de71c6e27bbbbf667c95e8279a94f18a6edd55816b44876a7d5465ffeb8ea4c59ecf6dcc2f21e4057faff18d611
TLSH
T15B4196753A95F1D1A68C1600644CE5660EF47B78B898FCE8F7B42984D0ABE3E4AFD710
MD5 SHA1 SHA512 TLSH

Submit Download

launchlog.txt

Path C:\Users\Admin\AppData\Local\CrystalLauncherInstallerNX\launchlog.txt
Size 4KB
SHA256 8cfed0718fb18c3f45dcb1a63a8e64a40aeea98878d1963accf9defe891f7948
MD5 3d0dd26f9079a157b634a26c9296f873
SHA1 914a0ac0935c75f951baa6d83645b7a53584fb83
SHA512 bd60bbae6846d6f3897976ddd864c31725ca71cd3449b9ba1a259f624328e7368af9a06a397aef06552bf890a149a5555853481b4b114c0095f412ec6e86d116
SSDEEP 48:KzPZlxzPZ7H6zPZSQzPZ/KzPZ7+zuKzumz2qIyzPZQs6zPZkWZS6lmwZlxwZ7H6h:iDj5sRNmbs0dqZ292Hd76z
TLSH
T16191E6657EC5F1D1A58C5610284CE5560AB46778B499FCECF7B42888E0AAE3F8EFD310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 47b387c2e41c3a76b71ea1179b790ef3bf61a1cd3cff1bf9c7a45bcd3d162793
MD5 2d9b301562ddc23ca96f7bd60b3d994f
SHA1 f411fe95ac593bf9f188648b05f26278bb57b8a9
SHA512 b2f851930d92529aca4a9e4f67e71e9157b33cfada719c1bee5b27d492be96abaae3fcbfbb480c531fdb4619c5b1eda8578bb6f45a4f86b4371e7566b7d31eda
TLSH
T1ECE022A6C822ED270DFD571CA15A8A56EB0123172B40894F3A3D91098FB062A45C5C6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 bcbba2f243892b4469bf1f73f62613c5217dd912e8c17d0bfe5992363a198a42
MD5 a501415afd0e724d5e0df7c66f1bb18e
SHA1 159a18637932bb6843fe18c8c680e4ecacec70f2
SHA512 a8b3aa11403ae682482d586895639f394432386264f35505dbf068ad156c2d7351fa6aa277976267ae79f479deaf8bfcbc9c27ef088a590674121eafad973a64
SSDEEP 48:O0VuXY5a2OtCJVRf29mqwWQlUBna18tXL0Ro6ERIWnWzA7inbf:FBr29mq1QyBn1XYO6ERInf
TLSH
T1A891D8354ADB8295F390013385DF060CB577DDFAFE236F916CA09C71276736140ADA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59096c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59096c.TMP
Size 3KB
SHA256 eed4b040324f00632c3ac89434d41463cbc713cf460ddeef98fe9e632a98ed31
MD5 329c7b891731705cfbc68c760cc6b674
SHA1 f1ebeb4caeed9f1fd37a571d9afb228ac3281026
SHA512 15237180519cba7786023340c84728bdb9fa86d6a9e17c6d5734233f227e34f8e5af5a08681254f7419ba41e41688cef53fd301ae60448b2fe40d93633dacc19
TLSH
T17081B57549D352A9F360413381DF054CB8B7CDF9FE276E916894A8B1272B37181ADA21
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 82b8a3e2d86079552de5f8502c6d645609685efb69b0a065a99ea25a31dd24b4
MD5 f7f3a1a6b880cc8c0e75558862d50227
SHA1 0f9020a8b339a072d50490be3220b9a6e2b8198f
SHA512 089acc20cd604a70aacd372902eaa64170cf8e2116527bcf475670e5430bf00b54437862ac9c72a7de6b785eba2ac8b00a3e3f2546b7010d323afebd2b5428cb
SSDEEP 192:D1cGbZkJbQ1Gaaij6RIJzw2gTNDetZyTZGeP5klmmo:D1cGbZkJbQ1GaaiGRIJzw2gTNDetkTZb
TLSH
T14CE1C4F3C7F8866DC92196F067246E2FCF18055493AC7C5AC5E8AF4BA3E2470D14159E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d86c7f01-daaa-4622-8d65-15f2484d6c11.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d86c7f01-daaa-4622-8d65-15f2484d6c11.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 c3978bdb226b1e9a567c6a0eff95b8dccd666803f0c08c24486eace14160985a
MD5 802214cf83e97cd02d9369806495bcf3
SHA1 7b4dd9169b85ebea83b8ee39a2968ed44030609d
SHA512 24a5af0e29a52569d7e0923a8a922445ff10629daaba6cb708982f66fed727c54e3bcc3205a3fe2dcf0429086efbfb9fefe1396cc79db9e2a1a1b30763909786
SSDEEP 192:sxZxRIyMqZjK1Ml8MtS/fUshX+ZdIaRuvFzodpbXx/6PcHW6+WNvAmTdiPXBSAJf:sxZxJlS/fUsF+zIKYOjXHbv4XkTMX
TLSH
T1A982D746A9345A7B8DD7D219F544BF63D7F91063A1905E84AAFC8A1C08E7BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7831f1ebecf1f155fca2f1631aa837603c0e5191d24a65f18cf77edb3806709e
MD5 d5eaaa4ee7e2396d0a665bfe0a1811b4
SHA1 d044a654386b64b5848a5f66b453696cda5b8b08
SHA512 28ccf73b236f5f91b4bff7bd69cc6769bb56618fe3e9c3534aabeb475f447897084ddd7540c700be81eb95134975be7b413d3c61b17e7c638052ccdb81bffc25
SSDEEP 192:sxZxRIyMqZjK1Ml8MjS/fUshXOaZdIaRuv7zodpbO1HW6+WN4iPXzZveuUOGyIg2:sxZxJ7S/fUsFOazIKYgiHb9XzTxY
TLSH
T1C572E806AA34597B8DD7D219FA45BF53D3F90163A1905E44A9FCCA1C04E7AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 1fca8ec6160537b9f38bc1b8978a25043556c34f169dd840d61b6afa8486383e
MD5 4c5bf30cd75eb4e8db818362f96df792
SHA1 36c72f2d0f9d42599943cf60b2b52c6f6fa3378d
SHA512 8acdda32bcf52668c2a4af881d81fc7c96ca0a5515cb096ca9920b1173069706997189ffcd812fff10144b1e6189906793d8c87265158f95e370109ecbc7fc61
SSDEEP 192:sxZxRIyMqZjK1Ml8UQbtS/fUshX+ZdIaRuvFzodpbXx/6PcHW6+WNvAmTdiPXBSh:sxZxJqBS/fUsF+zIKYOjXHbv4XRTMX
TLSH
T15B82E746A9345A7B8CD7E219F544BF63D7F91063A1905E84AAFC8A1C04E7AED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 5207386e023f14029cfa86c827547ee00158da6776ca056884a1df5ef8380e6b
MD5 e13e90f800b8f569d3fcaf4b1c90d5aa
SHA1 128fdcce970a9d8ee3738e956bef58006c078412
SHA512 62d07baf01974a91480ce2ef21e7537de6854b6860098535cee2094ed593369e75483544d3f73ccabb3156350fe4a438efbde9c3f6c5bd6df157137e954683e5
SSDEEP 192:sxZxRIyMqZjK1Ml8MiS/fUsssOaZdIaRuv7zodpbO1HW6+WN4+l/zZvSC+GyIgjY:sxZxJqS/fUsssOazIKYg+Hbz/GTjY
TLSH
T13A62E906AA34597B8DDBD219FA45BF63D7F50563A1904E449AFCCA0C04E7BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 72e7f6f2c6af6657caf047f9d9b62e942af43484547f12f9defa8fdf17984856
MD5 dfd04360b237e738aae3c6f9a947556d
SHA1 9d99c1353ad8f84c598dfd23a94d749fe8d7a2c4
SHA512 7d8f6e33fcc46d0c8ddefe2fbe1ad51939bcc90dee88c40b155d3367e092fb68a66d6bb81aa7acf58f67d6174af535b628887e9578ffd5a6af4052cb5a72de33
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvQX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXysy10Llo:eY8Od/HEnFhWvFvQXu1javt10Lm2Nuvv
TLSH
T113F2EA3B6C0CCB7E4F844E9CEC2A7F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 6402ab297776923723717aa1132d5602dba19d5d855d9f8f99bd108f85f11afc
MD5 99105a14a44de337855cc100fb439c4b
SHA1 843ccc8fd7225b774ce39ccdd530602dacb1d786
SHA512 881f3017ecebfc60f6ecc8fb2f5fbb9bac0dc753b2e3889624516ebcd0041135b216c6b10538601c0e0f360c9d983b5de0354062187ff1880ff91826124a760f
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGi:05ppxnY753RNBvRJJdt7p5J9Vlfm
TLSH
T149B28B1A713E0212397E2948B39696364F4235A37058E4BF7FB814A54F67E224CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 675cd062b6ffa54460b07d6a53161f2b5e081f673157a9b8fef0038db0ea2d81
MD5 ab82b39e624b1df26eba3f26258f0cc1
SHA1 706e4603dc7b87547f6322bbc2ad12a7ba672b7d
SHA512 fc19e4e691754c6f9d9e40ba14b879cdc76403f611118af2be1ae86e64fe635053c173c855fc98630eb47a06f4969154a1d6ec8f4700bb63680b8dde6bff7895
SSDEEP 384:nBsiFtZcIxsNh8TUNTUlI4pQckCrP5+2phBftGnv4tOOPrXLpe8C/MBDty/7Igi:BXF1x0wg4k8+o1Gv4tOi9Pzn
TLSH
T1B2D25C71D868DDA7ECEB9B85B75A3603EFF401A3D9C89AD4E9D85D0C048319D070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 d3cd18c75c9f647ea3789d1305477a53309dac15ed4c5ee99c81c613fafc444f
MD5 d144a1500acb2791aca15231eea9f609
SHA1 e5b2a6b8758cc9e7740fa1d44238f413749dce86
SHA512 c8d61809d3f1a8ec8015c97ef292bcd1c58718597512b7b4fc50f2335cb73ba71255955a0a3e2c7860841320f78861d765ce1331bd8cc32e17fa46153437774a
SSDEEP 384:npNiF9CcmyWCs3sNj8TUNTUlIm2QckCr9liKphBftGnI+pae4KV8p0mHpty/7IgI:pEFccps3mwgbkUwk1GIxI8p0wd
TLSH
T100B25B36DC58C9BBECE74F99BB4A7A03EFE0126786D899D4DAD81D0D10971DC070B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 82381d35e9f830d19a928aebda174dcb944442d267333c2d432cb2cab6c1d646
MD5 601aefd3dedf496ad831ae7bf3243000
SHA1 22c41513f1f540136e25d1b269e505a01f524ca7
SHA512 67f402aeac2bd7d86d9ac73a4b406cd163b17e5f3b31f4dc3e1353634661a45eda604db85a195d116adaf17acd74d7a1a6fc0621d6da0cb6eafe7a595b044e78
SSDEEP 384:npEiF9CcmyWCs3sNh8TUNTUlI44QckCraBVphBftGnvWt5mfty/7Igq:pfFccps30wg1kv71GvWtE
TLSH
T15AB24A32D898CEA7ECE75B99F74A3A43DFE411A389C89AD4DAD80D0D10872DD070BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 5bf2ab14884170c611613bf15add32036b5627cd238f844a6634b37b3c36867c
MD5 548234e6ef19b92983ccee1febbab57d
SHA1 dea7b5a32b9fbaf7d32c5e557eb7b9a96de7f41f
SHA512 5dac9382530c0e65eb5ff5decc4627606a269d7571ef320bddc648ecd937c0868e4c719ca277edc916e41d0ad1cd89583395ae3c71d36bc82d631a52c8df4003
SSDEEP 384:npEiFiZcIj3sNh8TUNTUlI4tQckCryBVphBftGnvWtOOPrXLpe8C/MBDty/7Igi:pfFQj30wgUkZ71GvWtOi9Pzn
TLSH
T1BED26C71D868DDA7FCEB9B95A78A3603EFF411A3D9C85AD4E9D85D0C008319D070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 22aebb1e3544cced24fa6cca7687502b0487d928427d81612e5752f6e0cac1f8
MD5 ece2e7b544cb82b2d22bbc124b7e78b6
SHA1 b43be65b88a9514e938ad1ab785a564c771695d5
SHA512 7de4952d7ca15a50e9004d0e3a2b8d2f1bca7f8977d3d9beac3924ed388a23453c45b0c950a6b08ec6a49f53c6233aeb64ded07fff1af87c37201616764af56e
SSDEEP 384:np9iF9CcmyWCs3sNl8TUNTUlIm2QckCr9XeWphBftGnvtte4KV8p0mHpty/7IgI:p0Fccps3EwgbkUOI1GvttI8p0wd
TLSH
T107C26C31D858CDABECE74B99B74A3A43EFE05177898C9AE4DAD85D0D10872DD070B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 43036ac2139c15dc0d188e2c08fe0d1e8ba812b55c31d5e67e76e972cc9a27ae
MD5 8218038d88a666f69665c8d3e1550ebb
SHA1 17266ddcd575dfff0c8ccddbd2b6aa3c323c3a47
SHA512 007e3409ccae4fcae0472c4cfb7a2bb055b3aa0bf1a5779c5f95f6c2ebea109aa794c6fd969a54d56fad5249fd0a195baeb80c8fad2a47579e3bb7348c069549
SSDEEP 384:nBoiFiZcINsNh8TUNTUlI4tQckCry5+2phBftGnvWtOOPrXLpe8C/MBDty/7Igi:BzFQN0wgUkh+o1GvWtOi9Pzn
TLSH
T138D26C71D868DDA7FCEB9B95A78A3603EFF401A3D9C89AD4E9D85D0C008319D070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 bac9a6c2ec15466ef7aa3590194180ba8feb170af03f63065b1faeaee373d49e
MD5 c9a9198221f4800ba8bb4d588d83f05a
SHA1 af490a32ea968faa69b5272b19aee13fec954e7c
SHA512 e48544492306bd551614d0acb0c820fd74cd3a68482040c7761535a52ff411d52ebd47794928ac0a310c786b5c0c0408cd9bea705fc5d221f75d0a45e0a82275
TLSH
T178E0021153100073C01C073450D72F003FA1C05402D343476B34116C1D72B043C30D04
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5740b4adeac921071ac8ff4e16d7d2526b41b939f67dea79303c5856f68689ea
MD5 e97a9383d9aeb7f04a970f428fd692e0
SHA1 0f606d18474b32dd911d5a3f82bdd1ad7ea4128e
SHA512 57bbbe36972e49e5ea215217a074eed80cb32c33bfdef309bf025fee717e012d7cc6544e833b78ee75ba5b68f01342283cd85827eb75d9e3128bef8583ae9cc5
TLSH
T1FAE00922931400B3C01C073451D72F003FB2C05403E38347AB34127C1D72B047C30E04
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58a14c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58a14c.TMP
Size 392B
SHA256 a4316f7f8056ac4712a8ec252ba39d6f52537b2b0aeccda37b3c95429c0c718c
MD5 9d87f4c288832d9431c144603acdba6d
SHA1 c046b9d935928cce411e1105b399ab55d8879129
SHA512 a93ed4414644d3c7625346f34314f2c9231db5abf411ba01e9b7465195fe696a638dd4f14e830dfaa18babe602c8832cc4ce78941ed24bd33369cd45010db89f
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 3385622a2418d348162334d9044edf8fd02a598de2eb9650b0f45eb582567995
MD5 14e99dd628ed178ac758efa4781d2a1e
SHA1 c8b35872f522becd0398db73ad6b33b1bbfcbe93
SHA512 96cc88fc7fcbfa80ddbf1f444a4fd3140f99bbc4d89e05cec6e15a9abbfc0150df61f54494e61ac860ab5ee454628a756ff91346db92ae3c0bb2c4de0ddf22ad
TLSH
T1E34140D15C391ED2C4BD0AAEB89738FC85E8C32AF1A4707D5898E8940B7D54D744583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 07f63bba6c9be60922bfe2cb77fa3c387ac8e67a0af5f9c25d5f77f248883c10
MD5 3ad86b5140145f2cb1da86e2f9d42b3c
SHA1 0fcfdc551396e88ddaa80c8f5b7d138fa16d2c9f
SHA512 5d3be1e14c24dc5d70d9da0d302d9a6bf3b50133d06753c2efb40d91890ba5d9b17ad60bd72628ae7eb759d0d28acc1946ad247c22809d9598662798000a7c78
TLSH
T1C0413ED15C390AD2C4BD0AAEB49739FC84E8D72AB1E0347C6888E8940B6D54D708583F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5b2d6375d74cb1d66611329fc893ef4a272e5ee722a1a9f743823032f41423ac
MD5 2fc76e7a1ee9d2cdedc6be2c21bfd2a3
SHA1 986e5b0045268e2fbfbd05ed63d14481a26a0043
SHA512 f4d3ed1962c870dd5f24fa8e52c25723c43a076d21a5d2bdbe4c0ff232837b66ccb7e9ce3f4bbe54b6e920c70b93f1c084c04318e851e7c8e0706f02101ded6a
TLSH
T1C141D459AAE91148B3B37F5AABF668AE447FBD772E07C45D00010D8F0A62A40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

.crystalinst

Path C:\Users\Admin\AppData\Roaming\.crystalinst
Size 47B
SHA256 f7b96d33e37ab4efee43ea4a9d4c872a2194d288954553c6e3bb7926e2a7287c
MD5 2749fa9b45b9755eefafbf5517c74614
SHA1 fb0b300aa4bb371f71b4fb0e7092d1911a1f976b
SHA512 ad1ea746af6e8ef14edd20ecc17304fae591d3696a0f0fdab264b7a039e600f50add376356c68813c72376160c6c89ec1af2e33a9a7cc185a896b85d8d7e0180
MD5 SHA1 SHA512

Submit Download

07f7c1e7e8f3e781fdc36cff5f35c833458f0c04.bin

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\cache\downloads\07f7c1e7e8f3e781fdc36cff5f35c833458f0c04.bin
Size 2.8MB
SHA256 8754919306df0bd62f87f19239d6386b5f1d422e9b2245921103a541a7f08d3c
MD5 bfa6d1985c2e23da451e7111d4b51f46
SHA1 07f7c1e7e8f3e781fdc36cff5f35c833458f0c04
SHA512 1edc2c589bbdcc6c94067d28fc1e4c102e79a531ccbb524bdbb2c3837cdff79cb22ec291a4e6cbb377a13f65161e48ba465060a73b375e1d5007796e13687ac4
SSDEEP 49152:u66UvhjSW9R9/cR9/Shnqvuyv39pXogjzpNtQ6lm3YMUVYoe77bS:5jUmRlcHSxqvuyvtpYqp43YMUVJe2
TLSH
T107D5F16251BF0534D437E33E95685A237C3CB8AB910B30EA3DF1154296FFA592A83F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63ea56587c8aaf05adab5cb0397e056bac8a2db0.bin

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\cache\downloads\63ea56587c8aaf05adab5cb0397e056bac8a2db0.bin
Size 300KB
SHA256 352b0ba1c657d8930063a9b83878fb717deef2d29ee25d13943be9beccc64d49
MD5 d4b7197bf50afc96e2fa2657a339f037
SHA1 63ea56587c8aaf05adab5cb0397e056bac8a2db0
SHA512 459c1faa00acdf1337020fa410b24dfeae4c3093aaa47045688e403783bc60918848b4947f38c791608a0165e510a554f0938f02dc3701596973c6742b629d5a
SSDEEP 6144:kcMr31b81NAlSlpf5oxNF6GnrNMsl5xALXsLXTOSmqV4:A3FC5eTn5d5xEX4TOdl
TLSH
T1A764CF3195C72820FA336139856274E720BAEF98D3CB79EE34FDB647D4A08464AF7650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b444a5baadf965189107c73b947069c1395e0dfa.bin

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\cache\downloads\b444a5baadf965189107c73b947069c1395e0dfa.bin
Size 164KB
SHA256 45e09282c00109bca4ec2c52259871da330251bee33c58b0952f5725eae71457
MD5 875057f855eb2301dc0a2f65d335307c
SHA1 b444a5baadf965189107c73b947069c1395e0dfa
SHA512 50434b4673e4b1e8d63ebb6567cb5638ffab2242a9f2804291ffb10af837fb5869de9876b8453f07606612c8e3478f76dc12e1f43aef1219e0b6d095b065ec90
SSDEEP 3072:0p8myKdcmUjV55WWhSPuSQy0oBgBSG9fz/cz/adD+5ciHTkZ:0OmyYc/VmW8xf0oBgJfzASdDTiHTkZ
TLSH
T12AF39E61A0DA05B4E17B85B4C4B32D57741D1B8580CAB93738E03627B0F7EFA93A7399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher.jar

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcher.jar
Size 7.1MB
SHA256 9e5606c95a376b30484d3a62f2f94cd9ec9db5cc511714f18af0bc5ca201bd86
MD5 63cf184869b78d9dac8d0cb83bfb4872
SHA1 341648475337f89890cd423b0051431f176fd2cf
SHA512 a6a98bcf4fb6011a23433fda148716ebadffe4b8684e1190b14fa2dfac52963e55706fa9874c12bf9b7041114b8aee63a5d87b4463b1d52ca2db5384033f64f1
SSDEEP 196608:qqsk/iFqENnY65DoTNGareiT6pPWOO8hiL6DzZ3syzMm8:qq7/iFqENnT+QJ1O8o2Z3sN
TLSH
T109760275C06C54B4CEBFD4B296D7128890F70A91CA4774BF2BB92B40FB166812BB271D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AbsoluteLayout-RELEASE126-all.jar

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\AbsoluteLayout-RELEASE126-all.jar
Size 10KB
SHA256 3be0e26025c0b81a664d9dd3054a3849afd4bdd9972b30506ddb1ec0edd5e9f9
MD5 091a0a48216020e4074e0bfed0c89edc
SHA1 6a5fb031400ea4eedd6407cb6c1dd1930ebde65a
SHA512 2e1ea9044244b0e3f103096e3fb55e29b61b5905ab5aeb95ba18eb64cfcb23ec5c1437c7d2a54d069a8a03f06046b0d64711b9e55a6bdc354d0ff4320df47317
SSDEEP 192:SMM5aH+gkccRyRyEOje5BTeHTRciEURB02bym3vfOxheXvkawdNimtkMih7u8:F6icR6/5BilDWUzvZvk7dkm6
TLSH
T11A228E31A9C74502F3AA1B34C63279663F75501A0A7C48D8B27997E9FF6AC31AD41E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

annotations-13.0-all.jar

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\annotations-13.0-all.jar
Size 17KB
SHA256 ace2a10dc8e2d5fd34925ecac03e4988b2c0f851650c94b8cef49ba1bd111478
MD5 f4fb462172517b46b6cd90003508515a
SHA1 919f0dfe192fb4e063e7dacadee7f8bb9a2672a9
SHA512 5622d0ffe410e7272e2bb9fae1006caedeb86d0c62d2d9f3929a3b3cdcdef1963218fcf0cede82e95ef9f4da3ed4a173fa055ee6e4038886376181e0423e02ff
SSDEEP 192:E6NPmcHUdViky3poaqrkbuNZtnBbe4Wn0uv77QGnsbNDJxW:EsO0k8oaq4CFBbe10I7QGCDJxW
TLSH
T14C72C7EEE3005115EF3E703730935456B43E60D5E0C8B6056BB917E7AAB6C622F9FA06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app-locker-1.1.2-all.jar

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\app-locker-1.1.2-all.jar
Size 19KB
SHA256 9b856f7638c0f0db7690032c561120005299b5802aaa1a8a7aa65a939c29bc14
MD5 e8a0797a1841d080ce850b731b23daff
SHA1 50158017da1ccc0bcb98d094c84b039cf12f36e7
SHA512 fc70c3ae413a598233008148ce9afb9247cb397b2626d251bc66417497878952eee98d1b638766db471dbd498077acaead8214c09cb7f114d61cd9addae237c0
SSDEEP 384:XvGNdwwkif3AmNuRDD5PJksDDTlMXGuI2zEk05S0:EIzmNuRDjkoTlDll3
TLSH
T16092ADF201F49253EBB37E7A8680845A713D412CF517A3B19AF491A997BF006B74289F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

argo-6.0-all.jar

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\argo-6.0-all.jar
Size 121KB
SHA256 c092dae3a116ba9f6f0d3c59a2bb276641e2cbcd769da8c32eeccf95b9a82a81
MD5 e44f1cd0ef72ae1be207a509e571126e
SHA1 91b282f3a05a4f3caf6baa7bb5d03976aee0855a
SHA512 39e48ab61a6879e010c35f25996dda1abdc43038b077d36603b870e3772e38f0247f6b9777a6f98d9bc69efa71081828ede5ab19ccc88fcd4d61a254356e2524
SSDEEP 1536:WwKQDR80d3fFyPW/xWCKnIdrAhFDj9BvQkFcusiLnMIC5cK7mL2GPCTrPF1dq:d3f0O/0It6NBI/oMm1CTrPQ
TLSH
T15EC3BF3156D19EA6F86F51B752E70762B97E26CAE70020B547E815F27AB2C9C0F13B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

checker-qual-3.12.0-all.jar

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\checker-qual-3.12.0-all.jar
Size 203KB
SHA256 ff10785ac2a357ec5de9c293cb982a2cbb605c0309ea4cc1cb9b9bc6dbe7f3cb
MD5 ab1ae0e2f2f63601597a5a96fca8a54f
SHA1 d5692f0526415fcc6de94bb5bfbd3afd9dd3b3e5
SHA512 ff20c424e130c31c30b4f4f5b4374f8f98f94ddae2b123f3c213f147be6b3de57854ee5651b02dd97d352c1c1df2a8bfeef73d5307a71372f46a6002eab24d78
SSDEEP 1536:cPx0Q6OOKmhpkxW1VuattcLwwxleKp9iDiW9UAmNPnZALgqcGnv1FzhS6VlVrIFV:1Kw1VHttLK4KBW9rkPnaLgVGvfYwVYrH
TLSH
T1F914937EEDFC40A9D03381B0A0834463B8641A4AB781681F3EF067579CFAD859657BDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

commons-codec-1.15-all.jar

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\commons-codec-1.15-all.jar
Size 345KB
SHA256 b3e9f6d63a790109bf0d056611fbed1cf69055826defeb9894a71369d246ed63
MD5 303baf002ce6d382198090aedd9d79a2
SHA1 49d94806b6e3dc933dacbd8acb0fdbab8ebd1e5d
SHA512 da30a716770795fce390e4dd340a8b728f220c6572383ffef55bd5839655d5611fcc06128b2144f6cdcb36f53072a12ec80b04afee787665e7ad0b6e888a6787
SSDEEP 6144:clDdXraL6MLAdTAR5JV4WtBTvEYc6xymTWZaJlQ1V0n34Pw2z:MrqxLA9AR5JV4Wte1mTQ2tId
TLSH
T12E74BF62E0C50840FE36A174A1B67C7E7C7EDB49828775C926ECB3834AF5D548E6316C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

commons-collections4-4.4-all.jar

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\commons-collections4-4.4-all.jar
Size 734KB
SHA256 1df8b9430b5c8ed143d7815e403e33ef5371b2400aadbe9bda0883762e0846d1
MD5 4a37023740719b391f10030362c86be6
SHA1 62ebe7544cb7164d87e0637a2a6a2bdc981395e8
SHA512 5939c9931eb9557caee3b45fe1dd9ce54cabdc4e6182ed7faac77e1a866dd0cb602bfa4ece2f3316d769913366106bd2b61bf3bb5faad1fa7d808124c06dec0f
SSDEEP 6144:V2WxQR7RyEvNPmL/TFLZ0Nu6+KXNPxfM4QOW8mpXYBU203grojqthfIEZfoFz9CU:VeEkVnjQOPm6S7QIdz9CkczHhzPRaN
TLSH
T1D5F49D21F4C66B70E2AB6931A5F324FA3439AF48D24B10D920FC5753CEB188916A775F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

commons-io-2.11.0-all.jar

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\commons-io-2.11.0-all.jar
Size 319KB
SHA256 961b2f6d87dbacc5d54abf45ab7a6e2495f89b75598962d8c723cea9bc210908
MD5 3b4b7ccfaeceeac240b804839ee1a1ca
SHA1 a2503f302b11ebde7ebc3df41daebe0e4eea3689
SHA512 5bd78eed456ede30119319c5bed8e3e4c443b6fd7bdb3a7a5686647bd83094d0c3e2832a7575cfb60e4ef25f08106b93476939d3adcfecf5533cc030b3039e10
SSDEEP 6144:UrBoCnU0+1j/OjXrf50ynaZ13lybiOmQ+CEEArHs2M1mX2TKYGGh82ajQe+yw:2oCnU0+hnZLOm7CH4Hs5mXmKYGer3
TLSH
T1F264E122F5C90811F733657AB09629AB38BED7C8D55B74DD20ECBA0394E6C054BE37A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

commons-lang3-3.12.0-all.jar

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\commons-lang3-3.12.0-all.jar
Size 573KB
SHA256 d919d904486c037f8d193412da0c92e22a9fa24230b9d67a57855c5c31c7e94e
MD5 19fe50567358922bdad277959ea69545
SHA1 c6842c86792ff03b9f1d1fe2aab8dc23aa6c6f0e
SHA512 fbdbc0943cb3498b0148e86a39b773f97c8e6013740f72dbc727faeabea402073e2cc8c4d68198e5fc6b08a13b7700236292e99d4785f2c9989f2e5fac11fd81
SSDEEP 12288:+ckjxCcwZ/O05RmbNxmLhmckii9z2B19dCk:ACcEOqENQEvUBlF
TLSH
T12CC4D120A9C61815FA37903841E3389A24BBCFD8E587B0DF39ECB74358B6E0646776D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

commons-logging-1.2-all.jar

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\commons-logging-1.2-all.jar
Size 60KB
SHA256 daddea1ea0be0f56978ab3006b8ac92834afeefbd9b7e4e6316fca57df0fa636
MD5 040b4b4d8eac886f6b4a2a3bd2f31b00
SHA1 4bfc12adfe4842bf07b657f0369c4cb522955686
SHA512 ed00dbfabd9ae00efa26dd400983601d076fe36408b7d6520084b447e5d1fa527ce65bd6afdcb58506c3a808323d28e88f26cb99c6f5db9ff64f6525ecdfa557
SSDEEP 1536:TWvDr5xeO4G9Q7+VCfSqguGukQYvFABhbHoneHz:6BxeO4CQSoRglukQTrjoeHz
TLSH
T1CE53D178F98A6854F22E06329152AD263C3F4FC1B107C4AD6A7C737750EAC571ACB6E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

commons-text-1.9-all.jar

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\commons-text-1.9-all.jar
Size 211KB
SHA256 0812f284ac5dd0d617461d9a2ab6ac6811137f25122dfffd4788a4871e732d00
MD5 c1c130c369aa86bfe4f7a7a920bc0223
SHA1 ba6ac8c2807490944a0a27f6f8e68fb5ed2e80e2
SHA512 ad39787c96445737904e343593c03aa4c4e76bd1516ff45e70fc1efd8a53439b1b104c3b0fed4e431d9291ebabf4bff2e5547e0c6510f59160b8ea620bad2ae2
SSDEEP 3072:GSvPTkmFjZuiY0VUJ5Ll9j0kwvA6VksCHpgEBu4qY0JSGu5OWACJ59lQGGZN:hjkOZuv4kwvAAEgEgFYcu5LACwGGn
TLSH
T1D124D025A4D74834FE3391788AD239C7B47FE748D29BB4D930EDF243946998426EB384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dnsjava-3.5.2-all.jar

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\dnsjava-3.5.2-all.jar
Size 520KB
SHA256 c7790a69fbacd6e57fd5be53c6af0478bc958700c74a37ec2753909db5785d2b
MD5 c074fadb8585b3232e180abc9d33a14c
SHA1 f980d4c3360861c5c8f1c7632ec5097d675e78f0
SHA512 a523a1ae5e8c379171d2835411a78cfaaa8c1c4571d2aad0972cb3d9682066dcce45859827170337753241f83fa200fb7986043b2602d4c3e0a90850c0a35bab
SSDEEP 12288:tmRvZs6YQgsDYRFfGsZDVXsrjmRc9C+KyG72hsJkEI3cs6lShaINtfEkwvuaOhzR:tmRvZs6YQgsDYRFfGsZDVXsrjGc9C+K8
TLSH
T1D3B4E106BD8C9BACEE87A13D50C2A45B393841E893DDF01B56B50B958AB0D944F13FDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

error_prone_annotations-2.7.1-all.jar

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\error_prone_annotations-2.7.1-all.jar
Size 14KB
SHA256 cd5257c08a246cf8628817ae71cb822be192ef91f6881ca4a3fcff4f1de1cff3
MD5 5260e1257140bed1936991931cff5ed8
SHA1 458d9042f7aa6fa9a634df902b37f544e15aacac
SHA512 32747ed9abb289da6ec8f3acb3a3be47c1271323847c8e3c1e9f58e9fc4a211221bdaf988990e8ec97bdba3986927ec81cf9d3f3b5939fff8cbdfb0ec7afc7fe
SSDEEP 192:CBYeUodpDPLBfiqPluK1UL+qFMDqgHQAjO/XM+TOCHw8/KNweg7:CBYLoDbdfhP2Fgo0WV/b7
TLSH
T15262B6DBFA04353BED0B983371304159F838DAB4BA5E36465BA106445890C8A6F8EBDF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

failureaccess-1.0.1-all.jar

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\failureaccess-1.0.1-all.jar
Size 4KB
SHA256 a171ee4c734dd2da837e4b16be9df4661afab72a41adaf31eb84dfdaf936ca26
MD5 091883993ef5bfa91da01dcc8fc52236
SHA1 1dcf1de382a0bf95a3d8b0849546c88bac1292c9
SHA512 f8d59b808d6ba617252305b66d5590937da9b2b843d492d06b8d0b1b1f397e39f360d5817707797b979a5bf20bf21987b35333e7a15c44ed7401fea2d2119cae
SSDEEP 96:6nc3+Tkadi8HKcL9CpLPu6+Lh61QyBcajLHtlqekr7ztyldIag4m85Bx:gc3+WTzpMyBcctlqGgZCBx
TLSH
T1989197F32A8DD4EFE64ACDBB06A1D5157530CA9B410EA1073A9570F40FA1DC44B06ECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flatlaf-1.6.5-all.jar

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\flatlaf-1.6.5-all.jar
Size 550KB
SHA256 532777efdf3310a76c13fc9edfd722ded49bb44977cd77638ec310b4c158bdf3
MD5 655814242aa5fa27b4f4eaca9390c951
SHA1 54e8fab4749cf268bdd3dc59c5635ce3f9368ba7
SHA512 e173fb242b8d5e6206decb2f1c8cfdb1d5cb5b3f4dbe8eccb4f57b1018e48bf4337689165bcba63856d915fec74e09398b4faad0c0c603e2f6f917cca7c58df4
SSDEEP 12288:2LShY/UYzCX20PX7RcR2lAl7+Ggk2D3F0uqQI8d31JaTaui:2LShSUKm2aXyRwE7+pkmyu/dKc
TLSH
T14CC4E17227FCD0E8EA73ABB786B16AC7ED0B47A89506DC3A04A052C3246DD471F1971D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flatlaf-intellij-themes-1.6.5-all.jar

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\flatlaf-intellij-themes-1.6.5-all.jar
Size 315KB
SHA256 a8f260b77ea6255c23f272440effb203e056e6ede41d9b77617d6b8ae0bf387a
MD5 82134debd8d1bb638d00232e1f9fff6b
SHA1 978c21c66867eaabfe1fde4c90eb1d56aaae72b2
SHA512 b68b706760e27ca9ce4e05b722c8411da29ca252d7e148bdeadc2fb0d516d3ccc11f1dad5531233ac7a3ab49d77cbc2a65a9a160474a4cddb1bf664ebbe4c177
SSDEEP 6144:xa+1BAimjio2XUqpbx7ngSN+hpAHnGSXWxMcH:x95m+7BbxMSN+hpqnB7cH
TLSH
T1F264CFA3937DC395CA2B567B81B105C2EF9F3BBB90879925D20411CB24A2C579B3E70D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flatlaf-swingx-1.6.5-all.jar

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\flatlaf-swingx-1.6.5-all.jar
Size 33KB
SHA256 6a99fb99235b2638c6b3425e55b2d900a959ebb7f2e65f6d492adadc6c25d50f
MD5 742ee84f00081d2f37a4e9800e6feeeb
SHA1 ffeff06849df34839fe88d1660003560b6a3f483
SHA512 3a2343e8321d23c0885b734c88600eed6dab03940cf98cf96b6e94c0569c0bd40251ea544640870e82080d981751fefe663455138271a6b932c5d7dcb496d11c
SSDEEP 768:t1EJXY1fJ3Ev9kHophLMjaaWKOaqfKkkG5P:tBQvCqhUaaWhK8
TLSH
T12CF2AE332BF8E26AD07756BBEBA0C792ED2B5A689157D97028E010C3757DD016E0871E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gson-2.8.9-all.jar

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\gson-2.8.9-all.jar
Size 252KB
SHA256 d3999291855de495c94c743761b8ab5176cfeabe281a5ab0d8e8d45326fd703e
MD5 e67627f67e03301092dc7de0a2d7cef8
SHA1 8a432c1d6825781e21a02db2e2c33c5fde2833b9
SHA512 46501e4dd34c9a6f33ff63aeeec45b049579365c5273490e5dfd5ea4effaeced907d0fc728204c619aa136e867ad826204582ff9ba3080d06693c1c675c8473f
SSDEEP 6144:mgn0WOOUZUBGvC+XHDMa+f9DB24I3fKJfd2RszIyXi:mmXOOpwC+X9+f9DZfs2IyS
TLSH
T13744BF67799589DEE80F887F40458013F8ACE4FDD64EF11B06F045898863E8D9B16BEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

guava-31.0.1-jre-all.jar

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\guava-31.0.1-jre-all.jar
Size 2.8MB
SHA256 d5be94d65e87bd219fb3193ad1517baa55a3b88fc91d21cf735826ab5af087b9
MD5 bb811ca86cba6506cca5d415cd5559a7
SHA1 119ea2b2bc205b138974d351777b20f02b92704b
SHA512 c8d8aa38e6fb04c409c37922efcbbe182f65156a853f691d8381d56eea208adf22f7a28873bb7895210e41857dd4411aaf952682a2692051220e281910d0798f
SSDEEP 49152:NScdDul0hTPa+VB5HtMQjP23PUM69tuTNwHVk4znE34fFPdytK1mXxtpCArZQ17y:EchuGdyANMQGd69Epu64znbN2D
TLSH
T103D5C0977DECD43AFA4BD97380B1E17D3C194B6DD005A81711B416AA08A2C9E1F06BFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

httpclient-4.5.13-all.jar

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\httpclient-4.5.13-all.jar
Size 762KB
SHA256 6fe9026a566c6a5001608cf3fc32196641f6c1e5e1986d1037ccdbd5f31ef743
MD5 40d6b9075fbd28fa10292a45a0db9457
SHA1 e5f6cae5ca7ecaac1ec2827a9e2d65ae2869cada
SHA512 3567739186e551f84cad3e4b6b270c5b8b19aba297675a96bcdff3663ff7d20d188611d21f675fe5ff1bfd7d8ca31362070910d7b92ab1b699872a120aa6f089
SSDEEP 12288:NmjM46szuytdXV3UaftwJEAV4+bcYroWxk11cg+p9OB3p:NUM4hHdF37VdA6qrookUBEp
TLSH
T15CF4C0ADF5A4B069E6178131C94255ABF47E8488E0879057B8BC1E3EC8F0DC56F06BED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

httpcore-4.4.13-all.jar

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\httpcore-4.4.13-all.jar
Size 320KB
SHA256 e06e89d40943245fcfa39ec537cdbfce3762aecde8f9c597780d2b00c2b43424
MD5 e07a248f61c52776a2366c075dcd4963
SHA1 853b96d3afbb7bf8cc303fe27ee96836a10c1834
SHA512 23430cde8b9bed33c91474ba49f1143284135df1b25fdcbc37bc3bb7e9549e77b3918eb40250093db652ae200367e87316129b23b4f6987e94939d60f467498d
SSDEEP 6144:vZnbouHwyCvVRWP7iXSIZ85HYKKpbNl1k3lPvepHDlZMrBAasrmNi7A:vZn5Hwt3WP7iXq5HYSlPvepHPdat
TLSH
T15C64AEADF9E06029E7035431D94265FBF83E809CD547A1D735FC0A4798B4A84AF0FEA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

j2objc-annotations-1.3-all.jar

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\j2objc-annotations-1.3-all.jar
Size 8KB
SHA256 21af30c92267bd6122c0e0b4d20cccb6641a37eaf956c6540ec471d584e64a7b
MD5 5fa4ec4ec0c5aa70af8a7d4922df1931
SHA1 ba035118bc8bac37d7eff77700720999acd9986d
SHA512 51ea975179f809cb260751d11a513881b643bf016d15949bcb63b57d3c8868a2197e0620ccbaa5739e032797ec6faa3aa6d64606e999fce32930314780ca4115
SSDEEP 192:Z6XofCki4/RcMgS+JFEGFDOMHfYqzQzKRosZDrjq:Zuof/cnFFEuOMHfY3eo+q
TLSH
T13C02F9E33504A1AAFE5E4833679506927C3E50D8A1C92330A9792CB27927C5D7F6E48F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafx-base-17.0.2-all.jar

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\javafx-base-17.0.2-all.jar
Size 302B
SHA256 453e4ad3467094f3fcc0c2b6037994cb067593f91922a20207580a7f3d53b71c
MD5 9add7713ad33522755719ce1766c6f96
SHA1 ca46f15a306175ac1513211e1d190a5baacd77cc
SHA512 784f69dfcd2c7aba493dae1ad5ecd91b710221f65b32a0f4e463b2c97aa7c10e44d4a74183b63fe153c75bdfd63068e9f58e0bb1f603fc3bf32214e46dc21b83
TLSH
T137E05EBC2BD6C85AE32C57F767B3756B663A814C064E0252111C6B503A2C5C51E83C18
MD5 SHA1 SHA512 TLSH

Submit Download

javafx-controls-17.0.2-all.jar

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\javafx-controls-17.0.2-all.jar
Size 306B
SHA256 d7c94677a4e1bd68c7686081233b3d0426a0d345dfedef9d45adb19c31ec2672
MD5 517d4f568d297ece0a2ee9da08ded2aa
SHA1 f52640ea07a0d7fe2ac8b9f945ec58fa22ac1afd
SHA512 eda43323b91829156ade43e615de129b723d72d971e49d4b7463cf289b4ca95792b8f36d4715d86c0200d482cbf9a8987c2f6fa7f538533864a5e53d0d2cf59f
TLSH
T18EE02B7917D0C422E36EA3F3E271711B983A9088052F0341411EAA15162D4C00D83C10
MD5 SHA1 SHA512 TLSH

Submit Download

javafx-graphics-17.0.2-all.jar

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\javafx-graphics-17.0.2-all.jar
Size 306B
SHA256 6c8df43a15129977cb3cd98faf30eecbf29a52d18862cefbd28428fa132a1847
MD5 45ffe440c901e99b2d66593df9ba3ed6
SHA1 1eb7ce07e07ccc2fcb26103f07535e72069519d6
SHA512 844ebe191e83022a7e0a3b5c9b342b688e91644967596b283244d5c6674ad29f6daca5206256001e2f2d654a4e8dec8faf7aa56265db50e6041acc37d6757a01
TLSH
T18FE02BB816D0C423E32CB2F15271631F553E0008150F1241110D5974252D4C40D43D84
MD5 SHA1 SHA512 TLSH

Submit Download

javafx-media-17.0.2-all.jar

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\launcherLibraries\javafx-media-17.0.2-all.jar
Size 303B
SHA256 dec1f1c645df549bfb453f34c074bd9cbcdb7441a0568630f4d2b52b3915f9fd
MD5 013840758a39068abdaeb6cd090757bb
SHA1 0b74a915a6f2790ca1387aff211b92c699ea631f
SHA512 4f2baa41beb9a2447ace130f2bf3670b1ee61c5da976ef1c07d38a31974a8ef4466600f3dd74ed6940f2083d6c5ee0434d83b6ec38377038dfd229c811ae761f
TLSH
T147E097BC2FD3CCA1E26C13F32371A56B66BF8768D24E03829508AA207A3C5C00EC3C00
MD5 SHA1 SHA512 TLSH

Submit Download

java.dll

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\java.dll
Size 141KB
SHA256 7a66cc03683eda0c2a9f23dbabb4ee4a42252ece743ad5fee60fc1f74f15abb2
MD5 38111e5139434cf879a94e702376fd81
SHA1 995d5f3fae928818ed0ce0c253dde966c95850ca
SHA512 9a6272b13c34d39a692df82e84a0937e33258318b664162884f0389392e6b47be72cd4c79b865a870590f567f21b4bc155e3cd570da9a3ab94a9d427ae7e2b45
SSDEEP 3072:loZ6DsxFuruWMmLu9DqRZg1P0BuqYnG0gm0BoNr+PUCqtYJ:KIIurKkguBzBvwta
TLSH
T1C9E33A0BB30240A3F45AB2B8701A850BD37A74A1502C93BE43E58A9F9F6F7317D97795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\java.exe
Size 47KB
SHA256 fafa615b1e9c3732cd0976563cf630ac316f795807567fdf0b812ea1c5a5f972
MD5 8d86c867407b649ce70d9b205f6680e0
SHA1 cd67d2487802c9a912662f80f1027345365bc35b
SHA512 db3c22ebb82a09f257f5e869983dd9d355e20f26784f7818f1e393ece179c8550962c16060fd5622a6ee3eeaa9be6ba6da2ada6b7563cc6fa64b2f8be55b7bcc
SSDEEP 768:7ilFWM5R2TyJ5R3s8D/bkt5Ruz3Vb3G25hDv1y5MP:7iyM5RdJ5R3sozkt5RA3G25hv1qMP
TLSH
T108236D87AA182C82F11B84F04467B9571978BE172BD173BA6DCAF31E0C713D19817A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\javaw.exe
Size 47KB
SHA256 aabc670f4aad59906236a0aa4e465c9f8b65ac86a15c6d0a2eae950890e8c693
MD5 ff2d3a19fe47fa88419716c79ac3e7c1
SHA1 506d95d54b49fb4ef021274605d62bb514b2b24a
SHA512 130562020d250c3e7ff18801f931a69371b6c7e858a0c294b0408b096e19fce300ed6bf1d3c07ce59e5f4ccec9f67fd304fa9bf29efcf6a455d30fcec53d3ad9
SSDEEP 768:4Vu2AM5R2TyJ5R3s8D/bkt5Ruz3Vb3385cDvC+7y5G:4WM5RdJ5R3sozkt5RA3385mvh7qG
TLSH
T195235D87AA182C82F12F84F04467B5571578BE132BD172BA6DCAF21E0C723D1D82769F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jimage.dll

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\jimage.dll
Size 31KB
SHA256 b0060bd198f6f721b098b8305c9f257adeccf68eddfa2e7a59f831f2131f736e
MD5 e4cbd8fd2e2c55a531a0699f4ee82e0b
SHA1 deeabbeccedd12279536dcf3f0dd928b05937914
SHA512 0e6e290fb4870e2264b358d2232d9b5a28e08964e25da8085718589181b7a225b8487bf99c180acf6c3e22c1c8726540acf26a2b35a5c24130cf80a4b3daec24
SSDEEP 384:pZPLu5NXUonW52XYiL0CzDL85KvLyabWymD/HRN7PIrl8gC/q4:pM1nWH9aLlvL/mDv9h
TLSH
T183E27C46EB585957C57BF174C1ABDA0BF979F6925F20838B1B11939E0E333C0AB1830A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jli.dll

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\jli.dll
Size 84KB
SHA256 eebb77c2c07cd19c6c168fd0ea09698f45b711658a3fb782fbf78b28af3cfda9
MD5 ce96e51eddd76d8ca575746f0d63fac6
SHA1 3d3f8258eb7fb5ad89b631cceca15477f9f6c0e6
SHA512 4a67ab3baca5725f4af8bfdb2ad240d4daf65cd03b61a180732b467b8c6e12dad4b3362c51332a27bddff94b15660a07481be85fe4d5428a603aa77e3827384a
SSDEEP 1536:bT+KCc/hBEM+hR7PG4akVRIOGNwnToIf2AytGGUcvrX:X9z/hbKRZN7YETBf2RgGUq
TLSH
T1B9839D9B57A010E2DEB284B9C670D50BD7F5F0572621934F03ADC9A60F637A27E18BD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\msvcp140.dll
Size 552KB
SHA256 78e8a75fe76172363d6e2a8ca455a995e414d376d06e2194482ad88f7459aa8d
MD5 f062fc66916d97955b1cae44f4de7844
SHA1 a726b68ae22c302be2a9c6f36158b261af2d3140
SHA512 a1b3707c061aa5833396a2a8e2ef46cffc621af99b3d2bcd570bedf6a4ab96bd2464587c5ccf962239c2974caf4882e7729f13f025b0c03ca52bc0fc7ef2a56d
SSDEEP 12288:d/Wn7JnU0QUgqtLe1fqSKnqEXG6IOaaal7wC/QaDWxncycIW6z/yjQEKZm+jWodk:BN59IW6z/8QEKZm+jWodEEYD
TLSH
T18BC41923B75D05E0E195A3B8A1838305D7F07C4A8312A3C792FB969D2F673D56B3B190
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\net.dll
Size 93KB
SHA256 dfef189785804970ed46cea809788398136fd6b07eb52ff95a5f7286d8c66eb2
MD5 a0e62ab9b86e3f73f8e98b05fd248b6b
SHA1 19d0671bd3c4e50168fb483123e5115cb0fbbf80
SHA512 eb24a24adcd06a282582da3d7f4e0ef980c405d8219b11e5278ce653517ce4d9422ee45bd9d833cc7a7d22b934a379e2eff03f960bf677dff5176e2c54a99ebf
SSDEEP 1536:3GOolf7rb1a1HkXM0rLbp0ZLlbjzbBeaFSEJsEM1Kcha40Zzhm0D3mvFT:3vqD41HWM0vbp0hpjIpEJUKc70Xm0jQT
TLSH
T1EA935A05A36820CAFC77D2B8C6468217D7B3B4712610939F13B6CA5E6FAB7B13E19741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nio.dll

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\nio.dll
Size 76KB
SHA256 b573c12c57e52f8fb0b959403a5d8f35b10da61c8ff007f194d5e9bf628807a5
MD5 20ff398354be25f4bf06885cabdd72ba
SHA1 e95718876f4c0833224bc36f038211ab3e630218
SHA512 14e247e541d1d778c7ff61e78563e5660fc2e6215531af16cdb73967fe7f040b48ef90a3608cac97de29c5661a121b6d4bce96fe13c546043f31e8eaa161c401
SSDEEP 1536:2EtIrrWUXU92tjFy4ksdTQ3zk8G0hJJyUpvJ:2EtvAU92Fy4Zd03z3hJMU
TLSH
T1767339A69374849BE82A7138825A5787F632FC515510A35F0328DB655F2F3B33E3E782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

classes.jsa

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\server\classes.jsa
Size 12.0MB
SHA256 b6048262ea0105fe150df9251695a0c0040f300a9cbd6a82743a397aa8c030bb
MD5 21a39604169e0573f840d59aaa53e1f7
SHA1 ccc50e0787d86bf9fa6e8d53d57b37e75c56913b
SHA512 19100c29240b0f85d5b7a3efc28f6a9540e4fba3276a5ceade937a8b8ef0548213bb1ec43731b855a20579fe469f2edb65738e1d9f95e3cbe24610f37531de27
SSDEEP 196608:oCaA9I3z+qnTOZUUc0AKgT93z1f5AUHj0:1TI3z+qnTOZUUc0AKgT93z1f
TLSH
T141C6F617F6809DA3E938867788A743906331E8659B038F473748E37EEDC32D58E566C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\server\jvm.dll
Size 12.0MB
SHA256 321361921d63e2f13a2f13d8a74ce7d72f6aed1f157be5d5aa2a3a50006833fd
MD5 6f8d2dd56671d1b96d4ec752cb326b85
SHA1 66aac967cff1463a3d65823d56065e10d75109ee
SHA512 b71e573a5378f564524fe186e507d55a9e65e9dad98190381acad922723af42700d959656ddb028e746b7dad9e84f38e5443cf5e7ece31a7afdfbeb21f8edf88
SSDEEP 393216:ZuAtCYw/ZUaEqRMS4sYDp6pwhv4boZNg+xYZz3hzU2ysXSUTk8p1aP14zkd5Rqvd:Zz0
TLSH
T143C67C6AA7B440D5D06BD178C61B9A0BE7F3B4649770D7DB10B8065E2F23BE1663E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svml.dll

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\svml.dll
Size 847KB
SHA256 d8cb9603e4fec3ac5b77130c4932bc113cbd95a38bd284abb4319fa6d5451aee
MD5 98817cdd235d859cc482725af2b32b0b
SHA1 a9c3779a493775c0f96a9ac71267f7a72a82bada
SHA512 64719489e7e03327ca0385aa82fbc5c8c31bb1b3a33ee11ec3cbbfad85e5e329b8330ded639ce0062875cef9334604375511896c94c69801d453e775dd7a36dd
SSDEEP 6144:cae+9H9S3FrAEsSAZqM5mvw6cPi/yJJzD0N5eqxeymYUB/VAA1SMNsFV5JRV+SM7:99SSusbiyc5eaZy/V71AVNV+Ssc3C
TLSH
T19305AF83F81285CDC03134B014BFBD95A92A1CE9857C0E732772AF8D2AF9B467957A74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\vcruntime140.dll
Size 94KB
SHA256 70128415dae505b4bd7e3b63e82355dd4bd783226363a7b58b01145afef94e76
MD5 e41f7041c95a33c5a6e02048232d1246
SHA1 8f1f3865281e80f099087e1cb395a8803fa51bc9
SHA512 cd17b910468dd4cc3e220c05cd64318c41bff46d67d0a5320aff2ed7a95621df43707249f2dd5dabf813400b5d57edf183ee144942779102ec427c04bf2b1302
SSDEEP 1536:yZHLG4SsAzAvadZw+1Hcx8uIYNUzUnHg4becbK/zJr3vwf0:yZrfZ+jPYNznHg4becbK/FrH
TLSH
T143936B4A76A442BBD06BD274C1A34A1AF770B8408B3093CF07B646AA5F67BE05E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\vcruntime140_1.dll
Size 36KB
SHA256 52beaeed839f64a6b3796ff1233f1215bdf9582dd427b82ccd91b56c44d52644
MD5 fcda026792268accd2a47f3cfb66debf
SHA1 66d406b0f27f62f0d29e3e6dcc90935db3e9595d
SHA512 3d33cd6e97c59dbe4b3f531b8c4144b111462c07460a014259578ab8f3319ac821ccea9de2e9a5929c86533922dec17aa8a69e4e0c96e5311e5a24589fafb191
SSDEEP 384:5SnvMCmWEyhUcSLt5a9k6KrOE5fY/ntz5txWE6Wc+XfbmuncS74GdWrUKWeD/HRg:7Cm5yhUcwrHY/ntTxT6ovR7VCDvWjn
TLSH
T17AF24B8467788096E06B95B4C4A35F27FE38F9615750938F0BA4819D2F637D0E63E31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\bin\zip.dll
Size 83KB
SHA256 fed1d03f0a4e5846c1e69a1b0d4df8db9832fe6e7a4dcdc944b8880740b3316a
MD5 52516d2bb7fcae734a142426685c5b56
SHA1 ee20f8f0b1293460b6b9c0ee115d594dc02ab6f5
SHA512 ce47262718f13e7fc4bb419608f054f1866bc904a0e51b272d1efa342e3ae574f79f4c47af7ac2c395dba57d86cc707302c9bccaa561da0e21d4a846b876ad73
SSDEEP 1536:O4mz9aQNPw2U42VOKWXIOQIOgDnToIfq208YvbG:O4mz9aQxwM2VOr5GgTTBfq2x7
TLSH
T1C8838D8289B05292CEFA55B0C5E28A2FD778B0521290574F539CDB9A2F037A17F583FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.security

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\conf\security\java.security
Size 56KB
SHA256 38166a975348862d693d95de8d676cf19cecccc45af4a1896c73c45f7bd966ef
MD5 00cf40959861f61f17b90c6b6002a9a1
SHA1 982e48466428e1f49c1a5941c73afdacefd1d22e
SHA512 bad90152685279d896a4063d76dec5befe14831d3dd3260929b9a639505e898fa996b52aab3821a51c6c9aa09d956a23a8bdd870377a10e75c9399629cab5779
SSDEEP 768:rfBzVIMtipMfSSvAOUjt1p+SiIj4sjyaF/IJnoIqHihz3oFoBfCDqrsoZ9d5eDF:rIMy8SCAOUjt1p5/jCG/UoQhzYKpNnCF
TLSH
T10743D422BB897B710AF211A363AEF1D9E76DA12A36721150748D420C7326F71C3776E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_US_export.policy.tmp

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\conf\security\policy\unlimited\default_US_export.policy.tmp
Size 146B
SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
MD5 1a08ffdf0bc871296c8d698fb22f542a
SHA1 f3f974d3f6245c50804dcc47173aa29d4d7f0e2c
SHA512 4cfca5b10cd7addcff887c8f3621d2fbec1b5632436326377b0ce5af1ae3e8b68ac5a743ca6082fc79991b8eec703a6e1dfd5b896153407ad72327753222fdb3
TLSH
T178C02B07BB17D0F800D0EF4617B57916B1701E89B0A1121CFA00C2A41EDC6108330394
MD5 SHA1 SHA512 TLSH

Submit Download

ADDITIONAL_LICENSE_INFO.tmp

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\legal\java.datatransfer\ADDITIONAL_LICENSE_INFO.tmp
Size 49B
SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
MD5 19c9d1d2aad61ce9cb8fb7f20ef1ca98
SHA1 2db86ab706d9b73feeb51a904be03b63bee92baf
SHA512 7ec63b59d8f87a42689f544c2e8e7700da5d8720b37b41216cbd1372c47b1bc3b892020f0dd3a44a05f2a7c07471ff484e4165427f1a9cad0d2393840cd94e5b
MD5 SHA1 SHA512

Submit Download

ASSEMBLY_EXCEPTION.tmp

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\legal\java.datatransfer\ASSEMBLY_EXCEPTION.tmp
Size 44B
SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
MD5 7caf4cdbb99569deb047c20f1aad47c4
SHA1 24e7497426d27fe3c17774242883ccbed8f54b4d
SHA512 a1435e6f1e4e9285476a0e7bc3b4f645bbafb01b41798a2450390e16b18b242531f346373e01d568f6cc052932a3256e491a65e8b94b118069853f2b0c8cd619
MD5 SHA1 SHA512

Submit Download

LICENSE.tmp

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\legal\java.datatransfer\LICENSE.tmp
Size 33B
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
MD5 SHA1 SHA512

Submit Download

jvm.cfg

Path C:\Users\Admin\AppData\Roaming\Crystal-Launcher\runtime\64\jdk-17.0.1+12\lib\jvm.cfg
Size 29B
SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
MD5 7ce21bdcfa333c231d74a77394206302
SHA1 c5a940d2dee8e7bfc01a87d585ddca420d37e226
SHA512 8b37a1a5600e0a4e5832021c4db50569e33f1ddc8ac4fc2f38d5439272b955b0e3028ea10dec0743b197aa0def32d9e185066d2bac451f81b99539d34006074b
MD5 SHA1 SHA512

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 12KB
SHA256 da9c4ee6ffa666aa4b08f6984ed46d0b7b136043bbd4a887c3d1cc187a121d9b
MD5 5044ab5a105e6884977cc3711d7a1c2c
SHA1 602c158d16ac94f6a79551ef13e763a8900b2116
SHA512 38eb3ab21a40aec9eab43c3a440897012c21782eb90c927412d78f28a988b7b4f2a4e59aada7820db4a1af341fdd2b9b9b01d0789578ef64b804021c0e2da411
SSDEEP 96:afJvuEHOfJWQgFR3UTzwoOg/QCc1JNRbbRNuEHOfJvuEHtMJruEHBmlJnIuEHs:WlcjARwD+zRbbRNElo54BIC
TLSH
T16042FE042BFB0519F2F3EE71AAF67B269E3AFD154A18465E008042061D72F05DE6EB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 10KB
SHA256 ac882ee994682b63a05b54f3280d7da46da603fa94ac2576c5fffb1717228625
MD5 9721d7b041394002943fa35850694987
SHA1 cc1d2ab77cf5272080528dfa1bdaabb3fc53ada0
SHA512 8a2ea289e0edb06b3c7ef4d315f7e0f73b9a8f88b78028e0fbac48794462527ba21d22f555a55a1f9734cad34eb3d6c77bc4918fbc4b37e941a67951c0c92d0f
SSDEEP 96:HRJvuEHSfJ2Gu9toFHAT7T+pucZuEHlMJruEHBKlJnIuEHs:xl0e9toFHAL+fk50BIC
TLSH
T1D222FD042FE71529F1F2EE71E5F27725AB3AF91A1E144A5E008043051D32E45DEAEBB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrystalLauncherN.zip.crdownload

Path C:\Users\Admin\Downloads\CrystalLauncherN.zip.crdownload
Size 1.6MB
SHA256 db572b6d085f845624e223e11d190ab17674b392d252b9d838ad285b7913f256
MD5 29e88eaf2f855ec1921ae6fbef531b96
SHA1 7ecd3d4b08b8dfcb8edff661faeec78fec620fb2
SHA512 ab1a9f35d02b24a702ef0b45ea2d001e8a86cf0e7e8fa21faef0eb8688f697afc1f04cb5fa94879621c066293021c47b18be68e58b5766b6fc1f6506f5369ad5
SSDEEP 12288:UBChVyzNndzFWPYhv/JBdBS4msNUCe65frHMnz2R9Iyev5whgCa:UohondzFWPM/bdo4mz1U8z2MyevjCa
TLSH
T1857571841A6AC913DA78C7FF8C6E39FEF2715C11B186D7DE0640B4A534D9E80A7812DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_Crystal_Launcher.exe

Path C:\Users\Admin\Downloads\CrystalLauncherN\Install_Crystal_Launcher.exe
Size 1.6MB
SHA256 041344a56eecc303e538698321e0d1bd4c0e765691300b699e8d89bcf39dcb4b
MD5 2bcf8f6eda4deab1666f98ddb6bc974f
SHA1 75b48b1480e7aada99f333684f78af61f2a2aa45
SHA512 1850bfc9fa97a07072297bce46afd148b7fd645b46c13da6c803187785082394584062c532006c285e4ad4b0e5d89f3670a4a999e48fdbe923eb8b6d6a623cdc
SSDEEP 12288:BBChVyzNndzFWPYhv/JBdBS4msNUCe65frHMnz2R9Iyev5whgC:BohondzFWPM/bdo4mz1U8z2MyevjC
TLSH
T1677571841A6AC913DA78C7FF8C6E39FEF2715C11B186D7DE0640B4A534D9E80A7812DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crystal.clkey

Path C:\Users\Admin\Downloads\CrystalLauncherN\crystal.clkey
Size 64B
SHA256 52d5dc94b8b923ad717d22d567b8b7168e72d161c12c5105dafbca9ae12faae9
MD5 244e5ad668bdd666d18ba8cdc012b673
SHA1 70b6d8798f18b542e99ddb3b87b280484f170087
SHA512 9a33ee15c38edbee04bef62b1623217272b69fe2a2ba2b05c73227151f52d91b72d82609ba3842cce48517cbad7d1df8b0dac3cb033cf78ea03909083976c8e7
TLSH
T107A0222822223AAC832C8032800832A0282E300A8B0EC8000C2AAA3000A20A23A23F00
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4800-3-0x0000026A0D300000-0x0000026A0D378000-memory.dmp

Download

memory/4800-1-0x0000026A0D380000-0x0000026A0D390000-memory.dmp

Download

memory/4800-4-0x0000026A0D390000-0x0000026A0D3A8000-memory.dmp

Download

memory/4800-21-0x0000026A0D380000-0x0000026A0D390000-memory.dmp

Download

memory/4800-20-0x0000026A0D380000-0x0000026A0D390000-memory.dmp

Download

memory/4800-19-0x0000026A0D380000-0x0000026A0D390000-memory.dmp

Download

memory/4800-0-0x0000026A0CDC0000-0x0000026A0CF52000-memory.dmp

Download