Overview

overview

8

Static

static

3

download.exe

windows7-x64

8

download.exe

windows10-1703-x64

8

download.exe

windows10-2004-x64

8

download.exe

windows11-21h2-x64

8

Resubmissions

25/09/2024, 10:15

240925-mah9eazdjk 8

19/09/2024, 16:05

240919-tjgkhaxdjh 8

Analysis

  • max time kernel
    302s
  • max time network
    302s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    25/09/2024, 10:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    download.exe

  • Size

    67.1MB

  • MD5

    7d658964c1874ca902f3dc0864b00a3c

  • SHA1

    c972667622f44e4cb93a2fc7d9f1a0dc1cbb5edf

  • SHA256

    100565864eed928d474d1912b9de2f124a2e94f312a454922b4ccdff36860fba

  • SHA512

    28adf2797b6acc971d67f75bc2c8ea90693c68e62732f1f5986561b0b9bfc60d0ca4495f6547057a046286328c6a25268c07aadbe5cdacf246ddbbb0c8de086f

  • SSDEEP

    1572864:AK93N+NLkIzv7Bc6hrd3L/HGuIa31UwAQEKhSzqYA8nfndf:AU9+NC69N/muIq1ULQE4SpFf

Score
8/10
discoveryexecutionpersistence

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 46 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 9 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry key 1 TTPs 58 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\download.exe
    "C:\Users\Admin\AppData\Local\Temp\download.exe"
    1⤵
    • Drops file in Program Files directory
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1656
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -c Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\nsy92AF.tmp\"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2184
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -c Add-MpPreference -ExclusionPath \"C:\Program Files\Kryptex\"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1840
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -c Remove-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\nsy92AF.tmp\"
      2⤵
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1724
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /delete /f /tn KryptexElevation
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2972
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /delete /f /tn KryptexElevationFromStartup
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2976
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /tn KryptexElevationV2 /xml "C:\Program Files\Kryptex\KryptexElevation.xml"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2244
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /tn KryptexElevationV2FromStartup /xml "C:\Program Files\Kryptex\KryptexElevationFromStartup.xml"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2160
  • C:\Program Files\Kryptex\Kryptex.exe
    "C:\Program Files\Kryptex\Kryptex.exe"
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks processor information in registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2632
    • C:\Program Files\Kryptex\Kryptex.exe
      "C:\Program Files\Kryptex\Kryptex.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Kryptex /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Kryptex\Crashpad --url=https://f.a.k/e --annotation=_productName=Kryptex --annotation=_version=4.44.2 --annotation=prod=Electron --annotation=ver=14.2.9 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2e8,0x2fc,0x147028a38,0x147028a48,0x147028a58
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2752
    • C:\Program Files\Kryptex\Kryptex.exe
      "C:\Program Files\Kryptex\Kryptex.exe" --type=gpu-process --field-trial-handle=1076,11521808900237572767,11769435166727064365,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --user-data-dir="C:\Users\Admin\AppData\Roaming\Kryptex" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1080 /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:344
    • C:\Program Files\Kryptex\Kryptex.exe
      "C:\Program Files\Kryptex\Kryptex.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1076,11521808900237572767,11769435166727064365,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Kryptex" --standard-schemes --secure-schemes --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=1304 /prefetch:8
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:2028
    • C:\Program Files\Kryptex\Kryptex.exe
      "C:\Program Files\Kryptex\Kryptex.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Kryptex" --standard-schemes --secure-schemes --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Program Files\Kryptex\resources\app.asar" --no-sandbox --no-zygote --field-trial-handle=1076,11521808900237572767,11769435166727064365,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1500 /prefetch:1
      2⤵
      • Adds Run key to start application
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1688
      • C:\Windows\System32\Wbem\wmic.exe
        wmic os get locale
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1464
      • C:\Windows\system32\reg.exe
        reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
        3⤵
          PID:1524
        • C:\Windows\system32\reg.exe
          reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
          3⤵
          • Modifies registry key
          PID:2288
        • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
          "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
          3⤵
          • Executes dropped EXE
          PID:2616
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "chcp"
          3⤵
            PID:2672
            • C:\Windows\system32\chcp.com
              chcp
              4⤵
                PID:2548
            • C:\Windows\System32\Wbem\wmic.exe
              wmic os get Caption /value
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2524
            • C:\Windows\System32\Wbem\wmic.exe
              wmic os get SerialNumber /value
              3⤵
                PID:2468
              • C:\Windows\System32\Wbem\wmic.exe
                wmic os get TotalVirtualMemorySize /value
                3⤵
                  PID:1844
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%%%PCI%%%%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress"
                  3⤵
                    PID:2236
                    • C:\Windows\System32\Wbem\WMIC.exe
                      wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%%%PCI%%%%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress
                      4⤵
                        PID:1040
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%%%PCI%%%%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress"
                      3⤵
                        PID:1816
                        • C:\Windows\System32\Wbem\WMIC.exe
                          wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%%%PCI%%%%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress
                          4⤵
                            PID:1920
                        • C:\Windows\System32\Wbem\wmic.exe
                          wmic pagefile get AllocatedBaseSize /value
                          3⤵
                            PID:2676
                          • C:\Windows\System32\Wbem\wmic.exe
                            wmic logicaldisk where Caption='C:' get FreeSpace /value
                            3⤵
                              PID:1580
                            • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\pagefile\build\Release\pagefile.exe
                              "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\pagefile\build\Release\pagefile.exe" 16 16
                              3⤵
                              • Executes dropped EXE
                              PID:852
                            • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                              "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe" setPageSize 2
                              3⤵
                              • Executes dropped EXE
                              PID:2036
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers /v TdrDelay /t REG_DWORD /d 0x14 /f"
                              3⤵
                                PID:592
                                • C:\Windows\system32\reg.exe
                                  reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers /v TdrDelay /t REG_DWORD /d 0x14 /f
                                  4⤵
                                    PID:1864
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /d /s /c "reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers /v TdrDdiDelay /t REG_DWORD /d 0xa /f"
                                  3⤵
                                    PID:1140
                                    • C:\Windows\system32\reg.exe
                                      reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers /v TdrDdiDelay /t REG_DWORD /d 0xa /f
                                      4⤵
                                        PID:1792
                                    • C:\Windows\system32\reg.exe
                                      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                      3⤵
                                        PID:1836
                                      • C:\Windows\system32\reg.exe
                                        reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                        3⤵
                                          PID:3016
                                        • C:\Windows\system32\reg.exe
                                          reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                          3⤵
                                          • Modifies registry key
                                          PID:1644
                                        • C:\Windows\system32\reg.exe
                                          reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                          3⤵
                                          • Modifies registry key
                                          PID:1908
                                        • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                          "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                          3⤵
                                          • Executes dropped EXE
                                          PID:1524
                                        • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                          "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                          3⤵
                                          • Executes dropped EXE
                                          PID:1880
                                        • C:\Windows\System32\Wbem\wmic.exe
                                          wmic os get Caption /value
                                          3⤵
                                            PID:2644
                                          • C:\Windows\System32\Wbem\wmic.exe
                                            wmic os get SerialNumber /value
                                            3⤵
                                              PID:2480
                                            • C:\Windows\System32\Wbem\wmic.exe
                                              wmic os get TotalVirtualMemorySize /value
                                              3⤵
                                                PID:2484
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /d /s /c "wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%%%PCI%%%%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress"
                                                3⤵
                                                  PID:2240
                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                    wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%%%PCI%%%%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress
                                                    4⤵
                                                      PID:1044
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /d /s /c "wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%%%PCI%%%%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress"
                                                    3⤵
                                                      PID:2352
                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                        wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%%%PCI%%%%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress
                                                        4⤵
                                                          PID:2072
                                                      • C:\Windows\system32\reg.exe
                                                        reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                        3⤵
                                                          PID:308
                                                        • C:\Windows\system32\reg.exe
                                                          reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                          3⤵
                                                          • Modifies registry key
                                                          PID:1888
                                                        • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                          "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                          3⤵
                                                          • Executes dropped EXE
                                                          PID:2736
                                                        • C:\Windows\system32\reg.exe
                                                          reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                          3⤵
                                                            PID:1224
                                                          • C:\Windows\system32\reg.exe
                                                            reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                            3⤵
                                                            • Modifies registry key
                                                            PID:1580
                                                          • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                            "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                            3⤵
                                                            • Executes dropped EXE
                                                            PID:852
                                                          • C:\Windows\system32\reg.exe
                                                            reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                            3⤵
                                                              PID:2104
                                                            • C:\Windows\system32\reg.exe
                                                              reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                              3⤵
                                                              • Modifies registry key
                                                              PID:2740
                                                            • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                              "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                              3⤵
                                                              • Executes dropped EXE
                                                              PID:2864
                                                            • C:\Windows\system32\reg.exe
                                                              reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                              3⤵
                                                                PID:2260
                                                              • C:\Windows\system32\reg.exe
                                                                reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                3⤵
                                                                • Modifies registry key
                                                                PID:2256
                                                              • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                3⤵
                                                                • Executes dropped EXE
                                                                PID:2300
                                                              • C:\Windows\system32\reg.exe
                                                                reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                3⤵
                                                                  PID:2932
                                                                • C:\Windows\system32\reg.exe
                                                                  reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                  3⤵
                                                                  • Modifies registry key
                                                                  PID:2620
                                                                • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                  "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  PID:1648
                                                                • C:\Windows\system32\reg.exe
                                                                  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                  3⤵
                                                                    PID:2876
                                                                  • C:\Windows\system32\reg.exe
                                                                    reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                    3⤵
                                                                    • Modifies registry key
                                                                    PID:1440
                                                                  • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                    "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    PID:2360
                                                                  • C:\Windows\system32\reg.exe
                                                                    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                    3⤵
                                                                      PID:1672
                                                                    • C:\Windows\system32\reg.exe
                                                                      reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                      3⤵
                                                                      • Modifies registry key
                                                                      PID:1976
                                                                    • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                      "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                      3⤵
                                                                      • Executes dropped EXE
                                                                      PID:2216
                                                                    • C:\Windows\system32\reg.exe
                                                                      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                      3⤵
                                                                        PID:2504
                                                                      • C:\Windows\system32\reg.exe
                                                                        reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                        3⤵
                                                                        • Modifies registry key
                                                                        PID:1700
                                                                      • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                        "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        PID:2772
                                                                      • C:\Windows\system32\reg.exe
                                                                        reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                        3⤵
                                                                          PID:1724
                                                                        • C:\Windows\system32\reg.exe
                                                                          reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                          3⤵
                                                                          • Modifies registry key
                                                                          PID:1792
                                                                        • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                          "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                          3⤵
                                                                          • Executes dropped EXE
                                                                          PID:1416
                                                                        • C:\Windows\system32\reg.exe
                                                                          reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                          3⤵
                                                                            PID:1624
                                                                          • C:\Windows\system32\reg.exe
                                                                            reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                            3⤵
                                                                            • Modifies registry key
                                                                            PID:1628
                                                                          • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                            "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                            3⤵
                                                                            • Executes dropped EXE
                                                                            PID:2616
                                                                          • C:\Windows\system32\reg.exe
                                                                            reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                            3⤵
                                                                              PID:2436
                                                                            • C:\Windows\system32\reg.exe
                                                                              reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                              3⤵
                                                                              • Modifies registry key
                                                                              PID:2600
                                                                            • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                              "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              PID:2692
                                                                            • C:\Windows\system32\reg.exe
                                                                              reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                              3⤵
                                                                                PID:812
                                                                              • C:\Windows\system32\reg.exe
                                                                                reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                3⤵
                                                                                • Modifies registry key
                                                                                PID:1436
                                                                              • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                PID:2712
                                                                              • C:\Windows\system32\reg.exe
                                                                                reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                3⤵
                                                                                  PID:1976
                                                                                • C:\Windows\system32\reg.exe
                                                                                  reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                  3⤵
                                                                                  • Modifies registry key
                                                                                  PID:2216
                                                                                • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                  "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                  3⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:888
                                                                                • C:\Windows\system32\reg.exe
                                                                                  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                  3⤵
                                                                                    PID:2424
                                                                                  • C:\Windows\system32\reg.exe
                                                                                    reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                    3⤵
                                                                                    • Modifies registry key
                                                                                    PID:2056
                                                                                  • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                    "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                    3⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:1696
                                                                                  • C:\Windows\system32\reg.exe
                                                                                    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                    3⤵
                                                                                      PID:2972
                                                                                    • C:\Windows\system32\reg.exe
                                                                                      reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                      3⤵
                                                                                      • Modifies registry key
                                                                                      PID:1836
                                                                                    • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                      "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                      3⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:1416
                                                                                    • C:\Windows\system32\reg.exe
                                                                                      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                      3⤵
                                                                                        PID:2064
                                                                                      • C:\Windows\system32\reg.exe
                                                                                        reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                        3⤵
                                                                                        • Modifies registry key
                                                                                        PID:2832
                                                                                      • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                        "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                        3⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:1624
                                                                                      • C:\Windows\system32\reg.exe
                                                                                        reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                        3⤵
                                                                                          PID:2528
                                                                                        • C:\Windows\system32\reg.exe
                                                                                          reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                          3⤵
                                                                                          • Modifies registry key
                                                                                          PID:2500
                                                                                        • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                          "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                          3⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:2508
                                                                                        • C:\Windows\system32\reg.exe
                                                                                          reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                          3⤵
                                                                                            PID:2344
                                                                                          • C:\Windows\system32\reg.exe
                                                                                            reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                            3⤵
                                                                                            • Modifies registry key
                                                                                            PID:1740
                                                                                          • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                            "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                            3⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:940
                                                                                          • C:\Windows\system32\reg.exe
                                                                                            reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                            3⤵
                                                                                              PID:1436
                                                                                            • C:\Windows\system32\reg.exe
                                                                                              reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                              3⤵
                                                                                              • Modifies registry key
                                                                                              PID:2236
                                                                                            • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                              "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                              3⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:2052
                                                                                            • C:\Windows\system32\reg.exe
                                                                                              reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                              3⤵
                                                                                                PID:1364
                                                                                              • C:\Windows\system32\reg.exe
                                                                                                reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                3⤵
                                                                                                • Modifies registry key
                                                                                                PID:1984
                                                                                              • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                3⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:2216
                                                                                              • C:\Windows\system32\reg.exe
                                                                                                reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                3⤵
                                                                                                  PID:1604
                                                                                                • C:\Windows\system32\reg.exe
                                                                                                  reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                  3⤵
                                                                                                  • Modifies registry key
                                                                                                  PID:852
                                                                                                • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                  "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                  3⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:1480
                                                                                                • C:\Windows\system32\reg.exe
                                                                                                  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                  3⤵
                                                                                                    PID:616
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                    3⤵
                                                                                                    • Modifies registry key
                                                                                                    PID:1640
                                                                                                  • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                    "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                    3⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:2864
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                    3⤵
                                                                                                      PID:2520
                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                      reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                      3⤵
                                                                                                      • Modifies registry key
                                                                                                      PID:2832
                                                                                                    • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                      "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                      3⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:1628
                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                      3⤵
                                                                                                        PID:2512
                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                        reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                        3⤵
                                                                                                        • Modifies registry key
                                                                                                        PID:1648
                                                                                                      • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                        "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                        3⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:2180
                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                        reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                        3⤵
                                                                                                          PID:1192
                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                          reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                          3⤵
                                                                                                          • Modifies registry key
                                                                                                          PID:1520
                                                                                                        • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                          "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                          3⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:936
                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                          reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                          3⤵
                                                                                                            PID:1848
                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                            reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                            3⤵
                                                                                                            • Modifies registry key
                                                                                                            PID:2164
                                                                                                          • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                            "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:2040
                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                            reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                            3⤵
                                                                                                              PID:2760
                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                              reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                              3⤵
                                                                                                              • Modifies registry key
                                                                                                              PID:2764
                                                                                                            • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                              "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                              3⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:2340
                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                              reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                              3⤵
                                                                                                                PID:1864
                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                3⤵
                                                                                                                • Modifies registry key
                                                                                                                PID:2204
                                                                                                              • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                3⤵
                                                                                                                • Executes dropped EXE
                                                                                                                PID:2816
                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                3⤵
                                                                                                                  PID:616
                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                  reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                  3⤵
                                                                                                                  • Modifies registry key
                                                                                                                  PID:2844
                                                                                                                • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                  "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                  3⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:3064
                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                  3⤵
                                                                                                                    PID:2200
                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                    reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                    3⤵
                                                                                                                    • Modifies registry key
                                                                                                                    PID:1856
                                                                                                                  • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                    "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                    3⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:1524
                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                    3⤵
                                                                                                                      PID:2192
                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                      reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                      3⤵
                                                                                                                      • Modifies registry key
                                                                                                                      PID:924
                                                                                                                    • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                      "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                      3⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:2468
                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                      3⤵
                                                                                                                        PID:1832
                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                        reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                        3⤵
                                                                                                                        • Modifies registry key
                                                                                                                        PID:2876
                                                                                                                      • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                        "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                        3⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:2232
                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                        reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                        3⤵
                                                                                                                          PID:316
                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                          reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                          3⤵
                                                                                                                          • Modifies registry key
                                                                                                                          PID:1672
                                                                                                                        • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                          "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                          3⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:2404
                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                          reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                          3⤵
                                                                                                                            PID:1976
                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                            reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                            3⤵
                                                                                                                            • Modifies registry key
                                                                                                                            PID:652
                                                                                                                          • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                            "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                            3⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:1212
                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                            reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                            3⤵
                                                                                                                              PID:2036
                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                              reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                              3⤵
                                                                                                                              • Modifies registry key
                                                                                                                              PID:1356
                                                                                                                            • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                              "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                              3⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:2084
                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                              reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                              3⤵
                                                                                                                                PID:564
                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                3⤵
                                                                                                                                • Modifies registry key
                                                                                                                                PID:1836
                                                                                                                              • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                3⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:1532
                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                3⤵
                                                                                                                                  PID:1660
                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                  reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                  3⤵
                                                                                                                                  • Modifies registry key
                                                                                                                                  PID:2256
                                                                                                                                • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                  "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                  3⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:2800
                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                  3⤵
                                                                                                                                    PID:2436
                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                    reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                    3⤵
                                                                                                                                    • Modifies registry key
                                                                                                                                    PID:1492
                                                                                                                                  • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                    "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                    3⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:1936
                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                    3⤵
                                                                                                                                      PID:1736
                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                      reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                      3⤵
                                                                                                                                      • Modifies registry key
                                                                                                                                      PID:1556
                                                                                                                                    • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                      "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                      3⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:952
                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                      3⤵
                                                                                                                                        PID:1012
                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                        reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                        3⤵
                                                                                                                                        • Modifies registry key
                                                                                                                                        PID:1560
                                                                                                                                      • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                        "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                        3⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:2236
                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                        reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                        3⤵
                                                                                                                                          PID:1816
                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                          reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                          3⤵
                                                                                                                                          • Modifies registry key
                                                                                                                                          PID:2004
                                                                                                                                        • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                          "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                          3⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:1452
                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                          reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                          3⤵
                                                                                                                                            PID:1992
                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                            reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                            3⤵
                                                                                                                                            • Modifies registry key
                                                                                                                                            PID:2592
                                                                                                                                          • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                            "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                            3⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:592
                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                            reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                            3⤵
                                                                                                                                              PID:1796
                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                              reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                              3⤵
                                                                                                                                              • Modifies registry key
                                                                                                                                              PID:616
                                                                                                                                            • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                              "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                              3⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:2100
                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                              reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                              3⤵
                                                                                                                                                PID:2516
                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                                3⤵
                                                                                                                                                • Modifies registry key
                                                                                                                                                PID:1908
                                                                                                                                              • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                                "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                                3⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:2244
                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                                3⤵
                                                                                                                                                  PID:2800
                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                  reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                                  3⤵
                                                                                                                                                  • Modifies registry key
                                                                                                                                                  PID:1932
                                                                                                                                                • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                                  "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                                  3⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:112
                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                                  3⤵
                                                                                                                                                    PID:1804
                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                    reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                                    3⤵
                                                                                                                                                    • Modifies registry key
                                                                                                                                                    PID:1552
                                                                                                                                                  • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                                    "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                                    3⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:1832
                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                                    3⤵
                                                                                                                                                      PID:812
                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                      reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                                      3⤵
                                                                                                                                                      • Modifies registry key
                                                                                                                                                      PID:464
                                                                                                                                                    • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                                      "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                                      3⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:2352
                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                                      3⤵
                                                                                                                                                        PID:2236
                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                        reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                                        3⤵
                                                                                                                                                        • Modifies registry key
                                                                                                                                                        PID:2720
                                                                                                                                                      • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                                        "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                                        3⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:1976
                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                        reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                                        3⤵
                                                                                                                                                          PID:1212
                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                          reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                                          3⤵
                                                                                                                                                          • Modifies registry key
                                                                                                                                                          PID:2496
                                                                                                                                                        • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                                          "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                                          3⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:2036
                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                          reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                                          3⤵
                                                                                                                                                            PID:1696
                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                            reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                                            3⤵
                                                                                                                                                            • Modifies registry key
                                                                                                                                                            PID:772
                                                                                                                                                          • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                                            "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:1640
                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                            reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                                            3⤵
                                                                                                                                                              PID:1324
                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                              reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                                              3⤵
                                                                                                                                                              • Modifies registry key
                                                                                                                                                              PID:2064
                                                                                                                                                            • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                                              "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                                              3⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:1660
                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                              reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                                              3⤵
                                                                                                                                                                PID:2616
                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                                                3⤵
                                                                                                                                                                • Modifies registry key
                                                                                                                                                                PID:2512
                                                                                                                                                              • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                                                "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                                                3⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:2508
                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:1904
                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                  reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                  PID:1868
                                                                                                                                                                • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                                                  "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:1736
                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:1576
                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                    reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                    PID:2072
                                                                                                                                                                  • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                                                    "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:2248
                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:2212
                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                        reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                                                        3⤵
                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                        PID:2040
                                                                                                                                                                      • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                                                        "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:1984
                                                                                                                                                                      • C:\Program Files\Kryptex\Kryptex.exe
                                                                                                                                                                        "C:\Program Files\Kryptex\Kryptex.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Kryptex" --standard-schemes --secure-schemes --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Program Files\Kryptex\resources\app.asar" --no-sandbox --no-zygote --field-trial-handle=1076,11521808900237572767,11769435166727064365,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2196 /prefetch:1
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                        PID:2860

                                                                                                                                                                    Network

                                                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                                                    Reconnaissance

                                                                                                                                                                    Resource Development

                                                                                                                                                                    Initial Access

                                                                                                                                                                    Execution

                                                                                                                                                                    Command and Scripting Interpreter

                                                                                                                                                                    1
                                                                                                                                                                    T1059

                                                                                                                                                                    PowerShell

                                                                                                                                                                    1
                                                                                                                                                                    T1059.001

                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                    1
                                                                                                                                                                    T1053

                                                                                                                                                                    Scheduled Task

                                                                                                                                                                    1
                                                                                                                                                                    T1053.005

                                                                                                                                                                    Persistence

                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                    1
                                                                                                                                                                    T1547

                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                    1
                                                                                                                                                                    T1547.001

                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                    1
                                                                                                                                                                    T1053

                                                                                                                                                                    Scheduled Task

                                                                                                                                                                    1
                                                                                                                                                                    T1053.005

                                                                                                                                                                    Privilege Escalation

                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                    1
                                                                                                                                                                    T1547

                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                    1
                                                                                                                                                                    T1547.001

                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                    1
                                                                                                                                                                    T1053

                                                                                                                                                                    Scheduled Task

                                                                                                                                                                    1
                                                                                                                                                                    T1053.005

                                                                                                                                                                    Defense Evasion

                                                                                                                                                                    Modify Registry

                                                                                                                                                                    3
                                                                                                                                                                    T1112

                                                                                                                                                                    Subvert Trust Controls

                                                                                                                                                                    1
                                                                                                                                                                    T1553

                                                                                                                                                                    Install Root Certificate

                                                                                                                                                                    1
                                                                                                                                                                    T1553.004

                                                                                                                                                                    Credential Access

                                                                                                                                                                    Discovery

                                                                                                                                                                    Query Registry

                                                                                                                                                                    3
                                                                                                                                                                    T1012

                                                                                                                                                                    System Information Discovery

                                                                                                                                                                    3
                                                                                                                                                                    T1082

                                                                                                                                                                    System Location Discovery

                                                                                                                                                                    1
                                                                                                                                                                    T1614

                                                                                                                                                                    System Language Discovery

                                                                                                                                                                    1
                                                                                                                                                                    T1614.001

                                                                                                                                                                    Lateral Movement

                                                                                                                                                                    Collection

                                                                                                                                                                    Command and Control

                                                                                                                                                                    Exfiltration

                                                                                                                                                                    Impact

                                                                                                                                                                    Replay Monitor

                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                    Downloads

                                                                                                                                                                    • C:\Program Files\Kryptex\KryptexElevation.xml
                                                                                                                                                                      Filesize

                                                                                                                                                                      3KB

                                                                                                                                                                      MD5

                                                                                                                                                                      e584e974928f5c25896c57ab4473c7fa

                                                                                                                                                                      SHA1

                                                                                                                                                                      d0f41300aa9899cfd8cee99c5b1179764cb5b3a9

                                                                                                                                                                      SHA256

                                                                                                                                                                      9ea9d814ae35bd3f5d8603fb174342f73e7292032b0e822920be971221b98211

                                                                                                                                                                      SHA512

                                                                                                                                                                      f9dfeae6ef90eb474a16262fd2b96a22418c3249cbf8e5a8765a297d3e4e14bd504aeed093b50d6537cd40b93bb1fab5503225e4812a793eacc72f2982867d2e

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Program Files\Kryptex\KryptexElevationFromStartup.xml
                                                                                                                                                                      Filesize

                                                                                                                                                                      3KB

                                                                                                                                                                      MD5

                                                                                                                                                                      6613ead33c20d846c8a1ba281d6c9327

                                                                                                                                                                      SHA1

                                                                                                                                                                      c7be96f9d32af83f99c23f21165fe860a455fc54

                                                                                                                                                                      SHA256

                                                                                                                                                                      77de3447f0f69513af4bc08f410a28f58189234bd908e5f7d1ff5c35e0a086b1

                                                                                                                                                                      SHA512

                                                                                                                                                                      fa71a511b96628999ff1a1ac5f8aebc44c2be108a427a51e56ac4c72aec37bfda308cafd0ab12b6a55bc7f802cdd98ae7922be6ad67adf3c3bbb65b4c946bf7d

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Program Files\Kryptex\chrome_100_percent.pak
                                                                                                                                                                      Filesize

                                                                                                                                                                      139KB

                                                                                                                                                                      MD5

                                                                                                                                                                      109ee8ffd715c63e3e2248c2ad5ca559

                                                                                                                                                                      SHA1

                                                                                                                                                                      7f89b213e80e2b4f52f75b449baecb88054d5e07

                                                                                                                                                                      SHA256

                                                                                                                                                                      b581f176c6bdbf8a152947fb37af9c0e6d7651616408cb7312b336c37a704580

                                                                                                                                                                      SHA512

                                                                                                                                                                      3fc5e1de128ce0ddf6dddba758a651f4030323e5285b54859019eb95fb0ae11321ba9c391e8bc578acb7f49dd4d82821c4f9947f39972d79360fd2e6abc67de8

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Program Files\Kryptex\chrome_200_percent.pak
                                                                                                                                                                      Filesize

                                                                                                                                                                      203KB

                                                                                                                                                                      MD5

                                                                                                                                                                      3e50e56e351309566b7e3e5a5ca7c7b6

                                                                                                                                                                      SHA1

                                                                                                                                                                      3ef35792e0b9c3b902d4da59d0a4bb34590c5400

                                                                                                                                                                      SHA256

                                                                                                                                                                      abd207d3e55f0250b27ce23f2a15b0a5ff6f769c08f54e705e2fd0273dca5f1e

                                                                                                                                                                      SHA512

                                                                                                                                                                      b24b20fe5dd9766b86869c51b6d92fd3b191bc3a2cac8a4b43b781644958b49500a0fca3fc69781d9c5a80868508f1fa0af9bc1896dc73f944cf1af8546815f0

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Program Files\Kryptex\ffmpeg.dll
                                                                                                                                                                      Filesize

                                                                                                                                                                      2.6MB

                                                                                                                                                                      MD5

                                                                                                                                                                      002287b5dfe53d87c189f368c7f785b5

                                                                                                                                                                      SHA1

                                                                                                                                                                      00e6e0e224b5f391c0172008ec78ec5124153649

                                                                                                                                                                      SHA256

                                                                                                                                                                      b453afca000aef28c8f27a315a31f244c46755308dea8d9ad55d19a507471a6b

                                                                                                                                                                      SHA512

                                                                                                                                                                      c2b23dd13e3f1c009e2eb2e4aae7a9a4e713642a9031c1e51125c9f0c6c8c6430a2088dd5c20867a2e948c97ae9a9078535e96b5d06ea6c7bd7f67a2db2104aa

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Program Files\Kryptex\icudtl.dat
                                                                                                                                                                      Filesize

                                                                                                                                                                      9.7MB

                                                                                                                                                                      MD5

                                                                                                                                                                      224ba45e00bbbb237b34f0facbb550bf

                                                                                                                                                                      SHA1

                                                                                                                                                                      1b0f81da88149d9c610a8edf55f8f12a87ca67de

                                                                                                                                                                      SHA256

                                                                                                                                                                      8dee674ccd2387c14f01b746779c104e383d57b36c2bdc8e419c470a3d5ffadc

                                                                                                                                                                      SHA512

                                                                                                                                                                      c04d271288dd2eff89d91e31829586706eba95ffbab0b75c2d202a4037e66a4e2205e8a37ecf15116302c51239b1826064ed4670a3346439470b260aba0ea784

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Program Files\Kryptex\locales\en-US.pak
                                                                                                                                                                      Filesize

                                                                                                                                                                      95KB

                                                                                                                                                                      MD5

                                                                                                                                                                      a986c722c10b0639d00250468bb41100

                                                                                                                                                                      SHA1

                                                                                                                                                                      7d5d7188ec4723f32bfb13e3573db39b234d934b

                                                                                                                                                                      SHA256

                                                                                                                                                                      cb40b01d42057e1aa9a3660afa5db2507e4dadb9b23099ab087c4ff14a99d5e9

                                                                                                                                                                      SHA512

                                                                                                                                                                      768145c6dd70e9d3df09cbabb0562249442e86369c6d60d27b2408b8e9d767899911bcc254c0aedc0d29705ab51367a08ff1e25e387a5eb6daae5365c2082d81

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Program Files\Kryptex\resources.pak
                                                                                                                                                                      Filesize

                                                                                                                                                                      4.6MB

                                                                                                                                                                      MD5

                                                                                                                                                                      d98298d188d7ebed9b3e89a822f95df7

                                                                                                                                                                      SHA1

                                                                                                                                                                      a50523cc15f47abb6f1b50982db454e4e956ebc8

                                                                                                                                                                      SHA256

                                                                                                                                                                      0acd9cafd7c4fac398e85a6e008bad6d7ad34f90b0bfd207df330d3e69bcfa75

                                                                                                                                                                      SHA512

                                                                                                                                                                      24cd58294f12f0541d49d180c23b89796596a599d1fc4346d8155b552d765bad0e759c85dded98cf4f3c74ec150b98baf27528f0e864fd37f71dd41c90345791

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Program Files\Kryptex\resources\app.asar
                                                                                                                                                                      Filesize

                                                                                                                                                                      49.5MB

                                                                                                                                                                      MD5

                                                                                                                                                                      8c337b5f01bd3f9628ea513dbb2eb7f7

                                                                                                                                                                      SHA1

                                                                                                                                                                      9090597fb41c9527a17eaf23fd679eccf99b150e

                                                                                                                                                                      SHA256

                                                                                                                                                                      4043dc892963956232ee95734f5c4d9b1f4848190d5177cca2d1248ef2a4786e

                                                                                                                                                                      SHA512

                                                                                                                                                                      676938726779e894b8fb87e35894521667df6378d47b48debc8df309954a0bd570f69ed7397a6ce6cad1471593fa45946ac7780ef1b9369100dc3cdd6f7c3344

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                                                      Filesize

                                                                                                                                                                      1.1MB

                                                                                                                                                                      MD5

                                                                                                                                                                      54dad5920a331983f1d5c5d0d936261c

                                                                                                                                                                      SHA1

                                                                                                                                                                      c6e185e00f3196b8d0af2401f42cb051c5b4ad7b

                                                                                                                                                                      SHA256

                                                                                                                                                                      37fdd3b2c7f3be49619bc0ed731d2e33534abb12170698e4ae759fd9143edcb5

                                                                                                                                                                      SHA512

                                                                                                                                                                      cc45cb0aca06841c219c8f8caa4c4e21a2a9a580012bd0b1d67cd5609d8c870a17c7c0154da064a7940f73064146954de38c49637b023d3eeb34a05a1ee0f9ca

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Program Files\Kryptex\v8_context_snapshot.bin
                                                                                                                                                                      Filesize

                                                                                                                                                                      160KB

                                                                                                                                                                      MD5

                                                                                                                                                                      1c153a96607d3e2c38f11a396533fc80

                                                                                                                                                                      SHA1

                                                                                                                                                                      42d11efbaa549ade29c341e6b8ad5a0545047c62

                                                                                                                                                                      SHA256

                                                                                                                                                                      18ad1a1abeec0230f2a3e38a80c00d4e298bb55d2bb76a2c8e8b113814023815

                                                                                                                                                                      SHA512

                                                                                                                                                                      c3ed01af43532d75c845152f35e844f730f6c7ee14f59ef77222a9b62c52354b4c995fc32b95369d888353da56c308dd32cdec97d34d2aab968e426018416248

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Program Files\Kryptex\vk_swiftshader_icd.json
                                                                                                                                                                      Filesize

                                                                                                                                                                      106B

                                                                                                                                                                      MD5

                                                                                                                                                                      8642dd3a87e2de6e991fae08458e302b

                                                                                                                                                                      SHA1

                                                                                                                                                                      9c06735c31cec00600fd763a92f8112d085bd12a

                                                                                                                                                                      SHA256

                                                                                                                                                                      32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

                                                                                                                                                                      SHA512

                                                                                                                                                                      f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\nsy92AF.tmp\StdUtils.dll
                                                                                                                                                                      Filesize

                                                                                                                                                                      100KB

                                                                                                                                                                      MD5

                                                                                                                                                                      c6a6e03f77c313b267498515488c5740

                                                                                                                                                                      SHA1

                                                                                                                                                                      3d49fc2784b9450962ed6b82b46e9c3c957d7c15

                                                                                                                                                                      SHA256

                                                                                                                                                                      b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

                                                                                                                                                                      SHA512

                                                                                                                                                                      9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Kryptex\Crashpad\settings.dat
                                                                                                                                                                      Filesize

                                                                                                                                                                      40B

                                                                                                                                                                      MD5

                                                                                                                                                                      bd2c1d41711d43141717b3ee10d2a8d6

                                                                                                                                                                      SHA1

                                                                                                                                                                      72b69dde3efde933e56d22be2ec2c604f8137cee

                                                                                                                                                                      SHA256

                                                                                                                                                                      45cbf616d37f3632603e9e68dcd3ec85fb6b12e872ed9aca587bbf767c3cb204

                                                                                                                                                                      SHA512

                                                                                                                                                                      69c3ab2c3affc770e7a0787e0b86158e1d2ea425a3853257ce329dc2596c685511d2aefec9e44e089d551b1e8981261981f3a04a6921f3a75b2934f2dcd01349

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Kryptex\sentry\queue\92929ff621f54af0834fcf8224ea88d3
                                                                                                                                                                      Filesize

                                                                                                                                                                      7KB

                                                                                                                                                                      MD5

                                                                                                                                                                      704a9020254bdf2cc294c8fa5a7b4875

                                                                                                                                                                      SHA1

                                                                                                                                                                      3e6fdf7bd5b1a5ce1efd8d443a99223f36fe14e7

                                                                                                                                                                      SHA256

                                                                                                                                                                      695b319ff2173ece8a56c9ac60bcdffd04dc2144fe42e85e5ebf74f2bc693427

                                                                                                                                                                      SHA512

                                                                                                                                                                      e9331f9058abb09a6c5db291d4c3cdcf0b767e69bb9225a4315109ea518fee9ed874ee9fa4c26d2d65e2230c650eaafad2a9e8e5a393a70d20ec36213f00e91a

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Kryptex\sentry\scope_v2.json
                                                                                                                                                                      Filesize

                                                                                                                                                                      6KB

                                                                                                                                                                      MD5

                                                                                                                                                                      0058f8dacda64789831860b51a1358d8

                                                                                                                                                                      SHA1

                                                                                                                                                                      a3df5c5ba28a541f30a1de09fa85da02e03b2752

                                                                                                                                                                      SHA256

                                                                                                                                                                      65884ab3264038b89ea6850fb124a22e5b34aea5b127fdbf2818b48b61b86d22

                                                                                                                                                                      SHA512

                                                                                                                                                                      c0f5093ce56553dba964c0499100549120aa79da91e01df77445b1815908842701b426e9084156c1c86565fd2e3d0e6fe425a23475e08a97d4bf01639b64283a

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
                                                                                                                                                                      Filesize

                                                                                                                                                                      7KB

                                                                                                                                                                      MD5

                                                                                                                                                                      35cccd2e56fbb8f60a41f2d34bac3d44

                                                                                                                                                                      SHA1

                                                                                                                                                                      67bba59c8430603f3cf8a4054adc63b97dd56c44

                                                                                                                                                                      SHA256

                                                                                                                                                                      2312a62a11516a045d6ccf8cd0b39ece1fe1634979b574abec20ab89c7fa3c54

                                                                                                                                                                      SHA512

                                                                                                                                                                      82d38fb9aed9dfea2b98835abe68e13bcb563ece1fa0abc1530455256d24d230f96518e3f3de70a885696e479368aaef7e1bababb9401cee030fce44ef6ffc89

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • \Program Files\Kryptex\d3dcompiler_47.dll
                                                                                                                                                                      Filesize

                                                                                                                                                                      4.3MB

                                                                                                                                                                      MD5

                                                                                                                                                                      7641e39b7da4077084d2afe7c31032e0

                                                                                                                                                                      SHA1

                                                                                                                                                                      2256644f69435ff2fee76deb04d918083960d1eb

                                                                                                                                                                      SHA256

                                                                                                                                                                      44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47

                                                                                                                                                                      SHA512

                                                                                                                                                                      8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • \Program Files\Kryptex\libEGL.dll
                                                                                                                                                                      Filesize

                                                                                                                                                                      432KB

                                                                                                                                                                      MD5

                                                                                                                                                                      6efa8068776b4eadb3b9dfdef089ca68

                                                                                                                                                                      SHA1

                                                                                                                                                                      fa2023ecbcae030cddff3188c9d3c906cc69a64f

                                                                                                                                                                      SHA256

                                                                                                                                                                      fa59945648614e0ebf9f8eaf63500347da59a0d2e7484b6b5d4be6cf6ee917de

                                                                                                                                                                      SHA512

                                                                                                                                                                      70e6749841a384daa65f284c5d7a8afa358b03b38cc091819aa5545960834b9b4a394eccc19c0a1e290c5b33fbaaa56bd1d6d988b5da0a34e2e56dacde5b17d4

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • \Program Files\Kryptex\libGLESv2.dll
                                                                                                                                                                      Filesize

                                                                                                                                                                      7.8MB

                                                                                                                                                                      MD5

                                                                                                                                                                      cdc3935fa97855b4f9d692702ea95ef9

                                                                                                                                                                      SHA1

                                                                                                                                                                      68939afd7f1f4a470d9328b068250c0b5fbab2c2

                                                                                                                                                                      SHA256

                                                                                                                                                                      eea91ba71fdec104e8d7c9fd24687ec4f1c308d79d6730ef58127a92025cc006

                                                                                                                                                                      SHA512

                                                                                                                                                                      3cdbd833e8311023d673315c2aebc8e19a17e5767dfa40ca2646ee094eeef27117961f581aaa4584fc639e9ec0195f98ea5454b397cf1cd2709b7772207381b5

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • \Program Files\Kryptex\vk_swiftshader.dll
                                                                                                                                                                      Filesize

                                                                                                                                                                      4.4MB

                                                                                                                                                                      MD5

                                                                                                                                                                      e8ae323ba929d42e9e1b8112b47a7af2

                                                                                                                                                                      SHA1

                                                                                                                                                                      8c78eba22be420ea3094aff6b2dd35587805c012

                                                                                                                                                                      SHA256

                                                                                                                                                                      081210e45740985a91a25c7ea057761c89b619375af64e0b7d37d3d4b57de490

                                                                                                                                                                      SHA512

                                                                                                                                                                      649d1483bfa2e8bce5c1143639534b5b612d613156f59b6ec1fbb3ce96242a6018f15c59471627f1ece7c9a59e3ee8031d10e51fcbbbca776675dd4a26898693

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • \Program Files\Kryptex\vulkan-1.dll
                                                                                                                                                                      Filesize

                                                                                                                                                                      711KB

                                                                                                                                                                      MD5

                                                                                                                                                                      e2b4f5e5fa717ccd9cf32c5cb45691f6

                                                                                                                                                                      SHA1

                                                                                                                                                                      6adb41cb87757eb218af0df932273dd2a63e5e3f

                                                                                                                                                                      SHA256

                                                                                                                                                                      7fa723cd735f2ddffb146c838ac2542edbd1119e3df1864ec47c5e77ac30b8d2

                                                                                                                                                                      SHA512

                                                                                                                                                                      cab830d0027a7fcca934129cc83165d99f7c15c5b1d70c3bc74c2ad64003e2236bd43165b48124d0b5ca96a9e5eb1db5464ce9f69c3209dbc54c428db1df7e8b

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • \Users\Admin\AppData\Local\Temp\nsy92AF.tmp\SpiderBanner.dll
                                                                                                                                                                      Filesize

                                                                                                                                                                      9KB

                                                                                                                                                                      MD5

                                                                                                                                                                      17309e33b596ba3a5693b4d3e85cf8d7

                                                                                                                                                                      SHA1

                                                                                                                                                                      7d361836cf53df42021c7f2b148aec9458818c01

                                                                                                                                                                      SHA256

                                                                                                                                                                      996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

                                                                                                                                                                      SHA512

                                                                                                                                                                      1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • \Users\Admin\AppData\Local\Temp\nsy92AF.tmp\System.dll
                                                                                                                                                                      Filesize

                                                                                                                                                                      12KB

                                                                                                                                                                      MD5

                                                                                                                                                                      0d7ad4f45dc6f5aa87f606d0331c6901

                                                                                                                                                                      SHA1

                                                                                                                                                                      48df0911f0484cbe2a8cdd5362140b63c41ee457

                                                                                                                                                                      SHA256

                                                                                                                                                                      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

                                                                                                                                                                      SHA512

                                                                                                                                                                      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • \Users\Admin\AppData\Local\Temp\nsy92AF.tmp\WinShell.dll
                                                                                                                                                                      Filesize

                                                                                                                                                                      3KB

                                                                                                                                                                      MD5

                                                                                                                                                                      1cc7c37b7e0c8cd8bf04b6cc283e1e56

                                                                                                                                                                      SHA1

                                                                                                                                                                      0b9519763be6625bd5abce175dcc59c96d100d4c

                                                                                                                                                                      SHA256

                                                                                                                                                                      9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

                                                                                                                                                                      SHA512

                                                                                                                                                                      7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • \Users\Admin\AppData\Local\Temp\nsy92AF.tmp\nsExec.dll
                                                                                                                                                                      Filesize

                                                                                                                                                                      6KB

                                                                                                                                                                      MD5

                                                                                                                                                                      ec0504e6b8a11d5aad43b296beeb84b2

                                                                                                                                                                      SHA1

                                                                                                                                                                      91b5ce085130c8c7194d66b2439ec9e1c206497c

                                                                                                                                                                      SHA256

                                                                                                                                                                      5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

                                                                                                                                                                      SHA512

                                                                                                                                                                      3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • \Users\Admin\AppData\Local\Temp\nsy92AF.tmp\nsProcess.dll
                                                                                                                                                                      Filesize

                                                                                                                                                                      4KB

                                                                                                                                                                      MD5

                                                                                                                                                                      f0438a894f3a7e01a4aae8d1b5dd0289

                                                                                                                                                                      SHA1

                                                                                                                                                                      b058e3fcfb7b550041da16bf10d8837024c38bf6

                                                                                                                                                                      SHA256

                                                                                                                                                                      30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

                                                                                                                                                                      SHA512

                                                                                                                                                                      f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • \Users\Admin\AppData\Local\Temp\nsy92AF.tmp\nsis7z.dll
                                                                                                                                                                      Filesize

                                                                                                                                                                      424KB

                                                                                                                                                                      MD5

                                                                                                                                                                      80e44ce4895304c6a3a831310fbf8cd0

                                                                                                                                                                      SHA1

                                                                                                                                                                      36bd49ae21c460be5753a904b4501f1abca53508

                                                                                                                                                                      SHA256

                                                                                                                                                                      b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

                                                                                                                                                                      SHA512

                                                                                                                                                                      c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

                                                                                                                                                                      Download Submit

                                                                                                                                                                    • memory/344-329-0x0000000000060000-0x0000000000061000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      4KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/344-367-0x00000000777A0000-0x00000000777A1000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      4KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/1656-290-0x0000000004110000-0x0000000004112000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      8KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/2184-22-0x0000000073F50000-0x00000000744FB000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      5.7MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/2184-21-0x0000000073F50000-0x00000000744FB000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      5.7MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/2184-19-0x0000000073F50000-0x00000000744FB000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      5.7MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/2184-20-0x0000000073F50000-0x00000000744FB000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      5.7MB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/2184-18-0x0000000073F51000-0x0000000073F52000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      4KB

                                                                                                                                                                      Download

                                                                                                                                                                    • memory/2184-23-0x0000000073F50000-0x00000000744FB000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      5.7MB

                                                                                                                                                                      Download