Overview

overview

8

Static

static

3

download.exe

windows7-x64

8

download.exe

windows10-1703-x64

8

download.exe

windows10-2004-x64

8

download.exe

windows11-21h2-x64

8

Resubmissions

25/09/2024, 10:15

240925-mah9eazdjk 8

19/09/2024, 16:05

240919-tjgkhaxdjh 8

Analysis

  • max time kernel
    304s
  • max time network
    302s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/09/2024, 10:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    download.exe

  • Size

    67.1MB

  • MD5

    7d658964c1874ca902f3dc0864b00a3c

  • SHA1

    c972667622f44e4cb93a2fc7d9f1a0dc1cbb5edf

  • SHA256

    100565864eed928d474d1912b9de2f124a2e94f312a454922b4ccdff36860fba

  • SHA512

    28adf2797b6acc971d67f75bc2c8ea90693c68e62732f1f5986561b0b9bfc60d0ca4495f6547057a046286328c6a25268c07aadbe5cdacf246ddbbb0c8de086f

  • SSDEEP

    1572864:AK93N+NLkIzv7Bc6hrd3L/HGuIa31UwAQEKhSzqYA8nfndf:AU9+NC69N/muIq1ULQE4SpFf

Score
8/10
discoveryexecutionpersistence

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 63 IoCs
  • Loads dropped DLL 40 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 9 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry key 1 TTPs 55 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\download.exe
    "C:\Users\Admin\AppData\Local\Temp\download.exe"
    1⤵
    • Drops file in Program Files directory
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2384
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -c Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\nsy4E3B.tmp\"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:828
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -c Add-MpPreference -ExclusionPath \"C:\Program Files\Kryptex\"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4896
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -c Remove-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\nsy4E3B.tmp\"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3956
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /delete /f /tn KryptexElevation
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4324
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /delete /f /tn KryptexElevationFromStartup
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4828
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /tn KryptexElevationV2 /xml "C:\Program Files\Kryptex\KryptexElevation.xml"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:3740
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /tn KryptexElevationV2FromStartup /xml "C:\Program Files\Kryptex\KryptexElevationFromStartup.xml"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2432
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3908,i,4356837537417149674,16553092232944545509,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:8
    1⤵
      PID:5020
    • C:\Program Files\Kryptex\Kryptex.exe
      "C:\Program Files\Kryptex\Kryptex.exe"
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4412
      • C:\Program Files\Kryptex\Kryptex.exe
        "C:\Program Files\Kryptex\Kryptex.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Kryptex /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Kryptex\Crashpad --url=https://f.a.k/e --annotation=_productName=Kryptex --annotation=_version=4.44.2 --annotation=prod=Electron --annotation=ver=14.2.9 --initial-client-data=0x464,0x46c,0x470,0x440,0x474,0x7ff68e138a38,0x7ff68e138a48,0x7ff68e138a58
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3956
      • C:\Program Files\Kryptex\Kryptex.exe
        "C:\Program Files\Kryptex\Kryptex.exe" --type=gpu-process --field-trial-handle=1680,10682167017813319528,11379004838789525348,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --user-data-dir="C:\Users\Admin\AppData\Roaming\Kryptex" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1688 /prefetch:2
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2952
      • C:\Program Files\Kryptex\Kryptex.exe
        "C:\Program Files\Kryptex\Kryptex.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1680,10682167017813319528,11379004838789525348,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Kryptex" --standard-schemes --secure-schemes --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2052 /prefetch:8
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:4740
      • C:\Program Files\Kryptex\Kryptex.exe
        "C:\Program Files\Kryptex\Kryptex.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Kryptex" --standard-schemes --secure-schemes --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Program Files\Kryptex\resources\app.asar" --no-sandbox --no-zygote --field-trial-handle=1680,10682167017813319528,11379004838789525348,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2332 /prefetch:1
        2⤵
        • Adds Run key to start application
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4732
        • C:\Windows\System32\Wbem\wmic.exe
          wmic os get locale
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:5424
        • C:\Windows\system32\reg.exe
          reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
          3⤵
            PID:5600
          • C:\Windows\system32\reg.exe
            reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
            3⤵
            • Modifies registry key
            PID:5724
          • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
            "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
            3⤵
            • Executes dropped EXE
            PID:5772
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "chcp"
            3⤵
              PID:5824
              • C:\Windows\system32\chcp.com
                chcp
                4⤵
                  PID:5928
              • C:\Windows\System32\Wbem\wmic.exe
                wmic os get Caption /value
                3⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:5844
              • C:\Windows\System32\Wbem\wmic.exe
                wmic os get SerialNumber /value
                3⤵
                  PID:5988
                • C:\Windows\System32\Wbem\wmic.exe
                  wmic os get TotalVirtualMemorySize /value
                  3⤵
                    PID:6056
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%%%PCI%%%%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress"
                    3⤵
                      PID:6120
                      • C:\Windows\System32\Wbem\WMIC.exe
                        wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%%%PCI%%%%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress
                        4⤵
                          PID:5140
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%%%PCI%%%%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress"
                        3⤵
                          PID:3936
                          • C:\Windows\System32\Wbem\WMIC.exe
                            wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%%%PCI%%%%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress
                            4⤵
                              PID:5172
                          • C:\Windows\System32\Wbem\wmic.exe
                            wmic pagefile get AllocatedBaseSize /value
                            3⤵
                              PID:2384
                            • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                              "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe" setPageSize 2
                              3⤵
                              • Executes dropped EXE
                              PID:4228
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers /v TdrDelay /t REG_DWORD /d 0x14 /f"
                              3⤵
                                PID:4436
                                • C:\Windows\system32\reg.exe
                                  reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers /v TdrDelay /t REG_DWORD /d 0x14 /f
                                  4⤵
                                    PID:3372
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /d /s /c "reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers /v TdrDdiDelay /t REG_DWORD /d 0xa /f"
                                  3⤵
                                    PID:5260
                                    • C:\Windows\system32\reg.exe
                                      reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers /v TdrDdiDelay /t REG_DWORD /d 0xa /f
                                      4⤵
                                        PID:5308
                                    • C:\Windows\system32\reg.exe
                                      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                      3⤵
                                        PID:5332
                                      • C:\Windows\system32\reg.exe
                                        reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                        3⤵
                                          PID:5336
                                        • C:\Windows\system32\reg.exe
                                          reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                          3⤵
                                          • Modifies registry key
                                          PID:5392
                                        • C:\Windows\system32\reg.exe
                                          reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                          3⤵
                                          • Modifies registry key
                                          PID:5416
                                        • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                          "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                          3⤵
                                          • Executes dropped EXE
                                          PID:5504
                                        • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                          "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                          3⤵
                                          • Executes dropped EXE
                                          PID:5572
                                        • C:\Windows\System32\Wbem\wmic.exe
                                          wmic os get Caption /value
                                          3⤵
                                            PID:5596
                                          • C:\Windows\System32\Wbem\wmic.exe
                                            wmic os get SerialNumber /value
                                            3⤵
                                              PID:5744
                                            • C:\Windows\System32\Wbem\wmic.exe
                                              wmic os get TotalVirtualMemorySize /value
                                              3⤵
                                                PID:5816
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /d /s /c "wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%%%PCI%%%%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress"
                                                3⤵
                                                  PID:5908
                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                    wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%%%PCI%%%%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress
                                                    4⤵
                                                      PID:5848
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /d /s /c "wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%%%PCI%%%%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress"
                                                    3⤵
                                                      PID:6004
                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                        wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%%%PCI%%%%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress
                                                        4⤵
                                                          PID:5988
                                                      • C:\Windows\system32\reg.exe
                                                        reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                        3⤵
                                                          PID:6140
                                                        • C:\Windows\system32\reg.exe
                                                          reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                          3⤵
                                                          • Modifies registry key
                                                          PID:5140
                                                        • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                          "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                          3⤵
                                                          • Executes dropped EXE
                                                          PID:5176
                                                        • C:\Windows\system32\reg.exe
                                                          reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                          3⤵
                                                            PID:4080
                                                          • C:\Windows\system32\reg.exe
                                                            reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                            3⤵
                                                            • Modifies registry key
                                                            PID:2384
                                                          • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                            "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                            3⤵
                                                            • Executes dropped EXE
                                                            PID:4228
                                                          • C:\Windows\system32\reg.exe
                                                            reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                            3⤵
                                                              PID:5272
                                                            • C:\Windows\system32\reg.exe
                                                              reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                              3⤵
                                                              • Modifies registry key
                                                              PID:3512
                                                            • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                              "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                              3⤵
                                                              • Executes dropped EXE
                                                              PID:4620
                                                            • C:\Windows\system32\reg.exe
                                                              reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                              3⤵
                                                                PID:2748
                                                              • C:\Windows\system32\reg.exe
                                                                reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                3⤵
                                                                • Modifies registry key
                                                                PID:5584
                                                              • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                3⤵
                                                                • Executes dropped EXE
                                                                PID:5480
                                                              • C:\Windows\system32\reg.exe
                                                                reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                3⤵
                                                                  PID:5732
                                                                • C:\Windows\system32\reg.exe
                                                                  reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                  3⤵
                                                                  • Modifies registry key
                                                                  PID:5784
                                                                • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                  "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  PID:5940
                                                                • C:\Windows\system32\reg.exe
                                                                  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                  3⤵
                                                                    PID:5956
                                                                  • C:\Windows\system32\reg.exe
                                                                    reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                    3⤵
                                                                    • Modifies registry key
                                                                    PID:3764
                                                                  • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                    "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    PID:6004
                                                                  • C:\Windows\system32\reg.exe
                                                                    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                    3⤵
                                                                      PID:6116
                                                                    • C:\Windows\system32\reg.exe
                                                                      reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                      3⤵
                                                                      • Modifies registry key
                                                                      PID:4380
                                                                    • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                      "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                      3⤵
                                                                      • Executes dropped EXE
                                                                      PID:4708
                                                                    • C:\Windows\system32\reg.exe
                                                                      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                      3⤵
                                                                        PID:4428
                                                                      • C:\Windows\system32\reg.exe
                                                                        reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                        3⤵
                                                                        • Modifies registry key
                                                                        PID:4516
                                                                      • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                        "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        PID:388
                                                                      • C:\Windows\system32\reg.exe
                                                                        reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                        3⤵
                                                                          PID:5264
                                                                        • C:\Windows\system32\reg.exe
                                                                          reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                          3⤵
                                                                          • Modifies registry key
                                                                          PID:5388
                                                                        • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                          "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                          3⤵
                                                                          • Executes dropped EXE
                                                                          PID:5404
                                                                        • C:\Windows\system32\reg.exe
                                                                          reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                          3⤵
                                                                            PID:5420
                                                                          • C:\Windows\system32\reg.exe
                                                                            reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                            3⤵
                                                                            • Modifies registry key
                                                                            PID:1920
                                                                          • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                            "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                            3⤵
                                                                            • Executes dropped EXE
                                                                            PID:5468
                                                                          • C:\Windows\system32\reg.exe
                                                                            reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                            3⤵
                                                                              PID:1656
                                                                            • C:\Windows\system32\reg.exe
                                                                              reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                              3⤵
                                                                              • Modifies registry key
                                                                              PID:5724
                                                                            • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                              "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              PID:5764
                                                                            • C:\Windows\system32\reg.exe
                                                                              reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                              3⤵
                                                                                PID:5856
                                                                              • C:\Windows\system32\reg.exe
                                                                                reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                3⤵
                                                                                • Modifies registry key
                                                                                PID:4344
                                                                              • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                PID:6008
                                                                              • C:\Windows\system32\reg.exe
                                                                                reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                3⤵
                                                                                  PID:6100
                                                                                • C:\Windows\system32\reg.exe
                                                                                  reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                  3⤵
                                                                                  • Modifies registry key
                                                                                  PID:6012
                                                                                • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                  "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                  3⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:440
                                                                                • C:\Windows\system32\reg.exe
                                                                                  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                  3⤵
                                                                                    PID:3620
                                                                                  • C:\Windows\system32\reg.exe
                                                                                    reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                    3⤵
                                                                                    • Modifies registry key
                                                                                    PID:1316
                                                                                  • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                    "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                    3⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:2592
                                                                                  • C:\Windows\system32\reg.exe
                                                                                    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                    3⤵
                                                                                      PID:4324
                                                                                    • C:\Windows\system32\reg.exe
                                                                                      reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                      3⤵
                                                                                      • Modifies registry key
                                                                                      PID:208
                                                                                    • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                      "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                      3⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:2688
                                                                                    • C:\Windows\system32\reg.exe
                                                                                      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                      3⤵
                                                                                        PID:1824
                                                                                      • C:\Windows\system32\reg.exe
                                                                                        reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                        3⤵
                                                                                        • Modifies registry key
                                                                                        PID:1744
                                                                                      • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                        "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                        3⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:4496
                                                                                      • C:\Windows\system32\reg.exe
                                                                                        reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                        3⤵
                                                                                          PID:4440
                                                                                        • C:\Windows\system32\reg.exe
                                                                                          reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                          3⤵
                                                                                          • Modifies registry key
                                                                                          PID:3628
                                                                                        • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                          "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                          3⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:1660
                                                                                        • C:\Windows\system32\reg.exe
                                                                                          reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                          3⤵
                                                                                            PID:5328
                                                                                          • C:\Windows\system32\reg.exe
                                                                                            reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                            3⤵
                                                                                            • Modifies registry key
                                                                                            PID:5396
                                                                                          • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                            "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                            3⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:3792
                                                                                          • C:\Windows\system32\reg.exe
                                                                                            reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                            3⤵
                                                                                              PID:4980
                                                                                            • C:\Windows\system32\reg.exe
                                                                                              reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                              3⤵
                                                                                              • Modifies registry key
                                                                                              PID:5496
                                                                                            • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                              "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                              3⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:5576
                                                                                            • C:\Windows\system32\reg.exe
                                                                                              reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                              3⤵
                                                                                                PID:2356
                                                                                              • C:\Windows\system32\reg.exe
                                                                                                reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                3⤵
                                                                                                • Modifies registry key
                                                                                                PID:5232
                                                                                              • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                3⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:5480
                                                                                              • C:\Windows\system32\reg.exe
                                                                                                reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                3⤵
                                                                                                  PID:5596
                                                                                                • C:\Windows\system32\reg.exe
                                                                                                  reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                  3⤵
                                                                                                  • Modifies registry key
                                                                                                  PID:5564
                                                                                                • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                  "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                  3⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:5912
                                                                                                • C:\Windows\system32\reg.exe
                                                                                                  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                  3⤵
                                                                                                    PID:6000
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                    3⤵
                                                                                                    • Modifies registry key
                                                                                                    PID:6012
                                                                                                  • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                    "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                    3⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:956
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                    3⤵
                                                                                                      PID:4952
                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                      reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                      3⤵
                                                                                                      • Modifies registry key
                                                                                                      PID:4296
                                                                                                    • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                      "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                      3⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:4428
                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                      3⤵
                                                                                                        PID:1468
                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                        reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                        3⤵
                                                                                                        • Modifies registry key
                                                                                                        PID:4984
                                                                                                      • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                        "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                        3⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:1544
                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                        reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                        3⤵
                                                                                                          PID:2816
                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                          reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                          3⤵
                                                                                                          • Modifies registry key
                                                                                                          PID:5284
                                                                                                        • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                          "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                          3⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:1592
                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                          reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                          3⤵
                                                                                                            PID:3160
                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                            reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                            3⤵
                                                                                                            • Modifies registry key
                                                                                                            PID:1952
                                                                                                          • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                            "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:5352
                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                            reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                            3⤵
                                                                                                              PID:4192
                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                              reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                              3⤵
                                                                                                              • Modifies registry key
                                                                                                              PID:5384
                                                                                                            • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                              "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                              3⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:5368
                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                              reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                              3⤵
                                                                                                                PID:5408
                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                3⤵
                                                                                                                • Modifies registry key
                                                                                                                PID:5488
                                                                                                              • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                3⤵
                                                                                                                • Executes dropped EXE
                                                                                                                PID:5056
                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                3⤵
                                                                                                                  PID:4688
                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                  reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                  3⤵
                                                                                                                  • Modifies registry key
                                                                                                                  PID:5748
                                                                                                                • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                  "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                  3⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:5232
                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                  3⤵
                                                                                                                    PID:5792
                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                    reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                    3⤵
                                                                                                                    • Modifies registry key
                                                                                                                    PID:5860
                                                                                                                  • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                    "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                    3⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:5936
                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                    3⤵
                                                                                                                      PID:3172
                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                      reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                      3⤵
                                                                                                                      • Modifies registry key
                                                                                                                      PID:772
                                                                                                                    • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                      "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                      3⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:2288
                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                      3⤵
                                                                                                                        PID:4916
                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                        reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                        3⤵
                                                                                                                        • Modifies registry key
                                                                                                                        PID:3764
                                                                                                                      • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                        "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                        3⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:6032
                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                        reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                        3⤵
                                                                                                                          PID:6080
                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                          reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                          3⤵
                                                                                                                          • Modifies registry key
                                                                                                                          PID:2772
                                                                                                                        • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                          "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                          3⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:4820
                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                          reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                          3⤵
                                                                                                                            PID:5904
                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                            reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                            3⤵
                                                                                                                            • Modifies registry key
                                                                                                                            PID:4232
                                                                                                                          • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                            "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                            3⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:4528
                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                            reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                            3⤵
                                                                                                                              PID:4952
                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                              reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                              3⤵
                                                                                                                              • Modifies registry key
                                                                                                                              PID:180
                                                                                                                            • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                              "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                              3⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:5916
                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                              reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                              3⤵
                                                                                                                                PID:1160
                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                3⤵
                                                                                                                                • Modifies registry key
                                                                                                                                PID:4984
                                                                                                                              • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                3⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:5624
                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                3⤵
                                                                                                                                  PID:2948
                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                  reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                  3⤵
                                                                                                                                  • Modifies registry key
                                                                                                                                  PID:4812
                                                                                                                                • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                  "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                  3⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:1372
                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                  3⤵
                                                                                                                                    PID:4224
                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                    reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                    3⤵
                                                                                                                                    • Modifies registry key
                                                                                                                                    PID:5212
                                                                                                                                  • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                    "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                    3⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:5320
                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                    3⤵
                                                                                                                                      PID:5344
                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                      reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                      3⤵
                                                                                                                                      • Modifies registry key
                                                                                                                                      PID:5376
                                                                                                                                    • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                      "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                      3⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:5104
                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                      3⤵
                                                                                                                                        PID:1540
                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                        reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                        3⤵
                                                                                                                                        • Modifies registry key
                                                                                                                                        PID:5456
                                                                                                                                      • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                        "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                        3⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:5484
                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                        reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                        3⤵
                                                                                                                                          PID:5288
                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                          reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                          3⤵
                                                                                                                                          • Modifies registry key
                                                                                                                                          PID:5588
                                                                                                                                        • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                          "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                          3⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:5660
                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                          reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                          3⤵
                                                                                                                                            PID:5732
                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                            reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                            3⤵
                                                                                                                                            • Modifies registry key
                                                                                                                                            PID:4328
                                                                                                                                          • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                            "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                            3⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:4492
                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                            reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                            3⤵
                                                                                                                                              PID:3692
                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                              reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                              3⤵
                                                                                                                                              • Modifies registry key
                                                                                                                                              PID:1724
                                                                                                                                            • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                              "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                              3⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:5184
                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                              reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                              3⤵
                                                                                                                                                PID:5988
                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                                3⤵
                                                                                                                                                • Modifies registry key
                                                                                                                                                PID:5852
                                                                                                                                              • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                                "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                                3⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:6000
                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                                3⤵
                                                                                                                                                  PID:4604
                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                  reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                                  3⤵
                                                                                                                                                  • Modifies registry key
                                                                                                                                                  PID:4140
                                                                                                                                                • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                                  "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                                  3⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:656
                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                                  3⤵
                                                                                                                                                    PID:2400
                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                    reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                                    3⤵
                                                                                                                                                    • Modifies registry key
                                                                                                                                                    PID:5248
                                                                                                                                                  • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                                    "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                                    3⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:2668
                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                                    3⤵
                                                                                                                                                      PID:4180
                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                      reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                                      3⤵
                                                                                                                                                      • Modifies registry key
                                                                                                                                                      PID:4296
                                                                                                                                                    • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                                      "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                                      3⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:180
                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                                      3⤵
                                                                                                                                                        PID:4456
                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                        reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                                        3⤵
                                                                                                                                                        • Modifies registry key
                                                                                                                                                        PID:5948
                                                                                                                                                      • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                                        "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                                        3⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:4884
                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                        reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                                        3⤵
                                                                                                                                                          PID:1160
                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                          reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                                          3⤵
                                                                                                                                                          • Modifies registry key
                                                                                                                                                          PID:1216
                                                                                                                                                        • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                                          "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                                          3⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:4336
                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                          reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                                          3⤵
                                                                                                                                                            PID:1740
                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                            reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                                            3⤵
                                                                                                                                                            • Modifies registry key
                                                                                                                                                            PID:3432
                                                                                                                                                          • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                                            "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:1356
                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                            reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                                            3⤵
                                                                                                                                                              PID:1936
                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                              reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                                              3⤵
                                                                                                                                                              • Modifies registry key
                                                                                                                                                              PID:3852
                                                                                                                                                            • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                                              "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                                              3⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:4696
                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                              reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AMD Catalyst Install Manager" /v DisplayVersion
                                                                                                                                                              3⤵
                                                                                                                                                                PID:5460
                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                reg query HKLM\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v RadeonSoftwareVersion
                                                                                                                                                                3⤵
                                                                                                                                                                • Modifies registry key
                                                                                                                                                                PID:316
                                                                                                                                                              • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe
                                                                                                                                                                "C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\build\Release\adlinfo.exe"
                                                                                                                                                                3⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:4904
                                                                                                                                                            • C:\Program Files\Kryptex\Kryptex.exe
                                                                                                                                                              "C:\Program Files\Kryptex\Kryptex.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Kryptex" --standard-schemes --secure-schemes --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Program Files\Kryptex\resources\app.asar" --no-sandbox --no-zygote --field-trial-handle=1680,10682167017813319528,11379004838789525348,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2900 /prefetch:1
                                                                                                                                                              2⤵
                                                                                                                                                              • Checks computer location settings
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                              PID:5544
                                                                                                                                                            • C:\Program Files\Kryptex\Kryptex.exe
                                                                                                                                                              "C:\Program Files\Kryptex\Kryptex.exe" --type=gpu-process --field-trial-handle=1680,10682167017813319528,11379004838789525348,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Kryptex" --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAQAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2484 /prefetch:2
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                              PID:4564
                                                                                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                            1⤵
                                                                                                                                                              PID:4080

                                                                                                                                                            Network

                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                            Reconnaissance

                                                                                                                                                            Resource Development

                                                                                                                                                            Initial Access

                                                                                                                                                            Execution

                                                                                                                                                            Command and Scripting Interpreter

                                                                                                                                                            1
                                                                                                                                                            T1059

                                                                                                                                                            PowerShell

                                                                                                                                                            1
                                                                                                                                                            T1059.001

                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                            1
                                                                                                                                                            T1053

                                                                                                                                                            Scheduled Task

                                                                                                                                                            1
                                                                                                                                                            T1053.005

                                                                                                                                                            Persistence

                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                            1
                                                                                                                                                            T1547

                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                            1
                                                                                                                                                            T1547.001

                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                            1
                                                                                                                                                            T1053

                                                                                                                                                            Scheduled Task

                                                                                                                                                            1
                                                                                                                                                            T1053.005

                                                                                                                                                            Privilege Escalation

                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                            1
                                                                                                                                                            T1547

                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                            1
                                                                                                                                                            T1547.001

                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                            1
                                                                                                                                                            T1053

                                                                                                                                                            Scheduled Task

                                                                                                                                                            1
                                                                                                                                                            T1053.005

                                                                                                                                                            Defense Evasion

                                                                                                                                                            Modify Registry

                                                                                                                                                            3
                                                                                                                                                            T1112

                                                                                                                                                            Subvert Trust Controls

                                                                                                                                                            1
                                                                                                                                                            T1553

                                                                                                                                                            Install Root Certificate

                                                                                                                                                            1
                                                                                                                                                            T1553.004

                                                                                                                                                            Credential Access

                                                                                                                                                            Discovery

                                                                                                                                                            Query Registry

                                                                                                                                                            3
                                                                                                                                                            T1012

                                                                                                                                                            System Information Discovery

                                                                                                                                                            3
                                                                                                                                                            T1082

                                                                                                                                                            System Location Discovery

                                                                                                                                                            1
                                                                                                                                                            T1614

                                                                                                                                                            System Language Discovery

                                                                                                                                                            1
                                                                                                                                                            T1614.001

                                                                                                                                                            Lateral Movement

                                                                                                                                                            Collection

                                                                                                                                                            Command and Control

                                                                                                                                                            Exfiltration

                                                                                                                                                            Impact

                                                                                                                                                            Replay Monitor

                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                            Downloads

                                                                                                                                                            • C:\Program Files\Kryptex\KryptexElevation.xml
                                                                                                                                                              Filesize

                                                                                                                                                              3KB

                                                                                                                                                              MD5

                                                                                                                                                              e584e974928f5c25896c57ab4473c7fa

                                                                                                                                                              SHA1

                                                                                                                                                              d0f41300aa9899cfd8cee99c5b1179764cb5b3a9

                                                                                                                                                              SHA256

                                                                                                                                                              9ea9d814ae35bd3f5d8603fb174342f73e7292032b0e822920be971221b98211

                                                                                                                                                              SHA512

                                                                                                                                                              f9dfeae6ef90eb474a16262fd2b96a22418c3249cbf8e5a8765a297d3e4e14bd504aeed093b50d6537cd40b93bb1fab5503225e4812a793eacc72f2982867d2e

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Program Files\Kryptex\KryptexElevationFromStartup.xml
                                                                                                                                                              Filesize

                                                                                                                                                              3KB

                                                                                                                                                              MD5

                                                                                                                                                              6613ead33c20d846c8a1ba281d6c9327

                                                                                                                                                              SHA1

                                                                                                                                                              c7be96f9d32af83f99c23f21165fe860a455fc54

                                                                                                                                                              SHA256

                                                                                                                                                              77de3447f0f69513af4bc08f410a28f58189234bd908e5f7d1ff5c35e0a086b1

                                                                                                                                                              SHA512

                                                                                                                                                              fa71a511b96628999ff1a1ac5f8aebc44c2be108a427a51e56ac4c72aec37bfda308cafd0ab12b6a55bc7f802cdd98ae7922be6ad67adf3c3bbb65b4c946bf7d

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Program Files\Kryptex\chrome_100_percent.pak
                                                                                                                                                              Filesize

                                                                                                                                                              139KB

                                                                                                                                                              MD5

                                                                                                                                                              109ee8ffd715c63e3e2248c2ad5ca559

                                                                                                                                                              SHA1

                                                                                                                                                              7f89b213e80e2b4f52f75b449baecb88054d5e07

                                                                                                                                                              SHA256

                                                                                                                                                              b581f176c6bdbf8a152947fb37af9c0e6d7651616408cb7312b336c37a704580

                                                                                                                                                              SHA512

                                                                                                                                                              3fc5e1de128ce0ddf6dddba758a651f4030323e5285b54859019eb95fb0ae11321ba9c391e8bc578acb7f49dd4d82821c4f9947f39972d79360fd2e6abc67de8

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Program Files\Kryptex\chrome_200_percent.pak
                                                                                                                                                              Filesize

                                                                                                                                                              203KB

                                                                                                                                                              MD5

                                                                                                                                                              3e50e56e351309566b7e3e5a5ca7c7b6

                                                                                                                                                              SHA1

                                                                                                                                                              3ef35792e0b9c3b902d4da59d0a4bb34590c5400

                                                                                                                                                              SHA256

                                                                                                                                                              abd207d3e55f0250b27ce23f2a15b0a5ff6f769c08f54e705e2fd0273dca5f1e

                                                                                                                                                              SHA512

                                                                                                                                                              b24b20fe5dd9766b86869c51b6d92fd3b191bc3a2cac8a4b43b781644958b49500a0fca3fc69781d9c5a80868508f1fa0af9bc1896dc73f944cf1af8546815f0

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Program Files\Kryptex\d3dcompiler_47.dll
                                                                                                                                                              Filesize

                                                                                                                                                              4.3MB

                                                                                                                                                              MD5

                                                                                                                                                              7641e39b7da4077084d2afe7c31032e0

                                                                                                                                                              SHA1

                                                                                                                                                              2256644f69435ff2fee76deb04d918083960d1eb

                                                                                                                                                              SHA256

                                                                                                                                                              44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47

                                                                                                                                                              SHA512

                                                                                                                                                              8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Program Files\Kryptex\ffmpeg.dll
                                                                                                                                                              Filesize

                                                                                                                                                              2.6MB

                                                                                                                                                              MD5

                                                                                                                                                              002287b5dfe53d87c189f368c7f785b5

                                                                                                                                                              SHA1

                                                                                                                                                              00e6e0e224b5f391c0172008ec78ec5124153649

                                                                                                                                                              SHA256

                                                                                                                                                              b453afca000aef28c8f27a315a31f244c46755308dea8d9ad55d19a507471a6b

                                                                                                                                                              SHA512

                                                                                                                                                              c2b23dd13e3f1c009e2eb2e4aae7a9a4e713642a9031c1e51125c9f0c6c8c6430a2088dd5c20867a2e948c97ae9a9078535e96b5d06ea6c7bd7f67a2db2104aa

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Program Files\Kryptex\icudtl.dat
                                                                                                                                                              Filesize

                                                                                                                                                              9.7MB

                                                                                                                                                              MD5

                                                                                                                                                              224ba45e00bbbb237b34f0facbb550bf

                                                                                                                                                              SHA1

                                                                                                                                                              1b0f81da88149d9c610a8edf55f8f12a87ca67de

                                                                                                                                                              SHA256

                                                                                                                                                              8dee674ccd2387c14f01b746779c104e383d57b36c2bdc8e419c470a3d5ffadc

                                                                                                                                                              SHA512

                                                                                                                                                              c04d271288dd2eff89d91e31829586706eba95ffbab0b75c2d202a4037e66a4e2205e8a37ecf15116302c51239b1826064ed4670a3346439470b260aba0ea784

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Program Files\Kryptex\libEGL.dll
                                                                                                                                                              Filesize

                                                                                                                                                              432KB

                                                                                                                                                              MD5

                                                                                                                                                              6efa8068776b4eadb3b9dfdef089ca68

                                                                                                                                                              SHA1

                                                                                                                                                              fa2023ecbcae030cddff3188c9d3c906cc69a64f

                                                                                                                                                              SHA256

                                                                                                                                                              fa59945648614e0ebf9f8eaf63500347da59a0d2e7484b6b5d4be6cf6ee917de

                                                                                                                                                              SHA512

                                                                                                                                                              70e6749841a384daa65f284c5d7a8afa358b03b38cc091819aa5545960834b9b4a394eccc19c0a1e290c5b33fbaaa56bd1d6d988b5da0a34e2e56dacde5b17d4

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Program Files\Kryptex\libGLESv2.dll
                                                                                                                                                              Filesize

                                                                                                                                                              7.8MB

                                                                                                                                                              MD5

                                                                                                                                                              cdc3935fa97855b4f9d692702ea95ef9

                                                                                                                                                              SHA1

                                                                                                                                                              68939afd7f1f4a470d9328b068250c0b5fbab2c2

                                                                                                                                                              SHA256

                                                                                                                                                              eea91ba71fdec104e8d7c9fd24687ec4f1c308d79d6730ef58127a92025cc006

                                                                                                                                                              SHA512

                                                                                                                                                              3cdbd833e8311023d673315c2aebc8e19a17e5767dfa40ca2646ee094eeef27117961f581aaa4584fc639e9ec0195f98ea5454b397cf1cd2709b7772207381b5

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Program Files\Kryptex\locales\en-US.pak
                                                                                                                                                              Filesize

                                                                                                                                                              95KB

                                                                                                                                                              MD5

                                                                                                                                                              a986c722c10b0639d00250468bb41100

                                                                                                                                                              SHA1

                                                                                                                                                              7d5d7188ec4723f32bfb13e3573db39b234d934b

                                                                                                                                                              SHA256

                                                                                                                                                              cb40b01d42057e1aa9a3660afa5db2507e4dadb9b23099ab087c4ff14a99d5e9

                                                                                                                                                              SHA512

                                                                                                                                                              768145c6dd70e9d3df09cbabb0562249442e86369c6d60d27b2408b8e9d767899911bcc254c0aedc0d29705ab51367a08ff1e25e387a5eb6daae5365c2082d81

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Program Files\Kryptex\resources.pak
                                                                                                                                                              Filesize

                                                                                                                                                              4.6MB

                                                                                                                                                              MD5

                                                                                                                                                              d98298d188d7ebed9b3e89a822f95df7

                                                                                                                                                              SHA1

                                                                                                                                                              a50523cc15f47abb6f1b50982db454e4e956ebc8

                                                                                                                                                              SHA256

                                                                                                                                                              0acd9cafd7c4fac398e85a6e008bad6d7ad34f90b0bfd207df330d3e69bcfa75

                                                                                                                                                              SHA512

                                                                                                                                                              24cd58294f12f0541d49d180c23b89796596a599d1fc4346d8155b552d765bad0e759c85dded98cf4f3c74ec150b98baf27528f0e864fd37f71dd41c90345791

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Program Files\Kryptex\resources\app.asar
                                                                                                                                                              Filesize

                                                                                                                                                              49.5MB

                                                                                                                                                              MD5

                                                                                                                                                              8c337b5f01bd3f9628ea513dbb2eb7f7

                                                                                                                                                              SHA1

                                                                                                                                                              9090597fb41c9527a17eaf23fd679eccf99b150e

                                                                                                                                                              SHA256

                                                                                                                                                              4043dc892963956232ee95734f5c4d9b1f4848190d5177cca2d1248ef2a4786e

                                                                                                                                                              SHA512

                                                                                                                                                              676938726779e894b8fb87e35894521667df6378d47b48debc8df309954a0bd570f69ed7397a6ce6cad1471593fa45946ac7780ef1b9369100dc3cdd6f7c3344

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\7zip-bin\index.js
                                                                                                                                                              Filesize

                                                                                                                                                              500B

                                                                                                                                                              MD5

                                                                                                                                                              9fe8a485038be54d687ad7dd9dff80d3

                                                                                                                                                              SHA1

                                                                                                                                                              76fc7b47a329b759539bca0b785ad41c083c29be

                                                                                                                                                              SHA256

                                                                                                                                                              48659f660a13b5fa01622f87dc8a5306ce7c232abf93b82a3b2f6e94c2cf5c86

                                                                                                                                                              SHA512

                                                                                                                                                              0f3b2ce074ede02079bdab4229f6d4ded5eb7ec64546c3b9f103114aabb35093fecfd04677a0a84d3691fb49bae8a6c5489cee946c7f5f4b86aec3e96434dfac

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\7zip-bin\package.json
                                                                                                                                                              Filesize

                                                                                                                                                              244B

                                                                                                                                                              MD5

                                                                                                                                                              2a3677c6c6bba9a148bc83c2f145d136

                                                                                                                                                              SHA1

                                                                                                                                                              1b828bd2e2b4eaaed8e68821692a0bf87bdd54db

                                                                                                                                                              SHA256

                                                                                                                                                              acabcd4f1c0b7399de4c213e8fdfd5d064f29e278f94bd5b763d8ac8555e2c18

                                                                                                                                                              SHA512

                                                                                                                                                              907651c11e31ce7c8242c825033e168c04a185e4717d6c28b1c77a48317ef662419c833300198fc6292721299905d7fe32069307bcc5751e3192e50c3c26209b

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\index.js
                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              MD5

                                                                                                                                                              976fc725b3643055a0ab0f1944b7b55c

                                                                                                                                                              SHA1

                                                                                                                                                              2728f42cd6889a0abb26a41d20a2e38fe8ea9d0f

                                                                                                                                                              SHA256

                                                                                                                                                              3e0b1ed5c6efb4e5b8afa244e4ee0a303180bed5d8d747177a1149e6e6bd77d5

                                                                                                                                                              SHA512

                                                                                                                                                              c31f0e83ee990b48324c4813b42ac41b47799be3ec8b009a667b22bd872a0414ef451d5df25e83f4ff910cda6d9a8814348d0ee3a519bf86d885045687568a0d

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\amd-binding\package.json
                                                                                                                                                              Filesize

                                                                                                                                                              390B

                                                                                                                                                              MD5

                                                                                                                                                              1c1ab1eaac9d44cf7ba78abab3314f8b

                                                                                                                                                              SHA1

                                                                                                                                                              bc141359f6383fc6329fcd6bd60a7396074c5011

                                                                                                                                                              SHA256

                                                                                                                                                              1c1f9fa4f21bfdc05088b3d3e76d46a01a0a3eac388f2bf59584c96e5b00b15a

                                                                                                                                                              SHA512

                                                                                                                                                              7fc6d56c0abdacaab94e459dc656a92ef625295df47580386db4d88cb339089f1735cf6dff36188936b3197a917f6ea15bc90aefc9b612b4876a7258fa9ab5f4

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\pagefile\index.js
                                                                                                                                                              Filesize

                                                                                                                                                              482B

                                                                                                                                                              MD5

                                                                                                                                                              f63893525bdabde99f42c544015b11ff

                                                                                                                                                              SHA1

                                                                                                                                                              85f947a7ccdc35df4796acc6b573c3e870fe12f8

                                                                                                                                                              SHA256

                                                                                                                                                              9b1588849017bb512ed2958133e2ee04d7703787246152440526513db0f72722

                                                                                                                                                              SHA512

                                                                                                                                                              b027ad668123b8d3f2eb7895b8afcb1b6d5439bb7efedc6d9b4cff8d198a46449bbe1f8ea0e5facc358fd60efda6bd392f26adf08a2d73e0de0359ce60be09c1

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Program Files\Kryptex\resources\app.asar.unpacked\node_modules\kryptex-backend\node_modules\pagefile\package.json
                                                                                                                                                              Filesize

                                                                                                                                                              294B

                                                                                                                                                              MD5

                                                                                                                                                              c1ef8b1c92d16bf52d8feb92fa29ab32

                                                                                                                                                              SHA1

                                                                                                                                                              c98865f894ec3c1ccd2310bca105d1872f9fe921

                                                                                                                                                              SHA256

                                                                                                                                                              8890db4f7f1d77acfae56339d378f8244e5ff5c867409464085ca22bea064a08

                                                                                                                                                              SHA512

                                                                                                                                                              07c36e200f5bf875475a54f6dd183a16bacfbb99be5c004c9d795e579ed4b40745235c3c7c67cf624e475aad4e7577cf6c34b03a21aea8d2a2d383234111d761

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Program Files\Kryptex\v8_context_snapshot.bin
                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              MD5

                                                                                                                                                              1c153a96607d3e2c38f11a396533fc80

                                                                                                                                                              SHA1

                                                                                                                                                              42d11efbaa549ade29c341e6b8ad5a0545047c62

                                                                                                                                                              SHA256

                                                                                                                                                              18ad1a1abeec0230f2a3e38a80c00d4e298bb55d2bb76a2c8e8b113814023815

                                                                                                                                                              SHA512

                                                                                                                                                              c3ed01af43532d75c845152f35e844f730f6c7ee14f59ef77222a9b62c52354b4c995fc32b95369d888353da56c308dd32cdec97d34d2aab968e426018416248

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Program Files\Kryptex\vk_swiftshader.dll
                                                                                                                                                              Filesize

                                                                                                                                                              4.4MB

                                                                                                                                                              MD5

                                                                                                                                                              e8ae323ba929d42e9e1b8112b47a7af2

                                                                                                                                                              SHA1

                                                                                                                                                              8c78eba22be420ea3094aff6b2dd35587805c012

                                                                                                                                                              SHA256

                                                                                                                                                              081210e45740985a91a25c7ea057761c89b619375af64e0b7d37d3d4b57de490

                                                                                                                                                              SHA512

                                                                                                                                                              649d1483bfa2e8bce5c1143639534b5b612d613156f59b6ec1fbb3ce96242a6018f15c59471627f1ece7c9a59e3ee8031d10e51fcbbbca776675dd4a26898693

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Program Files\Kryptex\vk_swiftshader_icd.json
                                                                                                                                                              Filesize

                                                                                                                                                              106B

                                                                                                                                                              MD5

                                                                                                                                                              8642dd3a87e2de6e991fae08458e302b

                                                                                                                                                              SHA1

                                                                                                                                                              9c06735c31cec00600fd763a92f8112d085bd12a

                                                                                                                                                              SHA256

                                                                                                                                                              32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

                                                                                                                                                              SHA512

                                                                                                                                                              f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Program Files\Kryptex\vulkan-1.dll
                                                                                                                                                              Filesize

                                                                                                                                                              711KB

                                                                                                                                                              MD5

                                                                                                                                                              e2b4f5e5fa717ccd9cf32c5cb45691f6

                                                                                                                                                              SHA1

                                                                                                                                                              6adb41cb87757eb218af0df932273dd2a63e5e3f

                                                                                                                                                              SHA256

                                                                                                                                                              7fa723cd735f2ddffb146c838ac2542edbd1119e3df1864ec47c5e77ac30b8d2

                                                                                                                                                              SHA512

                                                                                                                                                              cab830d0027a7fcca934129cc83165d99f7c15c5b1d70c3bc74c2ad64003e2236bd43165b48124d0b5ca96a9e5eb1db5464ce9f69c3209dbc54c428db1df7e8b

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                              Filesize

                                                                                                                                                              2KB

                                                                                                                                                              MD5

                                                                                                                                                              968cb9309758126772781b83adb8a28f

                                                                                                                                                              SHA1

                                                                                                                                                              8da30e71accf186b2ba11da1797cf67f8f78b47c

                                                                                                                                                              SHA256

                                                                                                                                                              92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                                                                                                                                                              SHA512

                                                                                                                                                              4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                              Filesize

                                                                                                                                                              18KB

                                                                                                                                                              MD5

                                                                                                                                                              d0766507690163a86c9044bdb0b119c1

                                                                                                                                                              SHA1

                                                                                                                                                              d3f5c4bf18510204b07eed6f8f08c235df1a667f

                                                                                                                                                              SHA256

                                                                                                                                                              af456a54a668d7782b56d393d944b237da394a9c3da3181e50cb5ed80e2f627c

                                                                                                                                                              SHA512

                                                                                                                                                              e423fc2da99153ad66f22df58d77c391954e189ca2e988914bedc0baa0ee3c2ba2bcf2430ab0e33793d6c0ac9b18ac5a912d28edf9bf6ae3d09dac8b4922d809

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                              Filesize

                                                                                                                                                              18KB

                                                                                                                                                              MD5

                                                                                                                                                              65bcbbf248fe37201462a7d266dbbeb3

                                                                                                                                                              SHA1

                                                                                                                                                              5cdc60a741762c75790fa9e5f246fa5204538198

                                                                                                                                                              SHA256

                                                                                                                                                              11878e45535ae5ea966e69bcab02ac7d834a3ebe4d9195a6365cdd9cdb545565

                                                                                                                                                              SHA512

                                                                                                                                                              ed8aa5c302256c6e64867b004b24df36a2a7e9e4e5477d7b4777152e4730b2384a9b018cffaa101ef7c4d8a7e8aec4a24945206663078ac749f7a3c11f023dd7

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1626273c-6a02-4d06-86bc-c7af6e842150.tmp.node
                                                                                                                                                              Filesize

                                                                                                                                                              147KB

                                                                                                                                                              MD5

                                                                                                                                                              5cb6b3762df753d84e4ffd4afe1a7e1c

                                                                                                                                                              SHA1

                                                                                                                                                              ae2b1c4652aec7315607fc413a4c258f11b69544

                                                                                                                                                              SHA256

                                                                                                                                                              48b7275f47cd44a05d349eb4fdb6cfc451ccbf609a4a56fa34452bcf231c1208

                                                                                                                                                              SHA512

                                                                                                                                                              5723c10ea9c26524f7866b9c749d9887b10c1514bf0cc893ba2a6e9c5d9690015cbcbe024653956af3fb842de3290b4c6c4beb051b67480bdae543d8fd3981cc

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\598c9399-9e6d-486c-a6a7-20bf590c7864.tmp.node
                                                                                                                                                              Filesize

                                                                                                                                                              148KB

                                                                                                                                                              MD5

                                                                                                                                                              4dc971c52b14a3843564fb0ce8a6a0c1

                                                                                                                                                              SHA1

                                                                                                                                                              5b19af49368e4f067cbc73af7b2b54bf2dc8efee

                                                                                                                                                              SHA256

                                                                                                                                                              27ec96008c48052d5f493683297c26b9136f1d6a9e73c3722e243bc959d7cc93

                                                                                                                                                              SHA512

                                                                                                                                                              52510b4c20146e635656814e7088464399cd4ca2d64ca67ee2b116ab4631918e092d90462fc450d610154b3284579cb8b7d0ca7bbc3a6eae6b0a348ccffd04dc

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7e5798b1-1cf6-4a75-b2d3-b07fc774c92d.tmp.node
                                                                                                                                                              Filesize

                                                                                                                                                              761KB

                                                                                                                                                              MD5

                                                                                                                                                              dc2791bf78b39ef568ba7bb495dedb98

                                                                                                                                                              SHA1

                                                                                                                                                              2d80d8c47096b8eec1945094797c9466762f3c1f

                                                                                                                                                              SHA256

                                                                                                                                                              eb1a2a0903c456db115ac01742afb3fbd4af8598e809c8f52e5b1fde2d5fe36a

                                                                                                                                                              SHA512

                                                                                                                                                              21780f4198695410fa87237d0d2c60ae2fae109ef0c66606b959072de7cc7216b3825af1c6f4797e1748b22b8bfecf33f24d16ad76a4e2501b1ba8dcdecf1407

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7fb78689-58e7-45da-a0ba-d296a2f85dae.tmp.node
                                                                                                                                                              Filesize

                                                                                                                                                              1.5MB

                                                                                                                                                              MD5

                                                                                                                                                              1f45de1aba2eb5820440183939e6107f

                                                                                                                                                              SHA1

                                                                                                                                                              c08e9af17578469a1692ee86e2d94ecdac5542b0

                                                                                                                                                              SHA256

                                                                                                                                                              0b8ec764bc98bc2fe44b0e3e3b398ddc9e82670663bd14c9e4a0cafec9c2713c

                                                                                                                                                              SHA512

                                                                                                                                                              bceebc835173eb542466b1a4f6f21c1eabd492ac9a86413e0b61194ef7b97f1310a54710dd4ae828b8ba7a52dc8db8caf95bdd7a8d0aa1348d9f83b97a04f25b

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gz3chz3q.f55.ps1
                                                                                                                                                              Filesize

                                                                                                                                                              60B

                                                                                                                                                              MD5

                                                                                                                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                              SHA1

                                                                                                                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                              SHA256

                                                                                                                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                              SHA512

                                                                                                                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\nsy4E3B.tmp\SpiderBanner.dll
                                                                                                                                                              Filesize

                                                                                                                                                              9KB

                                                                                                                                                              MD5

                                                                                                                                                              17309e33b596ba3a5693b4d3e85cf8d7

                                                                                                                                                              SHA1

                                                                                                                                                              7d361836cf53df42021c7f2b148aec9458818c01

                                                                                                                                                              SHA256

                                                                                                                                                              996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

                                                                                                                                                              SHA512

                                                                                                                                                              1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\nsy4E3B.tmp\StdUtils.dll
                                                                                                                                                              Filesize

                                                                                                                                                              100KB

                                                                                                                                                              MD5

                                                                                                                                                              c6a6e03f77c313b267498515488c5740

                                                                                                                                                              SHA1

                                                                                                                                                              3d49fc2784b9450962ed6b82b46e9c3c957d7c15

                                                                                                                                                              SHA256

                                                                                                                                                              b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

                                                                                                                                                              SHA512

                                                                                                                                                              9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\nsy4E3B.tmp\System.dll
                                                                                                                                                              Filesize

                                                                                                                                                              12KB

                                                                                                                                                              MD5

                                                                                                                                                              0d7ad4f45dc6f5aa87f606d0331c6901

                                                                                                                                                              SHA1

                                                                                                                                                              48df0911f0484cbe2a8cdd5362140b63c41ee457

                                                                                                                                                              SHA256

                                                                                                                                                              3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

                                                                                                                                                              SHA512

                                                                                                                                                              c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\nsy4E3B.tmp\WinShell.dll
                                                                                                                                                              Filesize

                                                                                                                                                              3KB

                                                                                                                                                              MD5

                                                                                                                                                              1cc7c37b7e0c8cd8bf04b6cc283e1e56

                                                                                                                                                              SHA1

                                                                                                                                                              0b9519763be6625bd5abce175dcc59c96d100d4c

                                                                                                                                                              SHA256

                                                                                                                                                              9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

                                                                                                                                                              SHA512

                                                                                                                                                              7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\nsy4E3B.tmp\nsExec.dll
                                                                                                                                                              Filesize

                                                                                                                                                              6KB

                                                                                                                                                              MD5

                                                                                                                                                              ec0504e6b8a11d5aad43b296beeb84b2

                                                                                                                                                              SHA1

                                                                                                                                                              91b5ce085130c8c7194d66b2439ec9e1c206497c

                                                                                                                                                              SHA256

                                                                                                                                                              5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

                                                                                                                                                              SHA512

                                                                                                                                                              3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\nsy4E3B.tmp\nsProcess.dll
                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              MD5

                                                                                                                                                              f0438a894f3a7e01a4aae8d1b5dd0289

                                                                                                                                                              SHA1

                                                                                                                                                              b058e3fcfb7b550041da16bf10d8837024c38bf6

                                                                                                                                                              SHA256

                                                                                                                                                              30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

                                                                                                                                                              SHA512

                                                                                                                                                              f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\nsy4E3B.tmp\nsis7z.dll
                                                                                                                                                              Filesize

                                                                                                                                                              424KB

                                                                                                                                                              MD5

                                                                                                                                                              80e44ce4895304c6a3a831310fbf8cd0

                                                                                                                                                              SHA1

                                                                                                                                                              36bd49ae21c460be5753a904b4501f1abca53508

                                                                                                                                                              SHA256

                                                                                                                                                              b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

                                                                                                                                                              SHA512

                                                                                                                                                              c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Kryptex\Crashpad\settings.dat
                                                                                                                                                              Filesize

                                                                                                                                                              40B

                                                                                                                                                              MD5

                                                                                                                                                              b90cb4cd9ad269722fd3d5d9787b6a46

                                                                                                                                                              SHA1

                                                                                                                                                              d50a179138893f34d655a47108e9b6df82dbdf70

                                                                                                                                                              SHA256

                                                                                                                                                              eb295145f36763de4ceb3e54319ccb2cd0d624343342f47250b837aab7343c91

                                                                                                                                                              SHA512

                                                                                                                                                              8c9723f46f127dff297272144f74f14d5bb1094935b7d068bc5ad0091137bd28ceb1cbafb64a647408c8fe69339de7ac8f65428e3df70063327e05f92e80623a

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Kryptex\Network Persistent State
                                                                                                                                                              Filesize

                                                                                                                                                              190B

                                                                                                                                                              MD5

                                                                                                                                                              144b52099522740457fb7554fc115877

                                                                                                                                                              SHA1

                                                                                                                                                              f8f27104c8c63d9f8d15b0dbfc69bd56074e222d

                                                                                                                                                              SHA256

                                                                                                                                                              7c403f84d980c75ea64d984e09e536e54869b80ccba91cec24d739238aacf984

                                                                                                                                                              SHA512

                                                                                                                                                              2e891bf8e7bfab586793d51ba520fb1e1f0d0100b76e76054f176873cf4353569e4165836dce4438af950561f0cf181ea6ee4635b1ceb1f4a45a919c0b68db8e

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Kryptex\Network Persistent State~RFe59ebae.TMP
                                                                                                                                                              Filesize

                                                                                                                                                              59B

                                                                                                                                                              MD5

                                                                                                                                                              2800881c775077e1c4b6e06bf4676de4

                                                                                                                                                              SHA1

                                                                                                                                                              2873631068c8b3b9495638c865915be822442c8b

                                                                                                                                                              SHA256

                                                                                                                                                              226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

                                                                                                                                                              SHA512

                                                                                                                                                              e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Kryptex\sentry\queue\ea937d52bfa84932bffc6da87b4f4aba
                                                                                                                                                              Filesize

                                                                                                                                                              7KB

                                                                                                                                                              MD5

                                                                                                                                                              67d7cf9a6ddff0838f2aec5b2b5e73d9

                                                                                                                                                              SHA1

                                                                                                                                                              62325b522f30e525780f3404dba57aa952071fff

                                                                                                                                                              SHA256

                                                                                                                                                              25296dcdd975c1076e6ddd3568b77d74101ee0e4faf004c87d841f38eead8c26

                                                                                                                                                              SHA512

                                                                                                                                                              0aa2088fca4adf778caeafed77439935a5896970e64aef436b4b8d9393d8e710591fa1f520cd24c4deaeb7db1a5443271c2232b528e2a4e3b44da0e6215abb52

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Kryptex\sentry\scope_v2.json
                                                                                                                                                              Filesize

                                                                                                                                                              7KB

                                                                                                                                                              MD5

                                                                                                                                                              b411f6a31c651a4243d5aa1fbabf9fa8

                                                                                                                                                              SHA1

                                                                                                                                                              70a1557bff160db53d35213633ccdd9277b65962

                                                                                                                                                              SHA256

                                                                                                                                                              27e8ea0192ffa9daa0c48ae96d05d41f878a5c899e7732e23c2ec5e9b161b529

                                                                                                                                                              SHA512

                                                                                                                                                              d5008fbfd21730b2c6c46275330f6137e8c5235e58ff4eceaaa7f8b9a4e393ce21bfddef5267884456bcc2d3644c358e08532e5b1ddbdf5ea6aeae6fcb14b842

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                                                                                                              Filesize

                                                                                                                                                              2B

                                                                                                                                                              MD5

                                                                                                                                                              f3b25701fe362ec84616a93a45ce9998

                                                                                                                                                              SHA1

                                                                                                                                                              d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                                                                                                                                              SHA256

                                                                                                                                                              b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                                                                                                                                              SHA512

                                                                                                                                                              98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                                                                                                                                              Download Submit

                                                                                                                                                            • memory/828-52-0x0000000007650000-0x00000000076E6000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              600KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/828-45-0x00000000745F0000-0x0000000074DA0000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              7.7MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/828-13-0x00000000745FE000-0x00000000745FF000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/828-14-0x0000000004AC0000-0x0000000004AF6000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              216KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/828-16-0x00000000051D0000-0x00000000057F8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.2MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/828-15-0x00000000745F0000-0x0000000074DA0000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              7.7MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/828-17-0x00000000745F0000-0x0000000074DA0000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              7.7MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/828-18-0x0000000005800000-0x0000000005822000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              136KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/828-19-0x00000000059A0000-0x0000000005A06000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              408KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/828-20-0x0000000005A80000-0x0000000005AE6000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              408KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/828-30-0x0000000005AF0000-0x0000000005E44000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              3.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/828-31-0x0000000006090000-0x00000000060AE000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              120KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/828-32-0x0000000006130000-0x000000000617C000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              304KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/828-33-0x0000000007210000-0x0000000007242000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              200KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/828-34-0x0000000070A80000-0x0000000070ACC000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              304KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/828-60-0x00000000745F0000-0x0000000074DA0000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              7.7MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/828-57-0x0000000007640000-0x0000000007648000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              32KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/828-44-0x0000000007250000-0x000000000726E000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              120KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/828-56-0x0000000007710000-0x000000000772A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              104KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/828-55-0x0000000007600000-0x0000000007614000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              80KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/828-54-0x00000000075F0000-0x00000000075FE000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              56KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/828-53-0x00000000075C0000-0x00000000075D1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              68KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/828-51-0x0000000007420000-0x000000000742A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              40KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/828-50-0x00000000073C0000-0x00000000073DA000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              104KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/828-49-0x0000000007A00000-0x000000000807A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.5MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/828-47-0x0000000007280000-0x0000000007323000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              652KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/828-48-0x00000000745F0000-0x0000000074DA0000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              7.7MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/828-46-0x00000000745F0000-0x0000000074DA0000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              7.7MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2952-566-0x00000251B79A0000-0x00000251B7CF5000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              3.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2952-920-0x00000251B79A0000-0x00000251B7CF5000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              3.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2952-846-0x00000251B79A0000-0x00000251B7CF5000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              3.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2952-763-0x00000251B79A0000-0x00000251B7CF5000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              3.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2952-405-0x00007FFAE5CC0000-0x00007FFAE5CC1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2952-666-0x00000251B79A0000-0x00000251B7CF5000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              3.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3956-317-0x0000000005B00000-0x0000000005E54000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              3.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3956-328-0x00000000061E0000-0x000000000622C000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              304KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3956-341-0x00000000076A0000-0x00000000076B4000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              80KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3956-340-0x0000000007660000-0x0000000007671000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              68KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3956-339-0x0000000007100000-0x00000000071A3000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              652KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3956-329-0x0000000070290000-0x00000000702DC000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              304KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4564-742-0x0000020436B30000-0x0000020436B31000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4564-741-0x0000020436B30000-0x0000020436B31000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4564-738-0x0000020436B30000-0x0000020436B31000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4564-737-0x0000020436B30000-0x0000020436B31000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4564-730-0x0000020436B30000-0x0000020436B31000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4564-732-0x0000020436B30000-0x0000020436B31000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4564-731-0x0000020436B30000-0x0000020436B31000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4564-736-0x0000020436B30000-0x0000020436B31000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4564-739-0x0000020436B30000-0x0000020436B31000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4564-740-0x0000020436B30000-0x0000020436B31000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4896-77-0x0000000005840000-0x0000000005B94000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              3.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4896-90-0x00000000745F0000-0x0000000074DA0000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              7.7MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4896-79-0x0000000070A80000-0x0000000070ACC000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              304KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4896-80-0x00000000745F0000-0x0000000074DA0000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              7.7MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4896-67-0x00000000745F0000-0x0000000074DA0000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              7.7MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4896-66-0x00000000745F0000-0x0000000074DA0000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              7.7MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4896-65-0x00000000745F0000-0x0000000074DA0000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              7.7MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4896-92-0x00000000745F0000-0x0000000074DA0000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              7.7MB

                                                                                                                                                              Download