CrownX is the ransomware component of the Avalon malware framework. It encrypts files using Windows Cryptography API, delivers ransom notes with deadline timers, inhibits system recovery by deleting shadow copies, and damages disk structures to render systems unusable.