Analysis
- user interaction
yes - max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
24/10/2026, 17:20
General
- Target AeroSwap(1).exe
- Size 33.3MB
- Sample261024-vwpmbacz5m
- SHA256 2faa60d6b848da0b703513e5d4dfc3862cb6f0a7b875c2a5e44f44740aa2edab
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
- Installs a root certificate to the trusted certificate store 1 TTPs 64 IoCs
A root certificate was added to the trusted certificate store using CertUtil.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Drops file in Program Files directory 61 IoCs
- Modifies trusted root certificate store through registry 1 TTPs 14 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 24 IoCs
- Modifies system certificate store 2 TTPs 31 IoCs
- Suspicious behavior: EnumeratesProcesses 58 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AeroSwap(1).exe"C:\Users\Admin\AppData\Local\Temp\AeroSwap(1).exe"1⤵
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exe"reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v Security_HKLM_only /t REG_DWORD /d 1 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" query HKU2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exe"reg" add "HKEY_USERS\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v Security_HKLM_only /t REG_DWORD /d 1 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" query HKU2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exe"reg" add "HKEY_USERS\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v Security_HKLM_only /t REG_DWORD /d 1 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" query HKU2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exe"reg" add "HKEY_USERS\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\certutil.exe"certutil" -f -delstore Root 38A28A81A89A71CA078369073BD2F0597422983C2⤵
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -delstore Root 38A28A81A89A71CA078369073BD2F0597422983C2⤵
-
-
C:\Windows\system32\certutil.exe"certutil" -f -delstore CA 38A28A81A89A71CA078369073BD2F0597422983C2⤵
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -delstore CA 38A28A81A89A71CA078369073BD2F0597422983C2⤵
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_ca_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_ca_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_ca_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_ca_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_crl_1824.crl2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_crl_1824.crl2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_crl_1824.crl2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_crl_1824.crl2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_config_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_config_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_config_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_config_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_epic_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_epic_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_epic_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_epic_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -store Root 05969B177719D7613DBED10B7FBE4A0DD846EB7A2⤵
-
-
C:\Windows\system32\certutil.exe"certutil" -store Root 05969B177719D7613DBED10B7FBE4A0DD846EB7A2⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=AeroSwap(1).exe --webview-exe-version=2.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=1824.3164.6780565463003486422⤵
- Drops file in Program Files directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ff8049ab078,0x7ff8049ab084,0x7ff8049ab0903⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView" --webview-exe-name=AeroSwap(1).exe --webview-exe-version=2.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1716,i,9645131040469491479,14881713444614082346,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1652 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView" --webview-exe-name=AeroSwap(1).exe --webview-exe-version=2.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2064,i,9645131040469491479,14881713444614082346,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:33⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView" --webview-exe-name=AeroSwap(1).exe --webview-exe-version=2.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2396,i,9645131040469491479,14881713444614082346,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView" --webview-exe-name=AeroSwap(1).exe --webview-exe-version=2.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3592,i,9645131040469491479,14881713444614082346,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView" --webview-exe-name=AeroSwap(1).exe --webview-exe-version=2.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3920,i,9645131040469491479,14881713444614082346,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView" --webview-exe-name=AeroSwap(1).exe --webview-exe-version=2.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2236,i,9645131040469491479,14881713444614082346,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView" --webview-exe-name=AeroSwap(1).exe --webview-exe-version=2.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4260,i,9645131040469491479,14881713444614082346,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView" --webview-exe-name=AeroSwap(1).exe --webview-exe-version=2.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=756,i,9645131040469491479,14881713444614082346,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView" --webview-exe-name=AeroSwap(1).exe --webview-exe-version=2.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4440,i,9645131040469491479,14881713444614082346,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\reg.exe"reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v Security_HKLM_only /t REG_DWORD /d 1 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" query HKU2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exe"reg" add "HKEY_USERS\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v Security_HKLM_only /t REG_DWORD /d 1 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" query HKU2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exe"reg" add "HKEY_USERS\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\certutil.exe"certutil" -store Root 05969B177719D7613DBED10B7FBE4A0DD846EB7A2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v Security_HKLM_only /t REG_DWORD /d 1 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\reg.exe"reg" query HKU2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
- Modifies data under HKEY_USERS
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKEY_USERS\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\certutil.exe"certutil" -f -delstore Root 38A28A81A89A71CA078369073BD2F0597422983C2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v Security_HKLM_only /t REG_DWORD /d 1 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" query HKU2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\reg.exe"reg" add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -delstore Root 38A28A81A89A71CA078369073BD2F0597422983C2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKEY_USERS\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\certutil.exe"certutil" -f -delstore CA 38A28A81A89A71CA078369073BD2F0597422983C2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -delstore CA 38A28A81A89A71CA078369073BD2F0597422983C2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v Security_HKLM_only /t REG_DWORD /d 1 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" query HKU2⤵
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_ca_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\reg.exe"reg" add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
- Modifies data under HKEY_USERS
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\reg.exe"reg" add "HKEY_USERS\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\certutil.exe"certutil" -f -delstore Root 38A28A81A89A71CA078369073BD2F0597422983C2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -delstore Root 38A28A81A89A71CA078369073BD2F0597422983C2⤵
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_ca_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\certutil.exe"certutil" -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_ca_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -f -delstore CA 38A28A81A89A71CA078369073BD2F0597422983C2⤵
-
-
C:\Windows\system32\certutil.exe"certutil" -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_ca_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -delstore CA 38A28A81A89A71CA078369073BD2F0597422983C2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_ca_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_crl_1824.crl2⤵
- Installs a root certificate to the trusted certificate store
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_ca_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_crl_1824.crl2⤵
- Installs a root certificate to the trusted certificate store
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\certutil.exe"certutil" -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_ca_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_crl_1824.crl2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_crl_1824.crl2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_ca_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_config_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_crl_1824.crl2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_crl_1824.crl2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_config_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\certutil.exe"certutil" -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_crl_1824.crl2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_config_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\certutil.exe"certutil" -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_config_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_epic_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_crl_1824.crl2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_config_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_epic_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_epic_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_config_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_epic_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -store Root 05969B177719D7613DBED10B7FBE4A0DD846EB7A2⤵
-
-
C:\Windows\system32\certutil.exe"certutil" -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_config_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_config_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_epic_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_epic_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_epic_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_epic_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -store Root 05969B177719D7613DBED10B7FBE4A0DD846EB7A2⤵
-
-
C:\Windows\system32\certutil.exe"certutil" -store Root 05969B177719D7613DBED10B7FBE4A0DD846EB7A2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\reg.exe"reg" add "HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v Security_HKLM_only /t REG_DWORD /d 1 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" query HKU2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exe"reg" add "HKEY_USERS\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v Security_HKLM_only /t REG_DWORD /d 1 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" query HKU2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exe"reg" add "HKEY_USERS\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\attrib.exe"attrib" -r -h -s C:\Windows\System32\drivers\etc\hosts2⤵
- Drops file in Drivers directory
- Views/modifies file attributes
-
-
C:\Windows\system32\certutil.exe"certutil" -store Root 05969B177719D7613DBED10B7FBE4A0DD846EB7A2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v Security_HKLM_only /t REG_DWORD /d 1 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" query HKU2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exe"reg" add "HKEY_USERS\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\certutil.exe"certutil" -store Root 05969B177719D7613DBED10B7FBE4A0DD846EB7A2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v Security_HKLM_only /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\reg.exe"reg" query HKU2⤵
-
-
C:\Windows\system32\reg.exe"reg" add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\reg.exe"reg" add "HKEY_USERS\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f2⤵
-
-
C:\Windows\system32\certutil.exe"certutil" -f -delstore Root 38A28A81A89A71CA078369073BD2F0597422983C2⤵
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -delstore Root 38A28A81A89A71CA078369073BD2F0597422983C2⤵
-
-
C:\Windows\system32\certutil.exe"certutil" -f -delstore CA 38A28A81A89A71CA078369073BD2F0597422983C2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -delstore CA 38A28A81A89A71CA078369073BD2F0597422983C2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_ca_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_ca_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\certutil.exe"certutil" -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_ca_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\certutil.exe"certutil" -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_ca_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_crl_1824.crl2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_crl_1824.crl2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_crl_1824.crl2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_crl_1824.crl2⤵
- Installs a root certificate to the trusted certificate store
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_config_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_config_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_config_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\certutil.exe"certutil" -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_config_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_epic_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -user -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_epic_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\certutil.exe"certutil" -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_epic_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
-
C:\Windows\system32\certutil.exe"certutil" -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_epic_1824.crt2⤵
- Installs a root certificate to the trusted certificate store
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\certutil.exe"certutil" -store Root 05969B177719D7613DBED10B7FBE4A0DD846EB7A2⤵
-
-
C:\Windows\system32\certutil.exe"certutil" -store Root 05969B177719D7613DBED10B7FBE4A0DD846EB7A2⤵
-
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1Subvert Trust Controls
3Install Root Certificate
3Replay Monitor
Loading Replay Monitor...
Downloads
crl-set
manifest.fingerprint
protocols.json
verified_contents.json
hyph-af.hyb
hyph-be.hyb
hyph-bg.hyb
hyph-cs.hyb
hyph-cu.hyb
hyph-cy.hyb
hyph-da.hyb
hyph-de-1901.hyb
hyph-de-1996.hyb
hyph-de-ch-1901.hyb
hyph-el.hyb
hyph-en-gb.hyb
hyph-en-us.hyb
hyph-es.hyb
hyph-et.hyb
hyph-eu.hyb
hyph-fr.hyb
hyph-ga.hyb
hyph-gl.hyb
hyph-gu.hyb
hyph-hr.hyb
hyph-hu.hyb
hyph-hy.hyb
hyph-it.hyb
hyph-ka.hyb
hyph-kn.hyb
hyph-la.hyb
hyph-lt.hyb
hyph-lv.hyb
hyph-ml.hyb
hyph-mn-cyrl.hyb
hyph-mul-ethi.hyb
hyph-nl.hyb
hyph-or.hyb
hyph-pa.hyb
hyph-pt.hyb
hyph-ru.hyb
hyph-sk.hyb
hyph-sl.hyb
hyph-sq.hyb
hyph-sv.hyb
hyph-ta.hyb
hyph-te.hyb
hyph-tk.hyb
hyph-uk.hyb
hyph-und-ethi.hyb
manifest.fingerprint
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
velocityrl_user_ca_1824.crt
velocityrl_user_crl_1824.crl
velocityrl_user_leaf_config_1824.crt
velocityrl_user_leaf_epic_1824.crt
795cc4f5-57e1-4c43-b822-a33319054fb5.tmp
97e343ea-c601-4d61-8e9d-3e55fea1c0d5.tmp
9f216abc-c016-45dc-a073-25104c42e375.tmp
manifest.fingerprint
manifest.json
manifest.json
settings.dat
settings.dat
throttle_store.dat
55d00b95-4870-46c4-a686-5f4d83cd9adb.tmp
temp-index
the-real-index
index
data_0
data_1
data_2
data_3
9ba55038-4931-4521-b0fb-15dbd661d510.tmp
Network Persistent State
SCT Auditing Pending Reports
Preferences
MANIFEST-000001
CURRENT
Local State
bdcf6c4e-101f-47f2-956a-330052461212.tmp
dc83c02a-bea3-4df8-b9cd-5a7614f49255.tmp
hyph-as.hyb
hyph-hi.hyb
hyph-nb.hyb
manifest.json
launch.log
launch.log
launch.log
launch.log
launch.log
psynet_config.json
hosts
memory/640-739-0x000001F2304C0000-0x000001F2304C1000-memory.dmp
memory/640-738-0x000001F2304C0000-0x000001F2304C1000-memory.dmp
memory/640-735-0x000001F2304C0000-0x000001F2304C1000-memory.dmp
memory/640-736-0x000001F2304C0000-0x000001F2304C1000-memory.dmp
memory/640-737-0x000001F2304C0000-0x000001F2304C1000-memory.dmp
memory/640-729-0x000001F2304C0000-0x000001F2304C1000-memory.dmp
memory/640-731-0x000001F2304C0000-0x000001F2304C1000-memory.dmp
memory/640-730-0x000001F2304C0000-0x000001F2304C1000-memory.dmp
memory/640-741-0x000001F2304C0000-0x000001F2304C1000-memory.dmp
memory/640-740-0x000001F2304C0000-0x000001F2304C1000-memory.dmp
memory/1656-93-0x00007FF821750000-0x00007FF821751000-memory.dmp
memory/1656-94-0x00007FF821E90000-0x00007FF821E91000-memory.dmp
memory/2068-156-0x00007FF8215A0000-0x00007FF8215A1000-memory.dmp
memory/3364-37-0x00007FF8215A0000-0x00007FF8215A1000-memory.dmp
memory/3364-297-0x000001DDB9B80000-0x000001DDB9D21000-memory.dmp