Overview

overview

8

Static

static

3

AeroSwap(1).exe

windows10-2004-x64

8

AeroSwap(1).exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/10/2026, 17:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    AeroSwap(1).exe
  • Size 33.3MB
  • Sample261024-vwpmbacz5m
  • SHA256 2faa60d6b848da0b703513e5d4dfc3862cb6f0a7b875c2a5e44f44740aa2edab
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryspywaretrojan

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Installs a root certificate to the trusted certificate store 1 TTPs 64 IoCs

    A root certificate was added to the trusted certificate store using CertUtil.

    defense_evasion
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in Windows directory 12 IoCs
  • Modifies trusted root certificate store through registry 1 TTPs 9 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 24 IoCs
  • Modifies system certificate store 2 TTPs 29 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\AeroSwap(1).exe
    "C:\Users\Admin\AppData\Local\Temp\AeroSwap(1).exe"
    1⤵
    • Drops file in Drivers directory
    • Checks whether UAC is enabled
    • Modifies trusted root certificate store through registry
    • Reads the TCP/IP host and domain name from the registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1096
    • C:\Windows\system32\reg.exe
      "reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
      2⤵
        PID:4924
      • C:\Windows\system32\reg.exe
        "reg" add "HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
        2⤵
          PID:4104
        • C:\Windows\system32\reg.exe
          "reg" add "HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
          2⤵
            PID:5816
          • C:\Windows\system32\reg.exe
            "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
            2⤵
              PID:4068
            • C:\Windows\system32\reg.exe
              "reg" add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
              2⤵
                PID:3552
              • C:\Windows\system32\reg.exe
                "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v Security_HKLM_only /t REG_DWORD /d 1 /f
                2⤵
                  PID:2948
                • C:\Windows\system32\reg.exe
                  "reg" query HKU
                  2⤵
                    PID:2924
                  • C:\Windows\system32\reg.exe
                    "reg" add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                    2⤵
                    • Modifies data under HKEY_USERS
                    PID:2972
                  • C:\Windows\system32\reg.exe
                    "reg" add "HKEY_USERS\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                    2⤵
                      PID:5708
                    • C:\Windows\system32\reg.exe
                      "reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                      2⤵
                        PID:2352
                      • C:\Windows\system32\reg.exe
                        "reg" add "HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                        2⤵
                          PID:5820
                        • C:\Windows\system32\reg.exe
                          "reg" add "HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                          2⤵
                            PID:4136
                          • C:\Windows\system32\reg.exe
                            "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                            2⤵
                              PID:4800
                            • C:\Windows\system32\reg.exe
                              "reg" add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                              2⤵
                                PID:2752
                              • C:\Windows\system32\reg.exe
                                "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v Security_HKLM_only /t REG_DWORD /d 1 /f
                                2⤵
                                  PID:1688
                                • C:\Windows\system32\reg.exe
                                  "reg" query HKU
                                  2⤵
                                    PID:3296
                                  • C:\Windows\system32\reg.exe
                                    "reg" add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                    2⤵
                                    • Modifies data under HKEY_USERS
                                    PID:3144
                                  • C:\Windows\system32\reg.exe
                                    "reg" add "HKEY_USERS\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                    2⤵
                                      PID:1596
                                    • C:\Windows\system32\reg.exe
                                      "reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                      2⤵
                                        PID:4288
                                      • C:\Windows\system32\reg.exe
                                        "reg" add "HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                        2⤵
                                          PID:3096
                                        • C:\Windows\system32\reg.exe
                                          "reg" add "HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                          2⤵
                                            PID:4956
                                          • C:\Windows\system32\reg.exe
                                            "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                            2⤵
                                              PID:3708
                                            • C:\Windows\system32\reg.exe
                                              "reg" add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                              2⤵
                                                PID:2112
                                              • C:\Windows\system32\reg.exe
                                                "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v Security_HKLM_only /t REG_DWORD /d 1 /f
                                                2⤵
                                                  PID:1944
                                                • C:\Windows\system32\reg.exe
                                                  "reg" query HKU
                                                  2⤵
                                                    PID:3316
                                                  • C:\Windows\system32\reg.exe
                                                    "reg" add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                    2⤵
                                                    • Modifies data under HKEY_USERS
                                                    PID:3652
                                                  • C:\Windows\system32\reg.exe
                                                    "reg" add "HKEY_USERS\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                    2⤵
                                                      PID:928
                                                    • C:\Windows\system32\certutil.exe
                                                      "certutil" -f -delstore Root 38A28A81A89A71CA078369073BD2F0597422983C
                                                      2⤵
                                                        PID:3124
                                                      • C:\Windows\system32\certutil.exe
                                                        "certutil" -user -f -delstore Root 38A28A81A89A71CA078369073BD2F0597422983C
                                                        2⤵
                                                          PID:5468
                                                        • C:\Windows\system32\certutil.exe
                                                          "certutil" -f -delstore CA 38A28A81A89A71CA078369073BD2F0597422983C
                                                          2⤵
                                                            PID:4408
                                                          • C:\Windows\system32\certutil.exe
                                                            "certutil" -user -f -delstore CA 38A28A81A89A71CA078369073BD2F0597422983C
                                                            2⤵
                                                              PID:2560
                                                            • C:\Windows\system32\certutil.exe
                                                              "certutil" -user -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_ca_1096.crt
                                                              2⤵
                                                              • Installs a root certificate to the trusted certificate store
                                                              PID:4220
                                                            • C:\Windows\system32\certutil.exe
                                                              "certutil" -user -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_ca_1096.crt
                                                              2⤵
                                                              • Installs a root certificate to the trusted certificate store
                                                              PID:1412
                                                            • C:\Windows\system32\certutil.exe
                                                              "certutil" -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_ca_1096.crt
                                                              2⤵
                                                              • Installs a root certificate to the trusted certificate store
                                                              PID:2872
                                                            • C:\Windows\system32\certutil.exe
                                                              "certutil" -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_ca_1096.crt
                                                              2⤵
                                                              • Installs a root certificate to the trusted certificate store
                                                              PID:4940
                                                            • C:\Windows\system32\certutil.exe
                                                              "certutil" -user -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_crl_1096.crl
                                                              2⤵
                                                              • Installs a root certificate to the trusted certificate store
                                                              PID:1264
                                                            • C:\Windows\system32\certutil.exe
                                                              "certutil" -user -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_crl_1096.crl
                                                              2⤵
                                                              • Installs a root certificate to the trusted certificate store
                                                              PID:624
                                                            • C:\Windows\system32\certutil.exe
                                                              "certutil" -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_crl_1096.crl
                                                              2⤵
                                                              • Installs a root certificate to the trusted certificate store
                                                              PID:4368
                                                            • C:\Windows\system32\certutil.exe
                                                              "certutil" -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_crl_1096.crl
                                                              2⤵
                                                              • Installs a root certificate to the trusted certificate store
                                                              PID:2484
                                                            • C:\Windows\system32\certutil.exe
                                                              "certutil" -user -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_config_1096.crt
                                                              2⤵
                                                              • Installs a root certificate to the trusted certificate store
                                                              PID:5724
                                                            • C:\Windows\system32\certutil.exe
                                                              "certutil" -user -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_config_1096.crt
                                                              2⤵
                                                              • Installs a root certificate to the trusted certificate store
                                                              PID:3424
                                                            • C:\Windows\system32\certutil.exe
                                                              "certutil" -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_config_1096.crt
                                                              2⤵
                                                              • Installs a root certificate to the trusted certificate store
                                                              PID:540
                                                            • C:\Windows\system32\certutil.exe
                                                              "certutil" -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_config_1096.crt
                                                              2⤵
                                                              • Installs a root certificate to the trusted certificate store
                                                              PID:2488
                                                            • C:\Windows\system32\certutil.exe
                                                              "certutil" -user -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_epic_1096.crt
                                                              2⤵
                                                              • Installs a root certificate to the trusted certificate store
                                                              PID:4728
                                                            • C:\Windows\system32\certutil.exe
                                                              "certutil" -user -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_epic_1096.crt
                                                              2⤵
                                                              • Installs a root certificate to the trusted certificate store
                                                              PID:1776
                                                            • C:\Windows\system32\certutil.exe
                                                              "certutil" -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_epic_1096.crt
                                                              2⤵
                                                              • Installs a root certificate to the trusted certificate store
                                                              PID:3828
                                                            • C:\Windows\system32\certutil.exe
                                                              "certutil" -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_epic_1096.crt
                                                              2⤵
                                                              • Installs a root certificate to the trusted certificate store
                                                              PID:4020
                                                            • C:\Windows\system32\certutil.exe
                                                              "certutil" -store Root 05969B177719D7613DBED10B7FBE4A0DD846EB7A
                                                              2⤵
                                                                PID:4892
                                                              • C:\Windows\system32\certutil.exe
                                                                "certutil" -store Root 05969B177719D7613DBED10B7FBE4A0DD846EB7A
                                                                2⤵
                                                                  PID:5332
                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=AeroSwap(1).exe --webview-exe-version=2.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1096.3700.7412155647783133822 /pfhostedapp:d72078a1fca2777aebc78ffc76240b60687fa74e
                                                                  2⤵
                                                                  • Drops file in Windows directory
                                                                  • Enumerates system info in registry
                                                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1252
                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView /prefetch:4 /pfhostedapp:d72078a1fca2777aebc78ffc76240b60687fa74e --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x164,0x194,0x7ffc63925fd8,0x7ffc63925fe4,0x7ffc63925ff0
                                                                    3⤵
                                                                      PID:2400
                                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView" --webview-exe-name=AeroSwap(1).exe --webview-exe-version=2.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1784 --field-trial-handle=1788,i,8780250531197970331,18269173376566129660,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:d72078a1fca2777aebc78ffc76240b60687fa74e
                                                                      3⤵
                                                                        PID:4588
                                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView" --webview-exe-name=AeroSwap(1).exe --webview-exe-version=2.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2076 --field-trial-handle=1788,i,8780250531197970331,18269173376566129660,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:d72078a1fca2777aebc78ffc76240b60687fa74e
                                                                        3⤵
                                                                          PID:3516
                                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView" --webview-exe-name=AeroSwap(1).exe --webview-exe-version=2.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2320 --field-trial-handle=1788,i,8780250531197970331,18269173376566129660,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d72078a1fca2777aebc78ffc76240b60687fa74e
                                                                          3⤵
                                                                            PID:4632
                                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView" --webview-exe-name=AeroSwap(1).exe --webview-exe-version=2.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3384 --field-trial-handle=1788,i,8780250531197970331,18269173376566129660,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:d72078a1fca2777aebc78ffc76240b60687fa74e /prefetch:1
                                                                            3⤵
                                                                              PID:3080
                                                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView" --webview-exe-name=AeroSwap(1).exe --webview-exe-version=2.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4040 --field-trial-handle=1788,i,8780250531197970331,18269173376566129660,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:d72078a1fca2777aebc78ffc76240b60687fa74e /prefetch:1
                                                                              3⤵
                                                                                PID:1044
                                                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView" --webview-exe-name=AeroSwap(1).exe --webview-exe-version=2.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2236 --field-trial-handle=1788,i,8780250531197970331,18269173376566129660,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d72078a1fca2777aebc78ffc76240b60687fa74e
                                                                                3⤵
                                                                                  PID:3360
                                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView" --webview-exe-name=AeroSwap(1).exe --webview-exe-version=2.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4168 --field-trial-handle=1788,i,8780250531197970331,18269173376566129660,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d72078a1fca2777aebc78ffc76240b60687fa74e
                                                                                  3⤵
                                                                                    PID:3828
                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView" --webview-exe-name=AeroSwap(1).exe --webview-exe-version=2.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4804 --field-trial-handle=1788,i,8780250531197970331,18269173376566129660,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d72078a1fca2777aebc78ffc76240b60687fa74e
                                                                                    3⤵
                                                                                      PID:2176
                                                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView" --webview-exe-name=AeroSwap(1).exe --webview-exe-version=2.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4820 --field-trial-handle=1788,i,8780250531197970331,18269173376566129660,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d72078a1fca2777aebc78ffc76240b60687fa74e
                                                                                      3⤵
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:3320
                                                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView" --webview-exe-name=AeroSwap(1).exe --webview-exe-version=2.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4868 --field-trial-handle=1788,i,8780250531197970331,18269173376566129660,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d72078a1fca2777aebc78ffc76240b60687fa74e
                                                                                      3⤵
                                                                                        PID:5512
                                                                                    • C:\Windows\system32\reg.exe
                                                                                      "reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                      2⤵
                                                                                        PID:4888
                                                                                      • C:\Windows\system32\reg.exe
                                                                                        "reg" add "HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                        2⤵
                                                                                          PID:3996
                                                                                        • C:\Windows\system32\reg.exe
                                                                                          "reg" add "HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                          2⤵
                                                                                            PID:568
                                                                                          • C:\Windows\system32\reg.exe
                                                                                            "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                            2⤵
                                                                                              PID:1492
                                                                                            • C:\Windows\system32\reg.exe
                                                                                              "reg" add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                              2⤵
                                                                                                PID:2128
                                                                                              • C:\Windows\system32\reg.exe
                                                                                                "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v Security_HKLM_only /t REG_DWORD /d 1 /f
                                                                                                2⤵
                                                                                                  PID:2284
                                                                                                • C:\Windows\system32\reg.exe
                                                                                                  "reg" query HKU
                                                                                                  2⤵
                                                                                                    PID:540
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    "reg" add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                    2⤵
                                                                                                    • Modifies data under HKEY_USERS
                                                                                                    PID:2420
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    "reg" add "HKEY_USERS\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                    2⤵
                                                                                                      PID:5328
                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                      "reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                      2⤵
                                                                                                        PID:4728
                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                        "reg" add "HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                        2⤵
                                                                                                          PID:2904
                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                          "reg" add "HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                          2⤵
                                                                                                            PID:3196
                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                            "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                            2⤵
                                                                                                              PID:2060
                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                              "reg" add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                              2⤵
                                                                                                                PID:4328
                                                                                                              • C:\Windows\system32\certutil.exe
                                                                                                                "certutil" -store Root 05969B177719D7613DBED10B7FBE4A0DD846EB7A
                                                                                                                2⤵
                                                                                                                  PID:4912
                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v Security_HKLM_only /t REG_DWORD /d 1 /f
                                                                                                                  2⤵
                                                                                                                    PID:5816
                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                    "reg" query HKU
                                                                                                                    2⤵
                                                                                                                      PID:3536
                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                      "reg" add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                      2⤵
                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                      PID:2728
                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                      "reg" add "HKEY_USERS\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                      2⤵
                                                                                                                        PID:3992
                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                        "reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                        2⤵
                                                                                                                          PID:2968
                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                          "reg" add "HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                          2⤵
                                                                                                                            PID:4148
                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                            "reg" add "HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                            2⤵
                                                                                                                              PID:2176
                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                              "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                              2⤵
                                                                                                                                PID:4908
                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                "reg" add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                2⤵
                                                                                                                                  PID:4580
                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v Security_HKLM_only /t REG_DWORD /d 1 /f
                                                                                                                                  2⤵
                                                                                                                                    PID:5860
                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                    "reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                    2⤵
                                                                                                                                      PID:2140
                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                      "reg" query HKU
                                                                                                                                      2⤵
                                                                                                                                        PID:3760
                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                        "reg" add "HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                        2⤵
                                                                                                                                          PID:3356
                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                          "reg" add "HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                          2⤵
                                                                                                                                            PID:5904
                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                            "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                            2⤵
                                                                                                                                              PID:252
                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                              "reg" add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                              2⤵
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:5488
                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                              "reg" add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                              2⤵
                                                                                                                                                PID:5776
                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                "reg" add "HKEY_USERS\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                2⤵
                                                                                                                                                  PID:960
                                                                                                                                                • C:\Windows\system32\certutil.exe
                                                                                                                                                  "certutil" -f -delstore Root 38A28A81A89A71CA078369073BD2F0597422983C
                                                                                                                                                  2⤵
                                                                                                                                                    PID:4860
                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                    "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v Security_HKLM_only /t REG_DWORD /d 1 /f
                                                                                                                                                    2⤵
                                                                                                                                                      PID:1236
                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                      "reg" query HKU
                                                                                                                                                      2⤵
                                                                                                                                                        PID:2780
                                                                                                                                                      • C:\Windows\system32\certutil.exe
                                                                                                                                                        "certutil" -user -f -delstore Root 38A28A81A89A71CA078369073BD2F0597422983C
                                                                                                                                                        2⤵
                                                                                                                                                          PID:2268
                                                                                                                                                        • C:\Windows\system32\certutil.exe
                                                                                                                                                          "certutil" -f -delstore CA 38A28A81A89A71CA078369073BD2F0597422983C
                                                                                                                                                          2⤵
                                                                                                                                                            PID:4500
                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                            "reg" add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                            2⤵
                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                            PID:416
                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                            "reg" add "HKEY_USERS\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                            2⤵
                                                                                                                                                              PID:5944
                                                                                                                                                            • C:\Windows\system32\certutil.exe
                                                                                                                                                              "certutil" -user -f -delstore CA 38A28A81A89A71CA078369073BD2F0597422983C
                                                                                                                                                              2⤵
                                                                                                                                                                PID:540
                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                "reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:1332
                                                                                                                                                                • C:\Windows\system32\certutil.exe
                                                                                                                                                                  "certutil" -user -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_ca_1096.crt
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Installs a root certificate to the trusted certificate store
                                                                                                                                                                  PID:3332
                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                  "reg" add "HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:4728
                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                    "reg" add "HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:1604
                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:1272
                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                        "reg" add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:5796
                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                          "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v Security_HKLM_only /t REG_DWORD /d 1 /f
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:4892
                                                                                                                                                                          • C:\Windows\system32\certutil.exe
                                                                                                                                                                            "certutil" -user -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_ca_1096.crt
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Installs a root certificate to the trusted certificate store
                                                                                                                                                                            PID:4560
                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                            "reg" query HKU
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:1908
                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                              "reg" add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                                              PID:4976
                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:2728
                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                "reg" add "HKEY_USERS\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:548
                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:3992
                                                                                                                                                                                  • C:\Windows\system32\certutil.exe
                                                                                                                                                                                    "certutil" -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_ca_1096.crt
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                    PID:3096
                                                                                                                                                                                  • C:\Windows\system32\certutil.exe
                                                                                                                                                                                    "certutil" -f -delstore Root 38A28A81A89A71CA078369073BD2F0597422983C
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:2968
                                                                                                                                                                                    • C:\Windows\system32\certutil.exe
                                                                                                                                                                                      "certutil" -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_ca_1096.crt
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                      PID:4692
                                                                                                                                                                                    • C:\Windows\system32\certutil.exe
                                                                                                                                                                                      "certutil" -user -f -delstore Root 38A28A81A89A71CA078369073BD2F0597422983C
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:2116
                                                                                                                                                                                      • C:\Windows\system32\certutil.exe
                                                                                                                                                                                        "certutil" -f -delstore CA 38A28A81A89A71CA078369073BD2F0597422983C
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:4908
                                                                                                                                                                                        • C:\Windows\system32\certutil.exe
                                                                                                                                                                                          "certutil" -user -f -delstore CA 38A28A81A89A71CA078369073BD2F0597422983C
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:2516
                                                                                                                                                                                          • C:\Windows\system32\certutil.exe
                                                                                                                                                                                            "certutil" -user -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_crl_1096.crl
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                            PID:5828
                                                                                                                                                                                          • C:\Windows\system32\certutil.exe
                                                                                                                                                                                            "certutil" -user -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_ca_1096.crt
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                            PID:928
                                                                                                                                                                                          • C:\Windows\system32\certutil.exe
                                                                                                                                                                                            "certutil" -user -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_ca_1096.crt
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                            PID:2884
                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:3760
                                                                                                                                                                                            • C:\Windows\system32\certutil.exe
                                                                                                                                                                                              "certutil" -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_ca_1096.crt
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                              PID:2980
                                                                                                                                                                                            • C:\Windows\system32\certutil.exe
                                                                                                                                                                                              "certutil" -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_ca_1096.crt
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                              PID:456
                                                                                                                                                                                            • C:\Windows\system32\certutil.exe
                                                                                                                                                                                              "certutil" -user -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_crl_1096.crl
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                              PID:960
                                                                                                                                                                                            • C:\Windows\system32\certutil.exe
                                                                                                                                                                                              "certutil" -user -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_crl_1096.crl
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                              PID:2664
                                                                                                                                                                                            • C:\Windows\system32\certutil.exe
                                                                                                                                                                                              "certutil" -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_crl_1096.crl
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                              PID:4368
                                                                                                                                                                                            • C:\Windows\system32\certutil.exe
                                                                                                                                                                                              "certutil" -user -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_crl_1096.crl
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                              PID:5724
                                                                                                                                                                                            • C:\Windows\system32\certutil.exe
                                                                                                                                                                                              "certutil" -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_crl_1096.crl
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                              PID:4160
                                                                                                                                                                                            • C:\Windows\system32\certutil.exe
                                                                                                                                                                                              "certutil" -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_crl_1096.crl
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                              PID:3424
                                                                                                                                                                                            • C:\Windows\system32\certutil.exe
                                                                                                                                                                                              "certutil" -user -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_config_1096.crt
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                              PID:3664
                                                                                                                                                                                            • C:\Windows\system32\certutil.exe
                                                                                                                                                                                              "certutil" -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_crl_1096.crl
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                              PID:1432
                                                                                                                                                                                            • C:\Windows\system32\certutil.exe
                                                                                                                                                                                              "certutil" -user -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_config_1096.crt
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                              PID:2272
                                                                                                                                                                                            • C:\Windows\system32\certutil.exe
                                                                                                                                                                                              "certutil" -user -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_config_1096.crt
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                              PID:5864
                                                                                                                                                                                            • C:\Windows\system32\certutil.exe
                                                                                                                                                                                              "certutil" -user -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_config_1096.crt
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                              PID:2160
                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:2060
                                                                                                                                                                                              • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                "certutil" -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_config_1096.crt
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                                PID:4020
                                                                                                                                                                                              • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                "certutil" -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_config_1096.crt
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                                PID:3264
                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:5816
                                                                                                                                                                                                • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                  "certutil" -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_config_1096.crt
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                                  PID:4892
                                                                                                                                                                                                • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                  "certutil" -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_config_1096.crt
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                                  PID:4608
                                                                                                                                                                                                • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                  "certutil" -user -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_epic_1096.crt
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                                  PID:2880
                                                                                                                                                                                                • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                  "certutil" -user -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_epic_1096.crt
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                                  PID:4956
                                                                                                                                                                                                • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                  "certutil" -user -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_epic_1096.crt
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                                  PID:3716
                                                                                                                                                                                                • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                  "certutil" -user -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_epic_1096.crt
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                                  PID:4064
                                                                                                                                                                                                • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                  "certutil" -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_epic_1096.crt
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                                  PID:4556
                                                                                                                                                                                                • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                  "certutil" -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_epic_1096.crt
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                                  PID:5680
                                                                                                                                                                                                • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                  "certutil" -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_epic_1096.crt
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                                  PID:4580
                                                                                                                                                                                                • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                  "certutil" -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_epic_1096.crt
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                                  PID:4908
                                                                                                                                                                                                • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                  "certutil" -store Root 05969B177719D7613DBED10B7FBE4A0DD846EB7A
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:3364
                                                                                                                                                                                                  • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                    "certutil" -store Root 05969B177719D7613DBED10B7FBE4A0DD846EB7A
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:4348
                                                                                                                                                                                                    • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                      "certutil" -store Root 05969B177719D7613DBED10B7FBE4A0DD846EB7A
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:2560
                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                        "reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:5896
                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                          "reg" add "HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:5480
                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                            "reg" add "HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:456
                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                              "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:2168
                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                "reg" add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:5064
                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v Security_HKLM_only /t REG_DWORD /d 1 /f
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:5108
                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                    "reg" query HKU
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:2100
                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                      "reg" add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                                      PID:2268
                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                      "reg" add "HKEY_USERS\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:2440
                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                        "reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:4780
                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:1492
                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                            "reg" add "HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:6080
                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                              "reg" add "HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:5876
                                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:1968
                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                  "reg" add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:4772
                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:5328
                                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v Security_HKLM_only /t REG_DWORD /d 1 /f
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:5144
                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:540
                                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                          "reg" query HKU
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:5864
                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                            "reg" add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                            PID:1152
                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                            "reg" add "HKEY_USERS\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:2160
                                                                                                                                                                                                                                            • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                              "attrib" -r -h -s C:\Windows\System32\drivers\etc\hosts
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                              • Drops file in Drivers directory
                                                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                                                              PID:4228
                                                                                                                                                                                                                                            • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                              "certutil" -store Root 05969B177719D7613DBED10B7FBE4A0DD846EB7A
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:5556
                                                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                "reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:5640
                                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                  "reg" add "HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:4924
                                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                    "reg" add "HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:292
                                                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:4196
                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:2880
                                                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                          "reg" add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:4680
                                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                            "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v Security_HKLM_only /t REG_DWORD /d 1 /f
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:2700
                                                                                                                                                                                                                                                            • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                                              "certutil" -store Root 05969B177719D7613DBED10B7FBE4A0DD846EB7A
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:476
                                                                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                "reg" query HKU
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:3368
                                                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                  "reg" add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                  PID:1540
                                                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                  "reg" add "HKEY_USERS\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:1124
                                                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                    "reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:4908
                                                                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                      "reg" add "HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:4692
                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                        "reg" add "HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:4968
                                                                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                          "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:5820
                                                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                            "reg" add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:1268
                                                                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                              "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v Security_HKLM_only /t REG_DWORD /d 1 /f
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:2560
                                                                                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                "reg" query HKU
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:3792
                                                                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                  "reg" add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                  PID:4408
                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:5896
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                    "reg" add "HKEY_USERS\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:4768
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                                                                      "certutil" -f -delstore Root 38A28A81A89A71CA078369073BD2F0597422983C
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:908
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                                                                        "certutil" -user -f -delstore Root 38A28A81A89A71CA078369073BD2F0597422983C
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:712
                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:2664
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                                                                            "certutil" -f -delstore CA 38A28A81A89A71CA078369073BD2F0597422983C
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:1608
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                                                                              "certutil" -user -f -delstore CA 38A28A81A89A71CA078369073BD2F0597422983C
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:4860
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                                                                                "certutil" -user -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_ca_1096.crt
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                                                                                                                                PID:2284
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                                                                                "certutil" -user -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_ca_1096.crt
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                                                                                                                                PID:2456
                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:4500
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                                                                                  "certutil" -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_ca_1096.crt
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                  • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                                                                                                                                  PID:5876
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                                                                                  "certutil" -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_ca_1096.crt
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                  • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                                                                                                                                  PID:4592
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                                                                                  "certutil" -user -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_crl_1096.crl
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                  • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                                                                                                                                  PID:2904
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                                                                                  "certutil" -user -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_crl_1096.crl
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                  • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                                                                                                                                  PID:5864
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                                                                                  "certutil" -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_crl_1096.crl
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                  • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                                                                                                                                  PID:4032
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                                                                                  "certutil" -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_crl_1096.crl
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                  • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                                                                                                                                  PID:5348
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                                                                                  "certutil" -user -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_config_1096.crt
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                  • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                                                                                                                                  PID:2636
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                                                                                  "certutil" -user -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_config_1096.crt
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                  • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                                                                                                                                  PID:2892
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                                                                                  "certutil" -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_config_1096.crt
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                  • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                                                                                                                                  PID:4892
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                                                                                  "certutil" -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_config_1096.crt
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                  • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                                                                                                                                  PID:5332
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                                                                                  "certutil" -user -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_epic_1096.crt
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                  • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                                                                                                                                  PID:1788
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                                                                                  "certutil" -user -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_epic_1096.crt
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                  • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                                                                                                                                  PID:3716
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                                                                                  "certutil" -f -addstore Root C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_epic_1096.crt
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                  • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                                                                                                                                  PID:4556
                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:3096
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                                                                                    "certutil" -f -addstore CA C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_epic_1096.crt
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                    • Installs a root certificate to the trusted certificate store
                                                                                                                                                                                                                                                                                                    PID:4064
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                                                                                    "certutil" -store Root 05969B177719D7613DBED10B7FBE4A0DD846EB7A
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:5404
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                                                                                      "certutil" -store Root 05969B177719D7613DBED10B7FBE4A0DD846EB7A
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:5680
                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:1540

                                                                                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                                                                            velocityrl_user_ca_1096.crt
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\velocityrl_user_ca_1096.crt
                                                                                                                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                                                                                                                            • SHA256 892acd027ae482ff908fd29519d2b0af2b87a440555711ac2ea53217131760b0
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            velocityrl_user_crl_1096.crl
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\velocityrl_user_crl_1096.crl
                                                                                                                                                                                                                                                                                                            • Size 412B
                                                                                                                                                                                                                                                                                                            • SHA256 202d1b0ebc580e9c4d8c931b0afb30fafbb8fb55b87dc01e514b6f7f2791c4dc
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            velocityrl_user_leaf_config_1096.crt
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_config_1096.crt
                                                                                                                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                                                                                                                            • SHA256 c8f569d76f60140f15717f9bc0e1938f3ce6ce65fd8a824dabb50bbdba66b3f9
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            velocityrl_user_leaf_epic_1096.crt
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\velocityrl_user_leaf_epic_1096.crt
                                                                                                                                                                                                                                                                                                            • Size 2KB
                                                                                                                                                                                                                                                                                                            • SHA256 2cf2065653713aee31cdeeb59518b05293b360046f014df812d9a975862d828d
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            0a28f1ab-adbb-4cf4-9aab-6d2d77b1678b.tmp
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView\0a28f1ab-adbb-4cf4-9aab-6d2d77b1678b.tmp
                                                                                                                                                                                                                                                                                                            • Size 3KB
                                                                                                                                                                                                                                                                                                            • SHA256 670138e61dc2cc3e779f7506283d5416bfd60c5fc6ba5a63228f130978b49477
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            4599a3bb-7797-4c68-a9bb-5afb95bcea82.tmp
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView\4599a3bb-7797-4c68-a9bb-5afb95bcea82.tmp
                                                                                                                                                                                                                                                                                                            • Size 2KB
                                                                                                                                                                                                                                                                                                            • SHA256 7c5566a678ae55cec76882a08d056facd56cc00846c283b5baf9d0c1d0e34fbd
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            7a54b750-8114-4c34-83cc-c35f45df4b25.tmp
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView\7a54b750-8114-4c34-83cc-c35f45df4b25.tmp
                                                                                                                                                                                                                                                                                                            • Size 3KB
                                                                                                                                                                                                                                                                                                            • SHA256 47230994fd48aebbaa56aee27612e687816760ab5b6dd4c3ccaf110381943452
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            settings.dat
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                            • Size 280B
                                                                                                                                                                                                                                                                                                            • SHA256 cc5ea9fbb609b2f790624a139934535049957403e23cd2f727a8c1cc485d043e
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            settings.dat
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                            • Size 280B
                                                                                                                                                                                                                                                                                                            • SHA256 4ffdbcd7e72dddc18a69bd27b16514acba22da19357ab76df35f7bc8a33a17db
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            throttle_store.dat
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView\Crashpad\throttle_store.dat
                                                                                                                                                                                                                                                                                                            • Size 20B
                                                                                                                                                                                                                                                                                                            • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            2545fef3-79c8-42e0-87e4-d25270360e13.tmp
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView\Default\2545fef3-79c8-42e0-87e4-d25270360e13.tmp
                                                                                                                                                                                                                                                                                                            • Size 6KB
                                                                                                                                                                                                                                                                                                            • SHA256 e034639f324b50b3bfe4ed7c1539a67b6c750b6c05b17a9cf6f4a348b3247423
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            temp-index
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView\Default\Code Cache\js\index-dir\temp-index
                                                                                                                                                                                                                                                                                                            • Size 48B
                                                                                                                                                                                                                                                                                                            • SHA256 701c6ff9ec5947f2229829e7d5d4b9d1330bf53b7bf021888ec618cb5b8027c8
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            temp-index
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView\Default\Code Cache\js\index-dir\temp-index
                                                                                                                                                                                                                                                                                                            • Size 96B
                                                                                                                                                                                                                                                                                                            • SHA256 34c2b56e469a87e46ef2e77281246741bee5881e6b218b3520883cd5d8a20909
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            Network Persistent State
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                            • Size 59B
                                                                                                                                                                                                                                                                                                            • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                                                            • Size 2B
                                                                                                                                                                                                                                                                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            fbb1a85f-7a29-4c78-9290-ee8d645135c8.tmp
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView\Default\Network\fbb1a85f-7a29-4c78-9290-ee8d645135c8.tmp
                                                                                                                                                                                                                                                                                                            • Size 111B
                                                                                                                                                                                                                                                                                                            • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            Preferences
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView\Default\Preferences
                                                                                                                                                                                                                                                                                                            • Size 6KB
                                                                                                                                                                                                                                                                                                            • SHA256 00d6d4e0ba7128247ced3bd1ce67da482eaeba0c7a316b2556a602f8f5873ffb
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            MANIFEST-000001
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
                                                                                                                                                                                                                                                                                                            • Size 41B
                                                                                                                                                                                                                                                                                                            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            CURRENT
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView\Default\Sync Data\LevelDB\CURRENT
                                                                                                                                                                                                                                                                                                            • Size 16B
                                                                                                                                                                                                                                                                                                            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            data_0
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView\GrShaderCache\data_0
                                                                                                                                                                                                                                                                                                            • Size 8KB
                                                                                                                                                                                                                                                                                                            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            data_1
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView\GrShaderCache\data_1
                                                                                                                                                                                                                                                                                                            • Size 264KB
                                                                                                                                                                                                                                                                                                            • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            data_2
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView\GrShaderCache\data_2
                                                                                                                                                                                                                                                                                                            • Size 8KB
                                                                                                                                                                                                                                                                                                            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            data_3
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView\GrShaderCache\data_3
                                                                                                                                                                                                                                                                                                            • Size 8KB
                                                                                                                                                                                                                                                                                                            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            Local State
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView\Local State
                                                                                                                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                                                                                                                            • SHA256 a8d440152eb329e8c5cfb1597b29cf9855be173748bc2d5ab3614be987de8c2b
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            a3888e83-1f33-4382-b216-3a3e39a25d34.tmp
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\com.aeroswap.app\EBWebView\a3888e83-1f33-4382-b216-3a3e39a25d34.tmp
                                                                                                                                                                                                                                                                                                            • Size 15KB
                                                                                                                                                                                                                                                                                                            • SHA256 d81d7100fc392271c0058333b59871190a025fead82fb263805e38aa8939b0fc
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            launch.log
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\com.aeroswap.app\logs\launch.log
                                                                                                                                                                                                                                                                                                            • Size 678B
                                                                                                                                                                                                                                                                                                            • SHA256 0ab7403929583647e27e0e066d99d0178db36c82a02a3bf3beb44881a6ba25a3
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            launch.log
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\com.aeroswap.app\logs\launch.log
                                                                                                                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                                                                                                                            • SHA256 b0c0a63daa965cf499e7c63fbd477e47023afd111452c1895ea040578eff6fb2
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            launch.log
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\com.aeroswap.app\logs\launch.log
                                                                                                                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                                                                                                                            • SHA256 e93d49ab889dfd42904ebc246947a0a572882068907129a0aeb84a9a9f553ec6
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            launch.log
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\com.aeroswap.app\logs\launch.log
                                                                                                                                                                                                                                                                                                            • Size 2KB
                                                                                                                                                                                                                                                                                                            • SHA256 25999563114aa4bab8a5a17fdbcf6c2ed2d1e845f237bde1023026b2a7977cb4
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            launch.log
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\com.aeroswap.app\logs\launch.log
                                                                                                                                                                                                                                                                                                            • Size 3KB
                                                                                                                                                                                                                                                                                                            • SHA256 ff5059af928a8468dc018f9e322f92d8a9f289f06f60ec1d1a8f251f26b2f44b
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            launch.log
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\com.aeroswap.app\logs\launch.log
                                                                                                                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                                                                                                                            • SHA256 da1df5c2779e8ddb8863dd8f9d6c65f7f6f752e4319fd0d3e66af5af4250e3aa
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            psynet_config.json
                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\VelocityRL\proxy\psynet_config.json
                                                                                                                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                                                                                                                            • SHA256 c179ecbea4f8d499a3933cb35435e0fa06c6492d3ccbb1f4e7b5cfa61c210603
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            manifest.json
                                                                                                                                                                                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1252_2108211790\manifest.json
                                                                                                                                                                                                                                                                                                            • Size 118B
                                                                                                                                                                                                                                                                                                            • SHA256 cc33e26f3b2efe862336389207db045cc7a916940213b9d33d845c82c12c8712
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            manifest.json
                                                                                                                                                                                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1252_256278926\manifest.json
                                                                                                                                                                                                                                                                                                            • Size 43B
                                                                                                                                                                                                                                                                                                            • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            manifest.json
                                                                                                                                                                                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1252_843236678\manifest.json
                                                                                                                                                                                                                                                                                                            • Size 108B
                                                                                                                                                                                                                                                                                                            • SHA256 8d58f4f4ef20dff6cd1c27243ddbe12d50713f2cf8bb22ba73696bbb04b36f4c
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            manifest.json
                                                                                                                                                                                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1252_881599769\manifest.json
                                                                                                                                                                                                                                                                                                            • Size 76B
                                                                                                                                                                                                                                                                                                            • SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            hosts
                                                                                                                                                                                                                                                                                                            • Path C:\Windows\system32\drivers\etc\hosts
                                                                                                                                                                                                                                                                                                            • Size 1KB
                                                                                                                                                                                                                                                                                                            • SHA256 9c65c31c953ece1e4136a1b9cf9f581323aeb0c26e99d55ad8d38a6d0a98b2c4
                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                            memory/3080-114-0x00007FFC84280000-0x00007FFC84281000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/3320-475-0x000001FE84600000-0x000001FE84601000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/3320-466-0x000001FE84600000-0x000001FE84601000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/3320-474-0x000001FE84600000-0x000001FE84601000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/3320-473-0x000001FE84600000-0x000001FE84601000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/3320-472-0x000001FE84600000-0x000001FE84601000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/3320-468-0x000001FE84600000-0x000001FE84601000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/3320-477-0x000001FE84600000-0x000001FE84601000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/3320-476-0x000001FE84600000-0x000001FE84601000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/3360-380-0x00007FFC858D0000-0x00007FFC858D1000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/3360-381-0x00007FFC85560000-0x00007FFC85561000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                            memory/4588-39-0x00007FFC84280000-0x00007FFC84281000-memory.dmp
                                                                                                                                                                                                                                                                                                            Download