Analysis
-
max time kernel
1202s -
max time network
1804s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
28/08/2024, 18:50
General
-
Target
RebelCracked.exe
-
Size
59.1MB
-
MD5
de03a6ac4fa6802caa50fd073b7be449
-
SHA1
ac9667427372479575e1eafe18e5a7cde34cdfcc
-
SHA256
4616bbe467cc30996c3ea49a15aa171f5638b37d908f1476898af213f4147477
-
SHA512
6f6a9a82a2639ff8b6773481eef48836c7c2e9a2177f90964340d3238e467dfe53e2b2e6909427fb06f0e1440d955dc6968b38047a09a23441360ecc3f63cf8e
-
SSDEEP
1572864:rSm+3uqEX+P9rhdiKsD3nkQC3eFS8z1wvNCwp860CvLc:+m+3uqy+lDqY34S8zmVPtHLc
Score
9/10
Malware Config
Signatures
-
Renames multiple (160) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Blocklisted process makes network request 31 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE 64 IoCs
-
Loads dropped DLL 64 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Detects videocard installed 1 TTPs 29 IoCs
Uses WMIC.exe to determine videocard installed.
-
Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST2⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name5⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST3⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"3⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST4⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"5⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'6⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST6⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"6⤵
- Executes dropped EXE
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"7⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"6⤵
- Drops file in System32 directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'7⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST7⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"7⤵
- Executes dropped EXE
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"8⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"9⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'8⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST8⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"8⤵
- Executes dropped EXE
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"9⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"8⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'9⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST9⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"9⤵
- Executes dropped EXE
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"10⤵
- Blocklisted process makes network request
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"11⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'10⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST10⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"10⤵
- Executes dropped EXE
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"11⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"12⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"10⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'11⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST11⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"11⤵
- Executes dropped EXE
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"12⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"13⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"11⤵
- Drops file in System32 directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'12⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST12⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"12⤵
- Executes dropped EXE
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"13⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"14⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"12⤵
- Drops file in System32 directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'13⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST13⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"13⤵
- Executes dropped EXE
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"14⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"15⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"13⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'14⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST14⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"14⤵
- Executes dropped EXE
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"16⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"16⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid17⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"16⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name17⤵
- Detects videocard installed
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"14⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'15⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST15⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"15⤵
- Executes dropped EXE
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"16⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"17⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"15⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'16⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST16⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"16⤵
- Executes dropped EXE
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"17⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"18⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"16⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'17⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST17⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"17⤵
- Executes dropped EXE
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"18⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"19⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"17⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'18⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST18⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"18⤵
- Executes dropped EXE
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"19⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"20⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"18⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'19⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST19⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"19⤵
- Executes dropped EXE
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"20⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"21⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"19⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'20⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST20⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"20⤵
- Executes dropped EXE
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"21⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"22⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"20⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'21⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST21⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"21⤵
- Executes dropped EXE
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"22⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"23⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"21⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'22⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST22⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"22⤵
- Executes dropped EXE
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"23⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"24⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"22⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'23⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST23⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"23⤵
- Executes dropped EXE
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"24⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"25⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"23⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'24⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST24⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"24⤵
- Executes dropped EXE
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"25⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"26⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"24⤵
- Drops file in System32 directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'25⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST25⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"25⤵
- Executes dropped EXE
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"26⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"27⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"25⤵
- Drops file in System32 directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'26⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST26⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"26⤵
- Executes dropped EXE
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"28⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"28⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid29⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"28⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV129⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name29⤵
- Detects videocard installed
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"26⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'27⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST27⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"27⤵
- Executes dropped EXE
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"28⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"29⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"27⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'28⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST28⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"28⤵
- Executes dropped EXE
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"29⤵
- Blocklisted process makes network request
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"30⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"28⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'29⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST29⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"29⤵
- Executes dropped EXE
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"30⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"31⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"29⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'30⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST30⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"30⤵
- Executes dropped EXE
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"31⤵
- Blocklisted process makes network request
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"32⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"30⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'31⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST31⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"31⤵
- Executes dropped EXE
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"32⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"33⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"31⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'32⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST32⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"32⤵
- Executes dropped EXE
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"33⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"34⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV135⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"32⤵
- Drops file in System32 directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'33⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST33⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV134⤵
-
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"33⤵
- Executes dropped EXE
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"34⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"35⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"33⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'34⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST34⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"34⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"35⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"36⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV137⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"34⤵
- Drops file in System32 directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'35⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST35⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"35⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"36⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"37⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"35⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'36⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST36⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"36⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"37⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"38⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"36⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'37⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST37⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"37⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"38⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"39⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"37⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'38⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST38⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"38⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"39⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"40⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"40⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid41⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"40⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name41⤵
- Detects videocard installed
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"38⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'39⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST39⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"39⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"40⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"41⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV142⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"39⤵
- Drops file in System32 directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'40⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST40⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"40⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"41⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"42⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"40⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'41⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV142⤵
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST41⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"41⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"42⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"43⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"41⤵
- Drops file in System32 directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'42⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST42⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"42⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"43⤵
- Blocklisted process makes network request
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"44⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"42⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'43⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST43⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"43⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"44⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"45⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"43⤵
- Drops file in System32 directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'44⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV145⤵
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST44⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"44⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"45⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"46⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"44⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'45⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST45⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"45⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"46⤵
- Blocklisted process makes network request
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"47⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"45⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'46⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST46⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"46⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"47⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"48⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"46⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'47⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST47⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"47⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"48⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"49⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"47⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'48⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST48⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV149⤵
-
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"48⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"49⤵
- Blocklisted process makes network request
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"50⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"48⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'49⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST49⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"49⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"50⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"51⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"49⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'50⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST50⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"50⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"51⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"52⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"52⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid53⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"52⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name53⤵
- Detects videocard installed
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"50⤵
- Drops file in System32 directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'51⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST51⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV152⤵
-
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"51⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"52⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"53⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"51⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'52⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST52⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"52⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"53⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"54⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"52⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'53⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST53⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"53⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"54⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"55⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV156⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"53⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'54⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST54⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"54⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"55⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"56⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"54⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'55⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST55⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"55⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"56⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"57⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"55⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'56⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV157⤵
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST56⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"56⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"57⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"58⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"56⤵
- Drops file in System32 directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'57⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST57⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"57⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"58⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"59⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV160⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"57⤵
- Drops file in System32 directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'58⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST58⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"58⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"59⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"60⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"58⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'59⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST59⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"59⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"60⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"61⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV162⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"59⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'60⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST60⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"60⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"61⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"62⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"60⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'61⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST61⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"61⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"62⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"63⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"61⤵
- Drops file in System32 directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'62⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST62⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"62⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"63⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"64⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"64⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid65⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"64⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name65⤵
- Detects videocard installed
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"62⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'63⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST63⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"63⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"64⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"65⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"63⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'64⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST64⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"64⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"65⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"66⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"64⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'65⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST65⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"65⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"66⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"67⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"65⤵
- Drops file in System32 directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'66⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST66⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV167⤵
-
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"66⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"67⤵
- Blocklisted process makes network request
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"68⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"66⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'67⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST67⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"67⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"68⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"69⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"67⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'68⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST68⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"68⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"69⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"70⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"68⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'69⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST69⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"69⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"70⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"71⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"69⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'70⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV171⤵
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST70⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"70⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"71⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"72⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"70⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'71⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST71⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"71⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"72⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"73⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"71⤵
- Drops file in System32 directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'72⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST72⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV173⤵
-
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"72⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"73⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"74⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"72⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'73⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST73⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"73⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"74⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"75⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"73⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'74⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST74⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"74⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"75⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"76⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"76⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid77⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"76⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV177⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name77⤵
- Detects videocard installed
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"74⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'75⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV176⤵
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST75⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV176⤵
-
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"75⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"76⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"77⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"75⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'76⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV177⤵
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST76⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"76⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"77⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"78⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"76⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'77⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST77⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV178⤵
-
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"77⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"78⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"79⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"77⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'78⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST78⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"78⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"79⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"80⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"78⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'79⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST79⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"79⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"80⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"81⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"79⤵
- Drops file in System32 directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'80⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST80⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"80⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"81⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"82⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"80⤵
- Drops file in System32 directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'81⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST81⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"81⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"82⤵
- Blocklisted process makes network request
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"83⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"81⤵
- Drops file in System32 directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'82⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST82⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"82⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"83⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"84⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"82⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'83⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST83⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"83⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"84⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"85⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"83⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'84⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST84⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV185⤵
-
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"84⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"85⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"86⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"84⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'85⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST85⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"85⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"86⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"87⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"85⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'86⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST86⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"86⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"87⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"88⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"86⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'87⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST87⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"87⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"88⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"89⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"89⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV190⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid90⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"89⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name90⤵
- Detects videocard installed
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"87⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'88⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST88⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"88⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"89⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"90⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"88⤵
- Drops file in System32 directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'89⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST89⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"89⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"90⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"91⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"89⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'90⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST90⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"90⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"91⤵
- Blocklisted process makes network request
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"92⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"90⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'91⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST91⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV192⤵
-
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"91⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"92⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"93⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"91⤵
- Drops file in System32 directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'92⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST92⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"92⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"93⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"94⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"92⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'93⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST93⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"93⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"94⤵
- Blocklisted process makes network request
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"95⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"93⤵
- Drops file in System32 directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'94⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST94⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"94⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"95⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"96⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV197⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"94⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'95⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST95⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"95⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"96⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"97⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"95⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'96⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST96⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"96⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"97⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"98⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"96⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'97⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST97⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"97⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"98⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"99⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"97⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'98⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST98⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"98⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"99⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"100⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"98⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'99⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST99⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"99⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"100⤵
- Blocklisted process makes network request
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"101⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"99⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'100⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST100⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵
-
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"100⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"101⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"102⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"102⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1103⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid103⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"102⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name103⤵
- Detects videocard installed
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"100⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'101⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1102⤵
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST101⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"101⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"102⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"103⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"101⤵
- Drops file in System32 directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'102⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST102⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"102⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"103⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"104⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"102⤵
- Drops file in System32 directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'103⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1104⤵
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST103⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1104⤵
-
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"103⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"104⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"105⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"103⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'104⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST104⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"104⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"105⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"106⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1107⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"104⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'105⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST105⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"105⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"106⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"107⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"105⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'106⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST106⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"106⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"107⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"108⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"106⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'107⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST107⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"107⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"108⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"109⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"107⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'108⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST108⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"108⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"109⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"110⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"108⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'109⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST109⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"109⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"110⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"111⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"109⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'110⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1111⤵
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST110⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"110⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"111⤵
- Blocklisted process makes network request
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"112⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1113⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"110⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'111⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST111⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"111⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"112⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"113⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"111⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'112⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST112⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1113⤵
-
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"112⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"113⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"114⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"114⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid115⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"114⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1115⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name115⤵
- Detects videocard installed
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"112⤵
- Drops file in System32 directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'113⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1114⤵
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST113⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"113⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"114⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"115⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"113⤵
- Drops file in System32 directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'114⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST114⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1115⤵
-
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"114⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"115⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"116⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1117⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"114⤵
- Drops file in System32 directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'115⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1116⤵
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST115⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"115⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"116⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"117⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"115⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'116⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST116⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"116⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"117⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"118⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"116⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'117⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST117⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"117⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"118⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"119⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"117⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Runtime Broker.exe'118⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Runtime Broker" /SC ONLOGON /TR "C:\Windows\System32\Runtime Broker.exe" /RL HIGHEST118⤵
-
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"118⤵
-
C:\Windows\System32\Runtime Broker.exe"C:\Windows\System32\Runtime Broker.exe"119⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"120⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-