Resubmissions
01/10/2024, 19:23
241001-x3tkyszekh1001/10/2024, 19:14
241001-xxtc1awdmj1030/09/2024, 22:07
240930-11v8jsxdnm1030/09/2024, 21:59
240930-1wfmas1crg1030/09/2024, 20:26
240930-y8bg1atepl1026/09/2024, 20:34
240926-zcgvkszbmg1026/09/2024, 19:28
240926-x6rkrstfrr1026/09/2024, 19:21
240926-x2mq1swhnh1026/09/2024, 19:20
240926-x19jdstdpl1025/09/2024, 21:15
240925-z4dx1a1elf10Analysis
- max time kernel
1200s - max time network
1162s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
25/09/2024, 21:15
General
- Target RebelCracked.exe
- Size 344KB
- Sample240925-z4dx1a1elf
- SHA256 9d9a79f4ae9bf7a992945f6c06c5bec642c05e4e828217c50255dabfa3677006
Score
10/10
Malware Config
Extracted
Family
-
asyncrat
Botnet
-
Default
C2
-
127.0.0.1:6606
-
127.0.0.1:7707
-
127.0.0.1:8808
Mutex
-
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- StormKitty
StormKitty is an open source info stealer written in C#.
- StormKitty payload 1 IoCs
- Blocklisted process makes network request 6 IoCs
- Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 64 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
- Suspicious use of SetThreadContext 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 64 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 7 IoCs
- Modifies data under HKEY_USERS 18 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"3⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All4⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile5⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid4⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All5⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650016⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile6⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid5⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650016⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"5⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All6⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650017⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile7⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid6⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650017⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid7⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All7⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 650018⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile8⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid7⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650018⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid8⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"5⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"7⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"7⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All8⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 650019⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile9⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid8⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650019⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid9⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"6⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"8⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"8⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All9⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500110⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile10⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid9⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500110⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid10⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"7⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"9⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All10⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500111⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile11⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid10⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500111⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid11⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"8⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"10⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"10⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"10⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"10⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All11⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500112⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile12⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid11⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500112⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid12⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"9⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"11⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All12⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500113⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile13⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid12⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500113⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid13⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"10⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All13⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500114⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile14⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All14⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid13⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500114⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid14⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"11⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"12⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"13⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"13⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All14⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500115⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile15⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All15⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid14⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500115⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid15⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"12⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All15⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500116⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile16⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All16⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid15⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500116⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid16⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"13⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"14⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"15⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All16⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500117⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile17⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All17⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid16⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500117⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid17⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"14⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All17⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500118⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile18⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All18⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid17⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500118⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid18⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"15⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"16⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All18⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500119⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile19⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All19⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid18⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500119⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid19⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"16⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All19⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500120⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile20⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All20⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid19⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500120⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid20⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"17⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"18⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"19⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All20⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500121⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile21⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All21⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid20⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500121⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid21⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"18⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All21⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500122⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile22⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All22⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid21⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500122⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid22⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"19⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"20⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"21⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All22⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500123⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile23⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All23⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid22⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500123⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid23⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"20⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All23⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500124⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile24⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All24⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid23⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500124⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid24⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"21⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"22⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All24⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500125⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile25⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All25⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid24⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500125⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid25⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"22⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"24⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"24⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All25⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500126⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile26⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All26⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid25⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500126⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid26⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"23⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"24⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"25⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All26⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500127⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile27⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All27⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid26⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500127⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid27⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"24⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All27⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500128⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile28⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All28⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid27⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500128⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid28⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"25⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"26⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"27⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All28⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500129⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile29⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All29⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid28⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500129⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid29⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"26⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"28⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All29⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500130⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile30⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All30⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid29⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500130⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid30⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"27⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"28⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"29⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All30⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500131⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile31⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All31⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid30⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500131⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid31⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"28⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"30⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All31⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500132⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile32⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All32⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid31⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500132⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid32⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"29⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"30⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All32⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500133⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile33⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All33⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid32⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500133⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid33⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"30⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"32⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"31⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"32⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"33⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All34⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500135⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile35⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All35⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid34⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500135⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid35⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"32⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All35⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500136⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile36⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All36⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid35⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500136⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid36⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"33⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"34⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"35⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All36⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500137⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile37⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All37⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid36⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV137⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500137⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid37⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"34⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"35⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"36⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All37⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500138⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile38⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All38⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid37⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500138⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid38⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"35⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"36⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"37⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"37⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All38⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500139⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile39⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All39⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid38⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500139⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid39⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"36⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"37⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"38⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All39⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500140⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile40⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All40⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid39⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500140⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid40⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"37⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"38⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"39⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All40⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500141⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile41⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All41⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid40⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500141⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid41⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"38⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"39⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"40⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All41⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500142⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile42⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All42⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid41⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500142⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid42⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"39⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"40⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"41⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"41⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"41⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All42⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500143⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile43⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All43⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid42⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"40⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"41⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"42⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All43⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500144⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile44⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All44⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid43⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500144⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid44⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"41⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"42⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"43⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All44⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500145⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile45⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All45⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid44⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500145⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid45⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"42⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"43⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"44⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"44⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All45⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500146⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile46⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All46⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid45⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500146⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid46⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"43⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"44⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"45⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All46⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500147⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile47⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All47⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid46⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500147⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid47⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"44⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"45⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"46⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All47⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500148⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile48⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All48⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid47⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500148⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid48⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"45⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"46⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"47⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All48⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500149⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile49⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All49⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid48⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV149⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500149⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid49⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"46⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"47⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"48⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All49⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500150⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile50⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All50⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid49⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500150⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid50⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"47⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"48⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"49⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All50⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500151⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile51⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All51⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid50⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"48⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"49⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All51⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500152⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile52⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All52⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid51⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"49⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"50⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"51⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All52⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500153⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile53⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All53⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid52⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500153⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid53⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"50⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"51⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"52⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"51⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"52⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"53⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"53⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All54⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500155⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile55⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All55⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid54⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500155⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid55⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"52⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"53⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"54⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All55⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500156⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile56⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All56⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid55⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500156⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid56⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"53⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"54⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"55⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All56⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500157⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile57⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All57⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid56⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500157⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid57⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"54⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"55⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"56⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All57⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500158⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile58⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All58⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid57⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500158⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid58⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"55⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"56⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"57⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"56⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"57⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"58⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"58⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All59⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"57⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"58⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"59⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"59⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"59⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"59⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All60⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500161⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile61⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All61⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid60⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"58⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"59⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"60⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All61⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500162⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile62⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All62⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid61⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"59⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"60⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"61⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All62⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500163⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile63⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All63⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid62⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500163⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid63⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"60⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"61⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All63⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500164⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile64⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All64⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid63⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500164⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid64⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"61⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"62⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"63⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"63⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All64⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500165⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile65⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All65⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid64⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"62⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"63⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"64⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All65⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500166⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile66⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All66⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid65⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500166⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid66⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"63⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"64⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"65⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All66⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500167⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile67⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All67⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid66⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500167⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid67⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"64⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"65⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"66⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"65⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"66⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"67⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All68⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500169⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile69⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All69⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid68⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500169⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid69⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"66⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"67⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"68⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"68⤵
- Drops desktop.ini file(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All69⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500170⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile70⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All70⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid69⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"67⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"68⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"69⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"68⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"69⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"70⤵
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All71⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500172⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile72⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All72⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid71⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500172⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid72⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"69⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"70⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"71⤵
- Drops desktop.ini file(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All72⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500173⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile73⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All73⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid72⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"70⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"71⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"72⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All73⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500174⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile74⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All74⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid73⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500174⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid74⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"71⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"72⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"73⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"73⤵
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All74⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500175⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile75⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All75⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid74⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500175⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid75⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"72⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"73⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"74⤵
- Drops desktop.ini file(s)
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"73⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"74⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"75⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All76⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500177⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile77⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All77⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid76⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"74⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"75⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"76⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"76⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All77⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500178⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile78⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All78⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid77⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500178⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid78⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"75⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"76⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"77⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"77⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All78⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500179⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile79⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All79⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid78⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"76⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"77⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"78⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All79⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500180⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile80⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All80⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid79⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"77⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"78⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"79⤵
- Drops desktop.ini file(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All80⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500181⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile81⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All81⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid80⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"78⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"79⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"80⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"80⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"80⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"80⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All81⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500182⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile82⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All82⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid81⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500182⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid82⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"79⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"80⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"81⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"81⤵
- Drops desktop.ini file(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All82⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500183⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile83⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All83⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid82⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500183⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid83⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"80⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"81⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"82⤵
- Drops desktop.ini file(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All83⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500184⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile84⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All84⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid83⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500184⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid84⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"81⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"82⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"83⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All84⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500185⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile85⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All85⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid84⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500185⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid85⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"82⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"83⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"84⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"83⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"84⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"85⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All86⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500187⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile87⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All87⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid86⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"84⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"85⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"86⤵
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All87⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500188⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile88⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All88⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid87⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"85⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"86⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"87⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"87⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"87⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"87⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All88⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500189⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile89⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All89⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid88⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"86⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"87⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"88⤵
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All89⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500190⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile90⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All90⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid89⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"87⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"88⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"89⤵
- Drops desktop.ini file(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All90⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV191⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500191⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile91⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All91⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid90⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"88⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"89⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"90⤵
- Drops desktop.ini file(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All91⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500192⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile92⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All92⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid91⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500192⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid92⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"89⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"90⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"91⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"91⤵
- Drops desktop.ini file(s)
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"90⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"91⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"92⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"91⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"92⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"93⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All94⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"92⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"93⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"94⤵
- Checks processor information in registry
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"93⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"94⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"95⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"95⤵
- Drops desktop.ini file(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All96⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500197⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile97⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All97⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid96⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500197⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"94⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"95⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"96⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"95⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"96⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"97⤵
- Drops desktop.ini file(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All98⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500199⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile99⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All99⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid98⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"96⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"97⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"98⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"98⤵
- Drops desktop.ini file(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All99⤵
-
C:\Windows\SysWOW64\chcp.comchcp 65001100⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile100⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All100⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid99⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"97⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"98⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"99⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"99⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"98⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"99⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"100⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All101⤵
-
C:\Windows\SysWOW64\chcp.comchcp 65001102⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile102⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All102⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid101⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"99⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"100⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"101⤵
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All102⤵
-
C:\Windows\SysWOW64\chcp.comchcp 65001103⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile103⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All103⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"100⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"101⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"102⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"101⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"102⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"103⤵
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All104⤵
-
C:\Windows\SysWOW64\chcp.comchcp 65001105⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile105⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All105⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid104⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"102⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"103⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"104⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All105⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 65001106⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile106⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All106⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"103⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"104⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"105⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"105⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All106⤵
-
C:\Windows\SysWOW64\chcp.comchcp 65001107⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile107⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All107⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid106⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"104⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"105⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"106⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"106⤵
- Drops desktop.ini file(s)
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"105⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"106⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"107⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"107⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"107⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"107⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All108⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 65001109⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile109⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All109⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"106⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"107⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"108⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"107⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"108⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"109⤵
- Drops desktop.ini file(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All110⤵
-
C:\Windows\SysWOW64\chcp.comchcp 65001111⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile111⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All111⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid110⤵
-
C:\Windows\SysWOW64\chcp.comchcp 65001111⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid111⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"108⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"109⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"110⤵
- Drops desktop.ini file(s)
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"109⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"110⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"111⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"110⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"111⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"112⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"112⤵
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All113⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 65001114⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile114⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All114⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid113⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"111⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"112⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"113⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"113⤵
- Checks processor information in registry
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"112⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"113⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"114⤵
- Checks processor information in registry
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"113⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"114⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"115⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"115⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"115⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"115⤵
- Drops desktop.ini file(s)
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"114⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"115⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"116⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"116⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"115⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"116⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"117⤵
- Checks processor information in registry
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"116⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"117⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"118⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"117⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"118⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"119⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"118⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"119⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"120⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"119⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"120⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"121⤵
- Drops desktop.ini file(s)
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-