Resubmissions
01/10/2024, 19:23
241001-x3tkyszekh1001/10/2024, 19:14
241001-xxtc1awdmj1030/09/2024, 22:07
240930-11v8jsxdnm1030/09/2024, 21:59
240930-1wfmas1crg1030/09/2024, 20:26
240930-y8bg1atepl1026/09/2024, 20:34
240926-zcgvkszbmg1026/09/2024, 19:28
240926-x6rkrstfrr1026/09/2024, 19:21
240926-x2mq1swhnh1026/09/2024, 19:20
240926-x19jdstdpl1025/09/2024, 21:15
240925-z4dx1a1elf10Analysis
- max time kernel
188s - max time network
502s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
26/09/2024, 19:20
General
- Target RebelCracked.exe
- Size 344KB
- Sample240926-x19jdstdpl
- SHA256 9d9a79f4ae9bf7a992945f6c06c5bec642c05e4e828217c50255dabfa3677006
Score
10/10
Malware Config
Extracted
Family
-
asyncrat
Botnet
-
Default
C2
-
127.0.0.1:6606
-
127.0.0.1:7707
-
127.0.0.1:8808
Mutex
-
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- StormKitty
StormKitty is an open source info stealer written in C#.
- StormKitty payload 1 IoCs
- Blocklisted process makes network request 6 IoCs
- Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 64 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 47 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
- Suspicious use of SetThreadContext 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Program crash 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 64 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"3⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All4⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile5⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid5⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"4⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All5⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650016⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile6⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid5⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650016⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"5⤵
- Blocklisted process makes network request
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All6⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650017⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile7⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid6⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650017⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid7⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"6⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All7⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650018⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile8⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid7⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650018⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid8⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"5⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All8⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 650019⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile9⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid8⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650019⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid9⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"6⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"8⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All9⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500110⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile10⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid9⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500110⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid10⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"7⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"9⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All10⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500111⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile11⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid10⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500111⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid11⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"8⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"10⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"10⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All11⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500112⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile12⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid11⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500112⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid12⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"9⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"11⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All12⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500113⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile13⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid12⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500113⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid13⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"10⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"12⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"12⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"12⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500114⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile14⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All14⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid13⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500114⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid14⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"11⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"12⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"13⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All14⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500115⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile15⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All15⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid14⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500115⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid15⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"12⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"14⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All15⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500116⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile16⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All16⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid15⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500116⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid16⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"13⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"14⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"15⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"15⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All16⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500117⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile17⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All17⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid16⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV117⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500117⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid17⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"14⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"16⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All17⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500118⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile18⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All18⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid17⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500118⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid18⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"15⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"16⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"17⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"17⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All18⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500119⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile19⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All19⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid18⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500119⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid19⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"16⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"18⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All19⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500120⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile20⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All20⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid19⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500120⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid20⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"17⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"18⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"19⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All20⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500121⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile21⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All21⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid20⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV121⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500121⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid21⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"18⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"20⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All21⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500122⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile22⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All22⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid21⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500122⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid22⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"19⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"20⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"21⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All22⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV123⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500123⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile23⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All23⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid22⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500123⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid23⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"20⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"22⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All23⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500124⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile24⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All24⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid23⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500124⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid24⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"21⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"22⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"23⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All24⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500125⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile25⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All25⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid24⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500125⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid25⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"22⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All25⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500126⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile26⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All26⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid25⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500126⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid26⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"23⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"24⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"25⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"25⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All26⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500127⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile27⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All27⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid26⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500127⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid27⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"24⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"26⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All27⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500128⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile28⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All28⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid27⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500128⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid28⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"25⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"26⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"27⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All28⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500129⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile29⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All29⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid28⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500129⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid29⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"26⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"28⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All29⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500130⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile30⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All30⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid29⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500130⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid30⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"27⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"28⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"29⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All30⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500131⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile31⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All31⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid30⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV131⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500131⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid31⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"28⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"30⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All31⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500132⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile32⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All32⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid31⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV132⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500132⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid32⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"29⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"30⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"31⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All32⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV133⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500133⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile33⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All33⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid32⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500133⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid33⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"30⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"32⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All33⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500134⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile34⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All34⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid33⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500134⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid34⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"31⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"32⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"33⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All34⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500135⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile35⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All35⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid34⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500135⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid35⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"32⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"34⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"34⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All35⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500136⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile36⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All36⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid35⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV136⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500136⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid36⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"33⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"34⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"35⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All36⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500137⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile37⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All37⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid36⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500137⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid37⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"34⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"35⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"36⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All37⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV138⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500138⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile38⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All38⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid37⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500138⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid38⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"35⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"36⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"37⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All38⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500139⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile39⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All39⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid38⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500139⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid39⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"36⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"37⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"38⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All39⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV140⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500140⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile40⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All40⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid39⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500140⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid40⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"37⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"38⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"39⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All40⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500141⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile41⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All41⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid40⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500141⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid41⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"38⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"39⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"40⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All41⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500142⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile42⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All42⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid41⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV142⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500142⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid42⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"39⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"40⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"41⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All42⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500143⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile43⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All43⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid42⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500143⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid43⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"40⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"41⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"42⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All43⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500144⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile44⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All44⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid43⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV144⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500144⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid44⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"41⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"42⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"43⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All44⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500145⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile45⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All45⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid44⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV145⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500145⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid45⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"42⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"43⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"44⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All45⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500146⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile46⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All46⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid45⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500146⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid46⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"43⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"44⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"45⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"45⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All46⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500147⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile47⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All47⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid46⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500147⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid47⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"44⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"45⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"46⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All47⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500148⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile48⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All48⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid47⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500148⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid48⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"45⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"46⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"47⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"47⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All48⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500149⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile49⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All49⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid48⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500149⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid49⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"46⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"47⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"48⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All49⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500150⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile50⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All50⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid49⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500150⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid50⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"47⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"48⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"49⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All50⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500151⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile51⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All51⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid50⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV151⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500151⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid51⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"48⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"49⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"50⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All51⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500152⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile52⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All52⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid51⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV152⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500152⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid52⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"49⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"50⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"51⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All52⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500153⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile53⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All53⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid52⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500153⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid53⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"50⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"51⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"52⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All53⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV154⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500154⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile54⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All54⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid53⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV154⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500154⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid54⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"51⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"52⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"53⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"53⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All54⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500155⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile55⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All55⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid54⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500155⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid55⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"52⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"53⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"54⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All55⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500156⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile56⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All56⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid55⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500156⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid56⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"53⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"54⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"55⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All56⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500157⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile57⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All57⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid56⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500157⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid57⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"54⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"55⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"56⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All57⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500158⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile58⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All58⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid57⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500158⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid58⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"55⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"56⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"57⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All58⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500159⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile59⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All59⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid58⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500159⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid59⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"56⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"57⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"58⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"58⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All59⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500160⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile60⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All60⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid59⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500160⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid60⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"57⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"58⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"59⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All60⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500161⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile61⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All61⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid60⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500161⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid61⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"58⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"59⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"60⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All61⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500162⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile62⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All62⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid61⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500162⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid62⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"59⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"60⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"61⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"61⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All62⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500163⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile63⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All63⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid62⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV163⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500163⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid63⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"60⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"61⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"62⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"62⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All63⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500164⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile64⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All64⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid63⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500164⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid64⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"61⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"62⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"63⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All64⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500165⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile65⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All65⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid64⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500165⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid65⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"62⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"63⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"64⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All65⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500166⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile66⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All66⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid65⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500166⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid66⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"63⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"64⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"65⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All66⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500167⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile67⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All67⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid66⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500167⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid67⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"64⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"65⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"66⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All67⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500168⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile68⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All68⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid67⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500168⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid68⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"65⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"66⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"67⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All68⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500169⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile69⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All69⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid68⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500169⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid69⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"66⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"67⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"68⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"68⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All69⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500170⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile70⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All70⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid69⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500170⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid70⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"67⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"68⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"69⤵
- Drops desktop.ini file(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All70⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV171⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500171⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile71⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All71⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid70⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500171⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid71⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"68⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"69⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"70⤵
- Drops desktop.ini file(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All71⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500172⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile72⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All72⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid71⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500172⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid72⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"69⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"70⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"71⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All72⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500173⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile73⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All73⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid72⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500173⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid73⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"70⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"71⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"72⤵
- Drops desktop.ini file(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All73⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500174⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile74⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All74⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid73⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500174⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid74⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"71⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"72⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"73⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All74⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500175⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile75⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All75⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid74⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500175⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid75⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"72⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"73⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"74⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All75⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500176⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile76⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All76⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid75⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500176⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid76⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"73⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"74⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"75⤵
- Drops desktop.ini file(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All76⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500177⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile77⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All77⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid76⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500177⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid77⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"74⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"75⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"76⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All77⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV178⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500178⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile78⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All78⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid77⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV178⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500178⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid78⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"75⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"76⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"77⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All78⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500179⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile79⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All79⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid78⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500179⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid79⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"76⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"77⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"78⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All79⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500180⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile80⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All80⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid79⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500180⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid80⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"77⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"78⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"79⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"79⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All80⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500181⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile81⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All81⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid80⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500181⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid81⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"78⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"79⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"80⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"80⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All81⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500182⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile82⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All82⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid81⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500182⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid82⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"79⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"80⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"81⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All82⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500183⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile83⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All83⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid82⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500183⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid83⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"80⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"81⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"82⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All83⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500184⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile84⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All84⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid83⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV184⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500184⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid84⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"81⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"82⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"83⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All84⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500185⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile85⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All85⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid84⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500185⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid85⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"82⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"83⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"84⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"84⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All85⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500186⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile86⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All86⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid85⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500186⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid86⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"83⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"84⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"85⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All86⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500187⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile87⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All87⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid86⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500187⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid87⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"84⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"85⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"86⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"86⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All87⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500188⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile88⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All88⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid87⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500188⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid88⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"85⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"86⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"87⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"87⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"87⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All88⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500189⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile89⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All89⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid88⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500189⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid89⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"86⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"87⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"88⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"88⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"88⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"88⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All89⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500190⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile90⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All90⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid89⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500190⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid90⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"87⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"88⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"89⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All90⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500191⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile91⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All91⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid90⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500191⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid91⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"88⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"89⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"90⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"89⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"90⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"91⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"91⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"91⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"90⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"91⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"92⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"91⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"92⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"93⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"92⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"93⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"94⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All95⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500196⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile96⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All96⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid95⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500196⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid96⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"93⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"94⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"95⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"94⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"95⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"96⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All97⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV198⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500198⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile98⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All98⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid97⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV198⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500198⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid98⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"95⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"96⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"97⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"97⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"97⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"96⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"97⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"98⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"98⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"98⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All99⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1100⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 65001100⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile100⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All100⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid99⤵
-
C:\Windows\SysWOW64\chcp.comchcp 65001100⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid100⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"97⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"98⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"99⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"99⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"99⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"99⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"99⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"98⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"99⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"100⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"99⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"100⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"101⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All102⤵
-
C:\Windows\SysWOW64\chcp.comchcp 65001103⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile103⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All103⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid102⤵
-
C:\Windows\SysWOW64\chcp.comchcp 65001103⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid103⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"100⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"101⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"102⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"101⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"102⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"103⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"102⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"103⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"104⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"103⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"104⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"105⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"104⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"105⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"106⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"105⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"106⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"107⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"107⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"106⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"107⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"108⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"107⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"108⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"109⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"108⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"109⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"109⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
Temp.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
msgid.dat
Desktop.txt
Documents.txt
Downloads.txt
OneDrive.txt
Pictures.txt
Startup.txt
Temp.txt
Temp.txt
Videos.txt
desktop.ini
desktop.ini
desktop.ini
desktop.ini
desktop.ini
desktop.ini
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
ProductKey.txt
ScanningNetworks.txt
WorldWind.jpg
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Temp.txt
Temp.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Temp.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Temp.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Windows.txt
Temp.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
RebelCracked.exe.log
RuntimeBroker.exe.log
RuntimeBroker.exe
places.raw
tmp9CFB.tmp.dat
tmp9CFD.tmp.dat
tmp9D10.tmp.dat
tmpA569.tmp.dat
tmpA57E.tmp.dat
tmpA57F.tmp.dat
tmpA580.tmp.dat
tmpA5B0.tmp.dat
Bookmarks.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Admin@ODZKDRGV_en-US.zip
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
Process.txt
ScanningNetworks.txt
ScanningNetworks.txt
Process.txt
memory/1572-25-0x0000000000400000-0x0000000000432000-memory.dmp
memory/1572-33-0x0000000005950000-0x00000000059B6000-memory.dmp
memory/1980-22-0x0000000005590000-0x00000000055DA000-memory.dmp
memory/1980-20-0x0000000005DB0000-0x0000000006354000-memory.dmp
memory/1980-19-0x0000000000610000-0x0000000000668000-memory.dmp
memory/1980-15-0x000000007446E000-0x000000007446F000-memory.dmp
memory/1980-24-0x00000000058A0000-0x00000000058AA000-memory.dmp
memory/1980-23-0x0000000005940000-0x00000000059DC000-memory.dmp
memory/1980-21-0x0000000005800000-0x0000000005892000-memory.dmp
memory/2496-17-0x00007FFC36753000-0x00007FFC36755000-memory.dmp
memory/2904-18-0x00007FFC36750000-0x00007FFC37211000-memory.dmp
memory/2904-0-0x00007FFC36753000-0x00007FFC36755000-memory.dmp
memory/2904-3-0x00007FFC36750000-0x00007FFC37211000-memory.dmp
memory/2904-1-0x0000000000480000-0x00000000004DC000-memory.dmp
memory/4912-712-0x00000000065E0000-0x00000000065EA000-memory.dmp
memory/4912-854-0x0000000006B00000-0x0000000006B12000-memory.dmp