Resubmissions
01/10/2024, 19:23
241001-x3tkyszekh1001/10/2024, 19:14
241001-xxtc1awdmj1030/09/2024, 22:07
240930-11v8jsxdnm1030/09/2024, 21:59
240930-1wfmas1crg1030/09/2024, 20:26
240930-y8bg1atepl1026/09/2024, 20:34
240926-zcgvkszbmg1026/09/2024, 19:28
240926-x6rkrstfrr1026/09/2024, 19:21
240926-x2mq1swhnh1026/09/2024, 19:20
240926-x19jdstdpl1025/09/2024, 21:15
240925-z4dx1a1elf10Analysis
- max time kernel
174s - max time network
1386s - platform
windows10-2004_x64 - resource
win10v2004-20240910-en - resource tags
- submitted
01/10/2024, 19:23
General
- Target RebelCracked.exe
- Size 344KB
- Sample241001-x3tkyszekh
- SHA256 9d9a79f4ae9bf7a992945f6c06c5bec642c05e4e828217c50255dabfa3677006
Score
10/10
Malware Config
Extracted
Family
-
asyncrat
Botnet
-
Default
C2
-
127.0.0.1:6606
-
127.0.0.1:7707
-
127.0.0.1:8808
Mutex
-
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- StormKitty
StormKitty is an open source info stealer written in C#.
- StormKitty payload 1 IoCs
- Blocklisted process makes network request 18 IoCs
- Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 64 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
- Suspicious use of SetThreadContext 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 64 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 25 IoCs
- Suspicious use of SendNotifyMessage 24 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"3⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All4⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile5⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid4⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid5⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"4⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 650016⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile6⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid5⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650016⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"5⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All6⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650017⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile7⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid6⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650017⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid7⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"6⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All7⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650018⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile8⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid7⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 650018⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid8⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"5⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"7⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All8⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 650019⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile9⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid8⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650019⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid9⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"6⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"8⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"8⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"8⤵
- Blocklisted process makes network request
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All9⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500110⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile10⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid9⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500110⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid10⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"7⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"9⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All10⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500111⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile11⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid10⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500111⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid11⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"8⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"10⤵
- Blocklisted process makes network request
- Executes dropped EXE
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All11⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500112⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile12⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid11⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500112⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid12⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"9⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"11⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"11⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All12⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500113⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile13⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid12⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500113⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid13⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"10⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"12⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"12⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"12⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"12⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All13⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500114⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile14⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All14⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid13⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500114⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid14⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"11⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"12⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"13⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All14⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500115⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile15⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All15⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid14⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500115⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid15⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"12⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"14⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All15⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500116⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile16⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All16⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid15⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500116⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid16⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"13⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"14⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"15⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All16⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500117⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile17⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All17⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid16⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500117⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid17⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"14⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"16⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All17⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500118⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile18⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All18⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid17⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500118⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid18⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"15⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"16⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"17⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All18⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500119⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile19⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All19⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid18⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500119⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid19⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"16⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"18⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"18⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All19⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500120⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile20⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All20⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid19⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500120⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid20⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"17⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"18⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"19⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All20⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV121⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500121⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile21⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All21⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid20⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV121⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500121⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid21⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"18⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"20⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All21⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500122⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile22⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All22⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid21⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500122⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid22⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"19⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"20⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"21⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All22⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500123⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile23⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All23⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid22⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV123⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500123⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid23⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"20⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"22⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All23⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500124⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile24⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All24⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid23⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500124⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid24⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"21⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"22⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"23⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"23⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All24⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500125⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile25⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All25⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid24⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500125⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid25⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"22⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"24⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"24⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"24⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All25⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500126⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile26⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All26⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid25⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500126⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid26⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"23⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"24⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"25⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All26⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500127⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile27⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All27⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid26⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500127⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid27⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"24⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"26⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All27⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500128⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile28⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All28⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid27⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500128⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid28⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"25⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"26⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"27⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All28⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500129⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile29⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All29⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid28⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500129⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid29⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"26⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All29⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500130⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile30⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All30⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid29⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500130⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid30⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"27⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"28⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"29⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"29⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All30⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500131⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile31⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All31⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid30⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV131⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500131⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid31⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"28⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"30⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All31⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500132⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile32⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All32⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid31⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500132⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid32⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"29⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"30⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"31⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All32⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500133⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile33⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All33⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid32⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500133⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid33⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"30⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"32⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"32⤵
- Blocklisted process makes network request
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All33⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500134⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile34⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All34⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid33⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500134⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid34⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"31⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"32⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"33⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All34⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500135⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile35⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All35⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid34⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500135⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid35⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"32⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"34⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All35⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500136⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile36⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All36⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid35⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500136⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid36⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"33⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"34⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"35⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All36⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500137⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile37⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All37⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid36⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500137⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid37⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"34⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"35⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"36⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All37⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500138⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile38⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All38⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid37⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500138⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid38⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"35⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"36⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"37⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"37⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All38⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500139⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile39⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All39⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid38⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500139⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid39⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"36⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"37⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"38⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"38⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All39⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500140⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile40⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All40⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid39⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500140⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid40⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"37⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"38⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"39⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All40⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500141⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile41⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All41⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid40⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV141⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500141⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid41⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"38⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"39⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All41⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500142⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile42⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All42⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid41⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500142⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid42⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"39⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"40⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"41⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All42⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500143⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile43⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All43⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid42⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500143⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid43⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"40⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"41⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"42⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All43⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500144⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile44⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All44⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid43⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500144⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid44⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"41⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"42⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"43⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All44⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500145⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile45⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All45⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid44⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500145⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid45⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"42⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"43⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"44⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All45⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500146⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile46⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All46⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid45⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500146⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid46⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"43⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"44⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"45⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All46⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500147⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile47⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All47⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid46⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500147⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid47⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"44⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"45⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"46⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All47⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500148⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile48⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All48⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid47⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500148⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid48⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"45⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"46⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"47⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All48⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500149⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile49⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All49⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid48⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500149⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid49⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"46⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"47⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"48⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All49⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500150⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile50⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All50⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid49⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500150⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid50⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"47⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"48⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"49⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All50⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500151⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile51⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All51⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid50⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500151⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid51⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"48⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"49⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"50⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All51⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500152⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile52⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All52⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid51⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500152⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid52⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"49⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"50⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"51⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All52⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500153⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile53⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All53⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid52⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500153⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid53⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"50⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"51⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"52⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All53⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV154⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500154⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile54⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All54⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid53⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500154⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid54⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"51⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"52⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"53⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"53⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All54⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500155⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile55⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All55⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid54⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500155⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid55⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"52⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"53⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"54⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"53⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"54⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"55⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All56⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500157⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile57⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All57⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid56⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500157⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid57⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"54⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"55⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"56⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"56⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All57⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500158⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile58⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All58⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid57⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500158⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid58⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"55⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"56⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"57⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All58⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500159⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile59⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All59⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid58⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500159⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid59⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"56⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"57⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"58⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"58⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All59⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV160⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500160⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile60⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All60⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid59⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500160⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid60⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"57⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"58⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"59⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All60⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500161⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile61⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All61⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid60⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV161⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500161⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid61⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"58⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"59⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"60⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All61⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500162⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile62⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All62⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid61⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500162⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid62⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"59⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"60⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"61⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All62⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500163⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile63⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All63⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid62⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500163⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid63⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"60⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"61⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"62⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All63⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500164⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile64⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All64⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid63⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500164⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid64⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"61⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"62⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"63⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"63⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All64⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500165⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile65⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All65⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid64⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500165⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid65⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"62⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"63⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"64⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All65⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV166⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500166⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile66⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All66⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid65⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500166⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid66⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"63⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"64⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"65⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All66⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV167⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500167⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile67⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All67⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid66⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV167⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500167⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid67⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"64⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"65⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"66⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"65⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"66⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"67⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All68⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500169⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile69⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All69⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid68⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV169⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500169⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid69⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"66⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"67⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"68⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"68⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"67⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"68⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"69⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All70⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500171⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile71⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All71⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid70⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500171⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid71⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"68⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"69⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"70⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"70⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All71⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500172⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile72⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All72⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid71⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500172⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid72⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"69⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"70⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"71⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All72⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500173⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile73⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All73⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid72⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500173⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid73⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"70⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"71⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"72⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All73⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500174⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile74⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All74⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid73⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500174⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid74⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"71⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"72⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"73⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All74⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500175⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile75⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All75⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid74⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500175⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid75⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"72⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"73⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"74⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All75⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500176⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile76⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All76⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid75⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500176⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid76⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"73⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"74⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"75⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"74⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"75⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"76⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"75⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"76⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"77⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"77⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"76⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"77⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"78⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"77⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"78⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"79⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All80⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500181⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile81⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All81⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid80⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500181⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid81⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"78⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"79⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"80⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"80⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"79⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"80⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"81⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All82⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV183⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500183⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile83⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All83⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid82⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV183⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500183⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid83⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"80⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"81⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"82⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"82⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"82⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All83⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500184⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile84⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All84⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid83⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500184⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid84⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"81⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"82⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"83⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"83⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All84⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500185⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile85⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All85⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid84⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500185⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid85⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"82⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"83⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"84⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"83⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"84⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"85⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"84⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"85⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"86⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"85⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"86⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"87⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All88⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500189⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile89⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All89⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid88⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500189⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid89⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"86⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"87⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"88⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"88⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All89⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500190⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile90⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All90⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid89⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV190⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500190⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid90⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"87⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"88⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"89⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"89⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"88⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"89⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"90⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All91⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500192⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile92⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All92⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid91⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV192⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 6500192⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid92⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"89⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"90⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"91⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"91⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"90⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"91⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"92⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"91⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"92⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"93⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"93⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"92⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"93⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"94⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All95⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500196⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile96⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All96⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid95⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500196⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid96⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"93⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"94⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"95⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All96⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500197⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile97⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All97⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid96⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500197⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid97⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"94⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"95⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"96⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"96⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All97⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500198⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile98⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All98⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid97⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500198⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid98⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"95⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"96⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"97⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"97⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All98⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500199⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile99⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr All99⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid98⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500199⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid99⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"96⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"97⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"98⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"97⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"98⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"99⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"98⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"99⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"100⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"99⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"100⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"101⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"100⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"101⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"102⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"102⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"101⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"102⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"103⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"102⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"103⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"104⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"103⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"104⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"105⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"104⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"105⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"106⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"105⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"106⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"107⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"106⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"107⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"108⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"107⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"108⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"109⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"108⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"109⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"110⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All111⤵
-
C:\Windows\SysWOW64\chcp.comchcp 65001112⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile112⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All112⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"109⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"110⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"111⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"110⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"111⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"112⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"112⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All113⤵
-
C:\Windows\SysWOW64\chcp.comchcp 65001114⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile114⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All114⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid113⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1114⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 65001114⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid114⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"111⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"112⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"113⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"113⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"112⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"113⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"114⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"113⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"114⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"115⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"114⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"115⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"116⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"115⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"116⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"117⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"117⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"116⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"117⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"118⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"118⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"117⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"118⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"119⤵
-
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"119⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"118⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"119⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"120⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"C:\Users\Admin\AppData\Local\Temp\RebelCracked.exe"119⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"120⤵
-
C:\Users\Admin\AppData\Local\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\RuntimeBroker.exe"121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-