Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10CMMON32.exe
windows7-x64
7Client-built.exe
windows7-x64
10CraxsRatV7.6.exe
windows7-x64
3FivemCheat.exe
windows7-x64
10QuantumBuilder.exe
windows7-x64
10R2Tf11dq2.exe
windows7-x64
10System.exe
windows7-x64
10kinginamoV2.exe
windows7-x64
10robloxfisc...st.exe
windows7-x64
10robloxlist.exe
windows7-x64
10Analysis
-
max time kernel
4s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/11/2024, 07:45
Behavioral task
behavioral1
Sample
CMMON32.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Client-built.exe
Resource
win7-20240903-en
Behavioral task
behavioral3
Sample
CraxsRatV7.6.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
FivemCheat.exe
Resource
win7-20240903-en
Behavioral task
behavioral5
Sample
QuantumBuilder.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
R2Tf11dq2.exe
Resource
win7-20240903-en
Behavioral task
behavioral7
Sample
System.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
kinginamoV2.exe
Resource
win7-20240903-en
Behavioral task
behavioral9
Sample
robloxfischscriptlist.exe
Resource
win7-20241010-en
General
-
Target
CMMON32.exe
-
Size
7.9MB
-
MD5
79c02f84f1618db1afcbddbb6bb6d797
-
SHA1
6220b2e090b0987290197449361fd2bb954fcc87
-
SHA256
c13cc014e521bf589bb1320d3fc5f6f673165d7b430ad4bc9849b9b46529dc9d
-
SHA512
3ef54cc01a53ae499516a99c5374f4b97f710352e92ac818985b4595e9036888c2d44d1ae39d9d5718d4c20f51232a7ad80fbe662cb515626afa0031d0c5017e
-
SSDEEP
196608:IsuvoQSD/MPz9wo4QesfpkwCA0X40G+C4ypCui/:luvoQ2/mwo4hsunXlqCd
Malware Config
Signatures
-
Executes dropped EXE 57 IoCs
pid Process 2580 IEUNATT.EXE 2940 IEUNATT.EXE 2764 IEUNATT.EXE 2776 IEUNATT.EXE 2948 IEUNATT.EXE 2672 IEUNATT.EXE 2692 IEUNATT.EXE 2568 IEUNATT.EXE 2352 IEUNATT.EXE 2576 IEUNATT.EXE 1292 IEUNATT.EXE 2000 IEUNATT.EXE 2688 IEUNATT.EXE 2088 IEUNATT.EXE 2968 IEUNATT.EXE 1052 IEUNATT.EXE 348 IEUNATT.EXE 956 IEUNATT.EXE 2448 IEUNATT.EXE 1164 IEUNATT.EXE 2280 IEUNATT.EXE 884 IEUNATT.EXE 2120 IEUNATT.EXE 2320 IEUNATT.EXE 2556 IEUNATT.EXE 2764 IEUNATT.EXE 2536 IEUNATT.EXE 2872 IEUNATT.EXE 2364 IEUNATT.EXE 2664 IEUNATT.EXE 2616 IEUNATT.EXE 2512 IEUNATT.EXE 2276 IEUNATT.EXE 2676 IEUNATT.EXE 1856 IEUNATT.EXE 1728 IEUNATT.EXE 2004 IEUNATT.EXE 792 IEUNATT.EXE 2980 IEUNATT.EXE 2424 IEUNATT.EXE 2272 IEUNATT.EXE 2480 IEUNATT.EXE 2584 IEUNATT.EXE 1264 IEUNATT.EXE 296 IEUNATT.EXE 996 IEUNATT.EXE 2072 IEUNATT.EXE 2260 IEUNATT.EXE 1772 IEUNATT.EXE 2328 IEUNATT.EXE 2320 IEUNATT.EXE 2556 IEUNATT.EXE 3004 IEUNATT.EXE 2804 IEUNATT.EXE 2724 IEUNATT.EXE 2808 IEUNATT.EXE 2652 IEUNATT.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 58 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMMON32.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2168 wrote to memory of 2284 2168 CMMON32.exe 30 PID 2168 wrote to memory of 2284 2168 CMMON32.exe 30 PID 2168 wrote to memory of 2284 2168 CMMON32.exe 30 PID 2168 wrote to memory of 2284 2168 CMMON32.exe 30 PID 2284 wrote to memory of 2544 2284 CMMON32.EXE 83 PID 2284 wrote to memory of 2544 2284 CMMON32.EXE 83 PID 2284 wrote to memory of 2544 2284 CMMON32.EXE 83 PID 2284 wrote to memory of 2544 2284 CMMON32.EXE 83 PID 2544 wrote to memory of 2220 2544 CMMON32.EXE 319 PID 2544 wrote to memory of 2220 2544 CMMON32.EXE 319 PID 2544 wrote to memory of 2220 2544 CMMON32.EXE 319 PID 2544 wrote to memory of 2220 2544 CMMON32.EXE 319 PID 2220 wrote to memory of 2896 2220 CMMON32.EXE 499 PID 2220 wrote to memory of 2896 2220 CMMON32.EXE 499 PID 2220 wrote to memory of 2896 2220 CMMON32.EXE 499 PID 2220 wrote to memory of 2896 2220 CMMON32.EXE 499 PID 2896 wrote to memory of 2996 2896 CMMON32.EXE 321 PID 2896 wrote to memory of 2996 2896 CMMON32.EXE 321 PID 2896 wrote to memory of 2996 2896 CMMON32.EXE 321 PID 2896 wrote to memory of 2996 2896 CMMON32.EXE 321 PID 2996 wrote to memory of 2640 2996 CMMON32.EXE 563 PID 2996 wrote to memory of 2640 2996 CMMON32.EXE 563 PID 2996 wrote to memory of 2640 2996 CMMON32.EXE 563 PID 2996 wrote to memory of 2640 2996 CMMON32.EXE 563 PID 2640 wrote to memory of 2612 2640 CMMON32.EXE 43 PID 2640 wrote to memory of 2612 2640 CMMON32.EXE 43 PID 2640 wrote to memory of 2612 2640 CMMON32.EXE 43 PID 2640 wrote to memory of 2612 2640 CMMON32.EXE 43 PID 2612 wrote to memory of 2676 2612 CMMON32.EXE 45 PID 2612 wrote to memory of 2676 2612 CMMON32.EXE 45 PID 2612 wrote to memory of 2676 2612 CMMON32.EXE 45 PID 2612 wrote to memory of 2676 2612 CMMON32.EXE 45 PID 2676 wrote to memory of 1856 2676 CMMON32.EXE 47 PID 2676 wrote to memory of 1856 2676 CMMON32.EXE 47 PID 2676 wrote to memory of 1856 2676 CMMON32.EXE 47 PID 2676 wrote to memory of 1856 2676 CMMON32.EXE 47 PID 1856 wrote to memory of 1740 1856 CMMON32.EXE 214 PID 1856 wrote to memory of 1740 1856 CMMON32.EXE 214 PID 1856 wrote to memory of 1740 1856 CMMON32.EXE 214 PID 1856 wrote to memory of 1740 1856 CMMON32.EXE 214 PID 1740 wrote to memory of 1784 1740 CMMON32.EXE 51 PID 1740 wrote to memory of 1784 1740 CMMON32.EXE 51 PID 1740 wrote to memory of 1784 1740 CMMON32.EXE 51 PID 1740 wrote to memory of 1784 1740 CMMON32.EXE 51 PID 1784 wrote to memory of 1992 1784 CMMON32.EXE 402 PID 1784 wrote to memory of 1992 1784 CMMON32.EXE 402 PID 1784 wrote to memory of 1992 1784 CMMON32.EXE 402 PID 1784 wrote to memory of 1992 1784 CMMON32.EXE 402 PID 1992 wrote to memory of 1160 1992 CMMON32.EXE 640 PID 1992 wrote to memory of 1160 1992 CMMON32.EXE 640 PID 1992 wrote to memory of 1160 1992 CMMON32.EXE 640 PID 1992 wrote to memory of 1160 1992 CMMON32.EXE 640 PID 1160 wrote to memory of 2936 1160 CMMON32.EXE 57 PID 1160 wrote to memory of 2936 1160 CMMON32.EXE 57 PID 1160 wrote to memory of 2936 1160 CMMON32.EXE 57 PID 1160 wrote to memory of 2936 1160 CMMON32.EXE 57 PID 2936 wrote to memory of 2460 2936 CMMON32.EXE 59 PID 2936 wrote to memory of 2460 2936 CMMON32.EXE 59 PID 2936 wrote to memory of 2460 2936 CMMON32.EXE 59 PID 2936 wrote to memory of 2460 2936 CMMON32.EXE 59 PID 2460 wrote to memory of 2356 2460 CMMON32.EXE 471 PID 2460 wrote to memory of 2356 2460 CMMON32.EXE 471 PID 2460 wrote to memory of 2356 2460 CMMON32.EXE 471 PID 2460 wrote to memory of 2356 2460 CMMON32.EXE 471
Processes
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.exe"C:\Users\Admin\AppData\Local\Temp\CMMON32.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"7⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"9⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"11⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"15⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"17⤵
- System Location Discovery: System Language Discovery
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"18⤵
- System Location Discovery: System Language Discovery
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"19⤵
- System Location Discovery: System Language Discovery
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"20⤵
- System Location Discovery: System Language Discovery
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"21⤵
- System Location Discovery: System Language Discovery
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"22⤵
- System Location Discovery: System Language Discovery
PID:560 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"23⤵
- System Location Discovery: System Language Discovery
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"24⤵
- System Location Discovery: System Language Discovery
PID:600 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"25⤵
- System Location Discovery: System Language Discovery
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"26⤵
- System Location Discovery: System Language Discovery
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"27⤵
- System Location Discovery: System Language Discovery
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"28⤵
- System Location Discovery: System Language Discovery
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"29⤵
- System Location Discovery: System Language Discovery
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"30⤵
- System Location Discovery: System Language Discovery
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"31⤵
- System Location Discovery: System Language Discovery
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"32⤵
- System Location Discovery: System Language Discovery
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"33⤵
- System Location Discovery: System Language Discovery
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"34⤵
- System Location Discovery: System Language Discovery
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"35⤵
- System Location Discovery: System Language Discovery
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"36⤵
- System Location Discovery: System Language Discovery
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"37⤵
- System Location Discovery: System Language Discovery
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"38⤵
- System Location Discovery: System Language Discovery
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"39⤵
- System Location Discovery: System Language Discovery
PID:776 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"40⤵
- System Location Discovery: System Language Discovery
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"41⤵
- System Location Discovery: System Language Discovery
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"42⤵
- System Location Discovery: System Language Discovery
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"43⤵
- System Location Discovery: System Language Discovery
PID:772 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"44⤵
- System Location Discovery: System Language Discovery
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"45⤵
- System Location Discovery: System Language Discovery
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"46⤵
- System Location Discovery: System Language Discovery
PID:908 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"47⤵
- System Location Discovery: System Language Discovery
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"48⤵
- System Location Discovery: System Language Discovery
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"49⤵
- System Location Discovery: System Language Discovery
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"50⤵
- System Location Discovery: System Language Discovery
PID:288 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"51⤵
- System Location Discovery: System Language Discovery
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"52⤵
- System Location Discovery: System Language Discovery
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"53⤵
- System Location Discovery: System Language Discovery
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"54⤵
- System Location Discovery: System Language Discovery
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"55⤵
- System Location Discovery: System Language Discovery
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"56⤵
- System Location Discovery: System Language Discovery
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"57⤵
- System Location Discovery: System Language Discovery
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"58⤵
- System Location Discovery: System Language Discovery
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"59⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"60⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"61⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"62⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"63⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"64⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"65⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"66⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"67⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"68⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"69⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"70⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"71⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"72⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"73⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"74⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"75⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"76⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"77⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"78⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"79⤵PID:288
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"80⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"81⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"82⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"83⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"84⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"85⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"86⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"87⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"88⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"89⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"90⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"91⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"92⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"93⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"94⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"95⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"96⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"97⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"98⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"99⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"100⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"101⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"102⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"103⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"104⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"105⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"106⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"107⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"108⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"109⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"110⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"111⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"112⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"113⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"114⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"115⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"116⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"117⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"118⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"119⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"120⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"121⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"C:\Users\Admin\AppData\Local\Temp\CMMON32.EXE"122⤵PID:1728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-