Overview
overview
7Static
static
7setup.exe
windows7-x64
7setup.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3Easy_Burning.exe
windows7-x64
7Easy_Burning.exe
windows10-2004-x64
7Uninst Eas...ng.exe
windows7-x64
7Uninst Eas...ng.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3VisualISO.exe
windows7-x64
3VisualISO.exe
windows10-2004-x64
3cdrecord.exe
windows7-x64
7cdrecord.exe
windows10-2004-x64
7check_file.exe
windows7-x64
7check_file.exe
windows10-2004-x64
7compare.exe
windows7-x64
1compare.exe
windows10-2004-x64
1cygwin1.dll
windows7-x64
7cygwin1.dll
windows10-2004-x64
7info.html
windows7-x64
1info.html
windows10-2004-x64
1language.exe
windows7-x64
7language.exe
windows10-2004-x64
7mkisofs.exe
windows7-x64
7mkisofs.exe
windows10-2004-x64
7problem.pdf
windows7-x64
1problem.pdf
windows10-2004-x64
1sh.exe
windows7-x64
7sh.exe
windows10-2004-x64
7Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18/04/2024, 21:44
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
Easy_Burning.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Easy_Burning.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
Uninst Easy_Burning.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Uninst Easy_Burning.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
VisualISO.exe
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
VisualISO.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral15
Sample
cdrecord.exe
Resource
win7-20240215-en
Behavioral task
behavioral16
Sample
cdrecord.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral17
Sample
check_file.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
check_file.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
compare.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
compare.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral21
Sample
cygwin1.dll
Resource
win7-20240215-en
Behavioral task
behavioral22
Sample
cygwin1.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral23
Sample
info.html
Resource
win7-20240319-en
Behavioral task
behavioral24
Sample
info.html
Resource
win10v2004-20240412-en
Behavioral task
behavioral25
Sample
language.exe
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
language.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral27
Sample
mkisofs.exe
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
mkisofs.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral29
Sample
problem.pdf
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
problem.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral31
Sample
sh.exe
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
sh.exe
Resource
win10v2004-20240226-en
General
-
Target
mkisofs.exe
-
Size
125KB
-
MD5
14a0f190d9872e9de65a7107e5dbc1c8
-
SHA1
f5df2fdf26c04759cff864c8df6db575c50d8574
-
SHA256
5fa3b5257f654a16c8cfe724e8f34f69c48dd632d8f103c34ad97e28dd395f52
-
SHA512
47f0f54f26a33e4f636716f2a632f3b63901f8fac912911c552ab86e49959026780c39f1e1ba8617a3744351fe86947b0495a1325ac5f2008dccaded81353ca0
-
SSDEEP
3072:i5yTsuMdqzSYK3Et99foXoidWdlrw2DmFGGrdU:iUr2YK3Et9hgoiUlmcmi
Malware Config
Signatures
-
resource yara_rule behavioral28/memory/5088-0-0x0000000000400000-0x0000000000480000-memory.dmp upx behavioral28/memory/5088-1-0x0000000061000000-0x000000006126B000-memory.dmp upx behavioral28/memory/3976-2-0x0000000000400000-0x0000000000480000-memory.dmp upx behavioral28/memory/3976-3-0x0000000061000000-0x000000006126B000-memory.dmp upx behavioral28/memory/4420-4-0x0000000061000000-0x000000006126B000-memory.dmp upx behavioral28/memory/3896-5-0x0000000061000000-0x000000006126B000-memory.dmp upx behavioral28/memory/1972-6-0x0000000061000000-0x000000006126B000-memory.dmp upx behavioral28/memory/5168-7-0x0000000061000000-0x000000006126B000-memory.dmp upx behavioral28/memory/5444-8-0x0000000061000000-0x000000006126B000-memory.dmp upx behavioral28/memory/5480-9-0x0000000061000000-0x000000006126B000-memory.dmp upx behavioral28/memory/5500-10-0x0000000061000000-0x000000006126B000-memory.dmp upx behavioral28/memory/6340-11-0x0000000061000000-0x000000006126B000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5088 wrote to memory of 3976 5088 mkisofs.exe 87 PID 5088 wrote to memory of 3976 5088 mkisofs.exe 87 PID 5088 wrote to memory of 3976 5088 mkisofs.exe 87 PID 3976 wrote to memory of 3400 3976 mkisofs.exe 88 PID 3976 wrote to memory of 3400 3976 mkisofs.exe 88 PID 3976 wrote to memory of 3400 3976 mkisofs.exe 88 PID 3400 wrote to memory of 4420 3400 mkisofs.exe 89 PID 3400 wrote to memory of 4420 3400 mkisofs.exe 89 PID 3400 wrote to memory of 4420 3400 mkisofs.exe 89 PID 4420 wrote to memory of 3880 4420 mkisofs.exe 90 PID 4420 wrote to memory of 3880 4420 mkisofs.exe 90 PID 4420 wrote to memory of 3880 4420 mkisofs.exe 90 PID 3880 wrote to memory of 3092 3880 mkisofs.exe 91 PID 3880 wrote to memory of 3092 3880 mkisofs.exe 91 PID 3880 wrote to memory of 3092 3880 mkisofs.exe 91 PID 3092 wrote to memory of 3596 3092 mkisofs.exe 92 PID 3092 wrote to memory of 3596 3092 mkisofs.exe 92 PID 3092 wrote to memory of 3596 3092 mkisofs.exe 92 PID 3596 wrote to memory of 1872 3596 mkisofs.exe 93 PID 3596 wrote to memory of 1872 3596 mkisofs.exe 93 PID 3596 wrote to memory of 1872 3596 mkisofs.exe 93 PID 1872 wrote to memory of 1384 1872 mkisofs.exe 94 PID 1872 wrote to memory of 1384 1872 mkisofs.exe 94 PID 1872 wrote to memory of 1384 1872 mkisofs.exe 94 PID 1384 wrote to memory of 5004 1384 mkisofs.exe 95 PID 1384 wrote to memory of 5004 1384 mkisofs.exe 95 PID 1384 wrote to memory of 5004 1384 mkisofs.exe 95 PID 5004 wrote to memory of 4524 5004 mkisofs.exe 96 PID 5004 wrote to memory of 4524 5004 mkisofs.exe 96 PID 5004 wrote to memory of 4524 5004 mkisofs.exe 96 PID 4524 wrote to memory of 552 4524 mkisofs.exe 97 PID 4524 wrote to memory of 552 4524 mkisofs.exe 97 PID 4524 wrote to memory of 552 4524 mkisofs.exe 97 PID 552 wrote to memory of 1752 552 mkisofs.exe 98 PID 552 wrote to memory of 1752 552 mkisofs.exe 98 PID 552 wrote to memory of 1752 552 mkisofs.exe 98 PID 1752 wrote to memory of 3896 1752 mkisofs.exe 99 PID 1752 wrote to memory of 3896 1752 mkisofs.exe 99 PID 1752 wrote to memory of 3896 1752 mkisofs.exe 99 PID 3896 wrote to memory of 1980 3896 mkisofs.exe 100 PID 3896 wrote to memory of 1980 3896 mkisofs.exe 100 PID 3896 wrote to memory of 1980 3896 mkisofs.exe 100 PID 1980 wrote to memory of 1972 1980 mkisofs.exe 101 PID 1980 wrote to memory of 1972 1980 mkisofs.exe 101 PID 1980 wrote to memory of 1972 1980 mkisofs.exe 101 PID 1972 wrote to memory of 2168 1972 mkisofs.exe 102 PID 1972 wrote to memory of 2168 1972 mkisofs.exe 102 PID 1972 wrote to memory of 2168 1972 mkisofs.exe 102 PID 2168 wrote to memory of 5024 2168 mkisofs.exe 103 PID 2168 wrote to memory of 5024 2168 mkisofs.exe 103 PID 2168 wrote to memory of 5024 2168 mkisofs.exe 103 PID 5024 wrote to memory of 3200 5024 mkisofs.exe 104 PID 5024 wrote to memory of 3200 5024 mkisofs.exe 104 PID 5024 wrote to memory of 3200 5024 mkisofs.exe 104 PID 3200 wrote to memory of 464 3200 mkisofs.exe 105 PID 3200 wrote to memory of 464 3200 mkisofs.exe 105 PID 3200 wrote to memory of 464 3200 mkisofs.exe 105 PID 464 wrote to memory of 4940 464 mkisofs.exe 106 PID 464 wrote to memory of 4940 464 mkisofs.exe 106 PID 464 wrote to memory of 4940 464 mkisofs.exe 106 PID 4940 wrote to memory of 4256 4940 mkisofs.exe 107 PID 4940 wrote to memory of 4256 4940 mkisofs.exe 107 PID 4940 wrote to memory of 4256 4940 mkisofs.exe 107 PID 4256 wrote to memory of 2440 4256 mkisofs.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"6⤵
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"7⤵
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"8⤵
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"9⤵
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"10⤵
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"11⤵
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"12⤵
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"13⤵
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"14⤵
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"15⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"16⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"17⤵
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"18⤵
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"19⤵
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"20⤵
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"21⤵
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"22⤵
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"23⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"24⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"25⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"26⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"27⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"28⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"29⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"30⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"31⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"32⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"33⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"34⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"35⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"36⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"37⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"38⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"39⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"40⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"41⤵PID:500
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"42⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"43⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"44⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"45⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"46⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"47⤵PID:492
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"48⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"49⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"50⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"51⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"52⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"53⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"54⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"55⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"56⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"57⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"58⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"59⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"60⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"61⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"62⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"63⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"64⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"65⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"66⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"67⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"68⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"69⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"70⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"71⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"72⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"73⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"74⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"75⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"76⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"77⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"78⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"79⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"80⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"81⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"82⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"83⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"84⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"85⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"86⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"87⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"88⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"89⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"90⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"91⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"92⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"93⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"94⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"95⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"96⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"97⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"98⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"99⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"100⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"101⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"102⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"103⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"104⤵PID:5132
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"105⤵PID:5148
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"106⤵PID:5168
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"107⤵PID:5180
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"108⤵PID:5200
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"109⤵PID:5216
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"110⤵PID:5232
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"111⤵PID:5252
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"112⤵PID:5264
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"113⤵PID:5292
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"114⤵PID:5312
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"115⤵PID:5328
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"116⤵PID:5352
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"117⤵PID:5364
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"118⤵PID:5380
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"119⤵PID:5396
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"120⤵PID:5412
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"121⤵PID:5428
-
C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"C:\Users\Admin\AppData\Local\Temp\mkisofs.exe"122⤵PID:5444
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-