Analysis
-
max time kernel
24s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-07-2022 17:40
Static task
static1
Behavioral task
behavioral1
Sample
PRODUCTS.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
PRODUCTS.exe
-
Size
1.6MB
-
MD5
c602a8370b58252d95cd8a6f6aa8c4fe
-
SHA1
89fade2a77769925085d8e3053b2cb367c7d6e65
-
SHA256
6fc9cd411abc81271ab3c8d4ff15a707a9aa9c537bb26199f3a4c65c0abfc066
-
SHA512
7ee8ef6cf954caa43e5c0961c21e9c222df8d6f83aeeeb18f7471e5a7ec03e9a167351eddeb6b09e8cc415d99d9992cad739e85fa9e4d495cee55819da32add1
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: MapViewOfSection 64 IoCs
Processes:
PRODUCTS.exepid process 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
PRODUCTS.exepid process 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
PRODUCTS.exepid process 1656 PRODUCTS.exe 1656 PRODUCTS.exe 1656 PRODUCTS.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
PRODUCTS.exedescription pid process target process PID 1656 wrote to memory of 1324 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 1324 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 1324 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 1324 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 1312 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 1312 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 1312 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 1312 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 1788 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 1788 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 1788 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 1788 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 1812 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 1812 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 1812 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 1812 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 2044 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 2044 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 2044 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 2044 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 1132 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 1132 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 1132 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 1132 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 1264 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 1264 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 1264 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 1264 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 2000 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 2000 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 2000 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 2000 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 1828 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 1828 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 1828 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 1828 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 2028 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 2028 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 2028 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 2028 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 2012 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 2012 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 2012 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 2012 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 856 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 856 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 856 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 856 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 988 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 988 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 988 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 988 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 632 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 632 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 632 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 632 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 1980 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 1980 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 1980 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 1980 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 688 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 688 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 688 1656 PRODUCTS.exe PRODUCTS.exe PID 1656 wrote to memory of 688 1656 PRODUCTS.exe PRODUCTS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵