Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
16-05-2024 03:42
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
PRODUCTS.exe
Resource
win7-20240220-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
PRODUCTS.exe
Resource
win10v2004-20240426-en
13 signatures
150 seconds
General
-
Target
PRODUCTS.exe
-
Size
1.6MB
-
MD5
c602a8370b58252d95cd8a6f6aa8c4fe
-
SHA1
89fade2a77769925085d8e3053b2cb367c7d6e65
-
SHA256
6fc9cd411abc81271ab3c8d4ff15a707a9aa9c537bb26199f3a4c65c0abfc066
-
SHA512
7ee8ef6cf954caa43e5c0961c21e9c222df8d6f83aeeeb18f7471e5a7ec03e9a167351eddeb6b09e8cc415d99d9992cad739e85fa9e4d495cee55819da32add1
-
SSDEEP
24576:hCdxte/80jYLT3U1jfsWaEpYEOcz4IsPoFM8C50kHk6QWegpI15w2XzbtQ:Aw80cTsjkWaEpX5sEM86HeoGpX2
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: MapViewOfSection 64 IoCs
Processes:
PRODUCTS.exepid process 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
PRODUCTS.exepid process 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
PRODUCTS.exepid process 1664 PRODUCTS.exe 1664 PRODUCTS.exe 1664 PRODUCTS.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
PRODUCTS.exedescription pid process target process PID 1664 wrote to memory of 2856 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2856 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2856 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2856 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 1800 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 1800 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 1800 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 1800 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2224 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2224 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2224 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2224 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2872 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2872 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2872 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2872 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 3048 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 3048 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 3048 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 3048 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2900 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2900 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2900 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2900 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2948 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2948 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2948 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2948 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2116 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2116 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2116 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2116 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2544 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2544 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2544 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2544 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2564 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2564 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2564 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2564 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2612 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2612 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2612 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2612 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2648 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2648 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2648 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2648 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2652 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2652 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2652 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2652 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2672 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2672 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2672 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2672 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2684 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2684 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2684 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2684 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2616 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2616 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2616 1664 PRODUCTS.exe PRODUCTS.exe PID 1664 wrote to memory of 2616 1664 PRODUCTS.exe PRODUCTS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS.exe"2⤵