2cb0d3b3c2a398a778d18b089cf68d8f7fd91808da695bee0f0fb556354efe09

Resubmissions

12/11/2022, 10:35

221112-mm661aaa7w10

09/11/2022, 16:24

221109-twddlsbhap10

Analysis

max time kernel
152s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09/11/2022, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ACH PAYMENT 1192022pdf.exe
Size 787KB
Sample221109-twddlsbhap
SHA256 2cb0d3b3c2a398a778d18b089cf68d8f7fd91808da695bee0f0fb556354efe09
MD5 8ce1b79f89e73e5d31f6e934a2be7821
SHA1 fa7a042f3ece8aecd491d4287cf76e0431e4a123
SHA512 2a186a4b11c142d731c872dc5a4b6eb30e3b9f2ab5c9709d2a23a9161694f63f455573b09bfd91b1727b9dfd019fd9a174ed71d01d6fd40f9a19c9d5b80ffef7
SSDEEP 24576:ebhfCCHEmgHSfhDMKnkUTgZGLvbPKqCRrLA3FC:YhfjEbSZYjUaQvbJQgFC
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2000	zgtspmlzyc.exe
1752	zgtspmlzyc.exe
1248	zgtspmlzyc.exe
2020	zgtspmlzyc.exe
2044	zgtspmlzyc.exe
968	zgtspmlzyc.exe
1872	zgtspmlzyc.exe
1888	zgtspmlzyc.exe
544	zgtspmlzyc.exe
612	zgtspmlzyc.exe
684	zgtspmlzyc.exe
1768	zgtspmlzyc.exe
1236	zgtspmlzyc.exe
1156	zgtspmlzyc.exe
1552	zgtspmlzyc.exe
1504	zgtspmlzyc.exe
912	zgtspmlzyc.exe
980	zgtspmlzyc.exe
1736	zgtspmlzyc.exe
1988	zgtspmlzyc.exe
1124	zgtspmlzyc.exe
388	zgtspmlzyc.exe
1728	zgtspmlzyc.exe
1632	zgtspmlzyc.exe
1184	zgtspmlzyc.exe
1104	zgtspmlzyc.exe
328	zgtspmlzyc.exe
984	zgtspmlzyc.exe
976	zgtspmlzyc.exe
1844	zgtspmlzyc.exe
288	zgtspmlzyc.exe
1928	zgtspmlzyc.exe
1700	zgtspmlzyc.exe
864	zgtspmlzyc.exe
276	zgtspmlzyc.exe
1364	zgtspmlzyc.exe
1360	zgtspmlzyc.exe
1732	zgtspmlzyc.exe
1224	zgtspmlzyc.exe
1272	zgtspmlzyc.exe
1752	zgtspmlzyc.exe
1248	zgtspmlzyc.exe
860	zgtspmlzyc.exe
1228	zgtspmlzyc.exe
2032	zgtspmlzyc.exe
2036	zgtspmlzyc.exe
896	zgtspmlzyc.exe
968	zgtspmlzyc.exe
1872	zgtspmlzyc.exe
1584	zgtspmlzyc.exe
1616	zgtspmlzyc.exe
1712	zgtspmlzyc.exe
920	zgtspmlzyc.exe
1376	zgtspmlzyc.exe
1716	zgtspmlzyc.exe
924	zgtspmlzyc.exe
1784	zgtspmlzyc.exe
776	zgtspmlzyc.exe
1976	zgtspmlzyc.exe
952	zgtspmlzyc.exe
612	zgtspmlzyc.exe
684	zgtspmlzyc.exe
1768	zgtspmlzyc.exe
1236	zgtspmlzyc.exe

Loads dropped DLL 64 IoCs

pid	Process
1912	ACH PAYMENT 1192022pdf.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2000	zgtspmlzyc.exe
2000	zgtspmlzyc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 2000	1912	ACH PAYMENT 1192022pdf.exe	28
PID 1912 wrote to memory of 2000	1912	ACH PAYMENT 1192022pdf.exe	28
PID 1912 wrote to memory of 2000	1912	ACH PAYMENT 1192022pdf.exe	28
PID 1912 wrote to memory of 2000	1912	ACH PAYMENT 1192022pdf.exe	28
PID 2000 wrote to memory of 1752	2000	zgtspmlzyc.exe	29
PID 2000 wrote to memory of 1752	2000	zgtspmlzyc.exe	29
PID 2000 wrote to memory of 1752	2000	zgtspmlzyc.exe	29
PID 2000 wrote to memory of 1752	2000	zgtspmlzyc.exe	29
PID 2000 wrote to memory of 1752	2000	zgtspmlzyc.exe	29
PID 2000 wrote to memory of 1248	2000	zgtspmlzyc.exe	30
PID 2000 wrote to memory of 1248	2000	zgtspmlzyc.exe	30
PID 2000 wrote to memory of 1248	2000	zgtspmlzyc.exe	30
PID 2000 wrote to memory of 1248	2000	zgtspmlzyc.exe	30
PID 2000 wrote to memory of 1248	2000	zgtspmlzyc.exe	30
PID 2000 wrote to memory of 2020	2000	zgtspmlzyc.exe	31
PID 2000 wrote to memory of 2020	2000	zgtspmlzyc.exe	31
PID 2000 wrote to memory of 2020	2000	zgtspmlzyc.exe	31
PID 2000 wrote to memory of 2020	2000	zgtspmlzyc.exe	31
PID 2000 wrote to memory of 2020	2000	zgtspmlzyc.exe	31
PID 2000 wrote to memory of 2044	2000	zgtspmlzyc.exe	32
PID 2000 wrote to memory of 2044	2000	zgtspmlzyc.exe	32
PID 2000 wrote to memory of 2044	2000	zgtspmlzyc.exe	32
PID 2000 wrote to memory of 2044	2000	zgtspmlzyc.exe	32
PID 2000 wrote to memory of 2044	2000	zgtspmlzyc.exe	32
PID 2000 wrote to memory of 968	2000	zgtspmlzyc.exe	33
PID 2000 wrote to memory of 968	2000	zgtspmlzyc.exe	33
PID 2000 wrote to memory of 968	2000	zgtspmlzyc.exe	33
PID 2000 wrote to memory of 968	2000	zgtspmlzyc.exe	33
PID 2000 wrote to memory of 968	2000	zgtspmlzyc.exe	33
PID 2000 wrote to memory of 1872	2000	zgtspmlzyc.exe	34
PID 2000 wrote to memory of 1872	2000	zgtspmlzyc.exe	34
PID 2000 wrote to memory of 1872	2000	zgtspmlzyc.exe	34
PID 2000 wrote to memory of 1872	2000	zgtspmlzyc.exe	34
PID 2000 wrote to memory of 1872	2000	zgtspmlzyc.exe	34
PID 2000 wrote to memory of 1888	2000	zgtspmlzyc.exe	37
PID 2000 wrote to memory of 1888	2000	zgtspmlzyc.exe	37
PID 2000 wrote to memory of 1888	2000	zgtspmlzyc.exe	37
PID 2000 wrote to memory of 1888	2000	zgtspmlzyc.exe	37
PID 2000 wrote to memory of 1888	2000	zgtspmlzyc.exe	37
PID 2000 wrote to memory of 544	2000	zgtspmlzyc.exe	36
PID 2000 wrote to memory of 544	2000	zgtspmlzyc.exe	36
PID 2000 wrote to memory of 544	2000	zgtspmlzyc.exe	36
PID 2000 wrote to memory of 544	2000	zgtspmlzyc.exe	36
PID 2000 wrote to memory of 544	2000	zgtspmlzyc.exe	36
PID 2000 wrote to memory of 612	2000	zgtspmlzyc.exe	35
PID 2000 wrote to memory of 612	2000	zgtspmlzyc.exe	35
PID 2000 wrote to memory of 612	2000	zgtspmlzyc.exe	35
PID 2000 wrote to memory of 612	2000	zgtspmlzyc.exe	35
PID 2000 wrote to memory of 612	2000	zgtspmlzyc.exe	35
PID 2000 wrote to memory of 684	2000	zgtspmlzyc.exe	38
PID 2000 wrote to memory of 684	2000	zgtspmlzyc.exe	38
PID 2000 wrote to memory of 684	2000	zgtspmlzyc.exe	38
PID 2000 wrote to memory of 684	2000	zgtspmlzyc.exe	38
PID 2000 wrote to memory of 684	2000	zgtspmlzyc.exe	38
PID 2000 wrote to memory of 1768	2000	zgtspmlzyc.exe	39
PID 2000 wrote to memory of 1768	2000	zgtspmlzyc.exe	39
PID 2000 wrote to memory of 1768	2000	zgtspmlzyc.exe	39
PID 2000 wrote to memory of 1768	2000	zgtspmlzyc.exe	39
PID 2000 wrote to memory of 1768	2000	zgtspmlzyc.exe	39
PID 2000 wrote to memory of 1236	2000	zgtspmlzyc.exe	42
PID 2000 wrote to memory of 1236	2000	zgtspmlzyc.exe	42
PID 2000 wrote to memory of 1236	2000	zgtspmlzyc.exe	42
PID 2000 wrote to memory of 1236	2000	zgtspmlzyc.exe	42
PID 2000 wrote to memory of 1236	2000	zgtspmlzyc.exe	42

C:\Users\Admin\AppData\Local\Temp\ACH PAYMENT 1192022pdf.exe
"C:\Users\Admin\AppData\Local\Temp\ACH PAYMENT 1192022pdf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
  "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1752
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1248
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:2044
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:968
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1872
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:612
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:684
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1768
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1552
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1156
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1236
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1504
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:912
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1736
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1124
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1988
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:980
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:388
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1728
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1184
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1104
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:328
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:984
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1844
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:288
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1928
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:864
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1364
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:276
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1700
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1360
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1732
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1224
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1272
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1752
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1248
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:860
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1228
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:2032
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:2036
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:968
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1872
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1584
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1616
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1712
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:920
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1376
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:924
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1784
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:776
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:612
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:684
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1768
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1236
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1156
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:520
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:856
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1504
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1072
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1824
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1064
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1940
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1988
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1536
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1828
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1404
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:572
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1908
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1984
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:832
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:388
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:828
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1728
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1416
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1628
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1104
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1496
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1492
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1836
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1068
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1936
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1648
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:696
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:756
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:552
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1372
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1444
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1708
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:752
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1232
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1332
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1348
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:860
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1228
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2032
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2036
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:968
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1872
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1584
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1616
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1712
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:920
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1376
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:924
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1784
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:776
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:612
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:684
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1768
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1236
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1156
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:520
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:856
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1504
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1072
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1824
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1064
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1940
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1988
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1536
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1828
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1404
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:572
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1908
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1984
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:832
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:388
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:828
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1728
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1416
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1192
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1660
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:328
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:624
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:984
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:996
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1844
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:932
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:288
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1928
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1700
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:864
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:276
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1372
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1444
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1708
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:752
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1232
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1332
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1248
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2044
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1532
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1588
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1608
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1612
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1604
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:668
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1832
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:268
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1032
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:760
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:584
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1436
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:432
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:576
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1552
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:764
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1008
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:980
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:912
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1736
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1804
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:580
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1556
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:632
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1036
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:688
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1780
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1512
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1160
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:960
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1124
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1500
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1600
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1776
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1176
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1816
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1184
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1104
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1496
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1492
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1836
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1068
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1936
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1648
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:696
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:756
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:552
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1668
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1364
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1360
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1732
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1224
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1272
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1752
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1544
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1348
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:860
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1228
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2032
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2036
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:968
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1872
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1584
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1616
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1712
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:920
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1376
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:924
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1784
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:776
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:612
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:684
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1768
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1236
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1156
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:520
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:856
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1504
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1072
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1824
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1064
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1940
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1988
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1536
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1828
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1404
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:572
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1908
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1984
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:832
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:388
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:828
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1728
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1416
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1192
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1660
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:624
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:328
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:984
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:996
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1844
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:932
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:288
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1928
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1700
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:864
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:276
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1364
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1668
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1360
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1732
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1224
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1272
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1752
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1544
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1348
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:860
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1228
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2044
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1532
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1588
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1608
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1612
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1604
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:668
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1832
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:268
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1032
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:760
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:584
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1436
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:432
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:576
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1552
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:764
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1008
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:980
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:912
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1736
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1804
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:580
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1556
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1036
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:632
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:688
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1780
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1512
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1160
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:960
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1124
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1500
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1600
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1776
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1176
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1816
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1184
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1104
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1496
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1492
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1836
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1068
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1936
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1648
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:696
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:756
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:552
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1444
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1708
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:752
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1232
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1332
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1248
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1644
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2032
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2036
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:968
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1872
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1584
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1616
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1712
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:920
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1376
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:924
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1784
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:776
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:612
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:684
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1768
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1236
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1156
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:520
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:856
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1504
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1072
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1824
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1064
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1940
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1988
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1536
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1828
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1404
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:572
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1908
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1984
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:832
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:388
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:828
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1728
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1416
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1192
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1660
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:624
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:328
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:984
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:996
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1844
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:932
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:288
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1928
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1700
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:864
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:276
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1444
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1708
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:752
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1232
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1332
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1248
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1644
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2032
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2036
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1608
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1612
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1604
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:668
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1832
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:268
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1032
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:760
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:584
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1436
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:432
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:576
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1552
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:764
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1008
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:980
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:912
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1736
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1804
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:580
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1556
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1036
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:632
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:688
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1780
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1512
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1160
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:960
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1124
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1500
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1600
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1776
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1176
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1816
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1184
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1104
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1496
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1492
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1836
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1068
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1936
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1648
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:696
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:756
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:552
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1364
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1444
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1708
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:752
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1232
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1332
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1248
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1644
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2032
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2036
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1608
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1612
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1604
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:668
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1832
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:268
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1032
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:760
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:584
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1436
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:432
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:576
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1552
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:764
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1008
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:980
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:912
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1736
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1804
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:580
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1556
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1036
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:632
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:688
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1780
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1512
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1160
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:960
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1124
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1500
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1600
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1776
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1176
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1816
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1184
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1104
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:624
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:328
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:984
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:996
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1844
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:932
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:288
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1928
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1700
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:864
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:276
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1364
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1444
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1708
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:752
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1232
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1332
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1248
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1644
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2032
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2036
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1608
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1612
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1604
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:668
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1832
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:268
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1032
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:760
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:584
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1436
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:432
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:576
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1552
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:764
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1008
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:980
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:912
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1736
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1804
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:580
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1556
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1036
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:632
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:688
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1780
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1512
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1160
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:960
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1124
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1500
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1600
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1776
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1176
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1816
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1184
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1104
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:624
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:984
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:328
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:996
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1844
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:932
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:288
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1928
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1700
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:864
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:276
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1364
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1444
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1708
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:752
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1232
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1332
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1248
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1644
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2032
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2036
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1608
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1612
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1604
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:668
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1832
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:268
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1032
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:760
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:584
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1436
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:432
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:576
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1552
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:764
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1008
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:980
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:912
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1736
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1804
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:580
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1556
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1036
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:632
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:688
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1780
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1512
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1160
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:960
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1124
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1500
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1600
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1776
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1176
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1816
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1184
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1104
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:624
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:328
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:984
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:996
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1844
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:932
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:288
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1928
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1700
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:864
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:276
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1364
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1444
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1708
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:752
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1232
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1332
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1248
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1644
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2032
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2036
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1608
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1612
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:920
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1376
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:924
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1784
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:776
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:612
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:684
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1768
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1236
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1156
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:520
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:856
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1504
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1072
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1824
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1064
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1940
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1988
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1536
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1828
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1404
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:572
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1908
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1984
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:832
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:388
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:828
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1728
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1416
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1192
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1660
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:916
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1496
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1492
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1836
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1068
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1936
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1648
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:696
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:756
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:552
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1668
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1360
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1732
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1364
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1444
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1708
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:752
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1232
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1332
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1248
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2032
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1644
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2036
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1608
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1612
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:920
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1376
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:924
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1784
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:776
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:612
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:684
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1768
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1236
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1156
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:520
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:856
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1504
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1072
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1824
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1064
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1940
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1988
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1536
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1828
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1404
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:572
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1908
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1984
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:832
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:388
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:828
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1728
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1416
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1192
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1660
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:916
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1496
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1492
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1836
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1068
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1936
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1648
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:696
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:756
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:552
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1668
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1360
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1732
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1364
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1444
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1708
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:752
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1232
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1332
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1248
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1644
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2032
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2036
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1608
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1612
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:920
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1376
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:924
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1784
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:776
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:612
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:684
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1768
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1236
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1156
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:520
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:856
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1504
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1072
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1824
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1064
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1940
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1988
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1536
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1404
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1828
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:572
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1908
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1984
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:832
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:388
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:828
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1728
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1416
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1192
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1660
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:916
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1496
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1492
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1836
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1068
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1936
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1648
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:696
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:756
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:552
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1668
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1360
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1732
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1364
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1444
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1708
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:752
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1232
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1332
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1248
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1644
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2032
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2036
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1608
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1612
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:920
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1376
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:924
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1784
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:776
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:612
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:684
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1768
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1236
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1156
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:520
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:856
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1504
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1072
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1824
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1064
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1940
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1988
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1536
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1828
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1404
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:572
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1908
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1984
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:832
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:388
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:828
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1728
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1416
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1192
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1660

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gbzirgrikw.sr

Path C:\Users\Admin\AppData\Local\Temp\gbzirgrikw.sr
Size 185KB
SHA256 5f01ca9005df391923dd005efd0b14e54cc95ff3f7a9832e9661a89d1ad22e73
MD5 6d7040cb67e39a76019d7a3dfa91de76
SHA1 7b48b374b7802c86efcc53afedf704582acfdf6b
SHA512 f81e2fdf220fc892eff3f7e7ad31ba074652f9e9f66e6fc00b610832bf093d77b587066d85bf7c68b755049bd6e22fe37cd90b2e8c31158fef76587a49f69386
SSDEEP 3072:4f+Bz7An88ij6h08U4itx9LeobLbC3+ThsaKcSv6T7Lye8wPS8XzxW7CqplB2PP1:6+BAYj6h0Vb9rm3+T31Svh3Ez47LpIP1
MD5 SHA1 SHA512 SSDEEP

Submit Download

phybypzup.au3

Path C:\Users\Admin\AppData\Local\Temp\phybypzup.au3
Size 6KB
SHA256 86bec25eb5f9e4ad312de7109e68e44ae12b3bee77e0c309033081abdacc2b26
MD5 91d76ebb15466101a2930db301879ed8
SHA1 9cdadadf16fbec1357dcad69fc2dea22a4095c09
SHA512 39134a5cca251ac7806ed944427c6f9da6e4784394ce2ff4c636a6cb1722840a23862d83db5a45409d6f885012d0354aa9156edf0625f87d43bb7b68fb4e8002
SSDEEP 48:YY828Pz8Z82WrE1uo9MC8Wws6gEAVdw8/uaCFYsIhZdQGdJ/:sfo9MC8Wws6gvuaCusBGdJ/
MD5 SHA1 SHA512 SSDEEP

Submit Download

rpohzycut.vu

Path C:\Users\Admin\AppData\Local\Temp\rpohzycut.vu
Size 42KB
SHA256 8020b459213224b6fa3efd8b5cd52797bfa245368db5646eca8ec09211024163
MD5 d0ed370e8bf44110fa633ccb2ab52e82
SHA1 4d326625d4a42237bf463630e0181947be401518
SHA512 9b2c648f4bdfda1ca6721e4543ffa787bf394d532c4e8723b6ed168ffa233ba63ec2e9ab843e565c4ded1d7ac2df4f0b254480dee2532c9b2ce336284742f162
SSDEEP 384:nF/nqSnWNrk+Iviks9slcmBnvBbfxILjLBpWpyJbsle8yr7r9bvRDbV8V:FBmgTuBpvMl8rm
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1912-54-0x00000000763F1000-0x00000000763F3000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads