2cb0d3b3c2a398a778d18b089cf68d8f7fd91808da695bee0f0fb556354efe09

Resubmissions

12/11/2022, 10:35

221112-mm661aaa7w10

09/11/2022, 16:24

221109-twddlsbhap10

Analysis

max time kernel
151s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12/11/2022, 10:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ACH PAYMENT 1192022pdf.exe
Size 787KB
Sample221112-mm661aaa7w
SHA256 2cb0d3b3c2a398a778d18b089cf68d8f7fd91808da695bee0f0fb556354efe09
MD5 8ce1b79f89e73e5d31f6e934a2be7821
SHA1 fa7a042f3ece8aecd491d4287cf76e0431e4a123
SHA512 2a186a4b11c142d731c872dc5a4b6eb30e3b9f2ab5c9709d2a23a9161694f63f455573b09bfd91b1727b9dfd019fd9a174ed71d01d6fd40f9a19c9d5b80ffef7
SSDEEP 24576:ebhfCCHEmgHSfhDMKnkUTgZGLvbPKqCRrLA3FC:YhfjEbSZYjUaQvbJQgFC
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
684	zgtspmlzyc.exe
1108	zgtspmlzyc.exe
1976	zgtspmlzyc.exe
2028	zgtspmlzyc.exe
1748	zgtspmlzyc.exe
1996	zgtspmlzyc.exe
956	zgtspmlzyc.exe
952	zgtspmlzyc.exe
368	zgtspmlzyc.exe
904	zgtspmlzyc.exe
1136	zgtspmlzyc.exe
524	zgtspmlzyc.exe
268	zgtspmlzyc.exe
1712	zgtspmlzyc.exe
1168	zgtspmlzyc.exe
828	zgtspmlzyc.exe
1180	zgtspmlzyc.exe
1436	zgtspmlzyc.exe
1384	zgtspmlzyc.exe
1860	zgtspmlzyc.exe
1356	zgtspmlzyc.exe
1948	zgtspmlzyc.exe
1036	zgtspmlzyc.exe
616	zgtspmlzyc.exe
840	zgtspmlzyc.exe
1188	zgtspmlzyc.exe
2012	zgtspmlzyc.exe
1408	zgtspmlzyc.exe
1828	zgtspmlzyc.exe
1664	zgtspmlzyc.exe
588	zgtspmlzyc.exe
788	zgtspmlzyc.exe
1636	zgtspmlzyc.exe
556	zgtspmlzyc.exe
976	zgtspmlzyc.exe
572	zgtspmlzyc.exe
1696	zgtspmlzyc.exe
1652	zgtspmlzyc.exe
300	zgtspmlzyc.exe
1564	zgtspmlzyc.exe
1668	zgtspmlzyc.exe
900	zgtspmlzyc.exe
1960	zgtspmlzyc.exe
276	zgtspmlzyc.exe
1112	zgtspmlzyc.exe
1216	zgtspmlzyc.exe
1320	zgtspmlzyc.exe
1976	zgtspmlzyc.exe
2020	zgtspmlzyc.exe
2028	zgtspmlzyc.exe
2040	zgtspmlzyc.exe
1748	zgtspmlzyc.exe
2024	zgtspmlzyc.exe
1620	zgtspmlzyc.exe
1720	zgtspmlzyc.exe
1624	zgtspmlzyc.exe
1984	zgtspmlzyc.exe
1972	zgtspmlzyc.exe
1584	zgtspmlzyc.exe
956	zgtspmlzyc.exe
988	zgtspmlzyc.exe
952	zgtspmlzyc.exe
1824	zgtspmlzyc.exe
368	zgtspmlzyc.exe

Loads dropped DLL 64 IoCs

pid	Process
1088	ACH PAYMENT 1192022pdf.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
684	zgtspmlzyc.exe
684	zgtspmlzyc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 684	1088	ACH PAYMENT 1192022pdf.exe	28
PID 1088 wrote to memory of 684	1088	ACH PAYMENT 1192022pdf.exe	28
PID 1088 wrote to memory of 684	1088	ACH PAYMENT 1192022pdf.exe	28
PID 1088 wrote to memory of 684	1088	ACH PAYMENT 1192022pdf.exe	28
PID 684 wrote to memory of 1108	684	zgtspmlzyc.exe	29
PID 684 wrote to memory of 1108	684	zgtspmlzyc.exe	29
PID 684 wrote to memory of 1108	684	zgtspmlzyc.exe	29
PID 684 wrote to memory of 1108	684	zgtspmlzyc.exe	29
PID 684 wrote to memory of 1108	684	zgtspmlzyc.exe	29
PID 684 wrote to memory of 1976	684	zgtspmlzyc.exe	30
PID 684 wrote to memory of 1976	684	zgtspmlzyc.exe	30
PID 684 wrote to memory of 1976	684	zgtspmlzyc.exe	30
PID 684 wrote to memory of 1976	684	zgtspmlzyc.exe	30
PID 684 wrote to memory of 1976	684	zgtspmlzyc.exe	30
PID 684 wrote to memory of 2028	684	zgtspmlzyc.exe	31
PID 684 wrote to memory of 2028	684	zgtspmlzyc.exe	31
PID 684 wrote to memory of 2028	684	zgtspmlzyc.exe	31
PID 684 wrote to memory of 2028	684	zgtspmlzyc.exe	31
PID 684 wrote to memory of 2028	684	zgtspmlzyc.exe	31
PID 684 wrote to memory of 1748	684	zgtspmlzyc.exe	32
PID 684 wrote to memory of 1748	684	zgtspmlzyc.exe	32
PID 684 wrote to memory of 1748	684	zgtspmlzyc.exe	32
PID 684 wrote to memory of 1748	684	zgtspmlzyc.exe	32
PID 684 wrote to memory of 1748	684	zgtspmlzyc.exe	32
PID 684 wrote to memory of 1996	684	zgtspmlzyc.exe	33
PID 684 wrote to memory of 1996	684	zgtspmlzyc.exe	33
PID 684 wrote to memory of 1996	684	zgtspmlzyc.exe	33
PID 684 wrote to memory of 1996	684	zgtspmlzyc.exe	33
PID 684 wrote to memory of 1996	684	zgtspmlzyc.exe	33
PID 684 wrote to memory of 956	684	zgtspmlzyc.exe	34
PID 684 wrote to memory of 956	684	zgtspmlzyc.exe	34
PID 684 wrote to memory of 956	684	zgtspmlzyc.exe	34
PID 684 wrote to memory of 956	684	zgtspmlzyc.exe	34
PID 684 wrote to memory of 956	684	zgtspmlzyc.exe	34
PID 684 wrote to memory of 952	684	zgtspmlzyc.exe	35
PID 684 wrote to memory of 952	684	zgtspmlzyc.exe	35
PID 684 wrote to memory of 952	684	zgtspmlzyc.exe	35
PID 684 wrote to memory of 952	684	zgtspmlzyc.exe	35
PID 684 wrote to memory of 952	684	zgtspmlzyc.exe	35
PID 684 wrote to memory of 368	684	zgtspmlzyc.exe	36
PID 684 wrote to memory of 368	684	zgtspmlzyc.exe	36
PID 684 wrote to memory of 368	684	zgtspmlzyc.exe	36
PID 684 wrote to memory of 368	684	zgtspmlzyc.exe	36
PID 684 wrote to memory of 368	684	zgtspmlzyc.exe	36
PID 684 wrote to memory of 904	684	zgtspmlzyc.exe	37
PID 684 wrote to memory of 904	684	zgtspmlzyc.exe	37
PID 684 wrote to memory of 904	684	zgtspmlzyc.exe	37
PID 684 wrote to memory of 904	684	zgtspmlzyc.exe	37
PID 684 wrote to memory of 904	684	zgtspmlzyc.exe	37
PID 684 wrote to memory of 1136	684	zgtspmlzyc.exe	38
PID 684 wrote to memory of 1136	684	zgtspmlzyc.exe	38
PID 684 wrote to memory of 1136	684	zgtspmlzyc.exe	38
PID 684 wrote to memory of 1136	684	zgtspmlzyc.exe	38
PID 684 wrote to memory of 1136	684	zgtspmlzyc.exe	38
PID 684 wrote to memory of 524	684	zgtspmlzyc.exe	39
PID 684 wrote to memory of 524	684	zgtspmlzyc.exe	39
PID 684 wrote to memory of 524	684	zgtspmlzyc.exe	39
PID 684 wrote to memory of 524	684	zgtspmlzyc.exe	39
PID 684 wrote to memory of 524	684	zgtspmlzyc.exe	39
PID 684 wrote to memory of 268	684	zgtspmlzyc.exe	40
PID 684 wrote to memory of 268	684	zgtspmlzyc.exe	40
PID 684 wrote to memory of 268	684	zgtspmlzyc.exe	40
PID 684 wrote to memory of 268	684	zgtspmlzyc.exe	40
PID 684 wrote to memory of 268	684	zgtspmlzyc.exe	40

C:\Users\Admin\AppData\Local\Temp\ACH PAYMENT 1192022pdf.exe
"C:\Users\Admin\AppData\Local\Temp\ACH PAYMENT 1192022pdf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
  "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:684
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1108
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1996
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:368
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:904
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1136
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:524
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:268
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1712
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:828
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1180
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1436
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1384
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1860
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1356
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1948
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1036
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:616
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:840
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1188
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1408
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1828
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1664
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:588
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:788
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1636
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:556
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:572
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:300
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1668
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:900
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1960
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:276
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:2024
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1620
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1984
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1972
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1584
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:988
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:1824
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    - Executes dropped EXE
    PID:368
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:904
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1364
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1136
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1856
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1332
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:268
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1252
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1712
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1380
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1120
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1132
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:828
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1784
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1200
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1328
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1436
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:704
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:928
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1560
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1860
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:672
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:592
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:332
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1084
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1744
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:616
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1236
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:840
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1556
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1348
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1520
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1572
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1300
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1664
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:588
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:788
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1636
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:556
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:572
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:300
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1668
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:900
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1960
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:276
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2024
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1620
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1984
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1972
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1584
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:988
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1824
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:368
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:904
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1364
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1136
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1856
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1332
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:268
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1252
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1712
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1380
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1120
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1132
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:828
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1784
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1200
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1328
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1436
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:704
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:928
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1560
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1860
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:672
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:592
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:332
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1084
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:308
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1288
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:540
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1756
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1188
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1532
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1920
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1408
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:576
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:696
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1828
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1048
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1312
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:548
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1832
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1420
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:872
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1600
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1612
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:636
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1396
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1080
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:296
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1668
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:900
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1960
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:276
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2024
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1620
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1984
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1972
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1584
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:988
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1824
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:368
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:904
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1364
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1136
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1856
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1332
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:268
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1252
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1712
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1380
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1120
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1132
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:828
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1784
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1200
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1328
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1436
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:704
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:928
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1560
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1860
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:672
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:592
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:332
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1084
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:308
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1288
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:540
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1756
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1188
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1532
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1920
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1408
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:576
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:696
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1828
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1048
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1312
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:548
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1832
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1420
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:872
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1600
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1612
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:636
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1396
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1080
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:296
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1668
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:900
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1960
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:276
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2024
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1620
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1984
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1972
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1584
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:988
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1824
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:368
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:904
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1364
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1136
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1856
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1332
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:268
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1252
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1712
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1380
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1120
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1132
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:828
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1784
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1200
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1328
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1436
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:704
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:928
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1560
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1860
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:672
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:592
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:332
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1084
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:308
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1288
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1556
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1348
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1520
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1572
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1300
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1664
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:588
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:788
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1636
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:556
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:572
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:300
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1788
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1484
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1668
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:900
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1960
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:276
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2024
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1620
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1984
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1972
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1584
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:988
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1824
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:368
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:904
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1364
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1136
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1856
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1332
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:268
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1252
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1712
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1380
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1120
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1132
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:828
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1784
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1200
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1328
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1436
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:704
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:928
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1560
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1860
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:672
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:592
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:332
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1084
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:308
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1288
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1556
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1348
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1520
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1572
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1300
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1664
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:588
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:788
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1636
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:556
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:572
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:300
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1788
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1484
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1668
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:900
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1960
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:276
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2024
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1620
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1984
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1972
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1584
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:988
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1824
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:368
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:904
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1364
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1136
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1856
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1332
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:268
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1252
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1712
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1380
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1120
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1132
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:828
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1784
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1200
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1328
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1436
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:704
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:928
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1560
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1860
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:672
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:592
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:332
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1084
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:308
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1288
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1556
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1348
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1520
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1572
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1300
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1664
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:588
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:788
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1636
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:556
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:572
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:300
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1788
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1484
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1668
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:900
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1960
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:276
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2024
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1620
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1984
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1972
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1584
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:988
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1824
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:368
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:904
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1364
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1136
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1856
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1332
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:268
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1252
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1712
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1380
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1120
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1132
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:828
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1784
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1200
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1328
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1436
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:704
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:928
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1560
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1860
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:672
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:592
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:332
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1084
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:308
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1288
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1556
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1348
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1520
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1572
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1300
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1664
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:588
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:788
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1636
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:556
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:572
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:300
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1788
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1484
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1668
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:900
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1960
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:276
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2024
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1620
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1984
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1972
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1584
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:988
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1824
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:368
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:904
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1364
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1136
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1856
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1332
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:268
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1252
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1712
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1380
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1120
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1132
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:828
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1784
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1200
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1328
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1436
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:704
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:928
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1560
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1860
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:672
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:592
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:332
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1084
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:308
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1288
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1556
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1348
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1520
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1572
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1300
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1664
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:588
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:788
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1636
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:556
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:572
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:300
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1788
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1484
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1668
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:900
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1960
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:276
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2024
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1620
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1984
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1972
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1584
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:988
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1824
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:368
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:904
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1364
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1136
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1856
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1332
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:268
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1252
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1712
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1380
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1120
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1132
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:828
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1784
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1200
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1328
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1436
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:704
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:928
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1560
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1860
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:672
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:592
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:332
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1084
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:308
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1288
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1556
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1348
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1520
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1572
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1300
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1664
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:588
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:788
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1636
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:556
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:572
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:300
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1788
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1484
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1668
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:900
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1960
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:276
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2024
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1620
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1984
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1972
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1584
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:988
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1824
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:368
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:904
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1364
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1136
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1856
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1332
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:268
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:536
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:824
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1400
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1384
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1580
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:564
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1352
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1356
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1940
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1948
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:472
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1872
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1036
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1372
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1744
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:616
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1236
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:840
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1756
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1188
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1532
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1920
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1408
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:576
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:696
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1828
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1048
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1312
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:548
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1832
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1420
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:872
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1600
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1612
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:636
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1396
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1080
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:296
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:572
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:300
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1788
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1484
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1668
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:900
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1960
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:276
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2024
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1620
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1984
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1972
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1584
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:988
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1824
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:368
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:904
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1364
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1136
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1160
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:612
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1180
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1516
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1252
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1712
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1380
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1120
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1132
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:828
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1784
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1200
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1328
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1436
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:704
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:928
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1560
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1860
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:672
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:592
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:332
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1084
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:308
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1288
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1556
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1348
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1520
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1572
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1300
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1664
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:588
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:788
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1636
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:556
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1936
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:572
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:300
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1788
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1484
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1668
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:900
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1960
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:276
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2024
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1620
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1984
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1972
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1584
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:988
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1824
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:368
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:904
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1364
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1136
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1160
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:612
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1180
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1516
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1252
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1712
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1380
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1120
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1132
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:828
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1784
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1200
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1328
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1436
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:704
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:928
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1560
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1860
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:672
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:592
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:332
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1084
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:308
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1288
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1556
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1348
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1520
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1572
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1300
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1664
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:588
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:788
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1636
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:556
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1936
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:572
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:300
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1788
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1484
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1668
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:900
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1960
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:276
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:2024
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1620
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1984
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1972
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1584
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:956
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:988
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1824
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:368
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:904
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1364
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1136
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1160
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:612
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1180
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1516
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1252
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1712
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1380
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1120
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1132
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:828
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1784
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1200
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1328
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:1436
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:704
- - C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
    "C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe" "C:\Users\Admin\AppData\Local\Temp\phybypzup.au3"
    3⤵
    PID:928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gbzirgrikw.sr

Path C:\Users\Admin\AppData\Local\Temp\gbzirgrikw.sr
Size 185KB
SHA256 5f01ca9005df391923dd005efd0b14e54cc95ff3f7a9832e9661a89d1ad22e73
MD5 6d7040cb67e39a76019d7a3dfa91de76
SHA1 7b48b374b7802c86efcc53afedf704582acfdf6b
SHA512 f81e2fdf220fc892eff3f7e7ad31ba074652f9e9f66e6fc00b610832bf093d77b587066d85bf7c68b755049bd6e22fe37cd90b2e8c31158fef76587a49f69386
SSDEEP 3072:4f+Bz7An88ij6h08U4itx9LeobLbC3+ThsaKcSv6T7Lye8wPS8XzxW7CqplB2PP1:6+BAYj6h0Vb9rm3+T31Svh3Ez47LpIP1
MD5 SHA1 SHA512 SSDEEP

Submit Download

phybypzup.au3

Path C:\Users\Admin\AppData\Local\Temp\phybypzup.au3
Size 6KB
SHA256 86bec25eb5f9e4ad312de7109e68e44ae12b3bee77e0c309033081abdacc2b26
MD5 91d76ebb15466101a2930db301879ed8
SHA1 9cdadadf16fbec1357dcad69fc2dea22a4095c09
SHA512 39134a5cca251ac7806ed944427c6f9da6e4784394ce2ff4c636a6cb1722840a23862d83db5a45409d6f885012d0354aa9156edf0625f87d43bb7b68fb4e8002
SSDEEP 48:YY828Pz8Z82WrE1uo9MC8Wws6gEAVdw8/uaCFYsIhZdQGdJ/:sfo9MC8Wws6gvuaCusBGdJ/
MD5 SHA1 SHA512 SSDEEP

Submit Download

rpohzycut.vu

Path C:\Users\Admin\AppData\Local\Temp\rpohzycut.vu
Size 42KB
SHA256 8020b459213224b6fa3efd8b5cd52797bfa245368db5646eca8ec09211024163
MD5 d0ed370e8bf44110fa633ccb2ab52e82
SHA1 4d326625d4a42237bf463630e0181947be401518
SHA512 9b2c648f4bdfda1ca6721e4543ffa787bf394d532c4e8723b6ed168ffa233ba63ec2e9ab843e565c4ded1d7ac2df4f0b254480dee2532c9b2ce336284742f162
SSDEEP 384:nF/nqSnWNrk+Iviks9slcmBnvBbfxILjLBpWpyJbsle8yr7r9bvRDbV8V:FBmgTuBpvMl8rm
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path C:\Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgtspmlzyc.exe

Path \Users\Admin\AppData\Local\Temp\zgtspmlzyc.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1088-54-0x0000000075241000-0x0000000075243000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads