– Random alphanumeric name. – Often seen with droppers or downloaders. – May attempt to disable Defender or add startup entries.