Malware Analysis Report

2025-03-15 06:49

Sample ID 240107-pnl9bsgeb9
Target BlitzedGrabberV12.exe
SHA256 eacf04d721fe4880dc73790ccbd58acf310dc0c90b13b7424200a9aa2b94640a
Tags
orcus persistence rat spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

eacf04d721fe4880dc73790ccbd58acf310dc0c90b13b7424200a9aa2b94640a

Threat Level: Known bad

The file BlitzedGrabberV12.exe was found to be: Known bad.

Malicious Activity Summary

orcus persistence rat spyware stealer

Orcus main payload

Orcus

Orcurs Rat Executable

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

Drops desktop.ini file(s)

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-07 12:31

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-07 12:28

Reported

2024-01-07 12:36

Platform

win10v2004-20231215-en

Max time kernel

102s

Max time network

219s

Command Line

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

Signatures

Orcus

rat spyware stealer orcus

Orcus main payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Orcurs Rat Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\mxfix.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mxfix.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mxfix.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mxfix.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mxfix.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mxfix.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mxfix.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mxfix.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mxfix.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mxfix.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
N/A N/A C:\Windows\System32\Conhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mxfix.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mxfix.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mxfix.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
N/A N/A C:\Windows\System32\Conhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
N/A N/A C:\Windows\System32\Conhost.exe N/A
N/A N/A C:\Windows\System32\Conhost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\mxfix.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\mxfix.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\mxfix.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Windows\System32\Conhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Windows\System32\Conhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\mxfix.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\mxfix.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Windows\System32\Conhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\mxfix.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\mxfix.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\mxfix.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\mxfix.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\mxfix.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\mxfix.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\mxfix.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\mxfix.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\assembly C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
File opened for modification C:\Windows\assembly C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
File opened for modification C:\Windows\assembly C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
File opened for modification C:\Windows\assembly C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
File opened for modification C:\Windows\assembly C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
File opened for modification C:\Windows\assembly C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
File opened for modification C:\Windows\assembly C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\Conhost.exe N/A
N/A N/A C:\Windows\System32\Conhost.exe N/A
N/A N/A C:\Windows\System32\Conhost.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mxfix.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mxfix.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mxfix.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mxfix.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3140 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\mxfix.EXE
PID 3140 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\mxfix.EXE
PID 3140 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe
PID 3140 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe
PID 3140 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe
PID 3140 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe
PID 2384 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\mxfix.EXE C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2384 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\mxfix.EXE C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4452 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\mxfix.EXE
PID 4452 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\mxfix.EXE
PID 828 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\mxfix.EXE C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 828 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\mxfix.EXE C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4452 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe
PID 4452 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe
PID 4452 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe
PID 4452 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe
PID 1872 wrote to memory of 4520 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\mxfix.EXE
PID 1872 wrote to memory of 4520 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\mxfix.EXE
PID 4520 wrote to memory of 3076 N/A C:\Users\Admin\AppData\Local\Temp\mxfix.EXE C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4520 wrote to memory of 3076 N/A C:\Users\Admin\AppData\Local\Temp\mxfix.EXE C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1872 wrote to memory of 3788 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe
PID 1872 wrote to memory of 3788 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe
PID 1872 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe
PID 1872 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe
PID 4524 wrote to memory of 3476 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\mxfix.EXE
PID 4524 wrote to memory of 3476 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\mxfix.EXE
PID 3476 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Local\Temp\mxfix.EXE C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3476 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Local\Temp\mxfix.EXE C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4524 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe
PID 4524 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe
PID 4524 wrote to memory of 3364 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe
PID 4524 wrote to memory of 3364 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe
PID 3364 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\mxfix.EXE
PID 3364 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\mxfix.EXE
PID 564 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\mxfix.EXE C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 564 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\mxfix.EXE C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3364 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe
PID 3364 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe
PID 3364 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe
PID 3364 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe
PID 2480 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\mxfix.EXE
PID 2480 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\mxfix.EXE
PID 2480 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe
PID 2480 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe
PID 2496 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\mxfix.EXE C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2496 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\mxfix.EXE C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2480 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe
PID 2480 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe
PID 4028 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe
PID 4028 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe
PID 2088 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2088 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4028 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe
PID 4028 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe
PID 4028 wrote to memory of 1856 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe
PID 4028 wrote to memory of 1856 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe
PID 1856 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\mxfix.EXE
PID 1856 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\mxfix.EXE
PID 2600 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Temp\mxfix.EXE C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2600 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Temp\mxfix.EXE C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1856 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe
PID 1856 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe
PID 1856 wrote to memory of 4080 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe
PID 1856 wrote to memory of 4080 N/A C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

Processes

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mcjbgpqq.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jyxas2nm.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eccjgyxc.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vxuwlpyi.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dm3nu9ok.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\au7bxf5h.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kvopm9jb.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cp-aqxrj.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nwyprvho.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\snoxramm.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kpl1oren.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1pgtnpjb.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mpxkyznm.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yxkfgpce.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lewr9jyl.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\b037ykjg.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kadapxya.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\i3l6xj0v.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dtbcyvib.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pxl2_byq.cmdline"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kvdk6uj2.cmdline"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES10CC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC10CB.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES10DB.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC10DA.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES10CB.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC10CA.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES10FA.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC10F9.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES10FB.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC10FA.tmp"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1119.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1118.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1129.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1128.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1148.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1137.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES111A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1119.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES112A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1129.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1149.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1147.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1158.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1157.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES10EA.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC10E9.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES10AD.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC10AB.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES10AC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC109C.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1187.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1176.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1167.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1166.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1196.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1186.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES11A6.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1195.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES109C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC109B.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES11A7.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC11A5.tmp"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uehkjmqv.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2CFE.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2CFD.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\v4rwhgdn.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3088.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3087.tmp"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Windows\SysWOW64\WindowsInput.exe

"C:\Windows\SysWOW64\WindowsInput.exe" --install

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\z0lqpehl.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3AF8.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3AF7.tmp"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5ctzvvvx.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4F0D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4F0C.tmp"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\02wyx83_.cmdline"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5C99.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5C98.tmp"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\SysWOW64\WindowsInput.exe

"C:\Windows\SysWOW64\WindowsInput.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\a3cmaxef.cmdline"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6796.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6795.tmp"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gfgrsfij.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES715A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7159.tmp"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\85ujdh2v.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7CB4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7CB3.tmp"

C:\ProgramData\Chrome\chromedriver.exe

"C:\ProgramData\Chrome\chromedriver.exe"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gsmdeohy.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES88F9.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC88E8.tmp"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dttafmor.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES97DD.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC97CD.tmp"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\z7w0g4br.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA078.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA077.tmp"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\c5qmuzyq.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAD4A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAD49.tmp"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mxvl0giv.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBAE6.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCBAE5.tmp"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\w14m5pgo.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC892.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC891.tmp"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\_g9tdupa.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD311.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD310.tmp"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2rjxpozg.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDE1E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCDE1D.tmp"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jiycey00.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEFB2.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCEFB1.tmp"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\ProgramData\Chrome\chromedriver.exe

C:\ProgramData\Chrome\chromedriver.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ldhlfsev.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFA50.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFA4F.tmp"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

Network

Country Destination Domain Proto
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 83.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 6.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 2.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 209.178.17.96.in-addr.arpa udp

Files

memory/3140-0-0x0000000000310000-0x0000000000554000-memory.dmp

memory/3140-1-0x00007FFD785C0000-0x00007FFD79081000-memory.dmp

memory/3140-2-0x0000000002650000-0x0000000002660000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

MD5 b4ec612c441786aa614ce5f32edae475
SHA1 3a264f8daeec9b156ddb5ed576d490dd8fbd8e7d
SHA256 e18ba6573b9aa2d139ed5c30f18ac2ece3ce8287d1651db4bc632dbc816f53bd
SHA512 c6800371cdc2b571061e6e755a2c95f49dcb233c3999976f180cb7cf95fa2c62d03b52a3c497a2cd7ae46ec72eaf823db25bd291ca676724194c05966f2bce16

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

MD5 3926c7b8fdfb0ab3b92303760b14d402
SHA1 b33e12ef4bdcd418139db59d048609c45fe8f9eb
SHA256 c101904ec19b45612213c2b398892a4523f63862bb3e24c245509db2417585e7
SHA512 4a022be27f58b1735f3a0ac9abdedbd769adb4e3ca1dacdcdc98700b17e138b647f9059585c8ef37fdd7072ad6283e95f10def171584097eb8c70e7d1212ce0e

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\BlitzedGrabberV12.exe.log

MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

memory/3140-28-0x00007FFD785C0000-0x00007FFD79081000-memory.dmp

memory/4452-29-0x00007FFD785C0000-0x00007FFD79081000-memory.dmp

memory/1808-31-0x00000276F3860000-0x00000276F3870000-memory.dmp

memory/1808-30-0x00007FFD785C0000-0x00007FFD79081000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s0tofuim.i5t.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1808-38-0x00000276F4030000-0x00000276F4052000-memory.dmp

memory/1808-32-0x00000276F3860000-0x00000276F3870000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\mxfixer.ps1

MD5 5d792fc7c4e2fd3eb595fce4883dcb2d
SHA1 ee2a88f769ad746f119e144bd06832cb55ef1e0f
SHA256 41eccaa8649345b33e57f5d494429276e9f2eb23ca981f018da33a34aabfd8eb
SHA512 4b85fe8205c705914867227c97aa1333421970d8e6f11b2ac6be8e95fef1a0f31f985547eafe52e382f13c2a16afa05462bd614b75bee250464c50734d59a92e

memory/4452-44-0x0000000003210000-0x0000000003220000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

MD5 f35791ecc6e9f2a581381f77ff170ef3
SHA1 6633a71a193f1d60675e4c507d92804f2e33f8d9
SHA256 b15c76b4bcfa2c08d3b0c4dc01cf3220affdbaa4ca55c000f3aefadfe9b76703
SHA512 fd40772f76794f4b2ef13a4a6c38af5413e5f9d9dfe30ba63396171da825cabb15dd10362c19d49ee350240bec342708ad17386b61a5c55a5153c7d5a61bf8ee

memory/2964-50-0x00007FFD785C0000-0x00007FFD79081000-memory.dmp

memory/2964-51-0x0000021363320000-0x0000021363330000-memory.dmp

memory/4452-53-0x00007FFD785C0000-0x00007FFD79081000-memory.dmp

memory/2964-52-0x0000021363320000-0x0000021363330000-memory.dmp

memory/1872-54-0x00007FFD785C0000-0x00007FFD79081000-memory.dmp

memory/2964-64-0x0000021363320000-0x0000021363330000-memory.dmp

memory/1808-66-0x00007FFD785C0000-0x00007FFD79081000-memory.dmp

memory/1872-67-0x000000001B200000-0x000000001B210000-memory.dmp

memory/2964-72-0x0000021363320000-0x0000021363330000-memory.dmp

memory/1808-71-0x00000276F3860000-0x00000276F3870000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

MD5 baf7d0ed3f88b5a98fddc1622247f3b9
SHA1 b2b1d6ba0cb779dee26511fdf77d35911236b720
SHA256 04c1cbbbbd3a4bdc371edf7ba210727dfb27bf79f6c54716eec31b399f044bde
SHA512 25b8fa6d5a969b2ce55c91fd228eca88b36dbc24d161a8a1c0da4e9a7bb08a5df7e88e163cc22b97bb91dd93cda8dee196a32b6b69cec6d5ea54f8725a8115c9

memory/1872-74-0x00007FFD785C0000-0x00007FFD79081000-memory.dmp

memory/1808-75-0x00000276F3860000-0x00000276F3870000-memory.dmp

memory/4524-76-0x00007FFD785C0000-0x00007FFD79081000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6d3e9c29fe44e90aae6ed30ccf799ca8
SHA1 c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA512 60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

memory/2964-82-0x00007FFD785C0000-0x00007FFD79081000-memory.dmp

memory/3076-84-0x00007FFD785C0000-0x00007FFD79081000-memory.dmp

memory/1808-83-0x00007FFD785C0000-0x00007FFD79081000-memory.dmp

memory/3076-85-0x00000184732A0000-0x00000184732B0000-memory.dmp

memory/3076-86-0x00000184732A0000-0x00000184732B0000-memory.dmp

memory/3076-97-0x00000184732A0000-0x00000184732B0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

MD5 0a78aa289dfbdc2a231da2477d05a9b4
SHA1 f534747751097fbe04217f29b75cddd8ff267d6b
SHA256 6620fd5c8af0670aa84bb80c43face3f4e63bd3b1e035dafeee05991cfe9c1f4
SHA512 c41ca77275e907d6d00c214b85e39b88f0bd84bba3978871f6d45f58adfd51c912949a59b3c57831a071242a9e06f2a2fded5042364677124879e288e700a3bb

memory/3076-99-0x00000184732A0000-0x00000184732B0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

MD5 879b0fef453f65872af0b41924e5adc9
SHA1 a9b8ae3a74e8e9ddda9805db8bdc0ad1d575d4fd
SHA256 b8512f3e38e425f046902652fbdf09da7652bd398bb8f37f4192cb87c2003cdf
SHA512 f2a9916a4e0ea94a812252f9d97f379552a9e176ef58abaa0b964cc3a2b9d325cb28ef4f2225cc8d32fbca37a7e7d1df80842252a734093070d8682e05d6bffc

memory/4524-104-0x00007FFD785C0000-0x00007FFD79081000-memory.dmp

memory/3076-107-0x00007FFD785C0000-0x00007FFD79081000-memory.dmp

memory/3364-106-0x00007FFD785C0000-0x00007FFD79081000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 fd98baf5a9c30d41317663898985593b
SHA1 ea300b99f723d2429d75a6c40e0838bf60f17aad
SHA256 9d97a5bbc88fdcceac25f293383f7e5ce242675460ffbfb2ee9090870c034e96
SHA512 bf4dbbd671b5d7afb326622a7c781f150860294d3dba7160330046c258c84a15981c70e50d84dc7faaa7cc8b8c90bf8df818b3f2d3806a8a3671dfe5e38fe7b0

memory/3788-119-0x00007FFD74B90000-0x00007FFD75531000-memory.dmp

memory/960-120-0x00007FFD74B90000-0x00007FFD75531000-memory.dmp

memory/3460-122-0x0000019794E70000-0x0000019794E80000-memory.dmp

memory/1496-123-0x0000000000D50000-0x0000000000D60000-memory.dmp

memory/3460-124-0x0000019794E70000-0x0000019794E80000-memory.dmp

memory/3060-121-0x0000000000D70000-0x0000000000D80000-memory.dmp

memory/1496-125-0x00007FFD74B90000-0x00007FFD75531000-memory.dmp

memory/3060-126-0x00007FFD74B90000-0x00007FFD75531000-memory.dmp

memory/3788-127-0x00007FFD74B90000-0x00007FFD75531000-memory.dmp

memory/960-128-0x00007FFD74B90000-0x00007FFD75531000-memory.dmp

memory/3460-129-0x0000019794E70000-0x0000019794E80000-memory.dmp

memory/3460-130-0x00007FFD785C0000-0x00007FFD79081000-memory.dmp

memory/3460-132-0x00007FFD785C0000-0x00007FFD79081000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

MD5 88f3356ffed02fc5172f0db45583794e
SHA1 3f8b2582107cfd558d2b75c04adfd4b5d73c303c
SHA256 85c93e322185d6a2c3dacc04cf1e6173e8e93e7ff4df0610480e18c9713ddc9f
SHA512 815c0032cfe9fa80de59737b800a3388d6034cd58671451ca63d4a74295789e579ddd4f0c928a8cc11f296be4212cf9461fd317be0e1fcaebff0f08985b76f53

memory/3040-137-0x00007FFD74B90000-0x00007FFD75531000-memory.dmp

memory/3364-139-0x00007FFD785C0000-0x00007FFD79081000-memory.dmp

memory/3040-138-0x00000000015D0000-0x00000000015E0000-memory.dmp

memory/2480-140-0x00007FFD785C0000-0x00007FFD79081000-memory.dmp

memory/3040-141-0x00007FFD74B90000-0x00007FFD75531000-memory.dmp

memory/2540-142-0x00007FFD785C0000-0x00007FFD79081000-memory.dmp

memory/2540-143-0x000001CE801E0000-0x000001CE801F0000-memory.dmp

memory/2540-149-0x000001CE801E0000-0x000001CE801F0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 22310ad6749d8cc38284aa616efcd100
SHA1 440ef4a0a53bfa7c83fe84326a1dff4326dcb515
SHA256 55b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf
SHA512 2ef08e2ee15bb86695fe0c10533014ffed76ececc6e579d299d3365fafb7627f53e32e600bb6d872b9f58aca94f8cb7e1e94cdfd14777527f7f0aa019d9c6def

memory/2480-156-0x000000001B7B0000-0x000000001B7C0000-memory.dmp

memory/960-157-0x00007FFD74B90000-0x00007FFD75531000-memory.dmp

memory/3788-158-0x00007FFD74B90000-0x00007FFD75531000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

MD5 f16b48c9bbe6101e156ccb95000d8dab
SHA1 5d66c71bb8889bd6516aeab28a56f9c907b703cd
SHA256 dae3b2e93d885407151e76e323b70f96dff6ce171f6a294bf667ecc0257ac9ec
SHA512 2111202ba8b27ff5c3e007cf41c65a5143d29cef05de11064a1f356b23baa1e10f858217917e5463103dd86b823151553e785cd74e6984c99a757b43ac992486

memory/3060-164-0x0000000000D70000-0x0000000000D80000-memory.dmp

memory/1496-165-0x0000000000D50000-0x0000000000D60000-memory.dmp

memory/3060-162-0x00007FFD74B90000-0x00007FFD75531000-memory.dmp

memory/2480-167-0x00007FFD785C0000-0x00007FFD79081000-memory.dmp

memory/1496-166-0x00007FFD74B90000-0x00007FFD75531000-memory.dmp

memory/3788-168-0x00007FFD74B90000-0x00007FFD75531000-memory.dmp

memory/1496-169-0x00007FFD74B90000-0x00007FFD75531000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 dd1d0b083fedf44b482a028fb70b96e8
SHA1 dc9c027937c9f6d52268a1504cbae42a39c8d36a
SHA256 cab7944d29e0501dc0db904ac460ca7a87700e0ec7eb62298b7b97cbf40c424c
SHA512 96bec38bfda176292ae65dcf735103e7888baa212038737c1d1e215fcb76e4c0355e4a827a1934303e7aecae91012fa412f13e38f382b732758bae985cc67973

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

MD5 59da608ee8a164c658434e6c66f85f7e
SHA1 0b66913c40ca6e3435e4803512fd3db759a1faae
SHA256 33a56a5c2db4ee4ee9478612b719cc547ef0dc0cd603e684f21b733bfe4aaed7
SHA512 c7e3d68b0243868b5c636172dedb11112cdd605f52b1b69d50b97e57ed8f29af07d290fb6999cf7ddd2a667d2782f10d4b057c8e69bf9b91e26ddb85155b85de

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 a9451a6b9669d49bd90704dff21beb85
SHA1 5f93d2dec01a31e04fc90c28eb1c5ca62c6fff80
SHA256 b2ff191507379930b97a212f869c3774c20b274e8fc9fcc96da5c154fb0e3056
SHA512 06634cb578f6ce8d721e6306004082073fc224b91ceea37ef870df87b12b2d5f59e7d08b20b520787a1d13f3edbbb004197bf70f180f86dd7f401a5ad289ccb5

C:\Windows\assembly\Desktop.ini

MD5 f7f759a5cd40bc52172e83486b6de404
SHA1 d74930f354a56cfd03dc91aa96d8ae9657b1ee54
SHA256 a709c2551b8818d7849d31a65446dc2f8c4cca2dcbbc5385604286f49cfdaf1c
SHA512 a50b7826bfe72506019e4b1148a214c71c6f4743c09e809ef15cd0e0223f3078b683d203200910b07b5e1e34b94f0fe516ac53527311e2943654bfceade53298

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

MD5 1d7166cc31eb40a1e01b175db70836c4
SHA1 d5b00dae8cb2e60605219a836728cd99b422fa59
SHA256 d3424c83dc1c93e8313bd7cc99469772e0469998bdb9dbe0e486c84b09240e77
SHA512 ccebdb91ccea1493445504387904fb6a6c6ab1130333dbab1c5a97a780e7d9cec5a4a304a6542c9054d7e8ac88619096175c30285e03137b6cff46254001866f

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 5cfe303e798d1cc6c1dab341e7265c15
SHA1 cd2834e05191a24e28a100f3f8114d5a7708dc7c
SHA256 c4d16552769ca1762f6867bce85589c645ac3dc490b650083d74f853f898cfab
SHA512 ef151bbe0033a2caf2d40aff74855a3f42c8171e05a11c8ce93c7039d9430482c43fe93d9164ee94839aff253cad774dbf619dde9a8af38773ca66d59ac3400e

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 eeec902f8040c7c6fa3299e0a7054583
SHA1 a7b7b72310e5d7351b97455bdc4a6507802ca99c
SHA256 63f23341e2d81cfb8343c98ec0fc0e352c997fd35187f8d340ffe77829bf5e51
SHA512 0af9a39f2ad1a63930fad08f171d4344da4aa925f2d6ac00153c8c447247463c52fb08b8cb6eeb1a977a4500e0b5016ae27509880f89b91751d01dcf32179348

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

MD5 5f9da4cb26962602376e1e17c66b7823
SHA1 ada8ee930612bb39a030e7632d47e1a92c5f82b1
SHA256 3582f45a608c66c862f79781dd9356b031ed2980d8a0cd9c84773cddb29484e6
SHA512 19b4b90a2454a08f4852cc308c5880dcdd82ac2381efe96f2e48319d222262f1a073fc119d17cb1ce838ab01aaaa1094f3241f47a90b22e316db662b04a308c1

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 f41f42c322498af0591f396c59dd4304
SHA1 e1e5aa68d73d48bc5e743a34f6c0fa8960ff7514
SHA256 d8bd9a4a363ff2ac2dc887759ec6ba4215a4ce0925a8fb9c531573458ee4a31c
SHA512 2328a1b402b4fb0de9c451fb630eab58549129d3bcfb70b9834cfbd16065ebaadec006b309ea17ac182d34c53e01705cbc9e0196eb0cbd62600c866e79a1844f

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 91e89794a950f0c7d439595297e31036
SHA1 73ffcbd7ed7056221d2758180139fad6131aa726
SHA256 a987ca7d465ab74e819f81a0f13713e60a530f371c0dc0b5da1f16042f4166a1
SHA512 7c689da0d24e237c3633843700d04e831fa027f8f6818e14620956088f34f08a5202cbafef81ceb5b88786af7593286642b1d9b653b994bc4c09f7e1a638985f

C:\Users\Admin\AppData\Local\Temp\mpxkyznm.0.cs

MD5 39bd13b4b1158ebb3db24636a66a24e4
SHA1 3d740f26d4a1c92820b1d04a5ecea6a646eceba2
SHA256 9b888a917e53ae095e10e6a281d7d133244c931d811d416af699df41f7eb396c
SHA512 642e4fbd50522da1037baef3952a225cc996d15626fe078f95a14c462dfffbb9322678a5378dbe66d968121557788dec812fb2378e6bd64b98730e31b1009214

C:\Users\Admin\AppData\Local\Temp\i3l6xj0v.0.cs

MD5 15dd5fc6f75b6659ef0939c0931b1571
SHA1 0115077541307076c850bab8fc09c64eaec35379
SHA256 415961f82e087130e69be859e7cc7377ee3fe250e0a50471dfbd2ef078c37491
SHA512 f135ebc6a4d5d4a7da3e081a8354361b40402062feb0f0c2fd3fb249f0a3440790da1cc9a5501b25cf6064ccd4de5963112a19c30a7569f9fcfbf3d8c5934ca7

C:\Users\Admin\AppData\Local\Temp\pxl2_byq.dll

MD5 70986492e827360a05c6162676c17f68
SHA1 55aeb727d0f09f374b65e51afeeacf7b49be2fbc
SHA256 0a3291b23af69ce053fd6b1da5ebbb07fd317ed48eb21b8c953bf31220943cf9
SHA512 c01f0e941fd6ec61d68b0346180d4e3aa85ceb115fab29fd2284fc575b411d1b863df2bdc07497280c47239a0051184e450046ae335db71c0cd02ef01fb9cc6a

C:\Windows\SysWOW64\WindowsInput.exe

MD5 e6fcf516d8ed8d0d4427f86e08d0d435
SHA1 c7691731583ab7890086635cb7f3e4c22ca5e409
SHA256 8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337
SHA512 c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

C:\Users\Admin\AppData\Local\Temp\a3cmaxef.0.cs

MD5 3fa595cf7244b929740eb1b6a718f95c
SHA1 5eca395f11f29d1d313b77b8ecc88f6ec6c97f5a
SHA256 0f9c7d197cbeb2e25b94bfb87500bab7a5586829a3484a147c0f941dc0b92217
SHA512 3479c0cfa528d76aaf7e39e1818c1c7429ff4778d0f5f2bc9d0f3eeb4ce2d8fc6d68922859d91973f97349a627cb19d6ac31c3c7d723d54cd92e5544445a1344

C:\Users\Admin\AppData\Local\Temp\z7w0g4br.0.cs

MD5 15db58d50525df2b54c95166602be406
SHA1 74b78c22f7ec783bad09e3d3e88638094d5ec685
SHA256 d37414ca8b986100d94b657fea119ff5f8bc33446906ae057eba6909063ab229
SHA512 a4cd7dcf95bac75a28f7fd0936695a2934f9a2bb5dc42e80d9473f3e863911adcfd4a813f298855111d5a3dec8b5158a8347920043c8f2be4db0bee4f24e72cc

C:\Users\Admin\AppData\Local\Temp\ldhlfsev.0.cs

MD5 b3f15b62e7a57f84e42c3343a46d45cc
SHA1 8de0d32bb4a01f51a9db22867d1ff74701971725
SHA256 5d2c32e70719677ba709251984ed163e032bd5378404091f02fe01da812c9023
SHA512 231dad7abaa33e43710e0ae559b56da1c3d099100a493053b8cd60bfc2e09d9fe5e474518227d3bef3672339da7670fa8028902466b1f104bacb724d7cd1a7f9

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-07 12:28

Reported

2024-01-07 12:37

Platform

win11-20231222-en

Max time kernel

151s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

Signatures

Orcus

rat spyware stealer orcus

Orcus main payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Orcurs Rat Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\SysWOW64\WindowsInput.exe

"C:\Windows\SysWOW64\WindowsInput.exe"

C:\ProgramData\Chrome\chromedriver.exe

"C:\ProgramData\Chrome\chromedriver.exe"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\ProgramData\Chrome\chromedriver.exe

C:\ProgramData\Chrome\chromedriver.exe

C:\Users\Admin\AppData\Roaming\svchost.exe

"C:\Users\Admin\AppData\Roaming\svchost.exe" /launchSelfAndExit "C:\ProgramData\Chrome\chromedriver.exe" 3608 /protectFile

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9BC4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9BC3.tmp"

C:\Users\Admin\AppData\Roaming\svchost.exe

"C:\Users\Admin\AppData\Roaming\svchost.exe" /watchProcess "C:\ProgramData\Chrome\chromedriver.exe" 3608 "/protectFile"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA22C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA22B.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tagtgjmm.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xjzcbeaj.cmdline"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\j99mxkxx.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAAE7.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAAE6.tmp"

C:\Windows\SysWOW64\WindowsInput.exe

"C:\Windows\SysWOW64\WindowsInput.exe" --install

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES900C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC900B.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rf8o5nbt.cmdline"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB48C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB48B.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jlocdygd.cmdline"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBD36.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCBD35.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kvitndhe.cmdline"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC6AC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC6AB.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4mzzy_cy.cmdline"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD061.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD060.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\q_xfwh8q.cmdline"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD8EC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD8EB.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\j1cs85mm.cmdline"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\7abffbao.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE2DF.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE2DE.tmp"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEC93.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCEC92.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qvb8zdhp.cmdline"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF51F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF51E.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\v2bxkb7q.cmdline"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFD8B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFD8A.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\geo2je7y.cmdline"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES694.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC693.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\l6zlmpgk.cmdline"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFFA.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFF9.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bcwwuxxf.cmdline"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1856.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1855.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yzkgpxwp.cmdline"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES214F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC214E.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\9v5jegdh.cmdline"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2A48.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2A47.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\9cvpftrq.cmdline"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3322.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3321.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iuvlnrlz.cmdline"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3C88.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3C87.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\g02xk-rb.cmdline"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES45CF.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC45CE.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vtuvqopy.cmdline"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4EF7.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4EF6.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\colxzup8.cmdline"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5792.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5791.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\x1iuvwo6.cmdline"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5FEF.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5FEE.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3vl6hbir.cmdline"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\k-mks2hl.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6899.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6898.tmp"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7134.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7133.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zxh06myb.cmdline"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7A6C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7A6B.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\abs8ej4n.cmdline"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8355.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8354.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vhutzhrc.cmdline"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\d1burutz.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8CAC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8CAB.tmp"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9537.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9536.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bnm4zuk6.cmdline"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9EDC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9EDB.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\8hcn2vw_.cmdline"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA823.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA822.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\txpzlfat.cmdline"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB1C8.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB1C7.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\w0hiv6g9.cmdline"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBA72.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCBA71.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\8yeubun5.cmdline"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC33C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC33B.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\n2s5pdwt.cmdline"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCC35.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCC34.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lftjex53.cmdline"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD4F0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD4EF.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uluposmi.cmdline"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\j73es_zq.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDDD9.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCDDD8.tmp"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\taqmrlur.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE6F1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE6F0.tmp"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEF5D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCEF5C.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\6uyvbflv.cmdline"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jux8t9tg.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF97F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF97E.tmp"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jf5uopte.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES268.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC267.tmp"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBBF.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCBBE.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2bzz3_5w.cmdline"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES145A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1459.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mjohkety.cmdline"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1DEF.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1DEE.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jkrhurpn.cmdline"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES26F8.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC26F7.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tvjnhlb5.cmdline"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2FC2.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2FC1.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ansbpzzj.cmdline"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES382E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC382D.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4dqsxrbk.cmdline"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4194.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4193.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uvldillr.cmdline"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4A2F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4A2E.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\98mop_0p.cmdline"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5396.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5395.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vqjruaap.cmdline"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5C02.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5C01.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jqvmurwp.cmdline"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES650A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6509.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\6n6dmdnz.cmdline"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6DF4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6DF3.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\-bgehlay.cmdline"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES773B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC773A.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\7hg-7cia.cmdline"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8082.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8081.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qnre0rhn.cmdline"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES897A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8979.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\et9gv2ha.cmdline"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES92C1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC92C0.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kcub3aya.cmdline"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9C18.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9C17.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wpfpeiu2.cmdline"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA4F2.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA4F1.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\e19fzeq_.cmdline"

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3kkawgj2.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESADBC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCADBB.tmp"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB6B5.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB6A4.tmp"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pdbpdec6.cmdline"

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe

"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 18.53.126.40.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 209.25.141.181:40489 tcp
US 209.25.141.181:40489 tcp
US 209.25.141.181:40489 tcp
US 209.25.141.181:40489 tcp
US 204.79.197.200:443 tcp
US 209.25.141.181:40489 tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 209.25.141.181:40489 tcp
US 209.25.141.181:40489 tcp
US 204.79.197.200:443 tcp
US 204.79.197.200:443 tcp
US 204.79.197.200:443 tcp
US 204.79.197.200:443 tcp
US 209.25.141.181:40489 tcp
US 209.25.141.181:40489 tcp
US 209.25.141.181:40489 tcp

Files

memory/4888-0-0x0000000000F40000-0x0000000001184000-memory.dmp

memory/4888-1-0x00007FFF058F0000-0x00007FFF063B2000-memory.dmp

memory/4888-2-0x0000000003250000-0x0000000003260000-memory.dmp

memory/2628-27-0x00007FFF058F0000-0x00007FFF063B2000-memory.dmp

memory/4888-30-0x00007FFF058F0000-0x00007FFF063B2000-memory.dmp

memory/2628-40-0x000002369B910000-0x000002369B932000-memory.dmp

memory/3740-45-0x000000001C080000-0x000000001C08E000-memory.dmp

memory/3656-47-0x00007FFF058F0000-0x00007FFF063B2000-memory.dmp

memory/3740-49-0x000000001CAD0000-0x000000001CB6C000-memory.dmp

memory/2628-51-0x00000236B3EE0000-0x00000236B3EF0000-memory.dmp

memory/2628-55-0x00000236B3EF0000-0x00000236B403F000-memory.dmp

memory/2628-56-0x00007FFF058F0000-0x00007FFF063B2000-memory.dmp

memory/2628-52-0x00000236B3EE0000-0x00000236B3EF0000-memory.dmp

memory/3740-50-0x00007FFEFFD90000-0x00007FFF00731000-memory.dmp

memory/3740-48-0x000000001C560000-0x000000001CA2E000-memory.dmp

memory/3740-42-0x000000001BEC0000-0x000000001BF1C000-memory.dmp

memory/3740-41-0x00007FFEFFD90000-0x00007FFF00731000-memory.dmp

memory/3740-31-0x0000000001760000-0x0000000001770000-memory.dmp

memory/2628-29-0x00000236B3EE0000-0x00000236B3EF0000-memory.dmp

memory/2628-28-0x00000236B3EE0000-0x00000236B3EF0000-memory.dmp

memory/4324-62-0x0000000000B20000-0x0000000000B30000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RES900C.tmp

MD5 5890cebfd3f14e122261210bcf2fdc70
SHA1 0246c71ba5015da537f9277af275da845cc08bed
SHA256 c873e2a2acf15c519cf8319dcb2a87bd8ff3607ecd67bdd7c2cb650a09ecaf3e
SHA512 3841f65bf54733a796d6b5d3a1989d0192a85a599b092d44b97db7cd4a775c96515656a7947c4d79cd9c987bd5b46590d83f6ced30d7feaf5ec21119c6ec8723

memory/3740-70-0x000000001CBA0000-0x000000001CBB6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\rf8o5nbt.dll

MD5 76ed69312164ea2cacc116547b882322
SHA1 4c37b46a90bf486037d992928dc3485d38ade1a6
SHA256 5349f0cbe47b415d6b90be94b0b90f546cb8c7dba41e3611a1b39752aef81bda
SHA512 f45490e4b0eb09344dd40a80bc5cd6a24be33068adfb6fb9c867290ea19fc03a9372a85982c7083ab4a6d3db3fc06dde50406a80c88cb7a528a568575363fc81

memory/3740-72-0x0000000001810000-0x0000000001822000-memory.dmp

memory/3740-74-0x000000001D1D0000-0x000000001D1F0000-memory.dmp

memory/1076-88-0x00000000004C0000-0x00000000004CC000-memory.dmp

C:\Windows\SysWOW64\WindowsInput.exe.config

MD5 a2b76cea3a59fa9af5ea21ff68139c98
SHA1 35d76475e6a54c168f536e30206578babff58274
SHA256 f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512 b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

memory/1076-89-0x00007FFF058F0000-0x00007FFF063B2000-memory.dmp

memory/1076-92-0x0000000002860000-0x000000000289C000-memory.dmp

C:\Windows\SysWOW64\WindowsInput.exe

MD5 e6fcf516d8ed8d0d4427f86e08d0d435
SHA1 c7691731583ab7890086635cb7f3e4c22ca5e409
SHA256 8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337
SHA512 c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

memory/4536-99-0x0000000019B00000-0x0000000019B10000-memory.dmp

memory/4536-98-0x00007FFF058F0000-0x00007FFF063B2000-memory.dmp

memory/4536-100-0x000000001A020000-0x000000001A12A000-memory.dmp

memory/1076-96-0x00007FFF058F0000-0x00007FFF063B2000-memory.dmp

memory/1076-91-0x000000001B220000-0x000000001B230000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE

MD5 b4ec612c441786aa614ce5f32edae475
SHA1 3a264f8daeec9b156ddb5ed576d490dd8fbd8e7d
SHA256 e18ba6573b9aa2d139ed5c30f18ac2ece3ce8287d1651db4bc632dbc816f53bd
SHA512 c6800371cdc2b571061e6e755a2c95f49dcb233c3999976f180cb7cf95fa2c62d03b52a3c497a2cd7ae46ec72eaf823db25bd291ca676724194c05966f2bce16

memory/3608-121-0x00000000003E0000-0x00000000004DC000-memory.dmp

memory/3608-123-0x000000001B220000-0x000000001B230000-memory.dmp

memory/3608-137-0x0000000002760000-0x0000000002772000-memory.dmp

memory/3608-146-0x0000000002910000-0x000000000295E000-memory.dmp

memory/4728-147-0x00007FFF058F0000-0x00007FFF063B2000-memory.dmp

memory/4728-153-0x000001FA49DC0000-0x000001FA49DD0000-memory.dmp

memory/4540-156-0x00007FFF00390000-0x00007FFF00D31000-memory.dmp

memory/3608-159-0x000000001B160000-0x000000001B178000-memory.dmp

memory/4140-168-0x00007FFF058F0000-0x00007FFF063B2000-memory.dmp

memory/3608-169-0x000000001B180000-0x000000001B190000-memory.dmp

memory/3608-170-0x000000001BA50000-0x000000001BC12000-memory.dmp

C:\Users\Admin\AppData\Roaming\svchost.exe

MD5 913967b216326e36a08010fb70f9dba3
SHA1 7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf
SHA256 8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a
SHA512 c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

memory/4536-184-0x00007FFF058F0000-0x00007FFF063B2000-memory.dmp

memory/4728-187-0x000001FA49DC0000-0x000001FA49DD0000-memory.dmp

C:\ProgramData\Chrome\chromedriver.exe

MD5 a1c49675458e2cb9241055e5bc21b03e
SHA1 72e3eaafd781050b7f45bde6065fd5036d84477c
SHA256 37349f8857956dd37b8100f6b36921a980d52eb088a6be72c3b6b519220417b7
SHA512 3fa4bd19d7eeab224b407af2e3c483116708e94b94e0f4ffff933529ae24cf305874efe410aca7e79e1cdaa4945f1dc3d9db50aac707818768da62efa746ebd4

memory/2740-191-0x0000000074A70000-0x0000000075221000-memory.dmp

memory/2740-190-0x0000000000580000-0x0000000000588000-memory.dmp

memory/4536-192-0x0000000019B00000-0x0000000019B10000-memory.dmp

memory/4728-194-0x000001FA49DC0000-0x000001FA49DD0000-memory.dmp

memory/3608-193-0x00007FFF058F0000-0x00007FFF063B2000-memory.dmp

memory/4728-196-0x000001FA49ED0000-0x000001FA4A01F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\xjzcbeaj.dll

MD5 e5f6fa3da8c8c847b31a0c956639fe9d
SHA1 b6dcce34e5dd3e316fe48487dfdc345ee1f9f1ef
SHA256 d89565451fbe79099e94b97b290e9c89f854cb5bd17d47f4b3e527de9e7987ac
SHA512 84347b6e9849d711803dd738d04f340c2785338780945c1e40d8dae0b4e7430c1ae5efdb9393c94987200cffcf150412889ab534007b8f9396f9ac93b67009c6

C:\Users\Admin\AppData\Local\Temp\RES9BC4.tmp

MD5 0ffc2a9724ed2e54bcf74cbb586ced0f
SHA1 aa22b051f2f3b7d0925078176864df1aff39e174
SHA256 9b1300a3e60fe0e0ad10d49b69fee687a2e1e89d01b91be129a66a8dc84b114b
SHA512 d87d5d161604d684f1a7f106e0f706bcba8b38590d6f522bfa7347f63bafab36e3de174f1d42f2a9bc506097354bcc3221d89e193f32326dbdd9bf562798aad1

\??\c:\Users\Admin\AppData\Local\Temp\CSC9BC3.tmp

MD5 ce0030ecced61fd31c7fcac43d8a5ec9
SHA1 26b2d4d11b3b5f462b731d0b596520a688fe296f
SHA256 9134c79559fba45344bc8ee491585ec6e9f97070fe5134d15ed01bb76aa03141
SHA512 1b49fbaf33e2ef7813911294619eb6bbb72926cffca18b07f6e8a15060e4418b47dd87e788e9f8e8e3cfd587d52b625fbd312c59056ce63e718cb3cdf43c2ca1

memory/476-208-0x0000000002300000-0x0000000002310000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\xjzcbeaj.0.cs

MD5 24ea1de4a1a2293a19cefa010053c8e2
SHA1 58aa2aa7b5fbaa8b23e52296351ffc0f87417736
SHA256 3df3a253d3a6feaf7005fde361fb3064d685cb5ce0845ce42633a80fc99b8f00
SHA512 2b4f74746affae0f4c42b71ec1153a3bda81058a1a0f44924089abb942fb8d85262fd9abb3578da48278b8e9a80c0ad70b7b60b165de3686567d6acd5a5b6794

\??\c:\Users\Admin\AppData\Local\Temp\xjzcbeaj.cmdline

MD5 0a606e6e593ed45fef14ce5cd89a9c41
SHA1 fcb9cb8c24c0e2dbaade40a612530f75d9789706
SHA256 3e6e9d67294addfde593f1b2d65d07ecbcbf12fe40e09563a0c4a5b8a3d209e0
SHA512 82e4fa02e87bf8baf47d5868d7ce4243550e0c7429a448bc1f84941fd222f8dadf153b738a9ad24107f1a565f157325f62acc7bffedd5e19b17d95acab1b1d66

memory/2740-205-0x0000000074A70000-0x0000000075221000-memory.dmp

memory/4728-204-0x00007FFF058F0000-0x00007FFF063B2000-memory.dmp

memory/2736-203-0x0000000074A70000-0x0000000075221000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\svchost.exe.log

MD5 bb27934be8860266d478c13f2d65f45e
SHA1 a69a0e171864dcac9ade1b04fc0313e6b4024ccb
SHA256 85ad0d9909461517acf2e24ff116ca350e9b7000b4eefb23aa3647423c9745b4
SHA512 87dd77feac509a25b30c76c119752cc25020cca9c53276c2082aef2a8c75670ef67e1e70024a63d44ae442b64f4bc464aee6691e80c525376bb7421929cfa3bb

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\mxfixer.ps1

MD5 5d792fc7c4e2fd3eb595fce4883dcb2d
SHA1 ee2a88f769ad746f119e144bd06832cb55ef1e0f
SHA256 41eccaa8649345b33e57f5d494429276e9f2eb23ca981f018da33a34aabfd8eb
SHA512 4b85fe8205c705914867227c97aa1333421970d8e6f11b2ac6be8e95fef1a0f31f985547eafe52e382f13c2a16afa05462bd614b75bee250464c50734d59a92e

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

MD5 5d6f6f93b456bcb84eb817cb0cfe90e3
SHA1 47253303c16b763f9056d9396dab3d32eeb5baac
SHA256 d039b8f46532eff4a900c75d968f8aa465d1c25d9ae44d1a8d052037d18089fb
SHA512 6ecdf29c3b3e42b877c3d20e2026ea4b86e4667823fdd61399ae37e0c5782cdd4946524046d73e083d5352f12c32b3deb3add334c446f98de7a2f57b45ca3ccc

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 42040a6f7e21cfd86a96c5332c2788bb
SHA1 5c6a3971c7fd8ed44dd7c402777a95823cba1e5c
SHA256 d4d37b2b2ac762d3dd8d5dda2910d4bd3450f43698a0d5cebd7f8392d193883e
SHA512 7af6ee3759fdad0e75d55c875551b155d94d9435e9bfe2acf76689e633470b4d7515fbdf2202e07ea4d6c2f9e9822f6d109284513f43e620328f905b90df74ce

\??\c:\Users\Admin\AppData\Local\Temp\tagtgjmm.cmdline

MD5 f951aa715c906201bd977c65d5a3ad18
SHA1 2904f1021d3497e2521fdb67b89392671ae68f19
SHA256 5bd30530554879d6fcc6e4ab91af4690ea47adaf58d66f99071090b6381d717a
SHA512 47356267abf9b9b8fc55f7e6a232297eb04b2818d37b74659f6815c01d102f9faa7f6f6274c0f366d07df1c41bef8271083238be99cb5f5f036c69f3194c7e35

C:\Users\Admin\AppData\Local\Temp\tagtgjmm.dll

MD5 bdf4ae5d8aa51077ae839ee5c35ccb55
SHA1 2cea55a5a04cbb67664ade61a7869bb20cd48131
SHA256 6d14efb6bcb50f115334f65b8b324b09669a0ddb59361873268ad0f1d273ed0d
SHA512 f9a06c53cf86c6c1b2f14250171794f33bba2f1b58f173ce571add74d1e0720485c44c531383d96b749ba24b95e39d453ef9a34f69921f052d5148b4d45c3f1e

C:\Users\Admin\AppData\Local\Temp\RESA22C.tmp

MD5 505c8211bc2d70177521abb9053ad255
SHA1 9b9e02a064f6e3514ce4ab6e89a0a54ea16505ff
SHA256 4b56dee2385849ac2baae9811565281415fbdc769ee3a0c620d62b0ba5dd5214
SHA512 07851f01ca8e2a7c3b1208f0a7295160a7b729e30b3d222bcd08c665686b0d5809b2acf2e8c6c515aa9ef27c779c2b8b1bf94b36e3ccbb0229e21ec4f37db4ab

\??\c:\Users\Admin\AppData\Local\Temp\CSCA22B.tmp

MD5 06f31fad0da59a49f4db0ec9746c41f3
SHA1 cda8d6954fb22de7cce390af6cba6ed59140d83c
SHA256 39856d3c6d682e108cb69811f9187f9732069bc23785b13de57d00087fd6833e
SHA512 8e0dfe965b92f43c3687d8f0721c3c68779fe23346e9eb283a46fef5c0e108d0c54ea74b4e1c42e6cb5ed81edbe069cbdc79a97d423e4ea6a3f9f60f68ca0e9e

\??\c:\Users\Admin\AppData\Local\Temp\tagtgjmm.0.cs

MD5 0aeef54d1c3182278b48ec7b436cc443
SHA1 e4f2dbcadf3dd5d29d5523f583323d5aed8a9cf8
SHA256 34c27c659501db28a8e8d790a88cff53e5ca63932451a5af4f80ee033d0dafbf
SHA512 d5098c12ebb0e5460a25f5b2a2ecf843795492c4cd581d76e9eb2d068168cdd35111a7a84dca28af725a0cfe17baa75a2bdbf81543cb820e626c839e871a168b

memory/4764-254-0x000002CE6D0D0000-0x000002CE6D21F000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 2e8eb51096d6f6781456fef7df731d97
SHA1 ec2aaf851a618fb43c3d040a13a71997c25bda43
SHA256 96bfd9dd5883329927fe8c08b8956355a1a6ceb30ceeb5d4252b346df32bc864
SHA512 0a73dc9a49f92d9dd556c2ca2e36761890b3538f355ee1f013e7cf648d8c4d065f28046cd4a167db3dea304d1fbcbcea68d11ce6e12a3f20f8b6c018a60422d2

memory/3608-173-0x000000001B220000-0x000000001B230000-memory.dmp

memory/4540-158-0x00007FFF00390000-0x00007FFF00D31000-memory.dmp

memory/3656-157-0x00007FFF058F0000-0x00007FFF063B2000-memory.dmp

memory/4540-154-0x0000000001040000-0x0000000001050000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\BlitzedGrabberV12.exe.log

MD5 2cbbb74b7da1f720b48ed31085cbd5b8
SHA1 79caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA256 e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
SHA512 ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\UnityCrashHandlerV2.exe.log

MD5 ff2a00f3070e734f54758fb05eb2cc15
SHA1 09f46a42146fbea98bb576f9be8ededdbe979d89
SHA256 7c979cb4d3e8c0a08d522b043a2f22181e4b88c170220d04eb7d537313b599ad
SHA512 7875ec4aa4fa093e0ba01444d55ea7d07de48965bebcbf665c6670c00446c987de2a22fd6aabdad4347c46b5720d2574bf01a317ce211493e0b382dfb2fc264d

memory/4728-151-0x000001FA49DC0000-0x000001FA49DD0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

MD5 3926c7b8fdfb0ab3b92303760b14d402
SHA1 b33e12ef4bdcd418139db59d048609c45fe8f9eb
SHA256 c101904ec19b45612213c2b398892a4523f63862bb3e24c245509db2417585e7
SHA512 4a022be27f58b1735f3a0ac9abdedbd769adb4e3ca1dacdcdc98700b17e138b647f9059585c8ef37fdd7072ad6283e95f10def171584097eb8c70e7d1212ce0e

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

MD5 3256de2dd4920e6412274e6b86eec2ee
SHA1 5bf2a2a1c867257562cacb77abed69b9b702300e
SHA256 4122b9e7ffc9ee222b428dfdf28876b979b6b96ddbe2bed82ad16d8faa2fec05
SHA512 5ce86714fe8e69331d823a66a96db2d4c893ae2be100c0be2374a7fb39318bb8edee124f15ccb4fcaedbbfbeb04dfb32bbe44fa87a2dd193e65f72511ea95c2a

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe

MD5 5fdae30a0a1424cece5c4c0cd283c297
SHA1 dd09bd9b9215aff0a3b028c4e83f8bb39f670ca3
SHA256 4c68403945236ce2dcb3ed96afc28c1831b07998f619e222408b143c88681a3d
SHA512 301535a8810bb183278cf92372d12c94472f48488cdf695479edd2c3de286a8ceacedcda56d5e30bbea4e2cf0a48ae2f8b082e34e5aa77e59386afb7713f8ba9

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 479895245adefd8bf3b5b12635182370
SHA1 7d469513c242796f2b1d2eb4ffe9285a2a62d768
SHA256 e15a137d87bf45fec91ec8dd7a5d342e98ceda16fd1791dec6f3e8124c5a75fa
SHA512 9caef52372788c95784147032f93eb8dca2fb2e33649a53c70755a041a7b5962e3df5817166a48e6be622e5ecec1b46c60a2086f69c75f30b68eb2475eb20f01

memory/1444-306-0x000002341EC50000-0x000002341ED9F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\j99mxkxx.dll

MD5 bee80a14831941ddeec7f5fde92520fd
SHA1 f85733eee106593b17feaf88f3f9f7650fdd3441
SHA256 214992eb6d8dda1b34a6320bea0cce4cb265d05c61fa7e105468d5fa084202de
SHA512 1efe4828ef153d91a94c59789bf7db3030ba7870a91ba73a6a3b9e28e409674bc84ac8ea9216d61b3617166607318f9e14c4cc5dc9edbb7b8e5d791288118d2b

C:\Users\Admin\AppData\Local\Temp\RESAAE7.tmp

MD5 95d73af1b69709000cb284dab1d9d7a3
SHA1 e304cd6975c6234b14d2ec4ebe17664ba6da864c
SHA256 02e94d46ecf6e45d58f6ed5f192e236d6e63b7ab5ad328d01e05e00c758e55ba
SHA512 683433b07ba49e996619c8e1cba47976103db35d2f15b075e54d559e6018a9af239372c5b0b8d543315b749daf2a7db998a9095134456ede8dc47e53bc5a34a7

\??\c:\Users\Admin\AppData\Local\Temp\CSCAAE6.tmp

MD5 83a2d7efefff5d101bb876e6cda9e79b
SHA1 265f120af26ac14eeea929e82006b1c743baa5d0
SHA256 94f261ef7e2340175b6bb6e98bf4aa47ad741085debacc4feaa45cf688790110
SHA512 92f8cf115176c3c33999ef63dd2ad6c027683ac309d4c096820805f3269da4342a1c6e4c269f3ecc5fac60d77051cf8aae84c645ce8e6f8bfe8599ec711847cc

\??\c:\Users\Admin\AppData\Local\Temp\j99mxkxx.cmdline

MD5 68c24ce087061e9a353307c87f250768
SHA1 d8642ab5f78950cbf0460ddd5e92aa6c9ab7c8ac
SHA256 85c25657f386a4e02d01d916f720fd34d618f81f093f663e4f17e22bbfb383a7
SHA512 ffd274b6d54d792c3091950980be1c0950e2c1a68d3b59a4ff68213bf200a4616a4e8337679e9203291fc7dc827275cf9bc8f2192208fcd1b480be1740cf0523

memory/3656-131-0x00007FFF058F0000-0x00007FFF063B2000-memory.dmp

memory/3656-122-0x000000001B240000-0x000000001B250000-memory.dmp

memory/3740-119-0x00007FFEFFD90000-0x00007FFF00731000-memory.dmp

memory/3608-120-0x00007FFF058F0000-0x00007FFF063B2000-memory.dmp

memory/1076-90-0x0000000000E10000-0x0000000000E22000-memory.dmp

memory/3740-73-0x0000000001780000-0x0000000001788000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\CSC900B.tmp

MD5 0092423595e70c35f2fee46991c61161
SHA1 1a197c5f731d044f14a4d4dc2c31f869ba0a2b06
SHA256 cd82737e314faeab9fb36e5bdceb4a74536bfa50c4715456529e467eb34b41c9
SHA512 5faeb51f62a17f724e36c1f3a06f2816e0cca2c71aef130a6a7e9b5c2aa466fa4b2fe24743597b6574e342d96dff729d4dfe86dd3f6df8146dc830b3a3feb5f0

\??\c:\Users\Admin\AppData\Local\Temp\rf8o5nbt.0.cs

MD5 ad8f3ede036f944e6e35c668f68e7e1b
SHA1 08f53a32c5ef19d058cf0bcd8832352c89f5c66f
SHA256 e0554ccbcfc5c79574b318900e858be7d57534a9746b7779cc77802cdf310bb4
SHA512 d630670030b705041434ba17000d29eb62b2aac52fe2c43466495451d9ace0734bbd150cd7710cc9aae7c610aa7e2c326639ded199045a3254bcf73059aacd09

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 050567a067ffea4eb40fe2eefebdc1ee
SHA1 6e1fb2c7a7976e0724c532449e97722787a00fec
SHA256 3952d5b543e5cb0cb84014f4ad9f5f1b7166f592d28640cbc3d914d0e6f41d2e
SHA512 341ad71ef7e850b10e229666312e4bca87a0ed9fe25ba4b0ab65661d5a0efa855db0592153106da07134d8fc2c6c0e44709bf38183c9a574a1fa543189971259

memory/1012-359-0x000001B83D5F0000-0x000001B83D73F000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\jlocdygd.0.cs

MD5 10a24fa44952b48b8273dc15a2f607a5
SHA1 332ee36f42b6520023444a3d64ec11b8a43c46c2
SHA256 475d984b360e49a77d6889e6990929bd956c133ac6034bb5a59edbe20d14e5e3
SHA512 0078047f57c9fa630d30bc94001090037178a3ffcf542e3c41bebcdc1279c6ba43365f23da7c262d0bd508e527591bc4fd71409d48c3365eddeebbd847325685

\??\c:\Users\Admin\AppData\Local\Temp\CSCB48B.tmp

MD5 4c968db7ca408322ffab93e9e2fb8f13
SHA1 6270e63e8af58c90ceacc117342e9774427cd584
SHA256 e6cc6a5ded7f6669aa79813c042ddf9feb44c1d9287836a58632b7e5a80ea79d
SHA512 79d9f30304a791f4ae89f7ab57ea2d1bbf748385a07c6b95d5d36ad9ef8c9a038433965e65b2a84574f8e8be1d30561f8c9a461da6ae9fea45196e99701007ae

\??\c:\Users\Admin\AppData\Local\Temp\jlocdygd.cmdline

MD5 1dfced53d374f3445a59c874325093f7
SHA1 90b08043efa865f5baef2758f503342a982e5efc
SHA256 528a4abdfe67d4aa14d7032025f5af9ffb112a77a6749ddf6a8394f2ab917129
SHA512 6be3efdf96e98df34ca8f9d398c0befcb0278c7b60c59e6391b65c1bcd262d316fc6f929fbeac74c1e40420c69043892d8cca167b52c177dc01590c1c78b8f74

memory/448-405-0x000002F158400000-0x000002F15854F000-memory.dmp

memory/2248-446-0x0000019865CD0000-0x0000019865E1F000-memory.dmp

memory/1276-491-0x0000029F7BCB0000-0x0000029F7BDFF000-memory.dmp

memory/4672-532-0x000001B6CE040000-0x000001B6CE18F000-memory.dmp

memory/2984-577-0x00000270C1960000-0x00000270C1AAF000-memory.dmp

memory/3872-618-0x00000155D1A80000-0x00000155D1BCF000-memory.dmp

memory/1012-659-0x000001C87F530000-0x000001C87F67F000-memory.dmp

memory/2032-702-0x000002286F2B0000-0x000002286F3FF000-memory.dmp

memory/1876-744-0x0000024035AE0000-0x0000024035C2F000-memory.dmp

memory/1296-786-0x000001BF77F80000-0x000001BF780CF000-memory.dmp

memory/4400-834-0x000002667AFF0000-0x000002667B13F000-memory.dmp

memory/2276-872-0x000002543BD50000-0x000002543BE9F000-memory.dmp

memory/3160-916-0x0000023A29250000-0x0000023A2939F000-memory.dmp

memory/1560-962-0x00000245C1BF0000-0x00000245C1D3F000-memory.dmp

memory/2848-1001-0x000001FC00060000-0x000001FC001AF000-memory.dmp

memory/1988-1043-0x0000016373FE0000-0x000001637412F000-memory.dmp

memory/1636-1085-0x000001A8BBFE0000-0x000001A8BC12F000-memory.dmp

memory/1644-1131-0x00000176E2A00000-0x00000176E2B4F000-memory.dmp

memory/2480-1170-0x0000024DCCE40000-0x0000024DCCF8F000-memory.dmp

memory/3584-1211-0x0000027E9EB10000-0x0000027E9EC5F000-memory.dmp

memory/4640-1253-0x00000253720B0000-0x00000253721FF000-memory.dmp

memory/3752-1296-0x000001E6596E0000-0x000001E65982F000-memory.dmp

memory/3816-1338-0x0000018C27670000-0x0000018C277BF000-memory.dmp

memory/2612-1381-0x000001C5B4710000-0x000001C5B485F000-memory.dmp

memory/1808-1425-0x0000018066EB0000-0x0000018066FFF000-memory.dmp

memory/3216-1467-0x000002BF4DCA0000-0x000002BF4DDEF000-memory.dmp

memory/4600-1511-0x00000294CAE90000-0x00000294CAFDF000-memory.dmp

memory/1428-1554-0x000001FBC9F00000-0x000001FBCA04F000-memory.dmp

memory/452-1597-0x00000211FA660000-0x00000211FA7AF000-memory.dmp

memory/388-1637-0x000001DEEB650000-0x000001DEEB79F000-memory.dmp

memory/3336-1680-0x0000027E59AB0000-0x0000027E59BFF000-memory.dmp

memory/1372-1720-0x000002039E510000-0x000002039E65F000-memory.dmp

memory/2124-1764-0x00000267F8D20000-0x00000267F8E6F000-memory.dmp

memory/4508-1805-0x000002CF2BFE0000-0x000002CF2C12F000-memory.dmp

memory/1540-1848-0x00000251DE640000-0x00000251DE78F000-memory.dmp

memory/3684-1894-0x0000024977020000-0x000002497716F000-memory.dmp

memory/4988-1939-0x000002EA4F020000-0x000002EA4F16F000-memory.dmp

memory/4876-1975-0x0000020EB0CE0000-0x0000020EB0E2F000-memory.dmp

memory/532-2017-0x00000141EC310000-0x00000141EC45F000-memory.dmp

memory/4268-2060-0x000001FBF92A0000-0x000001FBF93EF000-memory.dmp

memory/640-2101-0x00000255441D0000-0x000002554431F000-memory.dmp

memory/2260-2143-0x000001E222160000-0x000001E2222AF000-memory.dmp

memory/2564-2185-0x0000025FF89D0000-0x0000025FF8B1F000-memory.dmp

memory/4932-2228-0x00000218E9DD0000-0x00000218E9F1F000-memory.dmp

memory/1388-2271-0x0000028CBF060000-0x0000028CBF1AF000-memory.dmp

memory/4232-2312-0x0000016D4D560000-0x0000016D4D6AF000-memory.dmp

memory/2124-2357-0x0000010EF3520000-0x0000010EF366F000-memory.dmp

memory/4948-2401-0x000001CDB33F0000-0x000001CDB353F000-memory.dmp

memory/4668-2441-0x00000126E64F0000-0x00000126E663F000-memory.dmp

memory/2128-2484-0x000001D7DBFF0000-0x000001D7DC13F000-memory.dmp

memory/2356-2524-0x000001DCB2D30000-0x000001DCB2E7F000-memory.dmp

memory/2344-2567-0x000001CA6B570000-0x000001CA6B6BF000-memory.dmp

memory/2384-2609-0x0000012BFCDD0000-0x0000012BFCF1F000-memory.dmp

memory/2336-2652-0x000001BDC73E0000-0x000001BDC752F000-memory.dmp

memory/3256-2696-0x00000283450A0000-0x00000283451EF000-memory.dmp

memory/1628-2738-0x0000019970D80000-0x0000019970ECF000-memory.dmp

memory/3172-2784-0x000001DFFCB80000-0x000001DFFCCCF000-memory.dmp