Malware Analysis Report

2025-08-10 21:53

Sample ID 240526-dscd5sdf52
Target 5a16a1683c014264efd6d7a6d9cded40_NeikiAnalytics.exe
SHA256 c0f0c672fce3447c7858bf8a2c98f702dc06c1cd18212396107409d622b1c0d7
Tags
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

c0f0c672fce3447c7858bf8a2c98f702dc06c1cd18212396107409d622b1c0d7

Threat Level: Shows suspicious behavior

The file 5a16a1683c014264efd6d7a6d9cded40_NeikiAnalytics.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary


Executes dropped EXE

Loads dropped DLL

Unsigned PE

Program crash

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-05-26 03:15

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-26 03:15

Reported

2024-05-26 03:18

Platform

win7-20240221-en

Max time kernel

150s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5a16a1683c014264efd6d7a6d9cded40_NeikiAnalytics.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4275.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65406.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20804.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18971.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61525.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29538.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26200.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14597.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27596.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63222.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14706.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10300.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47379.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17011.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30009.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17917.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17917.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30915.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1388.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14387.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33869.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49556.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20221.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20029.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16691.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1663.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50672.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51092.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-43900.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23842.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27372.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-39986.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62182.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65327.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15935.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48223.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-449.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33999.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12872.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63142.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29400.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49074.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32546.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61689.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16018.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49266.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24814.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4564.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20132.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25473.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42302.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22436.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21175.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7792.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53272.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60200.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-45831.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\5a16a1683c014264efd6d7a6d9cded40_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5a16a1683c014264efd6d7a6d9cded40_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5a16a1683c014264efd6d7a6d9cded40_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5a16a1683c014264efd6d7a6d9cded40_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4275.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4275.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65406.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65406.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20804.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20804.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4275.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4275.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18971.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18971.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61525.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61525.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65406.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65406.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26200.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26200.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29538.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29538.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20804.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20804.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\5a16a1683c014264efd6d7a6d9cded40_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4275.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-65406.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20804.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18971.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-61525.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26200.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29538.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27596.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63222.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-10300.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-47379.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14597.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-30009.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17011.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14706.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-65327.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-449.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17917.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-30915.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14387.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-49556.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20029.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1388.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1663.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48223.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26111.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-16691.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-51092.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-61689.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63142.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-50672.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-62182.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27372.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33869.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29400.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-16018.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4564.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20221.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-49074.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24814.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33999.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-60200.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17917.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12872.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-65.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32546.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12680.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-49266.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-23842.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-43900.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15935.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53272.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22436.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-21175.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15655.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-39986.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29962.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7792.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27238.exe

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\5a16a1683c014264efd6d7a6d9cded40_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4275.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65406.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20804.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18971.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29538.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61525.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26200.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14597.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27596.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63222.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14706.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10300.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47379.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17011.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30009.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17917.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30915.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17917.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1388.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14387.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33869.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20029.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49556.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16691.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20221.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1663.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50672.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51092.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-43900.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23842.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27372.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-39986.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62182.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65327.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15935.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48223.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-449.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33999.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63142.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12872.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12680.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29400.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32546.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61689.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16018.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49266.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49074.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24814.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4564.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20132.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25473.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42302.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22436.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21175.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7792.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53272.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60200.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2648 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\5a16a1683c014264efd6d7a6d9cded40_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe
PID 2648 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\5a16a1683c014264efd6d7a6d9cded40_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe
PID 2648 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\5a16a1683c014264efd6d7a6d9cded40_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe
PID 2648 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\5a16a1683c014264efd6d7a6d9cded40_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe
PID 2884 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe
PID 2884 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe
PID 2884 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe
PID 2884 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe
PID 2648 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\5a16a1683c014264efd6d7a6d9cded40_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe
PID 2648 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\5a16a1683c014264efd6d7a6d9cded40_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe
PID 2648 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\5a16a1683c014264efd6d7a6d9cded40_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe
PID 2648 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\5a16a1683c014264efd6d7a6d9cded40_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe
PID 2648 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\5a16a1683c014264efd6d7a6d9cded40_NeikiAnalytics.exe C:\Windows\SysWOW64\WerFault.exe
PID 2648 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\5a16a1683c014264efd6d7a6d9cded40_NeikiAnalytics.exe C:\Windows\SysWOW64\WerFault.exe
PID 2648 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\5a16a1683c014264efd6d7a6d9cded40_NeikiAnalytics.exe C:\Windows\SysWOW64\WerFault.exe
PID 2648 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\5a16a1683c014264efd6d7a6d9cded40_NeikiAnalytics.exe C:\Windows\SysWOW64\WerFault.exe
PID 2984 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4275.exe
PID 2984 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4275.exe
PID 2984 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4275.exe
PID 2984 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4275.exe
PID 2884 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-65406.exe
PID 2884 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-65406.exe
PID 2884 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-65406.exe
PID 2884 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-65406.exe
PID 2964 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20804.exe
PID 2964 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20804.exe
PID 2964 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20804.exe
PID 2964 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20804.exe
PID 2884 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe C:\Windows\SysWOW64\WerFault.exe
PID 2884 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe C:\Windows\SysWOW64\WerFault.exe
PID 2884 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe C:\Windows\SysWOW64\WerFault.exe
PID 2884 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe C:\Windows\SysWOW64\WerFault.exe
PID 2524 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4275.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
PID 2524 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4275.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
PID 2524 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4275.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
PID 2524 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4275.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
PID 2984 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18971.exe
PID 2984 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18971.exe
PID 2984 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18971.exe
PID 2984 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18971.exe
PID 2388 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65406.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-61525.exe
PID 2388 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65406.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-61525.exe
PID 2388 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65406.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-61525.exe
PID 2388 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65406.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-61525.exe
PID 2632 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20804.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29538.exe
PID 2632 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20804.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29538.exe
PID 2632 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20804.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29538.exe
PID 2632 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20804.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29538.exe
PID 2964 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26200.exe
PID 2964 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26200.exe
PID 2964 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26200.exe
PID 2964 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26200.exe
PID 2984 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe C:\Windows\SysWOW64\WerFault.exe
PID 2984 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe C:\Windows\SysWOW64\WerFault.exe
PID 2984 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe C:\Windows\SysWOW64\WerFault.exe
PID 2984 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe C:\Windows\SysWOW64\WerFault.exe
PID 2964 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe C:\Windows\SysWOW64\WerFault.exe
PID 2964 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe C:\Windows\SysWOW64\WerFault.exe
PID 2964 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe C:\Windows\SysWOW64\WerFault.exe
PID 2964 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe C:\Windows\SysWOW64\WerFault.exe
PID 1200 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14597.exe
PID 1200 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14597.exe
PID 1200 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14597.exe
PID 1200 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14597.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5a16a1683c014264efd6d7a6d9cded40_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\5a16a1683c014264efd6d7a6d9cded40_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-4275.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4275.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65406.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65406.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20804.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20804.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18971.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18971.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61525.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61525.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29538.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29538.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26200.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26200.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-14597.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14597.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27596.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27596.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63222.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63222.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14706.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14706.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10300.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10300.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47379.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47379.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17011.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17011.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30009.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30009.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-17917.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17917.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17917.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17917.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30915.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30915.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1388.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1388.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14387.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14387.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33869.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33869.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49556.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49556.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20221.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20221.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20029.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20029.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16691.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16691.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1663.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1663.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50672.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50672.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51092.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51092.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-43900.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43900.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23842.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23842.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27372.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27372.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39986.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39986.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26111.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26111.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62182.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62182.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65327.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65327.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15935.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15935.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48223.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48223.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-449.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-449.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33999.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33999.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12872.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12872.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63142.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63142.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29400.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29400.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12680.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12680.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32546.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32546.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49074.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49074.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16018.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16018.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61689.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61689.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49266.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49266.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 832 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-24814.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24814.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4564.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4564.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-20132.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20132.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25473.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25473.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42302.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42302.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22436.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22436.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7792.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7792.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-53272.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53272.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60200.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60200.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45831.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45831.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15655.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15655.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15270.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15270.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10864.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10864.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47943.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47943.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59489.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59489.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30346.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30346.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47751.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47751.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63703.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63703.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29962.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29962.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10096.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10096.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65130.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65130.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61409.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61409.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32458.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32458.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15738.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15738.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-15353.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15353.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11824.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11824.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4300.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4300.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-36397.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36397.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-35821.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35821.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-51508.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51508.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37933.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37933.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39168.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39168.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1814.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1814.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-22915.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22915.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55587.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55587.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55395.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55395.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5810.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5810.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54134.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54134.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50413.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50413.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27238.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27238.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58649.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58649.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39442.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39442.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39058.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39058.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-481.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-481.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1358.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1358.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15592.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15592.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 880 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-37269.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37269.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3527.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3527.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-57339.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57339.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-7562.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7562.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3649.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3649.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56379.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56379.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42539.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42539.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59067.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59067.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22481.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22481.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25819.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25819.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37748.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37748.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4692.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4692.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-9290.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9290.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24174.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24174.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10525.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10525.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10333.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10333.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-27521.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27521.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43857.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43857.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31844.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31844.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15507.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15507.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30692.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30692.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32119.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32119.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-14822.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14822.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34039.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34039.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 708 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-22192.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22192.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6130.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6130.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25155.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25155.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55990.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55990.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-29670.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29670.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-45871.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45871.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61439.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61439.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2913.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2913.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19250.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19250.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52799.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52799.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-235.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-235.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19717.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19717.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-43230.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43230.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10365.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10365.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-45233.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45233.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 472 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-1782.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1782.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-18394.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18394.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-17818.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17818.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-51533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-63513.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63513.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63321.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63321.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1172 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-47068.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47068.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30156.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30156.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47727.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47727.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47727.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47727.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14286.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14286.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-830.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-830.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16783.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16783.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49647.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49647.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16591.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16591.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38210.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38210.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21682.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21682.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-4385.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4385.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-37058.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37058.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-40213.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40213.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 696 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-57016.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57016.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5978.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5978.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45003.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 592 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-37245.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37245.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19456.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19456.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3568 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-58288.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58288.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25424.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25424.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41184.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41184.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-25315.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25315.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28003.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-16457.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16457.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33260.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33260.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-64287.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64287.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3232 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3352 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3508 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-22648.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22648.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-21313.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21313.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3892 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4036 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-13955.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13955.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30759.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30759.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4617.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4617.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51981.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51981.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22957.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22957.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11327.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11327.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3604 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-43014.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43014.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58966.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58966.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3300 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3692 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-49340.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49340.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35692.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35692.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2635.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2635.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-52303.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52303.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3294.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3294.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35583.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35583.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1649.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1649.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50274.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50274.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35007.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35007.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-35474.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35474.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17877.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17877.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7892.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7892.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7892.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7892.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40757.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40757.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10004.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10004.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25765.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25765.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24888.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24888.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40840.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40840.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24312.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24312.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25355.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25355.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-31982.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31982.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5452 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4596 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-19279.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19279.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-36850.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36850.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19554.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19554.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52418.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52418.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35890.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35890.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-5905.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5905.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3628 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-57361.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57361.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-50558.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50558.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-1414.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1414.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5140 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5280 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5172 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5252 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5424 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-62328.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62328.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10304.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10304.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5592 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5540 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-49879.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49879.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20004.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20004.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19428.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19428.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35437.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35437.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5648 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-9282.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9282.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9090.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9090.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14168.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14168.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65014.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65014.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35222.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35222.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36229.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36229.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7396.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7396.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10001.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10001.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10001.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10001.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10001.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10001.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9425.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9425.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12378.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12378.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29208.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29208.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12679.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12679.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61688.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61688.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47080.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47080.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29457.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29457.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5972 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21310.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21310.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34439.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34439.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3987.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3987.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5136 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-5715.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5715.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37485.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37485.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5764 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5624 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6568 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-5497.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5497.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10406.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10406.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5716 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5924 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5160 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5548 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5992 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5680 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6208 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6236 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6388 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6328 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6428 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6608 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6360 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6300 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6800 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6420 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6684 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6540 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6768 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-8147.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8147.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6600 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-23005.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23005.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24074.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24074.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24074.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24074.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6732 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-23306.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23306.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45802.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45802.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6984 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6892 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-62688.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62688.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6832 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6628 -s 212

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7348 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-36508.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36508.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6704 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6760 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6812 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6924 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6956 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6884 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-38294.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38294.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-36239.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36239.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7899.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7899.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7492 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-61794.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61794.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10154.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10154.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29672.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29672.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51815.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51815.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2422.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2422.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51732.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51732.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59402.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59402.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46019.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46019.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34182.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34182.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22828.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22828.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21375.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21375.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37109.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37109.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42812.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42812.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7864 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-12324.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12324.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7972 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-46066.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46066.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62210.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62210.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31266.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31266.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63554.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63554.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27483.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27483.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46616.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46616.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46232.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46232.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8156 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-64296.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64296.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34577.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34577.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19777.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19777.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7172 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8128 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8072 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-56445.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56445.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7432 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7912 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-62890.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62890.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36090.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36090.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7588 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7828 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8148 -s 236

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe

MD5 4bd7b864811a75fc759875d43e22dfbe
SHA1 56cf6b1602087d8c19fc3e42db54272d83404269
SHA256 2dcb4a23371f836595ef6687af9d7356cd97df3b930e6080eb98a882f9ab82ad
SHA512 cc81bd5f783c17311a9b8217da04860d461c709d3e7784b4ff978aae1c0e482ef687a852ef6168446006351794278999241b59e557d92199524aca873c11cdf1

C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe

MD5 b404948b9b5d945dadea2a61e64cd055
SHA1 fbc4d3dc50eefa4d3c7abe3d8aa47e1157338477
SHA256 41e2f8517ccb88b1081fded01e0a075743e07ed6f47be1c40d2c0c246bc1a10a
SHA512 64d13971cd6e53d69ffc5dfeb2be45f8c2e2bee841202450cd99ea2f9b2256b99da9697cf11004aad058199260ef1bca1a34c3b347d9f04bff49a70918db82b8

\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe

MD5 3095689d0d329168e05f45b0a1ab69d1
SHA1 56bd34e523a4a8278a5a486cc6a6b5566976c4e7
SHA256 0b3e3296a1cf49ee9c8941bd6068067d6fc4c13a9922543604d2e499218a751d
SHA512 a2f7e63cdd84183accfc316ecc741e766bc4f31aacde4b0e412b6a8115d19b882cb3cab183343db37c1f6f17eacedf93bbc229d89b4f7f4b953344eebcd3da95

\Users\Admin\AppData\Local\Temp\Unicorn-65406.exe

MD5 1102397a9da99ea95775378fb3e9862c
SHA1 097f9ebb3beb10ca3921439ff7286b9590eac189
SHA256 b863cec2c5b3f2c50e3f0bdf3e568105796ac59f303dc2d0c13b734cf6b23358
SHA512 b5b56ea8d62768835fcafe352cf3c57e07eef166794cb6be2e31ae871db371fdff7d478357407097b9a123eb6a9bd9027a8020e01a7bcedbab0cc2d644db976b

C:\Users\Admin\AppData\Local\Temp\Unicorn-4275.exe

MD5 4ba8452b0b5b8ff26ce213b5a7e3b107
SHA1 f05a96d2a3cf25e4b91462b97bf6e043e947342a
SHA256 cb79e2fc822bceb2694289a980c6f8365054e04de83842878bcb98530ae4325d
SHA512 9a1cf513b20a3e8d9c96f17eef65f7d7d0d6007efa7aca988b0115bff37a036ae94d14b8f154ddde8d02bfff07601bb54395cfbae5cad39f84923d44f1e31470

\Users\Admin\AppData\Local\Temp\Unicorn-20804.exe

MD5 70484a93e34bc55757569cd1d049503a
SHA1 79d70856cb83c61055bb784ecc8a4211092cb489
SHA256 f75ed9c64c6cb22079923b28c9c28b81beda57600786bada0859659cda3e2e5f
SHA512 1dd71b1903c82e25a05dd202f293d9c26b336e334ab677b2fbdbb8169655a68ad9a75ad34ff0188106ab9c0512dea5c535db447a7b84e71326993a5a06dc40ca

\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe

MD5 627813483025015919ba5427d8439853
SHA1 89fb75136a4103d4c418cc356e63cec77582398e
SHA256 f033f9dd05f976f98888b5485946100978af3167ac5a477268422fd3ed0f1932
SHA512 4c08e2df302d6891bee78f57a51cfb212385e5a65ffee0927f0a47f8605e49bcfe5b2f45716894e44edd58209d006daa111b5fad1d65374553318f448c6bdbe0

\Users\Admin\AppData\Local\Temp\Unicorn-18971.exe

MD5 b52e108c5158b0787421f75bf1322850
SHA1 4d07ec3af0b963381b6596571bce3e12d30fd4d1
SHA256 d714400a8196a64f778d479ce07900684f837eee72a9270fad64b56d61bdbc22
SHA512 c2890bdae287ad823ec3acf75f36913096c292b5646b96efbd615f336b1bf2fef3659af403e617ce20448b5e631f921bbecb7edbb789978f56e4523719e985b2

\Users\Admin\AppData\Local\Temp\Unicorn-61525.exe

MD5 934fd7adf61dbb5ca9c36d6745cc4a83
SHA1 dd0070e94bf6e6b9bd35fdf193b743ffcdabedce
SHA256 44d19b8ef0c53baae74618a3bc20ab24cfde02e132714fb0c48b500a5c90b943
SHA512 caf834ac39a2ec83e3d6501e0b9a41663ef8b0ecc02e8666c64c4aa353c681945f5c6328413743490aed9547232037eee83307a2520e4c0bc0ecb2190683d0c2

\Users\Admin\AppData\Local\Temp\Unicorn-29538.exe

MD5 05a1bc73b827ecd9e1f2bd555702d149
SHA1 70c5510b18f05b307ef46fe074efb44c9b374cda
SHA256 48f418aaf12e04a3d955ddf2cdfb0ef3c72daee82dbdcdfdfc1ba19967ba507d
SHA512 ede7a24a0e6809879f87480899312cd2003be6362f8eb53056839fe03edb827f0b00929cdfb72ace12239dece46b536ba7a0fd7d0e4cf8c8c5b803481474b85e

C:\Users\Admin\AppData\Local\Temp\Unicorn-26200.exe

MD5 4455e0f55696784c9054739e15b04c4b
SHA1 8bbd1fe0be4cf47d867eb9225ccb14c2da39db52
SHA256 85d04c1e6393e709d3971a0c9f55bd5a2ef69bcfe6c33453856f486c3e027031
SHA512 bcd7e48fa0030a5610d7f71652e4c64d35898ec1a86df27aae270ef257f65dda2de72568d38ad7108fb0eb3a2c5fbee1f0b21a08cc947cbda26b81e7050abfa4

C:\Users\Admin\AppData\Local\Temp\Unicorn-14597.exe

MD5 5f7c77e51d6890e30155c24dc5fac9a8
SHA1 aff0e8c4b291d64d0f0912e05866115ec0654620
SHA256 dcf0a04089d812a380fc4165e2f45a7f99dcd65a42f02864dae19f4f8540d51f
SHA512 8f53c33fd4bcb93505749e17fb6ef3f176c60628d92439b361a45a67081f1a8d85e1d2cd1e5f0c3f9477750c8063dee82f2e126cea2193f9249de44a50570f0e

\Users\Admin\AppData\Local\Temp\Unicorn-27596.exe

MD5 a3cad3c50b53befef25435c82833bf29
SHA1 f73e1b8a29feab9f759e6d59fff8565ffa6bb2e0
SHA256 a7c3e5ecd6cd5896609413c44c07d9c20f99b09d51e13ae38f34787955367c00
SHA512 09592b482ff00a7fb98bc9eb4cc40d327b6a7ccd76e833bf075d066451ee77800376da66a52e873bf69aba0ea3dfba470cd6b5bad0a8e582338f6198653a5ba5

\Users\Admin\AppData\Local\Temp\Unicorn-63222.exe

MD5 63473fded20a1533e9221e6307c76547
SHA1 48192c6c36d1178996706d2112d39f5fa6c1bcb6
SHA256 aa602a6af58006ab2678d6508ae6a2a970ed51b261f16cbbe99c1da2280a612c
SHA512 e9787fc3908ebfc62a2e6f64ed676597f045975b3ba5fa49ec2be8671a109611c40634d9c6caeba73bbac23b934d1e52d4651f00f8cce3a78a622573b3a58f91

C:\Users\Admin\AppData\Local\Temp\Unicorn-39986.exe

MD5 17d04355f4e7c46d0fcf75048a7d266d
SHA1 f8ee63462b47b1f5570cd34c0513a9d50f3d2779
SHA256 59d15a7d86eec68be2bd85c359824cd26190a3dab64faec6e4880214c126f3ac
SHA512 5aaede267a3678f8039eea1b3556694e3784da728438168f2f9bbc556642036a60549261abb4b0364bec665175947d72676f679c88424155f5c6f9badc872080

C:\Users\Admin\AppData\Local\Temp\Unicorn-5810.exe

MD5 33d6af4e0d2bfd3ae8092ed74f660a21
SHA1 48444eebb7a007d9bb76e909297d0479d148fef4
SHA256 4ba3d1f49df1dd26b1fb40bee58cdc42e647ad657a22c4cfe9dd8c17bf1c27c5
SHA512 c385557ce183c39c6ea86914f7d5685490080654ae9199e19337af545ff051a1623d090abd061dcb2b3a4c03c2b15a26850a810391cfe9a6cc4f1476bfaaf7cf

C:\Users\Admin\AppData\Local\Temp\Unicorn-22192.exe

MD5 89fc716acb153a97cc6c67b817d3c0cf
SHA1 3b2a5d57d99b1a624d87a7f59435c5e0242bf22f
SHA256 b1096e69546d89831b8e6d4790682c9a2d158044e0a59b53451137b892d753e9
SHA512 212882fd82fa7ce8794cbf63a64fd7e2214dacd90977ab2e9af592f744620d274bad5fe5193bfe5d3f38443b612df1ba454809d1f300395e9423e03032b306d2

C:\Users\Admin\AppData\Local\Temp\Unicorn-36229.exe

MD5 2b952c8e7ecff73bf1bd1b2b2b1ba8b3
SHA1 a649226a8fb45d7821b08492eb542ca4d446d49d
SHA256 96ad58a877388be02b737d934571098f1e0bf819f6890530b34bea93e76ec341
SHA512 d8d85166cde2f4f04cc3bb8cedc477ed5e3db68a35562c07ad6d42929f6d7ea87298fcf34a90352038644628a73e011a707d312b168fd2d3a68806d940ce3b15

C:\Users\Admin\AppData\Local\Temp\Unicorn-36239.exe

MD5 2d35c10104d49a4d8a197cc12b4810a0
SHA1 502b65a0dc93049f2403f7064524536b85975c21
SHA256 a679c15447a2ae1bf0db091f19a26f77f592aa58ad5d93b390c61a21e7348832
SHA512 d594a06632ed960433b805113490e870d308ab798943b9591f49005688ad7cca95636bec08ebe027e7814538db0e76f7b7f314a5f24e8f3975262648d07d08cc

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-26 03:15

Reported

2024-05-26 03:18

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

104s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5a16a1683c014264efd6d7a6d9cded40_NeikiAnalytics.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1638.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38432.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57648.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37782.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57555.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22038.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5391.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21536.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-52682.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6242.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38723.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18857.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35385.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4566.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24432.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56035.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4182.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57571.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38774.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13287.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65249.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-45877.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1824.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1824.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2893.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1632.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32036.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46920.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34222.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50750.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49032.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29697.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27044.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-45457.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46142.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44424.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64206.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53454.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19713.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5872.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51544.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51544.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3220.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38545.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54689.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2151.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38161.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53921.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53921.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53729.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33863.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53080.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36743.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\5a16a1683c014264efd6d7a6d9cded40_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1638.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38432.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57648.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37782.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57555.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22038.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-5391.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-52682.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-21536.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18857.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38723.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6242.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25008.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24432.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4566.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33863.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38774.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-13287.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-65249.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32036.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34222.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-16174.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9344.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-36174.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-28177.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-61441.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29729.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-39137.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37985.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54689.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18222.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-28606.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6317.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37137.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-13152.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9216.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42574.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-65454.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17953.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17953.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18529.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33905.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-23175.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-3757.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24244.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4141.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33905.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24244.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24244.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-39886.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42020.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38817.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-40212.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-50929.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-10752.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-23559.exe

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\5a16a1683c014264efd6d7a6d9cded40_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1638.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38432.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37782.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57648.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57555.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22038.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5391.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21536.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-52682.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18857.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38723.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6242.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24432.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4566.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56035.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4182.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57571.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38774.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13287.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65249.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-45877.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1824.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1824.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2893.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1632.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32036.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46920.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34222.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50750.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49032.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29697.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27044.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-45457.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46142.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44424.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64206.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53454.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19713.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5872.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51544.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51544.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3220.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38545.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54689.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2151.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38161.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53921.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53921.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33863.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53729.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36743.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53080.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3088 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\5a16a1683c014264efd6d7a6d9cded40_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exe
PID 3088 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\5a16a1683c014264efd6d7a6d9cded40_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exe
PID 3088 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\5a16a1683c014264efd6d7a6d9cded40_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exe
PID 944 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe
PID 944 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe
PID 944 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe
PID 3088 wrote to memory of 4968 N/A C:\Users\Admin\AppData\Local\Temp\5a16a1683c014264efd6d7a6d9cded40_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1638.exe
PID 3088 wrote to memory of 4968 N/A C:\Users\Admin\AppData\Local\Temp\5a16a1683c014264efd6d7a6d9cded40_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1638.exe
PID 3088 wrote to memory of 4968 N/A C:\Users\Admin\AppData\Local\Temp\5a16a1683c014264efd6d7a6d9cded40_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1638.exe
PID 4912 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38432.exe
PID 4912 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38432.exe
PID 4912 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38432.exe
PID 4968 wrote to memory of 3612 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1638.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57648.exe
PID 4968 wrote to memory of 3612 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1638.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57648.exe
PID 4968 wrote to memory of 3612 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1638.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57648.exe
PID 944 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37782.exe
PID 944 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37782.exe
PID 944 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37782.exe
PID 1084 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38432.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57555.exe
PID 1084 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38432.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57555.exe
PID 1084 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38432.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57555.exe
PID 4912 wrote to memory of 4616 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22038.exe
PID 4912 wrote to memory of 4616 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22038.exe
PID 4912 wrote to memory of 4616 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22038.exe
PID 3400 wrote to memory of 512 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37782.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe
PID 3400 wrote to memory of 512 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37782.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe
PID 3400 wrote to memory of 512 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37782.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe
PID 3612 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57648.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe
PID 3612 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57648.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe
PID 3612 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57648.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe
PID 4968 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1638.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe
PID 4968 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1638.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe
PID 4968 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1638.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe
PID 4616 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22038.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-5391.exe
PID 4616 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22038.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-5391.exe
PID 4616 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22038.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-5391.exe
PID 4944 wrote to memory of 348 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57555.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-21536.exe
PID 4944 wrote to memory of 348 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57555.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-21536.exe
PID 4944 wrote to memory of 348 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57555.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-21536.exe
PID 1084 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38432.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-52682.exe
PID 1084 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38432.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-52682.exe
PID 1084 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38432.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-52682.exe
PID 3352 wrote to memory of 5080 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6242.exe
PID 3352 wrote to memory of 5080 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6242.exe
PID 3352 wrote to memory of 5080 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6242.exe
PID 3444 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38723.exe
PID 3444 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38723.exe
PID 3444 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38723.exe
PID 3612 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57648.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18857.exe
PID 3612 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57648.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18857.exe
PID 3612 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57648.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18857.exe
PID 3400 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37782.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35385.exe
PID 3400 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37782.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35385.exe
PID 3400 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37782.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35385.exe
PID 2684 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5391.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25008.exe
PID 2684 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5391.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25008.exe
PID 2684 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5391.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25008.exe
PID 4616 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22038.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
PID 4616 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22038.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
PID 4616 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22038.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
PID 512 wrote to memory of 220 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4566.exe
PID 512 wrote to memory of 220 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4566.exe
PID 512 wrote to memory of 220 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4566.exe
PID 348 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21536.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24432.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5a16a1683c014264efd6d7a6d9cded40_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\5a16a1683c014264efd6d7a6d9cded40_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1638.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1638.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3088 -ip 3088

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 716

C:\Users\Admin\AppData\Local\Temp\Unicorn-38432.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38432.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57648.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57648.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37782.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37782.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 944 -ip 944

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 944 -s 748

C:\Users\Admin\AppData\Local\Temp\Unicorn-57555.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57555.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22038.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22038.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4912 -ip 4912

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 736

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4968 -ip 4968

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 720

C:\Users\Admin\AppData\Local\Temp\Unicorn-5391.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5391.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21536.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21536.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52682.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52682.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6242.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6242.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18857.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18857.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38723.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38723.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35385.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35385.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1084 -ip 1084

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1084 -s 728

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3400 -ip 3400

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3612 -ip 3612

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 720

C:\Users\Admin\AppData\Local\Temp\Unicorn-25008.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25008.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4566.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4566.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24432.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24432.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56035.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56035.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4182.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4182.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57571.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57571.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38774.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38774.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4616 -ip 4616

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4944 -ip 4944

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 740

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3352 -ip 3352

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3352 -s 748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 512 -ip 512

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3444 -ip 3444

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 724

C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13287.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13287.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65249.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65249.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45877.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45877.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1824.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1824.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1824.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1824.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2893.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2893.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1632.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1632.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32036.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32036.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46920.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46920.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34222.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34222.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50750.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50750.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3360.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3360.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49032.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49032.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2684 -ip 2684

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2328 -ip 2328

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 348 -ip 348

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 724

C:\Users\Admin\AppData\Local\Temp\Unicorn-29697.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29697.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27044.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27044.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45457.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45457.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3668 -ip 3668

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5080 -ip 5080

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4756 -ip 4756

C:\Users\Admin\AppData\Local\Temp\Unicorn-46142.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46142.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 640

C:\Users\Admin\AppData\Local\Temp\Unicorn-44424.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44424.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3668 -s 752

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 652

C:\Users\Admin\AppData\Local\Temp\Unicorn-64206.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64206.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53454.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53454.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5872.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5872.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51544.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51544.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51544.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51544.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3220.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3220.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38545.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38545.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54689.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54689.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2151.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2151.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38161.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38161.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53921.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53921.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53921.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53921.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33863.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33863.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53729.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53729.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53080.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53080.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36743.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36743.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 4788 -ip 4788

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 752

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 1276 -ip 1276

C:\Users\Admin\AppData\Local\Temp\Unicorn-46433.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46433.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11300.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11300.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29713.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 760

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 3688 -ip 3688

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 220 -ip 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-16942.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16942.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4184 -ip 4184

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 4408 -ip 4408

C:\Users\Admin\AppData\Local\Temp\Unicorn-28487.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28487.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1864 -ip 1864

C:\Users\Admin\AppData\Local\Temp\Unicorn-15488.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15488.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16174.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16174.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44248.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44248.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 4932 -ip 4932

C:\Users\Admin\AppData\Local\Temp\Unicorn-17793.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17793.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30407.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30407.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 4184 -ip 4184

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 1604 -ip 1604

C:\Users\Admin\AppData\Local\Temp\Unicorn-2032.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2032.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64917.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64917.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 496

C:\Users\Admin\AppData\Local\Temp\Unicorn-57201.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57201.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38212.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38212.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42785.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42785.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10413.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10413.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9344.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9344.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38103.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38103.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8960.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8960.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45390.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45390.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45390.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45390.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28862.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28862.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25140.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25140.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23879.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23879.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 4032 -ip 4032

C:\Users\Admin\AppData\Local\Temp\Unicorn-57237.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57237.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11565.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11565.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44238.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44238.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44238.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44238.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11181.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11181.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26641.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26641.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26641.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26641.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42327.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42327.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42327.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42327.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 2772 -ip 2772

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 3380 -ip 3380

C:\Users\Admin\AppData\Local\Temp\Unicorn-28177.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28177.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2128 -ip 2128

C:\Users\Admin\AppData\Local\Temp\Unicorn-35105.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35105.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36174.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36174.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51441.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51441.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 736

C:\Users\Admin\AppData\Local\Temp\Unicorn-17809.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17809.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63480.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63480.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64549.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64549.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47637.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17844.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17844.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49640.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49640.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 312 -ip 312

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2544 -ip 2544

C:\Users\Admin\AppData\Local\Temp\Unicorn-20798.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20798.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20798.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20798.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52209.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52209.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36942.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36942.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15623.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15623.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 720

C:\Users\Admin\AppData\Local\Temp\Unicorn-18961.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18961.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19380.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19380.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4900 -ip 4900

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 4528 -ip 4528

C:\Users\Admin\AppData\Local\Temp\Unicorn-37985.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37985.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1783.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1783.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37025.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37025.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16967.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16967.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36833.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36833.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4652 -ip 4652

C:\Users\Admin\AppData\Local\Temp\Unicorn-39137.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39137.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4004.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4004.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5888.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5888.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10164.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10164.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28769.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28769.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41575.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41575.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61441.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61441.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41876.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41876.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 428 -ip 428

C:\Users\Admin\AppData\Local\Temp\Unicorn-29729.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29729.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13200.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13200.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45681.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45681.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30414.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30414.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 1176 -ip 1176

C:\Users\Admin\AppData\Local\Temp\Unicorn-28996.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28996.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 736

C:\Users\Admin\AppData\Local\Temp\Unicorn-14004.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14004.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2832 -ip 2832

C:\Users\Admin\AppData\Local\Temp\Unicorn-40126.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40126.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20260.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20260.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2663.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2663.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23681.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23681.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24366.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24366.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23681.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23681.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23681.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23681.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23681.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23681.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42129.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42129.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4668 -ip 4668

C:\Users\Admin\AppData\Local\Temp\Unicorn-55969.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55969.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55969.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55969.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54360.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54360.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 3844 -ip 3844

C:\Users\Admin\AppData\Local\Temp\Unicorn-10992.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10992.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 3880 -ip 3880

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 3612 -ip 3612

C:\Users\Admin\AppData\Local\Temp\Unicorn-55512.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55512.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55512.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55512.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 3684 -ip 3684

C:\Users\Admin\AppData\Local\Temp\Unicorn-48481.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48481.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2324 -ip 2324

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 2292 -ip 2292

C:\Users\Admin\AppData\Local\Temp\Unicorn-1392.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1392.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4996 -ip 4996

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2348 -ip 2348

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 4124 -ip 4124

C:\Users\Admin\AppData\Local\Temp\Unicorn-17537.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17537.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17537.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17537.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18222.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18222.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18222.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18222.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50017.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50017.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33681.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33681.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33681.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33681.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34750.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34750.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-624.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-624.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-624.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-624.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3828 -ip 3828

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3400 -ip 3400

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 1424 -ip 1424

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5092 -ip 5092

C:\Users\Admin\AppData\Local\Temp\Unicorn-37137.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37137.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53473.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53473.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38206.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38206.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 4676 -ip 4676

C:\Users\Admin\AppData\Local\Temp\Unicorn-36753.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36753.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 632 -ip 632

C:\Users\Admin\AppData\Local\Temp\Unicorn-21294.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21294.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53281.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53281.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53089.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53089.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 4856 -ip 4856

C:\Users\Admin\AppData\Local\Temp\Unicorn-26769.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26769.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27838.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27838.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59249.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59249.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55912.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55912.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 1592 -ip 1592

C:\Users\Admin\AppData\Local\Temp\Unicorn-28606.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28606.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 4260 -ip 4260

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 348 -ip 348

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 936 -ip 936

C:\Users\Admin\AppData\Local\Temp\Unicorn-9207.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9207.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46286.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46286.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4992 -ip 4992

C:\Users\Admin\AppData\Local\Temp\Unicorn-27655.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27655.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27655.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27655.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15232.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15232.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 2856 -ip 2856

C:\Users\Admin\AppData\Local\Temp\Unicorn-27079.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27079.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1728 -ip 1728

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 5104 -ip 5104

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3268 -ip 3268

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4384 -ip 4384

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 1000 -ip 1000

C:\Users\Admin\AppData\Local\Temp\Unicorn-1060.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1060.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3700 -ip 3700

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 864 -ip 864

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2372 -ip 2372

C:\Users\Admin\AppData\Local\Temp\Unicorn-6317.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6317.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6317.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6317.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 4704 -ip 4704

C:\Users\Admin\AppData\Local\Temp\Unicorn-37921.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37921.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53873.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53873.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6317.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6317.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3224 -ip 3224

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 432 -ip 432

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 2484 -ip 2484

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4344 -ip 4344

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3996 -ip 3996

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3668 -ip 3668

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 2064 -ip 2064

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1884 -ip 1884

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 3792 -ip 3792

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 4928 -ip 4928

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 976 -ip 976

C:\Users\Admin\AppData\Local\Temp\Unicorn-14781.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14781.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14781.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14781.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46193.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46193.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62721.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62721.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 744

C:\Users\Admin\AppData\Local\Temp\Unicorn-32545.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32545.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 1448 -ip 1448

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 760 -ip 760

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 4240 -ip 4240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4080 -ip 4080

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 5532 -ip 5532

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5232 -ip 5232

C:\Users\Admin\AppData\Local\Temp\Unicorn-34766.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34766.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18622.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18622.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33697.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33697.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50033.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50033.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17553.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17553.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33889.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33889.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18622.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18622.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36686.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36686.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5224 -ip 5224

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 5140 -ip 5140

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5316 -ip 5316

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 4672 -ip 4672

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5812 -ip 5812

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 1760 -ip 1760

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 7148 -ip 7148

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2368 -ip 2368

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3444 -ip 3444

C:\Users\Admin\AppData\Local\Temp\Unicorn-9872.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9872.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5224 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 5880 -ip 5880

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5140 -s 648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 2744 -ip 2744

C:\Users\Admin\AppData\Local\Temp\Unicorn-27553.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27553.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 1892 -ip 1892

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 1508 -ip 1508

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 6100 -ip 6100

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4788 -ip 4788

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2284 -ip 2284

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 4056 -ip 4056

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5508 -ip 5508

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 5392 -ip 5392

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 3272 -ip 3272

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 6060 -ip 6060

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 5400 -ip 5400

C:\Users\Admin\AppData\Local\Temp\Unicorn-51585.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51585.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51585.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51585.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51585.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51585.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51585.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51585.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18529.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18529.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5888 -ip 5888

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 5624 -ip 5624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 628

C:\Users\Admin\AppData\Local\Temp\Unicorn-51886.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51886.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51886.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51886.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51886.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51886.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 6040 -ip 6040

C:\Users\Admin\AppData\Local\Temp\Unicorn-17953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30951.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30951.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30951.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30951.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17953.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 5248 -ip 5248

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 5524 -ip 5524

C:\Users\Admin\AppData\Local\Temp\Unicorn-17569.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17569.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33905.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33905.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33905.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33905.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33905.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33905.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17569.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17569.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17377.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17377.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20174.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20174.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20174.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20174.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 5628 -ip 5628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5188 -ip 5188

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 5216 -ip 5216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5300 -ip 5300

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 3088 -ip 3088

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 1276 -ip 1276

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 5552 -ip 5552

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5248 -s 628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 5384 -ip 5384

C:\Users\Admin\AppData\Local\Temp\Unicorn-21985.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21985.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5712 -ip 5712

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 3364 -ip 3364

C:\Users\Admin\AppData\Local\Temp\Unicorn-45057.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45057.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42020.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42020.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 6124 -ip 6124

C:\Users\Admin\AppData\Local\Temp\Unicorn-14112.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14112.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 6068 -ip 6068

C:\Users\Admin\AppData\Local\Temp\Unicorn-13728.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13728.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14413.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14413.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13344.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13344.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13152.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13152.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46209.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46209.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 5684 -ip 5684

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 5472 -ip 5472

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5588 -ip 5588

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5684 -s 648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6068 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 5160 -ip 5160

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 6084 -ip 6084

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 812 -ip 812

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 5480 -ip 5480

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 456 -ip 456

C:\Users\Admin\AppData\Local\Temp\Unicorn-38817.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38817.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39886.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39886.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 5416 -ip 5416

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5724 -ip 5724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 4484 -ip 4484

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 5488 -ip 5488

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 5460 -ip 5460

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5920 -ip 5920

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5828 -ip 5828

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5292 -ip 5292

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 1612 -ip 1612

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 2184 -ip 2184

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4184 -ip 4184

C:\Users\Admin\AppData\Local\Temp\Unicorn-9216.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9216.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5452 -ip 5452

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 1084 -ip 1084

C:\Users\Admin\AppData\Local\Temp\Unicorn-42574.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42574.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42574.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42574.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42574.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42574.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 5984 -ip 5984

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1440 -ip 1440

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 5336 -ip 5336

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 6664 -ip 6664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 6748 -ip 6748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5560 -ip 5560

C:\Users\Admin\AppData\Local\Temp\Unicorn-23559.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23559.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10752.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10752.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10752.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10752.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24244.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 736

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 6560 -ip 6560

C:\Users\Admin\AppData\Local\Temp\Unicorn-16145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64769.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64769.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65454.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65454.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65454.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65454.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50929.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50929.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50929.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50929.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5244 -ip 5244

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 6728 -ip 6728

C:\Users\Admin\AppData\Local\Temp\Unicorn-35278.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35278.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 6640 -ip 6640

C:\Users\Admin\AppData\Local\Temp\Unicorn-16913.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16913.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3456.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3456.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4141.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4141.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 2532 -ip 2532

C:\Users\Admin\AppData\Local\Temp\Unicorn-3757.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3757.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 5952 -ip 5952

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 1304 -ip 1304

C:\Users\Admin\AppData\Local\Temp\Unicorn-36897.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36897.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4224.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4224.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3064 -ip 3064

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 7136 -ip 7136

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 5640 -ip 5640

C:\Users\Admin\AppData\Local\Temp\Unicorn-40212.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40212.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40212.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40212.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6964.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6964.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6964.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6964.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 6476 -ip 6476

C:\Users\Admin\AppData\Local\Temp\Unicorn-57208.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57208.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 6844 -ip 6844

C:\Users\Admin\AppData\Local\Temp\Unicorn-61614.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61614.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 5976 -ip 5976

C:\Users\Admin\AppData\Local\Temp\Unicorn-29601.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29601.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29601.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29601.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6708 -ip 6708

C:\Users\Admin\AppData\Local\Temp\Unicorn-13072.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13072.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8775.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8775.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 7072 -ip 7072

C:\Users\Admin\AppData\Local\Temp\Unicorn-27991.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27991.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27991.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27991.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27991.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27991.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 7128 -ip 7128

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 6456 -ip 6456

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6844 -s 648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 6148 -ip 6148

C:\Users\Admin\AppData\Local\Temp\Unicorn-63918.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63918.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34452.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34452.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 6500 -ip 6500

C:\Users\Admin\AppData\Local\Temp\Unicorn-16964.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16964.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 6692 -ip 6692

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 7052 -ip 7052

C:\Users\Admin\AppData\Local\Temp\Unicorn-1671.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1671.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1671.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1671.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1671.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1671.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38750.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38750.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 7152 -ip 7152

C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7312.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7312.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7312.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7312.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7312.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7312.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7312.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7312.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39793.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39793.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6928.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6928.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6928.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6928.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7997.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7997.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24142.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24142.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6928.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6928.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6544.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6544.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6544.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6544.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6656 -ip 6656

C:\Users\Admin\AppData\Local\Temp\Unicorn-58926.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58926.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58926.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58926.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58926.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58926.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 6464 -ip 6464

C:\Users\Admin\AppData\Local\Temp\Unicorn-24993.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24993.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25294.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25294.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6456 -s 664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3800 -ip 3800

C:\Users\Admin\AppData\Local\Temp\Unicorn-16161.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16161.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64785.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64785.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 6896 -ip 6896

C:\Users\Admin\AppData\Local\Temp\Unicorn-31729.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31729.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61064.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61064.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 6368 -ip 6368

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 6116 -ip 6116

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6464 -s 720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 4032 -ip 4032

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4772 -ip 4772

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 7096 -ip 7096

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 5280 -ip 5280

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 864 -ip 864

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 6448 -ip 6448

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4664 -ip 4664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 6012 -ip 6012

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5192 -ip 5192

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 2236 -ip 2236

C:\Users\Admin\AppData\Local\Temp\Unicorn-51345.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51345.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51345.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51345.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52414.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52414.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52414.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52414.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 5432 -ip 5432

C:\Users\Admin\AppData\Local\Temp\Unicorn-3021.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3021.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3021.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3021.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50961.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50961.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18289.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18289.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34817.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34817.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1952.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1952.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3021.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3021.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36353.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36353.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37038.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37038.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 6300 -ip 6300

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 5060 -ip 5060

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 7000 -ip 7000

C:\Users\Admin\AppData\Local\Temp\Unicorn-23281.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23281.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39809.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39809.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39809.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39809.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6096 -ip 6096

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 3696 -ip 3696

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5636 -ip 5636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3196 -ip 3196

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 1392 -ip 1392

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 2484 -ip 2484

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2192 -ip 2192

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 348 -ip 348

C:\Users\Admin\AppData\Local\Temp\Unicorn-64417.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64417.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64609.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64609.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49342.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49342.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65486.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65486.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 4616 -ip 4616

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 1280 -ip 1280

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4588 -ip 4588

C:\Users\Admin\AppData\Local\Temp\Unicorn-33966.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33966.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 2368 -ip 2368

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5148 -ip 5148

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 4552 -ip 4552

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 4412 -ip 4412

C:\Users\Admin\AppData\Local\Temp\Unicorn-21665.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21665.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21665.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21665.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57134.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57134.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57134.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57134.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23393.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23393.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23393.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23393.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8125.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8125.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 5180 -ip 5180

C:\Users\Admin\AppData\Local\Temp\Unicorn-41841.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41841.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59054.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59054.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59054.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59054.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59054.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59054.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59054.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59054.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25313.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25313.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59054.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59054.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 672 -ip 672

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 3432 -ip 3432

C:\Users\Admin\AppData\Local\Temp\Unicorn-62152.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62152.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 976 -ip 976

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 2124 -ip 2124

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 6156 -ip 6156

C:\Users\Admin\AppData\Local\Temp\Unicorn-19361.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19361.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20430.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20430.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4996 -ip 4996

C:\Users\Admin\AppData\Local\Temp\Unicorn-52225.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52225.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34929.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34929.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19361.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19361.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19361.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19361.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19361.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19361.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19361.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19361.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19361.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19361.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19361.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19361.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2064 -ip 2064

C:\Users\Admin\AppData\Local\Temp\Unicorn-37233.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37233.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21966.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21966.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21966.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21966.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 6400 -ip 6400

C:\Users\Admin\AppData\Local\Temp\Unicorn-54446.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54446.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60222.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60222.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60222.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60222.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60222.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60222.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60222.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60222.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25713.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 2176 -ip 2176

C:\Users\Admin\AppData\Local\Temp\Unicorn-11872.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11872.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60689.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60689.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60689.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60689.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60689.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60689.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60689.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60689.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 6048 -ip 6048

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4308 -ip 4308

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 3972 -ip 3972

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 748 -ip 748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 6928 -ip 6928

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6048 -s 728

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3972 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6928 -s 612

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 6552 -ip 6552

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6552 -s 740

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 5044 -ip 5044

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7032 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 7032 -ip 7032

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 5788 -ip 5788

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 4452 -ip 4452

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 4220 -ip 4220

C:\Users\Admin\AppData\Local\Temp\Unicorn-62817.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62817.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13424.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13424.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 6196 -ip 6196

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4220 -s 728

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 660

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 2344 -ip 2344

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5788 -s 644

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5112 -ip 5112

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5112 -s 728

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5980 -s 640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 644

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6196 -s 600

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5980 -ip 5980

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 3176 -ip 3176

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 3684 -ip 3684

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 6312 -ip 6312

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 1560 -ip 1560

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6312 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2416 -ip 2416

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 6160 -ip 6160

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 752

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6160 -s 628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5672 -s 648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 5672 -ip 5672

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2684 -ip 2684

C:\Users\Admin\AppData\Local\Temp\Unicorn-28801.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28801.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5188 -s 652

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 312 -s 728

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 5220 -ip 5220

C:\Users\Admin\AppData\Local\Temp\Unicorn-18817.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18817.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51297.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51297.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51297.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51297.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51297.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51297.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51297.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51297.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34961.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34961.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34961.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34961.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34961.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34961.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34577.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34577.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19118.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19118.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1604 -ip 1604

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5188 -ip 5188

C:\Users\Admin\AppData\Local\Temp\Unicorn-2672.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2672.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5024 -ip 5024

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5672 -s 648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 312 -ip 312

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1704 -ip 1704

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 632

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 1656 -ip 1656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5144 -s 652

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6124 -s 652

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6736 -s 624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6128 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5296 -s 628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6236 -s 648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5448 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 6204 -ip 6204

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 5832 -ip 5832

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6432 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5464 -s 736

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 6128 -ip 6128

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5616 -s 648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5492 -s 744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 5784 -ip 5784

C:\Users\Admin\AppData\Local\Temp\Unicorn-17281.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17281.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 6736 -ip 6736

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5188 -s 652

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 5144 -ip 5144

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 6124 -ip 6124

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 3372 -ip 3372

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5296 -ip 5296

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 3272 -ip 3272

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 6236 -ip 6236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5448 -ip 5448

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 4372 -ip 4372

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 728

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6908 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 6432 -ip 6432

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5580 -s 752

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 5464 -ip 5464

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6808 -s 624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 2740 -ip 2740

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3928 -ip 3928

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 5616 -ip 5616

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 5492 -ip 5492

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6088 -s 640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5940 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 660

C:\Users\Admin\AppData\Local\Temp\Unicorn-33345.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33345.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33345.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33345.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33345.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33345.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5144 -s 652

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6236 -s 648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1892 -ip 1892

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 640 -ip 640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 6908 -ip 6908

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 2364 -ip 2364

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 5580 -ip 5580

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 6808 -ip 6808

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 6088 -ip 6088

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 5940 -ip 5940

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 3160 -ip 3160

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5580 -s 752

C:\Users\Admin\AppData\Local\Temp\Unicorn-38654.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38654.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7709.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7709.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7709.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7709.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7709.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7709.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7709.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7709.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7517.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7517.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56718.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56718.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23662.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23662.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56718.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56718.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23662.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23662.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23662.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23662.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23662.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23662.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23662.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23662.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7325.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7325.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23662.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23662.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23662.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23662.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39121.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39121.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4932 -ip 4932

C:\Users\Admin\AppData\Local\Temp\Unicorn-7517.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7517.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7517.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7517.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7517.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7517.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 6964 -ip 6964

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6964 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 4416 -ip 4416

C:\Users\Admin\AppData\Local\Temp\Unicorn-15213.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15213.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64414.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64414.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 4912 -ip 4912

C:\Users\Admin\AppData\Local\Temp\Unicorn-30673.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30673.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30673.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30673.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30673.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30673.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64414.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64414.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49038.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49038.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34129.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34129.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 5800 -ip 5800

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5472 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6080 -s 660

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7160 -s 628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6936 -s 600

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5800 -s 652

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 6936 -ip 6936

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 484

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 7160 -ip 7160

C:\Users\Admin\AppData\Local\Temp\Unicorn-19137.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19137.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2909.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2909.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2141.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2141.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6044 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6560 -s 632

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 652

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6964 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 5472 -ip 5472

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 632

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6836 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 6080 -ip 6080

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 3312 -ip 3312

C:\Users\Admin\AppData\Local\Temp\Unicorn-46350.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46350.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 6044 -ip 6044

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 652

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5724 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6800 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6564 -s 640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5860 -s 648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 652

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6912 -s 608

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 3008 -ip 3008

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4804 -ip 4804

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7160 -s 628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 6560 -ip 6560

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 3468 -ip 3468

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 1668 -ip 1668

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 6836 -ip 6836

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 6912 -ip 6912

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6560 -s 632

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 2432 -ip 2432

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 5724 -ip 5724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 2992 -ip 2992

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 5860 -ip 5860

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 6564 -ip 6564

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 4004 -ip 4004

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 6800 -ip 6800

C:\Users\Admin\AppData\Local\Temp\Unicorn-11101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60302.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60302.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5724 -s 636

C:\Users\Admin\AppData\Local\Temp\Unicorn-19950.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19950.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19950.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19950.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19950.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19950.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19950.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19950.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35409.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35409.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36478.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36478.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3613.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3613.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35409.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35409.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38782.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38782.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5725.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5725.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54926.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54926.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21185.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21185.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21870.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21870.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53774.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53774.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20033.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20033.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20033.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20033.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20033.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20033.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20033.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20033.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20033.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20033.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60702.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60702.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11501.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11501.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11501.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11501.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60702.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60702.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60702.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60702.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 6504 -ip 6504

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 6712 -ip 6712

C:\Users\Admin\AppData\Local\Temp\Unicorn-10816.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10816.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63582.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63582.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5824.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5824.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 4236 -ip 4236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6712 -s 632

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 6192 -ip 6192

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 7016 -ip 7016

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 8392 -ip 8392

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 9136 -ip 9136

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 8384 -ip 8384

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 9084 -ip 9084

C:\Users\Admin\AppData\Local\Temp\Unicorn-36894.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36894.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38814.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38814.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56001.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56001.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23822.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23822.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28721.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28721.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28721.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28721.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28721.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28721.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13453.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13453.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13453.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13453.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13453.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13453.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29214.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29214.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29790.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29790.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 5004 -ip 5004

C:\Users\Admin\AppData\Local\Temp\Unicorn-45249.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45249.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44097.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44097.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44097.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44097.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31518.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31518.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31518.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31518.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63313.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63313.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63313.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63313.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31326.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31326.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14989.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14989.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14989.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14989.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14989.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14989.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14989.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14989.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14989.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14989.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14989.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14989.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14989.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14989.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14989.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14989.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46785.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46785.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 8416 -ip 8416

C:\Users\Admin\AppData\Local\Temp\Unicorn-31326.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31326.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13837.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13837.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 8176 -ip 8176

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 7112 -ip 7112

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4828 -ip 4828

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 692

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 6108 -ip 6108

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 116 -ip 116

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 9184 -ip 9184

C:\Users\Admin\AppData\Local\Temp\Unicorn-59953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59953.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 5052 -ip 5052

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 9196 -ip 9196

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5956 -ip 5956

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 632

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 9160 -ip 9160

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 9152 -ip 9152

C:\Users\Admin\AppData\Local\Temp\Unicorn-51998.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51998.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 7292 -ip 7292

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 7080 -ip 7080

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 7036 -ip 7036

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5928 -ip 5928

C:\Users\Admin\AppData\Local\Temp\Unicorn-3648.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3648.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 7960 -ip 7960

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 7444 -ip 7444

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 8064 -ip 8064

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5244 -ip 5244

C:\Users\Admin\AppData\Local\Temp\Unicorn-45745.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45745.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45745.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45745.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46814.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46814.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46814.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46814.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30478.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30478.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30478.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30478.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62273.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 9212 -ip 9212

C:\Users\Admin\AppData\Local\Temp\Unicorn-62273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48926.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48926.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 6584 -ip 6584

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 8716 -ip 8716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 6220 -ip 6220

C:\Users\Admin\AppData\Local\Temp\Unicorn-37982.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37982.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21646.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21646.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 9144 -ip 9144

C:\Users\Admin\AppData\Local\Temp\Unicorn-21646.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21646.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 8060 -ip 8060

C:\Users\Admin\AppData\Local\Temp\Unicorn-21646.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21646.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21646.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21646.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54977.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54977.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 3716 -ip 3716

C:\Users\Admin\AppData\Local\Temp\Unicorn-41246.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41246.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 9556 -ip 9556

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 6140 -ip 6140

C:\Users\Admin\AppData\Local\Temp\Unicorn-10519.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10519.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10519.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10519.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6220 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8060 -s 596

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9144 -s 608

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 9096 -ip 9096

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 708

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9556 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6140 -s 516

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9096 -s 712

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8208 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8372 -s 640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6212 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6568 -s 636

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 140.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exe

MD5 3b48876d3cdd4d2addc5210c1bb7ce83
SHA1 5caf558d004c366c5cc80012401df70a39a13f54
SHA256 17a676f8008adffaddb8e2142f1f442d744c7dc1f4930c639455b5689af99b4e
SHA512 dfa35cd30e7763f4a6a75c3bcc26400714ff29bfc30546edbc204417c7ba1d67049c5bca366da0c50d3667f4c9828febf5cabace98b10077c6cbb99d7df9e4a9

C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe

MD5 493059622750b7905aeeeb0ce4e7ca8a
SHA1 d04897dea4ab1dbabba9d6796b13a7140ec465bc
SHA256 c91934ad80e84021ac67f9f6e79a67dec13a09b30b0a76b690511540473e610f
SHA512 3a3d7f67296b40b868b5af465a12a52518d88ae3407e4b2b3a1f451226e96904ee7b6be9a4814831db324e2557ced4aab2ceaf76b52ae95fb04f35689f767777

C:\Users\Admin\AppData\Local\Temp\Unicorn-1638.exe

MD5 f186d5baa25d61054e39a931ca4cae51
SHA1 c10a3d6dc8ca95806ab60b44c4565afbad0c94bf
SHA256 8d11c1ad4beb76fbe89cc97349c7547f0f4fb1944523ab2c67c1aee4c1051b69
SHA512 3567be9c95e4e72f43394d56dfe255d9381d06e8e50f11e8defd1f7065572c8ca11f922a5f0595b63bcc8d8ce54719e86399801900beb1c2d47e2bc7e783887d

C:\Users\Admin\AppData\Local\Temp\Unicorn-38432.exe

MD5 bf1cd821a08a940cb54832d1b966f627
SHA1 ff558ae55cefc904e9f85964bccb8230ba11ac49
SHA256 17c30425ec8bce07bdccb7594ed8b9353ebbe5cb4f994f304920d7c84896bfe7
SHA512 f33351ce1a1a7003f2370afe4c01000b33001096ac6f05aa1744268ee4cd44e8ffc34479b94a149cc44053d7d40b1c5efd920e917baed5e08f4df75a9fc2f220

C:\Users\Admin\AppData\Local\Temp\Unicorn-57648.exe

MD5 376fd3868ba154eb82dda51290d1101e
SHA1 91269bfe31b632be2770b89bcdf2e15011f8f61b
SHA256 c4d9d53d48757332533183128417d285ca69182b04f1d8dbea6922053a0677ef
SHA512 e917f869b727bdf9b710fcd59e0ee3c6b765130026ea0ba5ea2f9234d487eac5dac7dc156d2064ca0ddad3302888d1fddd8fe3f5464d9cb8f34330589c093f08

C:\Users\Admin\AppData\Local\Temp\Unicorn-37782.exe

MD5 bf1003028ab0b8048a3683706dc40cf5
SHA1 ed5713c507f86163755167e1bc6c564737aa7f30
SHA256 76fb3b584204e90ec5c9549ef906db88fa81d645fe6c2a15fb6ca5c48aa02cba
SHA512 6f412a9a790b8d11597dedac7953ddf7565472589516d781dd985639512a21d6ef298b1a1fee9cba7916f2c6e8b7b04cca043a5c7aa53aa460ce18aa8081106b

C:\Users\Admin\AppData\Local\Temp\Unicorn-57555.exe

MD5 705b3d1cabfbe57bf50b896b04c58bf8
SHA1 fb03e6fd1aae6cd4af884e252248bfcedae6d6c4
SHA256 a34cba4071a654e43fb4e14a1110d582250340c9365f54f0ab6d33128f83e1f7
SHA512 a64a5acdb0690a36fb1f88553ca07dd835bd07e313bea8ec7d7e791c7bfc33ac50c5a33abd4509d266401ccdb167fe58412c46926e02fabce757d0c6a059e3b2

C:\Users\Admin\AppData\Local\Temp\Unicorn-22038.exe

MD5 43a5f734828f8e69bd973f6b04a455d9
SHA1 eb600fd55487a0373f35032804a31db2e68323c8
SHA256 5b1f8dbc289cfead57cd4bd337006ced8daa70f50aa531cb6f9d2c62995a8069
SHA512 1f90a74a4969f9bd14fc207e1ce4f67ca2b8bfc0d3a94185ddbfba251b20ebccc69b5e300edd779987f1034136e2997ee8bede95fe401c9e4fccaaaef73e2d96

C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe

MD5 ba2d2044a875eaf6b71019ecc889ca82
SHA1 999b99b864c69dd831ddb57eef16ef2c1b979f1d
SHA256 73bdb924b71ca4c864e30f3aefd98a04805fa9fdfdb3615cf69163801fa33491
SHA512 8e0d080ce56e0043573c7006d0252f7e6ef5a3f0b1b5b0a971b5987fe74d58d9795348fe49d75c6bad983fedbcd68d9db03f92168041dd991fd08adb6e857e5e

C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe

MD5 248ea429f116cfe0c08d582bb0ecb240
SHA1 dbffe7536ad2aaa475ff6c35e05e610a75053f60
SHA256 dae19c0a7248e3ec05478cc5b6ccbff24e2acc7f9eadce4e1ccf7386978792c3
SHA512 fd64db644df07fd0470bcb078fdea3a0f62ea12540ac67f3ce247c78d8716d69ebf2a3eec6a1894e93c8a73a2e0b52f6d7032a5dcaf94b8369b361cb41fd9095

C:\Users\Admin\AppData\Local\Temp\Unicorn-5391.exe

MD5 aa2d23ba3e86a5461bb5d09835ce590f
SHA1 2099c46f153bf51a32376b6fb5685b10eecdf913
SHA256 dabf1d3ac5e5f725b90b14e1d16fa84b1a36feba77f77a58ae8c7beb1d1c5d7d
SHA512 70fd73aa453e99ab86d6b4f4c2dccd9d13fcca9c30df36345916a154e8b98965e4e0a5277f16a06f3cc78dc53a01b0add4c7ac2bcef51bdda7e6c6fb6a0c863f

C:\Users\Admin\AppData\Local\Temp\Unicorn-21536.exe

MD5 dbcdf7f1b6cac9bee481e707524a7eb0
SHA1 0826114c6fea8743202bc8e1cca219e064fefff5
SHA256 f8201540a4e5581f531a1df13574a2e7e948b15dc757acc42b068d3a44ec066f
SHA512 072354e4c093384fa8d4eec2c2d4653e51c5cb4fa33407327268ae2ef7bb94d3d45f08dd55ca501cd9a5be9d3fbbb320c9f2e7114d8f4036fab01775a860d236

C:\Users\Admin\AppData\Local\Temp\Unicorn-52682.exe

MD5 0c6ea95495c852130fcf49d7a349cf0b
SHA1 37165e41cc315b1e55fb5b7066c7b3d6306c29ed
SHA256 cf0a861b55750e9bd5e49cb0f5326eca2a1f903c5d810910f282d502d2906262
SHA512 b51ee819808445a3b938b1c289f7cc407038e2fdba38c02e234a2ea6a73b8102c2f799aeebec089d1b0b567ced4d182dd3d06de2507d5dddd3bfc34f0b02b8a6

C:\Users\Admin\AppData\Local\Temp\Unicorn-6242.exe

MD5 4f9e2620ca5e2a8a67ec3b44ce166755
SHA1 4108e5c34b4b86474353393cc9c66e2949eef3c2
SHA256 286785a816eb32039638f78efa65600fff32ba45fdfd39e1f758b41ad1832fad
SHA512 52996968ffb4c5fc19a5f90e20ea3ac7f7d57a356b951d2a7987a5a56dab7ce5c0374d07c4ea30bc760cf156012c177a7bdef3a36e69f571a238f4ebf098fb7e

C:\Users\Admin\AppData\Local\Temp\Unicorn-38723.exe

MD5 02270f6e9965ca628f89f7346399942a
SHA1 c7f02d8ee34f9ad1c7cff48d5f5046f605a1c7e8
SHA256 4ca72578ff2e01be53746950f6efa3ddfc6691854439164dacc8d349d36f3529
SHA512 3558532c6ac4870ea6981a3c79c56373242a3d77de42598c748e442804dfcd95204ac6ec59837e6aa4a87a99650f016dcaa18531ef371ac8dbcd2fe6dcfbbbce

C:\Users\Admin\AppData\Local\Temp\Unicorn-18857.exe

MD5 0e13481c9aa8ef2076fef7cef4b0ed30
SHA1 af0f342712335e7d3f629dd536e0312b391e22be
SHA256 44688bd19f890977825afffd1cd10d67091e40de6a60e73515f5fd720b0f42a8
SHA512 5e003a2e4c9f9633485c9cd5a96d6b97cf2832343efec630967b4def78125b5acc2a99fc62307bc495484eb4477fb2a6c19d2abf59511799d2d34bcdec2c91fd

C:\Users\Admin\AppData\Local\Temp\Unicorn-35385.exe

MD5 fc56b2d9bf0d0d441028c9669203b8e1
SHA1 be29611c0521b5924095a7ad3af8ee0163060c36
SHA256 71887fdbcdcb56656a5f016efcb00fd1e81faf320434556082c2236976897096
SHA512 b76bf6d0a6b90a7e8339a3bd5ff93be920b03d83c2648a17964cc0491ce9badd1756df0840de49c72503549619ef4a7cb8e13f644f317c9ebe9826c3a0ed0159

C:\Users\Admin\AppData\Local\Temp\Unicorn-25008.exe

MD5 50d970965e0e4ef21b250062a817838f
SHA1 535e33a6d7a09cbed3d85ae55325d857886df973
SHA256 980abb5297fdfd50d663bb34b3388a6df0800e971723e8ced3e685f0c450c6e4
SHA512 85b8807662f803824fcc120651e6a9a7de85894800f1562c9581940c2001cab92d9813186a35421bd52a80dd9de13528bb73f858aaee2e9ceaf9ae90b108547d

C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe

MD5 e206898e5247a64f6b2838b09ec94e11
SHA1 561364006a116f5813ef1c1910f5a81eadfdb99c
SHA256 d2e995f885d81e28a9b3f001bf85f06bc0118f391dfc18a4508bb5a372b44f92
SHA512 9cd57d9756a8819a78687255cb52edd49e9bba000f652df699927ea676de2bbae44d57704f81b0442bd9d41795b4cb802ddfdb46885992b23752625e7e28cae5

C:\Users\Admin\AppData\Local\Temp\Unicorn-4566.exe

MD5 1b799820d3ea4116b810887249a1ff55
SHA1 c9ef7c74da4d30bc72ad5672c03287ce3ba366e3
SHA256 ead462a9c10cb87487c1355fa8384a5d639429633ebdba266b5efeae9420355a
SHA512 d38ad46524ec463aca8fe2e2a0fc982b1a8e751bd561af12791a71d747f8824dae9378cd64ad98273f6fbc137d228fc74a092c7a1423dabf086f9af9d82324d5

C:\Users\Admin\AppData\Local\Temp\Unicorn-24432.exe

MD5 f5a4a7525718217ea8f8e5b48589a4e7
SHA1 df7cf455e360139ffda2886f64f910b7dc2a777b
SHA256 d56f4f7e111ece602fc13c8a3e8bed0b298f350a5c35c655244552f4d00ae7da
SHA512 0f010a808a01b4d2334cefc0ed7497b9e6ab8c512b28d15c03c370c568f57668ee5177a2972bccd74845efbf8830c83a61cf326c6067b92ad7a824f79225b249

C:\Users\Admin\AppData\Local\Temp\Unicorn-56035.exe

MD5 b6ebcaeb6973763647459596652dfefa
SHA1 9da38841d310be4369286ff51703f75a5866ffba
SHA256 8e6982c5fa5c4177e62dd21174d95a9e63376d1d3c1c46936f7ac7be064c8a2e
SHA512 1be37c49364af4033d947740bf1835b744ad26147ea893cd78c3bf0bb3253093a07cccdb1bd82b5a584efaee929fceca2c253f9661e079f2415efecd419dc990

C:\Users\Admin\AppData\Local\Temp\Unicorn-4182.exe

MD5 0eda6b6acf1036f100bbb35ca4dc9ec0
SHA1 acc36da5c89202f4e9371b35bb7b3ada3e24ecd5
SHA256 670b2a1d23b28177c4f53b72363e584fdd9c7bb86e2e28ea931441f14ac4657f
SHA512 f96b8b3b4eb59ebba3a9cd571d6747cc7aa9e663f8417dcad762af74d5b1d2704538134a4e9d6906b7bf2d46005a7ca5586399bc945be99631e45f350122dae3

C:\Users\Admin\AppData\Local\Temp\Unicorn-57571.exe

MD5 df73e778ae26f90945f438ddbe71b981
SHA1 1088b7fce741d7ffddb9e741ddd96fcd2ae7b9b7
SHA256 6308f69165a61ad04d48508dc02f6ba62dadd6d24e83246cd4f4e475df1476f2
SHA512 3a9dc72e670244df4d4cfd8337b3f152761d3009609deeaa3f9396d30aa7a533be674ddbcc159c50238f07bcd2c37214a62751538b2406cc8215108715a28bdd

C:\Users\Admin\AppData\Local\Temp\Unicorn-38774.exe

MD5 2e33f108469a73941603e32b840ba1e6
SHA1 927f6eeeb0e0659c7559b365d69fb5817656842e
SHA256 73c301acce3fbc3fc82f6382516a2f657f825399920d8be4536608e66557b150
SHA512 0b6ac579605ea784a9bf3decfc88920f7f08d1cc63257155d643012ac83835e4c806fe57b0f616f4bea69c33f30abb576fceafb46e13c8501e7af9df9709b2fc

C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe

MD5 0790b1f220789d1959e5185109d4d657
SHA1 57798a9ff2fc205367701e4b9fd2e597d7a751a1
SHA256 5eb5eeb9f56f62be13da0c96f368c5d229bcf91b71916ef27dd42eef357302a1
SHA512 9f4fd14e5e1e3c993006bfc88fd98e5b920b3fea629a897c6f26c22c099cd2c30cbbb02d91c340816ce7b61c3bc11d3677ba57a0e1a11fea11b77fe83d0ec607

C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe

MD5 6b3ca3700d4dc4e62835311a4ada8dc0
SHA1 0d09d2dfb3b2792f51eb520f2648d8100a2d0ecc
SHA256 4b0d169af6d310fb300c509e2022139db4cbbbcde1a12f260078efefa13035c2
SHA512 5258e7a4688e89bdb55d3fb609261b74c48330c80b409acfbd34c721ed503bef05ead8c6f5a9c29115afe0481980da587effee46cc1e5a1037941acef7cf5fc4

C:\Users\Admin\AppData\Local\Temp\Unicorn-13287.exe

MD5 54b2cb86b843537fe482c5e384f100e7
SHA1 dca70a97b93309fbde1a571ca68bc20ce9c8e9d4
SHA256 583941d04e941052823920fcf4984ac37a3b6c102f3aed3b26f2ebd2e5772454
SHA512 32f8f0322cc96c745af4098b1b40083bd5982bc597a7a1e0379b6607131380a8ce4c74ce1ae983dcbc89a297ee6ab536796e1efbdf6a9784c18a649d7d52bf3c

C:\Users\Admin\AppData\Local\Temp\Unicorn-65249.exe

MD5 de4b06abd45a26b9de7e693624891407
SHA1 f61c6228f42f92994661c5f4ed94914f303af463
SHA256 b08dc6547352ac0251a0e342886bd3080da649957a161cf867f7738498a67af5
SHA512 c3c5ad4c576c5fbde5eba7a919ab8e18ae7ae6d2a95c8e58a832525984ce951ebc05e5624b269760172ec80eccd27e4cf313d9ebab7ced8f38458b0102c294b1

C:\Users\Admin\AppData\Local\Temp\Unicorn-45877.exe

MD5 d25d40a007374caf2a455a5e894135ac
SHA1 e3b53aa06fbb55d9d52682a21906e015ba0a07da
SHA256 3e757949ce4c9ca956b61ea36d368d80eb33aae2156bc37bc41098afd9c00f70
SHA512 f028f9ef446f19a16d35d2a587e0d6937134030ddd61f6590f9048f66712a8aca6dea446bb7df114a18494ff1b5420792e10de41090ae43db5133bb53e347a00

C:\Users\Admin\AppData\Local\Temp\Unicorn-1824.exe

MD5 c3377ffd7355935c7652c1896638b6e9
SHA1 b179e4d5697b1684be93bea5e6b913a14e61b896
SHA256 1078ce252484a1dd7d80d67bd55c680b74aedd914a895705c40b38449607182b
SHA512 5d6af3ec1e257aca796680951747a860792c1d7cd22cece6f23be1f9b311625d98a48d625376a8b6d37b5adf1b71afb53dbd4adde67c32c3b45725b0b03c5dc0

C:\Users\Admin\AppData\Local\Temp\Unicorn-28769.exe

MD5 75f81494c4ded4ece836014f99e27582
SHA1 c922753f17f8295755932d2f117ac35c1b88d893
SHA256 05abaa98eb9f0f0797a86a375fb706cd7015d4f3a4c382ff28786214679e236e
SHA512 11f174d85c22c293c275dbba6db61aa7eea3ddbe4497ee6894357d3021a76c6010def52c059204737e07f032654296b34efe39a6f471eace74ced5871224c24f

C:\Users\Admin\AppData\Local\Temp\Unicorn-20174.exe

MD5 ad87bfcf836d297d8e40b1ba4f994093
SHA1 6a64b67cb3bf2eb37c5a9100004dc14d5f2bbfb0
SHA256 1090761d5a62ac0ec8fbebcb8cdeadd79dec2d6aabf37764cd6adf89730e4d4d
SHA512 d76301011c1825952801ed177aa5f7d5d081f71fa7e26cf0170788346a2ece24d1e45f6a3cf769f23264c8a3c21a933e5f93d8d980d395a3b356dc2af5c5f1b6

C:\Users\Admin\AppData\Local\Temp\Unicorn-11872.exe

MD5 eaee329b8f4af5a6f12131d6eae54679
SHA1 cf143fc2638568d1f4575aacf4024b1f4a92bd30
SHA256 a9baa06307ac1d6528353c06ff0ca1e2425bda04b8aaebcfd4893ac5f9a6cfb5
SHA512 1dd0e0259f47a4cebc58ccba65f648f264e583f2971089e6b62468db3cf9c7c51e763e742f08570d3f65aca1e672114d5fe9cadb610ffdb74cce056dbea6e8f5

C:\Users\Admin\AppData\Local\Temp\Unicorn-23822.exe

MD5 13900031eab43867297349bd6f804e25
SHA1 dd6455eed3e581533b63740c90fcd4351a7d8c46
SHA256 4ff3fc91596072b18345dc9c003c2b5e18f4f756ca3f558e1beeac99407f56c0
SHA512 9e462f1aa72c6d10dd041e6055c404c2e82d20d070874a528b4bf2d7c2081b7411a74f442332388ca98b237c3095e156f228598b57af2d5d8c2700be10445d62

C:\Users\Admin\AppData\Local\Temp\Unicorn-22366.exe

MD5 c63253d6b59e1546d9ec3667b3ee414c
SHA1 57cd91ebae38cafcd58f55e6ba819e69a9e28479
SHA256 11890801364b4fd59a4b2b25ee48ba57a89172db20071e27da2722f8ddeb6a10
SHA512 7db73230f42bf53d3a932c1d08b31b0de2b4cf2a5391d1ec2def935e1b2e49a13c06598c83e8994be5127143260f607c4694e7b012e045c8e3d18cd31b8c6ac1