Malware Analysis Report

2025-08-05 16:06

Sample ID 240526-ed3s8adh2y
Target ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826
SHA256 ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826
Tags
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826

Threat Level: Shows suspicious behavior

The file ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826 was found to be: Shows suspicious behavior.

Malicious Activity Summary


Executes dropped EXE

Loads dropped DLL

Unsigned PE

Program crash

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-05-26 03:50

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-26 03:50

Reported

2024-05-26 03:52

Platform

win7-20240221-en

Max time kernel

150s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51461.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63428.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2281.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-28883.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12354.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58026.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18162.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47305.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53522.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33656.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35541.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19890.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36418.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48348.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32721.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63940.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44952.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63748.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47220.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27354.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62715.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62715.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33380.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14775.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34641.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24496.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36918.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-40448.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4246.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55331.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6322.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24003.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23318.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7858.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-11065.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42668.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46198.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14594.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13717.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10681.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10681.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30547.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36463.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48201.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53458.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37314.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3873.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17064.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20594.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33400.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53266.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16488.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3489.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37973.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51461.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51461.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63428.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63428.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51461.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51461.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63428.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63428.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-28883.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-28883.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2281.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2281.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58026.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58026.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12354.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12354.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-51461.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63428.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-28883.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-2281.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-58026.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12354.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-47305.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18162.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33656.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35541.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53522.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19890.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-36418.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48348.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32721.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63940.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44952.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-62715.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27354.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63748.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31953.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14775.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-47220.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34641.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33380.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-62715.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24496.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24003.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-36918.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-23318.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48201.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-46198.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-13717.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-11065.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37973.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33400.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35704.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53458.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-3873.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-16488.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35979.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42668.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14594.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20594.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38248.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17806.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17064.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54106.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54392.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1086.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17614.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55331.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37480.exe

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51461.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63428.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-28883.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2281.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12354.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58026.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47305.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18162.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33656.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53522.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35541.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19890.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36418.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48348.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32721.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63940.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44952.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63748.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27354.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62715.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47220.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62715.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14775.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33380.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34641.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24496.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36918.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-40448.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4246.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55331.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6322.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24003.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23318.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7858.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-11065.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42668.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14594.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46198.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10681.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13717.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10681.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30547.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36463.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48201.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53458.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37314.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3873.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17064.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20594.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33400.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53266.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16488.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3489.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2128 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe
PID 2128 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe
PID 2128 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe
PID 2128 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe
PID 996 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-51461.exe
PID 996 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-51461.exe
PID 996 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-51461.exe
PID 996 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-51461.exe
PID 2128 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe
PID 2128 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe
PID 2128 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe
PID 2128 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe
PID 2128 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826.exe C:\Windows\SysWOW64\WerFault.exe
PID 2128 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826.exe C:\Windows\SysWOW64\WerFault.exe
PID 2128 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826.exe C:\Windows\SysWOW64\WerFault.exe
PID 2128 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826.exe C:\Windows\SysWOW64\WerFault.exe
PID 2532 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51461.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63428.exe
PID 2532 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51461.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63428.exe
PID 2532 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51461.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63428.exe
PID 2532 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51461.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63428.exe
PID 996 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe
PID 996 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe
PID 996 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe
PID 996 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe
PID 2584 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe
PID 2584 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe
PID 2584 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe
PID 2584 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe
PID 996 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe C:\Windows\SysWOW64\WerFault.exe
PID 996 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe C:\Windows\SysWOW64\WerFault.exe
PID 996 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe C:\Windows\SysWOW64\WerFault.exe
PID 996 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe C:\Windows\SysWOW64\WerFault.exe
PID 2716 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63428.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe
PID 2716 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63428.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe
PID 2716 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63428.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe
PID 2716 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63428.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe
PID 2532 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51461.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-2281.exe
PID 2532 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51461.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-2281.exe
PID 2532 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51461.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-2281.exe
PID 2532 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51461.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-2281.exe
PID 2440 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-28883.exe
PID 2440 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-28883.exe
PID 2440 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-28883.exe
PID 2440 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-28883.exe
PID 2732 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12354.exe
PID 2732 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12354.exe
PID 2732 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12354.exe
PID 2732 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12354.exe
PID 2584 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-58026.exe
PID 2584 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-58026.exe
PID 2584 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-58026.exe
PID 2584 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-58026.exe
PID 2532 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51461.exe C:\Windows\SysWOW64\WerFault.exe
PID 2532 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51461.exe C:\Windows\SysWOW64\WerFault.exe
PID 2532 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51461.exe C:\Windows\SysWOW64\WerFault.exe
PID 2532 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51461.exe C:\Windows\SysWOW64\WerFault.exe
PID 2584 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe C:\Windows\SysWOW64\WerFault.exe
PID 2584 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe C:\Windows\SysWOW64\WerFault.exe
PID 2584 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe C:\Windows\SysWOW64\WerFault.exe
PID 2584 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe C:\Windows\SysWOW64\WerFault.exe
PID 2708 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18162.exe
PID 2708 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18162.exe
PID 2708 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18162.exe
PID 2708 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18162.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826.exe

"C:\Users\Admin\AppData\Local\Temp\ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826.exe"

C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51461.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51461.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-63428.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63428.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 996 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2281.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2281.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28883.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28883.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12354.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12354.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58026.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58026.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-18162.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18162.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47305.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47305.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53522.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53522.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33656.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33656.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35541.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35541.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19890.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19890.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36418.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36418.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48348.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48348.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-32721.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32721.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63940.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63940.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44952.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44952.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63748.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63748.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27354.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27354.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47220.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47220.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62715.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62715.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62715.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62715.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33380.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33380.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34641.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34641.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14775.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14775.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-24496.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24496.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-36918.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36918.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-40448.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40448.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4246.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4246.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55331.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55331.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6322.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6322.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54106.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54106.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23318.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23318.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7858.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7858.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11065.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11065.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42668.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42668.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46198.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46198.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13717.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13717.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14594.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14594.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10681.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10681.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10681.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10681.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30547.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30547.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-36463.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36463.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-48201.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48201.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1144 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-53458.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53458.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37314.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37314.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3873.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3873.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17064.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17064.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20594.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20594.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33400.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33400.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53266.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53266.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16488.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16488.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3489.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3489.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37973.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37973.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35704.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35704.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37013.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37013.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35979.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35979.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54776.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54776.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38248.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38248.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17806.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17806.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54392.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54392.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5684.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5684.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1086.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1086.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1086.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1086.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20952.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20952.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34142.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34142.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17614.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17614.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17614.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17614.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37480.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37480.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11351.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56146.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56146.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10474.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10474.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-11517.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11517.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1876 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-42279.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42279.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-61761.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61761.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 812 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-65508.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65508.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62171.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62171.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2659.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2659.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1782.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1782.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15466.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15466.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17543.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17543.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47755.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47755.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33303.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33303.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-13904.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13904.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36650.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36650.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32544.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32544.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3593.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3593.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52026.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52026.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31475.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31475.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1564.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1564.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1564.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1564.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17901.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17901.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37635.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37635.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38704.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38704.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42234.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42234.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37443.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37443.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57309.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57309.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36867.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36867.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56733.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56733.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-4003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40589.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40589.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53396.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53396.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7724.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7724.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20147.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20147.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40013.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40013.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59229.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59229.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7615.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7615.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20806.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20806.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40672.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40672.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59696.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59696.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41907.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41907.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41331.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41331.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55399.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55399.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-27299.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27299.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59971.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59971.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-7241.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7241.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39036.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39036.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10194.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10194.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 288 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-6857.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6857.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8933.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8933.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-47369.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47369.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-47945.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47945.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62371.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62371.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-4961.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4961.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-39554.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39554.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-23218.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23218.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-23493.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23493.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-61147.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61147.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1312 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42324.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42324.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61806.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61806.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-61230.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61230.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61230.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61230.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45086.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45086.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-45086.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45086.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60846.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60846.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 880 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-58360.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58360.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-12304.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12304.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12304.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12304.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14992.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14992.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3171.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3171.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-51220.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51220.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17479.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17479.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-21044.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21044.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19783.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19783.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52647.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52647.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37162.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37162.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36586.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36586.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 420 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 296 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 896 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-26493.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26493.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-26960.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26960.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26576.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26576.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43104.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43104.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 672 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-43955.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43955.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43955.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43955.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10322.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10322.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11749.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11749.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61827.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61827.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11173.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11173.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26633.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26633.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50006.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50006.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-997.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-997.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15689.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15689.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49788.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49788.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-779.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-779.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-33753.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33753.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64972.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64972.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34604.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34604.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18268.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18268.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-670.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-670.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2974.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2974.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-39477.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39477.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 716 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-52967.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52967.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-22023.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22023.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-55354.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55354.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-22874.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22874.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 324 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-39485.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39485.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22573.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22573.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-10943.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10943.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10943.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10943.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29392.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29392.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45920.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45920.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12178.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12178.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44467.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44467.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29859.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29859.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30051.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30051.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-61462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62339.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62339.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29283.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29283.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61955.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61955.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11493.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11493.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61571.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61571.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3616 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-52438.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52438.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-139.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-139.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-35500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35500.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-2443.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2443.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-20316.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20316.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18863.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18863.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-2142.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2142.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50274.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50274.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-33589.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33589.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-54825.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54825.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-11815.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11815.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-16715.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16715.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47934.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47934.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16331.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16331.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32558.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32558.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33793.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33793.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55687.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55687.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22055.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22055.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7830.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7830.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6761.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6761.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22714.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22714.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-39709.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39709.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-55469.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55469.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25293.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25293.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-23072.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23072.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-61904.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61904.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11250.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11250.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3076 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-36793.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36793.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-56941.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56941.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7849.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7849.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59162.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59162.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-22899.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22899.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58970.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58970.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-61274.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61274.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8674.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8674.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56915.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56915.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-46931.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46931.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17056.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17056.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-911.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-911.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29993.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29993.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3752 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-45945.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45945.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49152.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49152.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-16262.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16262.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63817.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63817.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31337.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31337.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48166.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48166.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17990.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17990.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50086.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50086.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33942.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33942.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36895.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36895.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19407.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19407.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-57564.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57564.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57180.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57180.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7787.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7787.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56412.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56412.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39365.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39365.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58249.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58249.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58379.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58379.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51249.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51249.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2925.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2925.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35655.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35847.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35847.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51799.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51799.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2598.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2598.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51223.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51223.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26330.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26330.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5260 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-25235.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25235.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11337.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11337.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5336 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-43491.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43491.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5256 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5408 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5448 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5756 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5584 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5612 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-15897.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15897.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5748 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-51366.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51366.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5952 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5788 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5828 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5900 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6056 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6000 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-32399.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32399.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6116 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6048 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5328 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5912 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-38860.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38860.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5688 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5968 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6068 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5368 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6760 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5536 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5740 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5872 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6072 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-30552.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30552.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5376 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5800 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6628 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6232 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6588 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6280 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6348 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6312 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6688 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6656 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6396 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6436 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6540 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6840 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6952 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6868 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7024 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7076 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6668 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-45117.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45117.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61261.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61261.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28755.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28755.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48080.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48080.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64224.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64224.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38096.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38096.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51718.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51718.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20774.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20774.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3861.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3861.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6357.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6357.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55366.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55366.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21023.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21023.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21900.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21900.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21900.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21900.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43820.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43820.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43820.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43820.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10571.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10571.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57909.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57909.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39745.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39745.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33099.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33099.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50177.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50177.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13207.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13207.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13207.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13207.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13892.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13892.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13892.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13892.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33758.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33758.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8156 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-29555.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29555.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8104 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7928 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7480 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7660 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-6638.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6638.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7528 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7556 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7788 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7736 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7844 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8052 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7932 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8136 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7640 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8080 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7592 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7732 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7964 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-35832.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35832.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7628 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7988 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8164 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8000 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7796 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7576 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-26756.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26756.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7852 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-13730.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13730.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65235.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65235.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7812 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-45189.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45189.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12324.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12324.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12516.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12516.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29154.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29154.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29154.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29154.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12241.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12241.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8048 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7572 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7752 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7344 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7940 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7672 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24415.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24415.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11861.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11861.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23896.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23896.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19431.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19431.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7318.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7318.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26177.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26177.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60048.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60048.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8332 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-18300.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18300.exe

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe

MD5 407b1f89b10f7009a58a541a77cf07d5
SHA1 a3fb64ef6def32ec9e02b8f263ee4af88e322623
SHA256 d970e3fda4d980644f05dfe66caa33b14bf456931b8012bcdfbefdf17fdfe76c
SHA512 ac8fa6af6d84cb8579b6738556450143aa7726307d57803dd403ed9687f0b1a145e60273fff2d2a96aeec683c0617d5a1edf74aec7449989f00862b83335a303

\Users\Admin\AppData\Local\Temp\Unicorn-51461.exe

MD5 a0e9f03d8eaaed49672162ad9f07902a
SHA1 22b476fa1bbb182a93b8fc6d858440fd625f4235
SHA256 42c93035dec2fc39f7409648ad7574c5fc21af32b0fd5d707c3a1a71b96b1171
SHA512 eef1272218bf19f7c346987f5289fb5947ceab82fae4de32bff17b57324480f0c148ba6b95d915b5adcfe10c3d25f240c24df8b41aef010f955dcbf0d040677e

\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe

MD5 fc4a335d8c4029c1fabe1c5f26ed785b
SHA1 fc468d64c6ef8a61f095529fad8f5cd55657a0c4
SHA256 cc24ea9d8cce5251540a5c1ecde3074bf15d47cfbef1d63db4457361abebba8a
SHA512 975371ee24a5cefb83675fb24d07b76638a2e550bbb573b0ca912755556713971274776244ab1496fc639bce08727ff7bf46acc0a97aa774f04f14e9604f7fd1

\Users\Admin\AppData\Local\Temp\Unicorn-63428.exe

MD5 9a5dcc256c3dcf7f5ca784caf37dd4ed
SHA1 ac4e01ca2c481f77e6de4b7000968d624a0887b3
SHA256 91e183241d1ad77c89c386fb77637ca40a23eed3ff0e7b3607ed7e6c5490f5a2
SHA512 28e9f453951ee24b9aa2bb05ea0b337244e0c08eb83ac6625dd1f6a845f425bd709428c98fc4c1dacb81dfb3693fb791a504fe8a3de01fc05fbc3f17a6d60636

C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe

MD5 b577ec3998e30480b6c87e706a807353
SHA1 c2b4e43974448dbd7252bb4f075778e84a10c1fc
SHA256 d7aa504b1ddb86c8e04ae4eae068062f8cbd53fb29ba41595932644a44622cd6
SHA512 4068a0a247e6f5b214dbf737d4411f7d284b69c0f6c7d32b7f21a61578b391c1d71bc72f30263cb8d707b66855778c803215942e33a83d5d691c69793069e238

C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe

MD5 1952f074a417d4b314591aff6d174bf4
SHA1 d5e58aa50411913c68f0110d1047e352622247b1
SHA256 85c27b0dd56382fbcce1c095fc3dcd5c3650678f5ab134a88aee81421e113d05
SHA512 bda19c16b67be3b8ac8075f85d0b9a6b56e8b77ec3a25d8f9d0b460abb6dbeba921abd0747fddd9cc3d9b75d7ec686d5ead668bec5588e042a8e5eabda7d9e2f

\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe

MD5 b9daca1e8ed0b5624d1deb417618dd6d
SHA1 d080b51cdd91950f3aca38778c6a55f2b885d34f
SHA256 2e201ba91068ac630a724de71e26b2261b84fb75b7dbf6f5a2a2c1e75ecf28e3
SHA512 3bbe7866445cd879bfb0f1273f2036d11f62f962a04de7ee28dc9e2237ca3d6fc419d8e773b249391489e60d59c046adf573c19fe299cfd94e60b0d21f28951e

\Users\Admin\AppData\Local\Temp\Unicorn-2281.exe

MD5 f44a95ec424583d2c432c67d1ccd4613
SHA1 6090175a8d89443b8df96a6b27e227e533fcbcba
SHA256 44fed093f2f5003e29cfbc8f97ccd2cb380edc465f271c59f89e334cbec33bab
SHA512 97cd5bb3802bc0b8be75fd32031cdaae6a924757d5cceb844cf0ac2ea906bd0817a80f257e5543a91be2d7166f03369e415bdef9239cfa373fb5aadd8b21685b

C:\Users\Admin\AppData\Local\Temp\Unicorn-28883.exe

MD5 36b1e39c4279ee2916d4f54f272a566f
SHA1 c50d87bc1124e06dbe6a3fbe39779f05446fdd6f
SHA256 38dc6c4fd9457478e6088bf0df48b2bc3dc65e885ea36f2fda00473faaf6b78a
SHA512 35c4fc01ed1a7076cc139b9e1529b5b09622ca4966e0978e0fb7a963e22e8efded5d30fdfa1124e6d05a68790f16963349e8ebbe3a746a9d1c8a8f5b5903d36e

C:\Users\Admin\AppData\Local\Temp\Unicorn-12354.exe

MD5 dcf6832f87626c8938a6c1f574489a60
SHA1 0cd774b743d04483155a0cf01d17935af258f02d
SHA256 689f2fa2985524c3d506b5d54e8318912fe3e8a550040be7937bbf218d1ac817
SHA512 8a2c9d786bc165948cd876e9a8cb975b19d8e414a293e445fcc820e1e31cba6faea74242fba73d0c3440bf65783a3d9edd97561d8299e2b225de23d470a7353a

\Users\Admin\AppData\Local\Temp\Unicorn-58026.exe

MD5 e8b3d17e72f66f990aae5e02eaa7efb3
SHA1 a4fc810c76de204a5e068fb77cb2e3983f3b748d
SHA256 f628483800784f933ef346f6d5fa8c9a1667b27f30cc0eccf4a0b570a0a5d0c8
SHA512 13eb3cc59b67862ac6a56905447fa8eb98b48f331dc13096ef7cc803bee58d24f64382e9d2fd4dcea1d69e450db26e0ad3cd1435a7bc1728b4d7e0b11b7be9ca

\Users\Admin\AppData\Local\Temp\Unicorn-18162.exe

MD5 d158f2ef7f7eba2586762905a1673967
SHA1 4182ebda05c915095d19c651a85ee4996b06beb7
SHA256 fb74b357422f36bbf9230cc682e197ffab38404f88aa282ff3dd8e362918da37
SHA512 c1dc7ef8bda2f1b4f71767f420d1f829d8bd7a3b4511c9c6b86fbf1c49b5e2adc2ad575672dd2426d21955d3b928a5002aebb072e53003da5348d1468efb6bb9

\Users\Admin\AppData\Local\Temp\Unicorn-47305.exe

MD5 d43dd3c6ccc463f41f2dbb2a424b042b
SHA1 4fafc3ff35205e0a87a64dabe5328d285c5bd277
SHA256 3040cae42c95ef4c54d5efa41f703e2f5cd4a93ef984110f70b5ab07d6f3faf3
SHA512 5b8b3d0d0f7a04b8387770fc1bdc17f69ecc7e52a0f642b1f658f31b383eb8422e9040d104f59a8c70b67c712e059243729be18cc631ed690eb70bbdb6babdd5

\Users\Admin\AppData\Local\Temp\Unicorn-53522.exe

MD5 31191a3cdd88ff8fcdfb1b92290f9053
SHA1 21e7b30bead706563d501d50f1c2a5ae5b78d05a
SHA256 7f6e6c10c5e34878562a3f0f58cc275772fd265d8f755bb697d1b70bfdcc1983
SHA512 78297c741ae4ba9b09797b0156d0381bbe2e02b48a4f6b8b31bdd9da8478c502a85b5a2bfae524827daf6a2921fba67e90d4ddeba1b5a268b814489394903b64

C:\Users\Admin\AppData\Local\Temp\Unicorn-6322.exe

MD5 b08d9eb63aac796f73c51ecb835a34aa
SHA1 6123c80341a4c5546ce1c62330aee0c82398c549
SHA256 b6dcd008dd18cceda3c6ed48d644e32f9acb39363a6777dbb5521a5bc31974d3
SHA512 8249f6194adcf396777a16202fd354fc63986451bbf29dc6dc47931b1e558110895e733999fe10eb353bc9563cdf7439aa20bffab8e21d7b2fc3f11aedfb2ad9

C:\Users\Admin\AppData\Local\Temp\Unicorn-23218.exe

MD5 011c842b1f7e16cf8ca02ba1cc3aa69e
SHA1 ebeff2c2c81c4dcf5d83415b54b07d50cd4b065b
SHA256 b3d990e442c2facf48cb94ffdc569b5a6a9608744ecd53bc731ab4c5c697e330
SHA512 cd89b84d63d66505f397d386c56810efc9eaffe649463125e9d8f2ff6ef0972582ab9c4e28427c3271d7c0eac994fcdce0f6dd9c088f95970500f4681de704bd

C:\Users\Admin\AppData\Local\Temp\Unicorn-22714.exe

MD5 8b6361f8c88bc2db7ee4eb77fb5e5cf1
SHA1 ad72e23914daa4a98bf35268ee3de706028bbbe6
SHA256 26d5264a0450b9355f63f9235135f46ea0aac12db4fc70d0b419e2446efebada
SHA512 fec687bdb210c8f8072ccf10aa150733c8e6975e3ce2815b88f4e739b158d7ce11a57e4c673b7349dc1e2f3119a56d9f1b34bf21d323925d3fadd00fa4f7cc3e

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-26 03:50

Reported

2024-05-26 03:52

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20377.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65353.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62208.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15711.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38473.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55193.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1394.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18009.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63872.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57417.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-41081.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54272.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6872.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19679.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22825.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35439.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-41097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60121.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7391.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-43209.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23535.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26489.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59545.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9768.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9768.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22767.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14776.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27391.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19785.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36121.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36121.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2223.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51616.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38233.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21705.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54761.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21321.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4984.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50848.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50848.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17599.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50848.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17577.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14047.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49865.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49289.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13087.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23545.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9512.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55184.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21935.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44105.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-43529.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-43529.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59673.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-65353.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20377.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-62208.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15711.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38473.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55193.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1394.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18009.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57417.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63872.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-41081.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6872.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19679.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22825.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-41097.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7391.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-23535.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22767.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9768.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9768.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27391.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-60121.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14047.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-49865.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-49289.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-13087.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29497.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22601.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-8184.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27209.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26057.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-43487.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25999.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7624.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25801.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-5167.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35993.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-232.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33839.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24153.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27737.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-45417.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53808.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17862.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-52169.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-2319.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-41135.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20486.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63350.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-61622.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34518.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-30294.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14725.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-40412.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-16262.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20486.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14533.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63734.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-47206.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63350.exe

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20377.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65353.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62208.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15711.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38473.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55193.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1394.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18009.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63872.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57417.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-41081.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54272.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6872.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19679.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22825.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35439.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-41097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7391.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60121.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-43209.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23535.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9768.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59545.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26489.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9768.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22767.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14776.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27391.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19785.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36121.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36121.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2223.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51616.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54761.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21705.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38233.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50848.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21321.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4984.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50848.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17599.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50848.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17577.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14047.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49865.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49289.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13087.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23545.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9512.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55184.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21935.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44105.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-43529.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1372 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20377.exe
PID 1372 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20377.exe
PID 1372 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20377.exe
PID 1320 wrote to memory of 3100 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20377.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-65353.exe
PID 1320 wrote to memory of 3100 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20377.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-65353.exe
PID 1320 wrote to memory of 3100 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20377.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-65353.exe
PID 1372 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-62208.exe
PID 1372 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-62208.exe
PID 1372 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-62208.exe
PID 1320 wrote to memory of 3732 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20377.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15711.exe
PID 1320 wrote to memory of 3732 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20377.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15711.exe
PID 1320 wrote to memory of 3732 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20377.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15711.exe
PID 3504 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62208.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe
PID 3504 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62208.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe
PID 3504 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62208.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe
PID 4752 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38473.exe
PID 4752 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38473.exe
PID 4752 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38473.exe
PID 3732 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15711.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55193.exe
PID 3732 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15711.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55193.exe
PID 3732 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15711.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55193.exe
PID 3504 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62208.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1394.exe
PID 3504 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62208.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1394.exe
PID 3504 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62208.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1394.exe
PID 3348 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38473.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18009.exe
PID 3348 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38473.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18009.exe
PID 3348 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38473.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18009.exe
PID 4752 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63872.exe
PID 4752 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63872.exe
PID 4752 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63872.exe
PID 5016 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55193.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57417.exe
PID 5016 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55193.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57417.exe
PID 5016 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55193.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57417.exe
PID 2216 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1394.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-41081.exe
PID 2216 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1394.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-41081.exe
PID 2216 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1394.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-41081.exe
PID 3732 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15711.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54272.exe
PID 3732 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15711.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54272.exe
PID 3732 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15711.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54272.exe
PID 4768 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18009.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6872.exe
PID 4768 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18009.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6872.exe
PID 4768 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18009.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6872.exe
PID 3348 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38473.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19679.exe
PID 3348 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38473.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19679.exe
PID 3348 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38473.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19679.exe
PID 4496 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63872.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22825.exe
PID 4496 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63872.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22825.exe
PID 4496 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63872.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22825.exe
PID 2684 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54272.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
PID 2684 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54272.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
PID 2684 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54272.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
PID 2308 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-41081.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
PID 2308 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-41081.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
PID 2308 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-41081.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
PID 4512 wrote to memory of 4084 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57417.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
PID 4512 wrote to memory of 4084 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57417.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
PID 4512 wrote to memory of 4084 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57417.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe
PID 5016 wrote to memory of 4040 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55193.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35439.exe
PID 5016 wrote to memory of 4040 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55193.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35439.exe
PID 5016 wrote to memory of 4040 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55193.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35439.exe
PID 1540 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6872.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-41097.exe
PID 1540 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6872.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-41097.exe
PID 1540 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6872.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-41097.exe
PID 4484 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19679.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-60121.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826.exe

"C:\Users\Admin\AppData\Local\Temp\ddfaafd154bf2a2b10e5f1e008f4ba8154b3fab5640a8f28ea52b12d531de826.exe"

C:\Users\Admin\AppData\Local\Temp\Unicorn-20377.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20377.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65353.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65353.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62208.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62208.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1372 -ip 1372

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3100 -ip 3100

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 720

C:\Users\Admin\AppData\Local\Temp\Unicorn-15711.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15711.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1320 -ip 1320

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1320 -s 724

C:\Users\Admin\AppData\Local\Temp\Unicorn-38473.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38473.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55193.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55193.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1394.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1394.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3504 -ip 3504

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 752

C:\Users\Admin\AppData\Local\Temp\Unicorn-18009.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18009.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63872.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63872.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57417.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57417.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41081.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41081.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54272.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54272.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4752 -ip 4752

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 752

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3732 -ip 3732

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 764

C:\Users\Admin\AppData\Local\Temp\Unicorn-6872.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6872.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19679.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19679.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22825.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22825.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35439.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35439.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3348 -ip 3348

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3348 -s 720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5016 -ip 5016

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2216 -ip 2216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 728

C:\Users\Admin\AppData\Local\Temp\Unicorn-41097.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41097.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60121.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60121.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7391.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7391.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43209.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43209.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23535.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23535.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26489.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26489.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59545.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59545.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9768.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9768.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9768.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9768.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6239.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6239.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22767.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22767.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4768 -ip 4768

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4512 -ip 4512

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4496 -ip 4496

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2308 -ip 2308

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2684 -ip 2684

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 640

C:\Users\Admin\AppData\Local\Temp\Unicorn-14776.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14776.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27391.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27391.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19785.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19785.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36121.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36121.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36121.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36121.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2223.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2223.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51616.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51616.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38233.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38233.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21705.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21705.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54761.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54761.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54185.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21321.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21321.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4984.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4984.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50848.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50848.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50848.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50848.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50848.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50848.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17599.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17599.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1540 -ip 1540

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4484 -ip 4484

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4084 -ip 4084

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4940 -ip 4940

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 728

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 752

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4668 -ip 4668

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4040 -ip 4040

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2360 -ip 2360

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 736

C:\Users\Admin\AppData\Local\Temp\Unicorn-17577.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17577.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14047.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14047.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49865.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49865.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49289.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49289.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13087.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13087.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23545.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23545.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9512.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9512.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55184.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55184.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21935.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21935.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44105.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44105.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43529.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43529.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43529.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43529.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59673.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59673.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45641.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45641.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29497.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29497.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29497.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29497.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12584.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12584.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12584.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12584.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45257.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45257.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64224.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64224.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64224.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64224.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58448.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58448.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64224.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64224.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1640.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1640.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1640.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1640.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14447.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14447.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1756 -ip 1756

C:\Users\Admin\AppData\Local\Temp\Unicorn-20089.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20089.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-415.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-415.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3908 -ip 3908

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4904 -ip 4904

C:\Users\Admin\AppData\Local\Temp\Unicorn-51801.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51801.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2792.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2792.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48464.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48464.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3560 -ip 3560

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 736

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 536 -ip 536

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 756

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 460

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1760 -ip 1760

C:\Users\Admin\AppData\Local\Temp\Unicorn-15205.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15205.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59808.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59808.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10031.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10031.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10031.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10031.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47577.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47577.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47577.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47577.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44240.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44240.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22601.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22601.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55081.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55081.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 3444 -ip 3444

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 1860 -ip 1860

C:\Users\Admin\AppData\Local\Temp\Unicorn-38553.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38553.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3168 -ip 3168

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 1204 -ip 1204

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 616

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4428 -ip 4428

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 708

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 716

C:\Users\Admin\AppData\Local\Temp\Unicorn-39705.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39705.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 740

C:\Users\Admin\AppData\Local\Temp\Unicorn-42393.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42393.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42393.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42393.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 3320 -ip 3320

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 244 -ip 244

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 4112 -ip 4112

C:\Users\Admin\AppData\Local\Temp\Unicorn-8184.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8184.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27209.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27209.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28278.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28278.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28278.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28278.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 1768 -ip 1768

C:\Users\Admin\AppData\Local\Temp\Unicorn-59305.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59305.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26633.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26633.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10296.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10296.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26057.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26057.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 1920 -ip 1920

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 4728 -ip 4728

C:\Users\Admin\AppData\Local\Temp\Unicorn-49321.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49321.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 2312 -ip 2312

C:\Users\Admin\AppData\Local\Temp\Unicorn-16649.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16649.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-312.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-312.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48937.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48937.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 4036 -ip 4036

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 2464 -ip 2464

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 3716 -ip 3716

C:\Users\Admin\AppData\Local\Temp\Unicorn-1272.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1272.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 2292 -ip 2292

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 4192 -ip 4192

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 4636 -ip 4636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 4236 -ip 4236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 452 -ip 452

C:\Users\Admin\AppData\Local\Temp\Unicorn-49705.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49705.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50774.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50774.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19529.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19529.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 3976 -ip 3976

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2672 -ip 2672

C:\Users\Admin\AppData\Local\Temp\Unicorn-21065.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21065.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 1588 -ip 1588

C:\Users\Admin\AppData\Local\Temp\Unicorn-20681.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20681.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 2704 -ip 2704

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 3944 -ip 3944

C:\Users\Admin\AppData\Local\Temp\Unicorn-53161.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53161.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2352 -ip 2352

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3964 -ip 3964

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 1572 -ip 1572

C:\Users\Admin\AppData\Local\Temp\Unicorn-9736.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9736.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5823.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5823.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54832.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54832.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9160.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9160.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 736

C:\Users\Admin\AppData\Local\Temp\Unicorn-56368.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56368.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42911.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42911.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46441.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46441.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25999.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25999.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25999.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25999.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 728

C:\Users\Admin\AppData\Local\Temp\Unicorn-13000.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13000.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58672.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58672.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 740

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2056 -ip 2056

C:\Users\Admin\AppData\Local\Temp\Unicorn-43487.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43487.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43679.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43679.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4252 -ip 4252

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 220 -ip 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-940.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-940.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52217.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52217.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5320.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5320.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 5084 -ip 5084

C:\Users\Admin\AppData\Local\Temp\Unicorn-4552.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4552.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1520 -ip 1520

C:\Users\Admin\AppData\Local\Temp\Unicorn-53945.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53945.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 3708 -ip 3708

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 2920 -ip 2920

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 1292 -ip 1292

C:\Users\Admin\AppData\Local\Temp\Unicorn-51760.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51760.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41257.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41257.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41257.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41257.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3820 -ip 3820

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 1516 -ip 1516

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 3620 -ip 3620

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 3536 -ip 3536

C:\Users\Admin\AppData\Local\Temp\Unicorn-24153.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24153.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7624.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7624.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7624.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7624.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24345.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24345.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7816.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7816.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7816.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7816.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 3240 -ip 3240

C:\Users\Admin\AppData\Local\Temp\Unicorn-47321.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47321.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10543.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10543.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 3900 -ip 3900

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 3412 -ip 3412

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 1100 -ip 1100

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 1372 -ip 1372

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 4768 -ip 4768

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 2924 -ip 2924

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4684 -ip 4684

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 1192 -ip 1192

C:\Users\Admin\AppData\Local\Temp\Unicorn-40.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16377.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16377.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-232.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-232.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49433.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49433.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 4984 -ip 4984

C:\Users\Admin\AppData\Local\Temp\Unicorn-35593.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35593.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51545.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51545.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 4940 -ip 4940

C:\Users\Admin\AppData\Local\Temp\Unicorn-35593.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35593.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 216 -ip 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-35209.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35209.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 2620 -ip 2620

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 744 -ip 744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 1796 -ip 1796

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3152 -ip 3152

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 1096 -ip 1096

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 4556 -ip 4556

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 440 -ip 440

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 3504 -ip 3504

C:\Users\Admin\AppData\Local\Temp\Unicorn-25801.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25801.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25801.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25801.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58281.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58281.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 4780 -ip 4780

C:\Users\Admin\AppData\Local\Temp\Unicorn-42137.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42137.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38415.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38415.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41753.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41753.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 1128 -ip 1128

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 116 -ip 116

C:\Users\Admin\AppData\Local\Temp\Unicorn-5167.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5167.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5167.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5167.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2400 -ip 2400

C:\Users\Admin\AppData\Local\Temp\Unicorn-44057.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44057.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 900 -ip 900

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 984 -ip 984

C:\Users\Admin\AppData\Local\Temp\Unicorn-62121.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62121.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 656

C:\Users\Admin\AppData\Local\Temp\Unicorn-60969.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60969.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41103.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41103.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 4904 -ip 4904

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 740

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5148 -ip 5148

C:\Users\Admin\AppData\Local\Temp\Unicorn-367.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-367.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19849.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19849.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19849.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19849.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19849.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19849.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2936.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2936.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52329.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52329.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35993.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35993.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35993.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35993.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 624 -ip 624

C:\Users\Admin\AppData\Local\Temp\Unicorn-18889.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18889.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 4464 -ip 4464

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 5164 -ip 5164

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5344 -ip 5344

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 5260 -ip 5260

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 1528 -ip 1528

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 5364 -ip 5364

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 752

C:\Users\Admin\AppData\Local\Temp\Unicorn-35343.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35343.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35343.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35343.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 4432 -ip 4432

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 5700 -ip 5700

C:\Users\Admin\AppData\Local\Temp\Unicorn-45225.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45225.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45417.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45417.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45417.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45417.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45417.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45417.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 5716 -ip 5716

C:\Users\Admin\AppData\Local\Temp\Unicorn-44841.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44841.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11976.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11976.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8831.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8831.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5748 -ip 5748

C:\Users\Admin\AppData\Local\Temp\Unicorn-27737.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27737.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 5396 -ip 5396

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 5180 -ip 5180

C:\Users\Admin\AppData\Local\Temp\Unicorn-26895.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26895.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26895.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26895.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5200 -ip 5200

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 5712 -ip 5712

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 5936 -ip 5936

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 5856 -ip 5856

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 6116 -ip 6116

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 5900 -ip 5900

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 6092 -ip 6092

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 6064 -ip 6064

C:\Users\Admin\AppData\Local\Temp\Unicorn-63673.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63673.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49833.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49833.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6128 -ip 6128

C:\Users\Admin\AppData\Local\Temp\Unicorn-30159.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30159.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50025.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50025.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 5172 -ip 5172

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 5388 -ip 5388

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 5340 -ip 5340

C:\Users\Admin\AppData\Local\Temp\Unicorn-19215.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19215.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5332 -ip 5332

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5200 -s 636

C:\Users\Admin\AppData\Local\Temp\Unicorn-55417.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55417.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55417.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55417.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38313.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38313.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51120.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51120.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 5588 -ip 5588

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5360 -ip 5360

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 5356 -ip 5356

C:\Users\Admin\AppData\Local\Temp\Unicorn-3647.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3647.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 2464 -ip 2464

C:\Users\Admin\AppData\Local\Temp\Unicorn-8712.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8712.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8712.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8712.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5780 -ip 5780

C:\Users\Admin\AppData\Local\Temp\Unicorn-8136.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8136.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5360 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5588 -s 724

C:\Users\Admin\AppData\Local\Temp\Unicorn-53808.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53808.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27353.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27353.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60025.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60025.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 5792 -ip 5792

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1612 -ip 1612

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 3044 -ip 3044

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 5960 -ip 5960

C:\Users\Admin\AppData\Local\Temp\Unicorn-39583.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39583.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 2292 -ip 2292

C:\Users\Admin\AppData\Local\Temp\Unicorn-45360.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45360.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 1612 -ip 1612

C:\Users\Admin\AppData\Local\Temp\Unicorn-14607.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14607.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14799.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14799.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14799.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14799.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34665.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34665.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34665.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34665.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 1864 -ip 1864

C:\Users\Admin\AppData\Local\Temp\Unicorn-14799.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14799.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1032.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1032.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50233.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50233.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17862.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17862.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17862.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17862.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17862.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17862.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17862.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17862.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17862.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17862.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17862.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17862.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5576 -ip 5576

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 5296 -ip 5296

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 5620 -ip 5620

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3108 -ip 3108

C:\Users\Admin\AppData\Local\Temp\Unicorn-47856.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47856.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51385.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51385.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51385.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51385.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5272 -ip 5272

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 4192 -ip 4192

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 5292 -ip 5292

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 5188 -ip 5188

C:\Users\Admin\AppData\Local\Temp\Unicorn-26217.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26217.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26217.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26217.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9880.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9880.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42553.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42553.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 6096 -ip 6096

C:\Users\Admin\AppData\Local\Temp\Unicorn-38447.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38447.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58313.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58313.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41135.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41135.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41135.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41135.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40751.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40751.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60617.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60617.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7311.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7311.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39983.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39983.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39983.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39983.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56704.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56704.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40175.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 4924 -ip 4924

C:\Users\Admin\AppData\Local\Temp\Unicorn-28063.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28063.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 5680 -ip 5680

C:\Users\Admin\AppData\Local\Temp\Unicorn-47545.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47545.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30825.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30825.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14488.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14488.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14488.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14488.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4356 -ip 4356

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 548 -ip 548

C:\Users\Admin\AppData\Local\Temp\Unicorn-52169.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52169.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2319.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2319.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 5648 -ip 5648

C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2127.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2127.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21993.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21993.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 820 -ip 820

C:\Users\Admin\AppData\Local\Temp\Unicorn-33839.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33839.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3471.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3471.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3471.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3471.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 3344 -ip 3344

C:\Users\Admin\AppData\Local\Temp\Unicorn-3279.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3279.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37679.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37679.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 2364 -ip 2364

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 4520 -ip 4520

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 820 -s 636

C:\Users\Admin\AppData\Local\Temp\Unicorn-62493.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62493.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62493.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62493.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62493.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62493.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 1984 -ip 1984

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 632

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 2616 -ip 2616

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2324 -ip 2324

C:\Users\Admin\AppData\Local\Temp\Unicorn-8181.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8181.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 668

C:\Users\Admin\AppData\Local\Temp\Unicorn-27782.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27782.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 3084 -ip 3084

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 2304 -ip 2304

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5088 -ip 5088

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 6112 -ip 6112

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 5988 -ip 5988

C:\Users\Admin\AppData\Local\Temp\Unicorn-3957.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3957.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20486.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20486.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20486.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20486.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20486.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20486.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37014.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37014.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 484

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6112 -s 720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3940 -ip 3940

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 5668 -ip 5668

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 2260 -ip 2260

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 5964 -ip 5964

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 3048 -ip 3048

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2360 -ip 2360

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 1600 -ip 1600

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 4792 -ip 4792

C:\Users\Admin\AppData\Local\Temp\Unicorn-61622.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61622.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63734.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63734.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63734.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63734.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63734.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63734.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14725.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14725.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14725.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14725.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30678.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30678.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14149.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14149.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30678.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30678.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63350.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63350.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47206.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47206.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47206.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47206.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47206.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47206.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63350.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63350.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4040 -ip 4040

C:\Users\Admin\AppData\Local\Temp\Unicorn-14341.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14341.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30870.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30870.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30870.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30870.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30294.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30294.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47206.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47206.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63350.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63350.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63350.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63350.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30486.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30486.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30486.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30486.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30486.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30486.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46822.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46822.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 4684 -ip 4684

C:\Users\Admin\AppData\Local\Temp\Unicorn-63158.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63158.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63158.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63158.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49318.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49318.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 688 -ip 688

C:\Users\Admin\AppData\Local\Temp\Unicorn-16262.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16262.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 5524 -ip 5524

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 5432 -ip 5432

C:\Users\Admin\AppData\Local\Temp\Unicorn-34518.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34518.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34518.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34518.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 5124 -ip 5124

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 2716 -ip 2716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2332 -ip 2332

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 5688 -ip 5688

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 2648 -ip 2648

C:\Users\Admin\AppData\Local\Temp\Unicorn-9157.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9157.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42214.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42214.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 3680 -ip 3680

C:\Users\Admin\AppData\Local\Temp\Unicorn-58550.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58550.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40412.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40412.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 3664 -ip 3664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 5716 -ip 5716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5952 -ip 5952

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5840 -ip 5840

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 5568 -ip 5568

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 4840 -ip 4840

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 3700 -ip 3700

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 5740 -ip 5740

C:\Users\Admin\AppData\Local\Temp\Unicorn-6988.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6988.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6988.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6988.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 5836 -ip 5836

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 5904 -ip 5904

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 1772 -ip 1772

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 1096 -ip 1096

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 3124 -ip 3124

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 2924 -ip 2924

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4352 -ip 4352

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 2884 -ip 2884

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 216 -ip 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 3420 -ip 3420

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 1320 -ip 1320

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 4984 -ip 4984

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1340 -ip 1340

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5192 -ip 5192

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 668 -ip 668

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 5772 -ip 5772

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 3040 -ip 3040

C:\Users\Admin\AppData\Local\Temp\Unicorn-8213.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8213.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 5284 -ip 5284

C:\Users\Admin\AppData\Local\Temp\Unicorn-56454.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56454.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 5636 -ip 5636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 4144 -ip 4144

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 3492 -ip 3492

C:\Users\Admin\AppData\Local\Temp\Unicorn-41846.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41846.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26086.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26086.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26086.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26086.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9749.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9749.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 1784 -ip 1784

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5772 -s 624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 6068 -ip 6068

C:\Users\Admin\AppData\Local\Temp\Unicorn-64438.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64438.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 452 -ip 452

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5800 -ip 5800

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 1584 -ip 1584

C:\Users\Admin\AppData\Local\Temp\Unicorn-49830.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49830.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33494.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33494.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33494.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33494.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16966.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16966.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-629.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-629.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-629.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-629.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16582.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16582.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-245.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-245.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-245.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-245.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-245.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-245.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33302.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33302.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32726.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32726.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16198.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16198.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 5600 -ip 5600

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5720 -ip 5720

C:\Users\Admin\AppData\Local\Temp\Unicorn-53.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34838.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34838.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1205.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1205.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50598.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50598.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36182.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36182.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35798.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35798.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35798.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35798.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35798.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35798.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35798.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35798.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2933.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2933.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17734.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17734.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 1776 -ip 1776

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 2464 -ip 2464

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 5464 -ip 5464

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6068 -s 716

C:\Users\Admin\AppData\Local\Temp\Unicorn-26006.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26006.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26006.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26006.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41766.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41766.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5728 -ip 5728

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 1372 -ip 1372

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 772 -ip 772

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 6088 -ip 6088

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5720 -s 652

C:\Users\Admin\AppData\Local\Temp\Unicorn-26892.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26892.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26892.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26892.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26892.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26892.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10556.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10556.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10556.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10556.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46566.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46566.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 4736 -ip 4736

C:\Users\Admin\AppData\Local\Temp\Unicorn-58797.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58797.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 5856 -ip 5856

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 5276 -ip 5276

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 3116 -ip 3116

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 5624 -ip 5624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 5748 -ip 5748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 3520 -ip 3520

C:\Users\Admin\AppData\Local\Temp\Unicorn-30054.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30054.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58813.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58813.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29286.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29286.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 1536 -ip 1536

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 3044 -ip 3044

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 6012 -ip 6012

C:\Users\Admin\AppData\Local\Temp\Unicorn-62150.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62150.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 660

C:\Users\Admin\AppData\Local\Temp\Unicorn-30822.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30822.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 4036 -ip 4036

C:\Users\Admin\AppData\Local\Temp\Unicorn-13333.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13333.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 5556 -ip 5556

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 1236 -ip 1236

C:\Users\Admin\AppData\Local\Temp\Unicorn-30630.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30630.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7381.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7381.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 932 -ip 932

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 3100 -ip 3100

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 3712 -ip 3712

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 4716 -ip 4716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 4604 -ip 4604

C:\Users\Admin\AppData\Local\Temp\Unicorn-57542.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57542.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57542.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57542.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4164 -ip 4164

C:\Users\Admin\AppData\Local\Temp\Unicorn-10453.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10453.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10453.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10453.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26982.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26982.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26982.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26982.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 3084 -ip 3084

C:\Users\Admin\AppData\Local\Temp\Unicorn-26214.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26214.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26214.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26214.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10453.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10453.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10453.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10453.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10453.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10453.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10453.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10453.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60806.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60806.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26214.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26214.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60230.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60230.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3532 -ip 3532

C:\Users\Admin\AppData\Local\Temp\Unicorn-46909.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46909.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 5272 -ip 5272

C:\Users\Admin\AppData\Local\Temp\Unicorn-50438.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50438.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 6140 -ip 6140

C:\Users\Admin\AppData\Local\Temp\Unicorn-50054.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50054.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16998.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16998.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16422.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16422.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19302.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19302.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2965.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2965.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 5324 -ip 5324

C:\Users\Admin\AppData\Local\Temp\Unicorn-51974.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51974.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31148.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31148.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47869.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47869.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 1936 -ip 1936

C:\Users\Admin\AppData\Local\Temp\Unicorn-53510.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53510.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 5444 -ip 5444

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5752 -ip 5752

C:\Users\Admin\AppData\Local\Temp\Unicorn-54470.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54470.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21990.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21990.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 3572 -ip 3572

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5956 -ip 5956

C:\Users\Admin\AppData\Local\Temp\Unicorn-57293.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57293.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56525.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56525.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 5520 -ip 5520

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 1636 -ip 1636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 5504 -ip 5504

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 5248 -ip 5248

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 2152 -ip 2152

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5520 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 732

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5956 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 736

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 3104 -ip 3104

C:\Users\Admin\AppData\Local\Temp\Unicorn-64854.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64854.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64854.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64854.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64662.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64662.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5248 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 800 -ip 800

C:\Users\Admin\AppData\Local\Temp\Unicorn-21430.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21430.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 5300 -ip 5300

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 5944 -ip 5944

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 1444 -ip 1444

C:\Users\Admin\AppData\Local\Temp\Unicorn-7589.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7589.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24310.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24310.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 3940 -ip 3940

C:\Users\Admin\AppData\Local\Temp\Unicorn-7205.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7205.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56406.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56406.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42566.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42566.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42758.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42758.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42758.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42758.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 5988 -ip 5988

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 664

C:\Users\Admin\AppData\Local\Temp\Unicorn-47862.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47862.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15381.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15381.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56598.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56598.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 6116 -ip 6116

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5944 -s 712

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 740

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 5700 -ip 5700

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5988 -s 608

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 6000 -ip 6000

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 5920 -ip 5920

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5700 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6668 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6000 -s 720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6116 -s 748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5920 -s 712

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 6668 -ip 6668

C:\Users\Admin\AppData\Local\Temp\Unicorn-35558.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35558.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 5196 -ip 5196

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5196 -s 716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 5648 -ip 5648

C:\Users\Admin\AppData\Local\Temp\Unicorn-43254.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43254.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43254.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43254.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42870.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42870.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9813.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9813.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12117.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12117.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5648 -s 524

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5616 -s 616

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 5616 -ip 5616

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5608 -s 636

C:\Users\Admin\AppData\Local\Temp\Unicorn-28070.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28070.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5608 -ip 5608

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 652

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 608

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2148 -ip 2148

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5136 -s 648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5268 -s 648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 608

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 692

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6928 -s 640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5692 -s 600

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6048 -s 652

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6584 -s 648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3560 -ip 3560

C:\Users\Admin\AppData\Local\Temp\Unicorn-39222.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39222.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6016 -s 644

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5376 -s 596

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 644

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6612 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6920 -s 628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5292 -s 612

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 736

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 5136 -ip 5136

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 5268 -ip 5268

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3764 -ip 3764

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 4188 -ip 4188

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5608 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 1028 -ip 1028

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 6928 -ip 6928

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 5692 -ip 5692

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 6048 -ip 6048

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 2328 -ip 2328

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5024 -ip 5024

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6584 -ip 6584

C:\Users\Admin\AppData\Local\Temp\Unicorn-33462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40006.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40006.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40006.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40006.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23670.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23670.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40006.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40006.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40006.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40006.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56726.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56726.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40198.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40198.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40006.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40006.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23670.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23670.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40006.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40006.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23670.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23670.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40006.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40006.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23670.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23670.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40006.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40006.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 3504 -ip 3504

C:\Users\Admin\AppData\Local\Temp\Unicorn-23670.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23670.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40006.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40006.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7141.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7141.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39430.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39430.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6181.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6181.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6181.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6181.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55382.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55382.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 788 -ip 788

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 4720 -ip 4720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 456 -ip 456

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 6016 -ip 6016

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2364 -ip 2364

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 5376 -ip 5376

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 6612 -ip 6612

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5908 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 612

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6460 -s 648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 688 -s 560

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 632

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 6920 -ip 6920

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6792 -s 664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 5292 -ip 5292

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3528 -ip 3528

C:\Users\Admin\AppData\Local\Temp\Unicorn-49814.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49814.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16950.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16950.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16950.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16950.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1512 -ip 1512

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5908 -ip 5908

C:\Users\Admin\AppData\Local\Temp\Unicorn-49814.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49814.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-229.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-229.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4680 -ip 4680

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 6460 -ip 6460

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 688 -ip 688

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1848 -ip 1848

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6248 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 6792 -ip 6792

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5312 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3972 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5536 -s 624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6644 -s 540

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 6248 -ip 6248

C:\Users\Admin\AppData\Local\Temp\Unicorn-59549.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59549.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59549.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59549.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59549.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59549.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42636.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42636.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42636.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42636.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5152 -s 736

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5908 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 652

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6604 -s 628

C:\Users\Admin\AppData\Local\Temp\Unicorn-42636.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42636.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6344 -s 736

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6844 -s 632

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 900 -ip 900

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6780 -s 656

C:\Users\Admin\AppData\Local\Temp\Unicorn-556.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-556.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5312 -ip 5312

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6792 -s 664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 3972 -ip 3972

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1212 -ip 1212

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4104 -ip 4104

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5536 -ip 5536

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 6644 -ip 6644

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 5152 -ip 5152

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6520 -s 696

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6676 -s 648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3972 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 856 -ip 856

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 6604 -ip 6604

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 6344 -ip 6344

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 6844 -ip 6844

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6644 -s 540

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 4624 -ip 4624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 6780 -ip 6780

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6844 -s 632

C:\Users\Admin\AppData\Local\Temp\Unicorn-32822.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32822.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32438.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32438.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6316 -s 664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 6520 -ip 6520

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 6676 -ip 6676

C:\Users\Admin\AppData\Local\Temp\Unicorn-36662.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36662.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52998.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52998.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19750.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19750.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7068 -s 664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7064 -s 664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7012 -s 664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6904 -s 732

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6380 -s 616

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 632

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 616

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6272 -s 716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7004 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 852 -s 624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6804 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6488 -s 648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6660 -s 660

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 540

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 632

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 464 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 6316 -ip 6316

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6520 -s 696

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6676 -s 648

C:\Users\Admin\AppData\Local\Temp\Unicorn-42246.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42246.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41670.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41670.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57814.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57814.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8805.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8805.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58006.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58006.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58006.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58006.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6316 -s 664

C:\Users\Admin\AppData\Local\Temp\Unicorn-8421.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8421.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42822.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42822.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45126.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45126.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28790.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28790.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12645.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12645.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28982.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28982.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28982.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28982.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12069.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12069.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12069.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12069.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12069.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12069.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61270.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61270.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44742.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44742.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44742.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44742.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28406.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28406.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44934.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44934.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61462.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 7064 -ip 7064

C:\Users\Admin\AppData\Local\Temp\Unicorn-61462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61462.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 7068 -ip 7068

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 7012 -ip 7012

C:\Users\Admin\AppData\Local\Temp\Unicorn-29750.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29750.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 6904 -ip 6904

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 6380 -ip 6380

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 2648 -ip 2648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1648 -ip 1648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7068 -s 664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 828 -ip 828

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4664 -ip 4664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7064 -s 664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 6272 -ip 6272

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6904 -s 732

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 852 -ip 852

C:\Users\Admin\AppData\Local\Temp\Unicorn-38982.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38982.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 7004 -ip 7004

C:\Users\Admin\AppData\Local\Temp\Unicorn-22838.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22838.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 6488 -ip 6488

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 6804 -ip 6804

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 616

C:\Users\Admin\AppData\Local\Temp\Unicorn-7269.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7269.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 6660 -ip 6660

C:\Users\Admin\AppData\Local\Temp\Unicorn-9516.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9516.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 4640 -ip 4640

C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 852 -s 624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 1464 -ip 1464

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 2696 -ip 2696

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6804 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 464 -ip 464

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5456 -s 664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5456 -ip 5456

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 7028 -ip 7028

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 4000 -ip 4000

C:\Users\Admin\AppData\Local\Temp\Unicorn-57254.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57254.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 6956 -ip 6956

C:\Users\Admin\AppData\Local\Temp\Unicorn-42838.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42838.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42838.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42838.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42838.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42838.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42838.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42838.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26310.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26310.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 632

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6956 -s 740

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 532 -s 648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 464 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5456 -s 664

C:\Users\Admin\AppData\Local\Temp\Unicorn-49190.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49190.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 2248 -ip 2248

C:\Users\Admin\AppData\Local\Temp\Unicorn-52070.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52070.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5852 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 652

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6428 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5916 -s 640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 660

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6200 -s 640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6852 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5928 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7152 -s 640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 632

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5652 -s 660

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 636

C:\Users\Admin\AppData\Local\Temp\Unicorn-27670.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27670.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11141.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11141.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 532 -ip 532

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 1.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\Unicorn-20377.exe

MD5 640268b949fc1b6128fd7dde5ae7d0b1
SHA1 0e2bee3c99afdee3b68750321593ec3d15c74a6d
SHA256 845ab3ff5bd9a49e1fb5efb0b56dd089f3a79c5542a539b4ebc3766d9ffea534
SHA512 9b30d8837c7e53f60b6ded384c3ea1449e63a56c63277c5d56eeb911da84da9740694e05de901711752854fecf02c2100a959c8ec97c5d6c8b097b9fb6dae6ae

C:\Users\Admin\AppData\Local\Temp\Unicorn-65353.exe

MD5 ba909ffdb59e269985163eb33439a5a0
SHA1 f4af17b7ba9f9bf230913f7e2c419df06af089c0
SHA256 f5a01f5577387c4d438d992757c3cc2deee59457b9f031df2c1a9336332d4a7c
SHA512 fc17bf0055b84f4fcd75270ded871c5a16f57eb97864d611c123b0d81c65157197a1bd537dce961c4f3173c66154255b5c74c9d7018c6cc87050f33646226d80

C:\Users\Admin\AppData\Local\Temp\Unicorn-62208.exe

MD5 1e417a3e32922e21bed5502043e3eaba
SHA1 2efe8b1cfc698e227b1bfd1779c650279d4c6bc8
SHA256 3de0f8f828b6e97f308857ce192da1cffa3a18e9d0f9bb9eaa1eda78820a758f
SHA512 7e77732dfae7b265010b6c627312d3125b303c24dd75b86e3152f4ad565ed5cba713397ad8b90a9bbf8748acc75be296107bb2de8b7da623cf46516213f814a7

C:\Users\Admin\AppData\Local\Temp\Unicorn-15711.exe

MD5 bca7200f12b6eaf1b0d5e675b8ce244e
SHA1 1a3e127bc8a0430a8002506e1a165ddc7c2467fd
SHA256 a32878e0d61bd1dd37c103d85f4ea6930ea2e5ec6b5865bf80321ea7c18434a8
SHA512 8edea22aea89cf9bcc0c9f8b339e3e689f04813ab98399e08d69c72ab9b22d813c71848a2ec06e9edbb5a9711d6de76c18f1b69ba7548b8daf9d57afe23229bb

C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe

MD5 6bd1c6001c7e9e69e7f5342d3cc0ef46
SHA1 a39ca4eaf0ef1934df00bda578c924c527e68107
SHA256 c7a2f814c9441c18473235cd05f8d772c9d373aab88b69879b109635660c42f1
SHA512 1b03667db5f9e020012e26672ab2aa58dd6f0a97877b4d8d52f9ac55d3204d528fe82487809dcc1043ed6d92bc669285d78ca2df42d62dd9d1a5a16f70ef9600

C:\Users\Admin\AppData\Local\Temp\Unicorn-38473.exe

MD5 612597f671d11d76c206fc005bf17a1f
SHA1 9d72b1f40b1094df231f4ad9d4a1f15169a43d3f
SHA256 05b34d4e7e53c2c8d2fa2ad21445250cc567bc69e240fbcd95f6ba6a3c1540bf
SHA512 9ce9ddd07920f3d3ddfec99aa3ade794f9d146502331ec23433bf34e9f193d2cfe40e55b816bb39fbddc68bb579d308e25c8b544db646d1e770cb0f04839e3de

C:\Users\Admin\AppData\Local\Temp\Unicorn-1394.exe

MD5 40552e5536e6a2e81ff451836ad9f3e4
SHA1 2aa2db15dd09211d08d625b5e099d8b84c073435
SHA256 e3f7ac3571affbd445265b4527fba7b84016b89ac59566d072916d99d8e6948e
SHA512 855dbdb25e7e184f02e597e18c68f4a68868126be3d8aba8ecb1ec52abbafbb9c31459a9c1325374c34363e85346f7595c7ba5464fe4552140c0b00f4c50806b

C:\Users\Admin\AppData\Local\Temp\Unicorn-55193.exe

MD5 a920aa2f7af80f4fed1a19db0eccb5a8
SHA1 11bc1bb54676972ab2037ff6f1de06fdec287f6c
SHA256 50c16177ade06963a6c78fa225698c8044deae312e4587fc431ea95d628efcb2
SHA512 fdd8e5cf6d0ff17e4c4652611f3b85d4295baecbaf6372c76227f3284c07770864d5503da3037fd123306e706807eb8ee0a7052393b63ac3303376f6421a3968

C:\Users\Admin\AppData\Local\Temp\Unicorn-18009.exe

MD5 084fda36c1807078d8b72f74ca87d8b5
SHA1 54ebb6665c9fd51a73ddedb957d79890df450856
SHA256 11e5e38cd5abb4377d912ffbf11f58f70a0079e8dfbe910c8e8f19f3bc85f961
SHA512 03f5285c6a0d8eff479e717d31607dc2157598db511f4427cf65bb9dfe8f05302e973b86f47818d995f519e17682f8f13821ed1c565e2f9c26df855e6350bd8b

C:\Users\Admin\AppData\Local\Temp\Unicorn-63872.exe

MD5 d57b3bf1e3a3027fcb4991dd893813a0
SHA1 a3d27d68c0a083fd4c15c940d984fdfb9635c8ce
SHA256 6fdc9d004887226dac2d3de864c879c8a63d485e187bd85fda9edbee110a3518
SHA512 b95a9e6ad45d0e5b5d20afbd138cb998963a31274b91ea8f94f1f16fddde600b8883d12df649a5d66cb0a23203c40cb71014a14089be4a64d2698d454604527e

C:\Users\Admin\AppData\Local\Temp\Unicorn-57417.exe

MD5 52c4fda8bd2b618913aa3bcab219ddc0
SHA1 8aa8bbea7b01a1018e36ed2b91ae2a67cecd8910
SHA256 3ec7ab7f0dad3caa9c8fc8d5c60aa8c3d622705d8fb2bab090f8f6fae7c53d9f
SHA512 a55fede6935bb71dddf05bc1c738a5d93a9e019058d022e0992f8f36ace553444602eb78066e0b09ca11e755158cd382249a61cf40059f2e4671d3f9956f20ff

C:\Users\Admin\AppData\Local\Temp\Unicorn-41081.exe

MD5 3f4fe63b6518ab52e8406f432af36de1
SHA1 d0080c9831d6477561afee028b9ef7e0e63c7bcf
SHA256 e07d482152f6b2e38a3eb2e7725f4902dfbd46943b196025778c0d6643bd318b
SHA512 503eb20cf3e5acd411180db631c0a86268fd2ea22e2599bf090a8ef992f2c32a2ff9c425950c8bf8559ce27aa6efac580108ce2cb260d94a560e623625cd89bb

C:\Users\Admin\AppData\Local\Temp\Unicorn-54272.exe

MD5 b75e638a694e392bca9386a55004dd0e
SHA1 48bac4ee1b9ae3264cb02638b33259278fc72378
SHA256 07c90587e9208a045927ad9439e2c7af46756f9e2d535031e9518fa1303c954c
SHA512 c79624dc763f3485099645d4633930fa147c2eddb3b4a6a1d19eb05c07369db2fabc8fa8bb610c4a43d41007ba4806e04c9de34e1a3978b06b2790d7a6c7c746

C:\Users\Admin\AppData\Local\Temp\Unicorn-6872.exe

MD5 e2752fb23428efd98cd7ed02ffbc270c
SHA1 3fa77cef7813b79b547cceb871ebb1260427b498
SHA256 1e7d2d858797625d8f5e5873b229704459ab48f7e899ace8958b5d0c9ad476d0
SHA512 aa22a30c1b3e105602432f2866b54cf75f7720ac438a64d44389ae1b9324f22c688079ce46f5379cab924e0f59e60d874412bf9ad021b2b39984c3a3d73c8518

C:\Users\Admin\AppData\Local\Temp\Unicorn-19679.exe

MD5 f55abf8b3a74dde8a03f4aecfc035ea4
SHA1 99026d916ad1a7faa42050b0d5620df5f581e533
SHA256 57e7d1663ca8a2b3e43702c616071288ccae17101654c532407cae191177715d
SHA512 c4cc43f2ad13d2efe89da0b32c2e3e747fb50a674cf45759c5445e5e2a985263af4a5c7abefefb4662b2a212be4dd0330e4493b1b022a3637becab16f97d6db6

C:\Users\Admin\AppData\Local\Temp\Unicorn-22825.exe

MD5 f820029c6fd7b6e0a12b5b57e576fe76
SHA1 27cbc1f1ffd0684fd1f237966288541022c5f724
SHA256 9f99ad20beb1124ce7ec3e66f4aa7f24ebf6256a920d9636b7fb1033f5122e82
SHA512 92474daa4b0937d8973fef40a8eedf642375de0cd516229c37843b765e77c52ca148f2fbfd01498864d0cc7b9308e9b9b56cc30c7b57e0e74162d48375dc06ff

C:\Users\Admin\AppData\Local\Temp\Unicorn-22441.exe

MD5 cc00ac762ce930ca96dbab4fde551eea
SHA1 5449cf6473614d3e331e1e01b8abc311697e8503
SHA256 c54e9a77dee4c7534f546b244e4df12c6e5ebaca1ee69751599ac1d90f0c1f4b
SHA512 7015c17f5db6317ac746691f701225a25b0002c4922cd12891bc97e634875db7440533a9c2a87fc17dbc0f264a000a2a0b8ea813ccebf81f89ea0c12ca8c8aae

C:\Users\Admin\AppData\Local\Temp\Unicorn-35439.exe

MD5 b9daf770b2ef4211f4d1e864949619fe
SHA1 b7e144f8dcd27deed79a2100694e40ced6adfed7
SHA256 97d1794caf186edd3df3f115da98744f4464f5a2af12df5bd4c8ee5dc48fec93
SHA512 79514ce061d9d6d63b99f62b22c520550f471a1ca88de850536e302e6f8f8029aa9966607a3cc7e7a1704c7e6eba6a6decdf1e7e40a26182710dac4b04acf317

C:\Users\Admin\AppData\Local\Temp\Unicorn-41097.exe

MD5 d6357594ffe4aa0f549d9178078de0dd
SHA1 72b68021af28f6db4180c59f2ab9f718c226beca
SHA256 df5e3f4ecf0a122c153bf1fd774534f60c013a876dc242b5a5fbcd68d876a45b
SHA512 14f11686ebe1e2d1784001bdf8e1d6d843e00e6473c4536c4ec610ac5299dc75b21f2f17bad0988c921544bb6d4cb48f516e968716e54e962f805049ded43d70

C:\Users\Admin\AppData\Local\Temp\Unicorn-60121.exe

MD5 a11c21d57cb1216f91bd911cd77563a9
SHA1 1bdba9097ceea2c9d30f9058f3938a3de16e46fc
SHA256 8bcd21af89f659e63b58b0e90ef13c94cae79ad5cda457a0b18de38943164e3b
SHA512 680808ffde9373e9e404fbfd0e8ee7aed7840676f38ce7ac53dbee1ec3383a56ac66b04f2dbdb5934e6908b5524074596fc1d049822de3153c700bafda04404f

C:\Users\Admin\AppData\Local\Temp\Unicorn-7391.exe

MD5 47ae69088532b70ccb09ef4317f528db
SHA1 5e36552cfb98b30bcb8c8553a28860fdcec6a99c
SHA256 2196a14a5d8db7f1b8470baa43fd978f9e7759c4939b56a5301a7e411639be68
SHA512 2392bcab401fe39d047a206ed966a7cf64d704edf4069db732adec289c3cf22fd8db9bcefd7802361f2cc228e25c7baba314e8f5bea4384eef82ffd2f4ecb1c9

C:\Users\Admin\AppData\Local\Temp\Unicorn-43209.exe

MD5 b1ad797633e694bd595eaf73011e3ab2
SHA1 2c6703c3a6123e49729e5c80f2e546b79b4c5215
SHA256 41fc141591331d312c32b5a0275f5a0a5364399ae6da7e85850bc415fb830834
SHA512 c772200a10ad440b5513b03a63ee43f062fbf3cb113c5a1405025ccab6cd5f73729e4c16e23f192c63feab1200294016361d63124a5cb2faf4e0cacaf462b277

C:\Users\Admin\AppData\Local\Temp\Unicorn-23535.exe

MD5 060d0f03ae76397119a5c9ec2d98f6dc
SHA1 2fcd0a0b047b3ad33ca628f7c8ba249fbd366614
SHA256 cf28a0432ba64aa2a14237a4184378f841f85e8fc9a2a79c80dc39b938de7649
SHA512 6096119a78116a0d1ed48eada5b534c64e228634c924e7f504f1f8bd56ae18a59f7372b7f482ea158db013941cf28ab8f07caec9be90cec54098bc5737ab1f8e

C:\Users\Admin\AppData\Local\Temp\Unicorn-26489.exe

MD5 9884a17baa2d4b473a83d98a7a5309bc
SHA1 d53d8b9ca1a6c89d5edad1e16a3329609843f4d6
SHA256 6e9b23fd7b4980856910c6082ec116fcec6db7294f821d3c4e0e49ac971d296f
SHA512 3c770816f94f45da55e09fb0fcf2dd62e1dd56f90e61717b2b4495b167d804d61cac40525d454bc146370ae9461090ff5154a2176d4bf473f0774a052cd2e653

C:\Users\Admin\AppData\Local\Temp\Unicorn-59545.exe

MD5 d9ed8d0c3f87d2bf3ec3338543eae5b9
SHA1 46211d5031e0ceb0e1c23967f0b3f1b0c646b65a
SHA256 666f7f45ce328a9f83930f7a0c2cad9e5dd48824fab021129bd35be445398b53
SHA512 6be5900e49d5a25f8e263c1f3c52c39762414981fdb93ccab5d152c06ef3dfccd18040d160b2f6b83b05c00cc5f36c61969e38119e35fc744c51da6d097f835d

C:\Users\Admin\AppData\Local\Temp\Unicorn-9768.exe

MD5 d56951b172f759b586aa9743132e775b
SHA1 833b4ed82a3d40c6ede2245be723c6e24bf4b382
SHA256 d366c0280a85e511354e4ee61b65e233bdc6d047b7dc81d0ebee8f38ea3ab613
SHA512 5cb1f6b6d0674baa03ab091268941e65333f57d23fdfb61e48bcecc0dd44690800dcf0449d74843314c88da90dee939b5e13c2c9dda3e4df84bb7310fb2f975f

C:\Users\Admin\AppData\Local\Temp\Unicorn-22767.exe

MD5 c84b9a620192d1602491c9e83503ed8f
SHA1 667633b62288995a2f610bc1bed8937890b2b430
SHA256 b4fd6da728505b37c715132dcff069b23b43411501a519efacfd34594bb39d47
SHA512 7badc22244a723a82751d4d3f0a716209c38dced0702986bbf06d8a8115e6c2fbb5e3423476c4662cbbeb11dadff4dcbd1ec83412b1e0a139a7437153c30569c

C:\Users\Admin\AppData\Local\Temp\Unicorn-6239.exe

MD5 6c18df90ab149e307f5a76df12a82113
SHA1 caa0cdaf6ab79de953a11f11d05d0e819276c245
SHA256 4a629e942d25945b697cb6b98474d57ae354940ed42aba686243120e338749f1
SHA512 8f7cbae4950f149c9e34ef2e5609991d818d0e8883886255d2f2c76973a0fb1d44c31bbf9887e2e3223bcf6878e1b1cfac15b7e25c2eec1c874c28c56ec5f90a

C:\Users\Admin\AppData\Local\Temp\Unicorn-14776.exe

MD5 16b703495481ae02e3f771397a3b4e6d
SHA1 45b8e2148c86894679bcc0cc86fbec11b9c8c659
SHA256 106d7c7352cb95f538a74ef49164d5431aae75b5ec8756af5a6ed31f51c27d4e
SHA512 802ccb47f67e87b5fa9fcab2784f1aeaea9bdb7c645435c14c9c7a101495fe5a826d7d80f2058e5a1ee3da77207688195778d53830ff1b82c88f91ceb61bb3ea

C:\Users\Admin\AppData\Local\Temp\Unicorn-26895.exe

MD5 6dfdba355f900f051dafc4999ac8d108
SHA1 4233b56e7c317fba27b5af2449b0e47ac5460a26
SHA256 fa91e40f5240afc8900b462dc21a3c12aa742caf05e55ac133a6a81d9227b80f
SHA512 e5e4f10297a0ebec5ec02103b790d65776ca6c734a4adb362da413879452cce60eef9bab06173f6934f2d18c97f31dddc767dc6c83164665ee57b76ac815712c

C:\Users\Admin\AppData\Local\Temp\Unicorn-49318.exe

MD5 5c55cf31b0175fe9a5dc8e51c165b15f
SHA1 3a75c418e7b494a80498d515ae58d22e2fbea8ec
SHA256 f3ba46f2010521a60088f44dc24d7ae3955649e9fb8629f3233f56032ff9db8e
SHA512 62b3bc36772fdcf473c7d6a5a2408bfd4753492c819c10f1bf7fbc350d175be9d047ab5decee123865d3d567f1e041ee83ec646dec13edde6601db6b36faf1c8

C:\Users\Admin\AppData\Local\Temp\Unicorn-9749.exe

MD5 92cd81b1e7e9f46abd25e6b0277fd6ba
SHA1 f66ce4953d4e7711c1a42012e3c5e91ea07fde7d
SHA256 d4f4dc8d40e5211b1e29e557f935b21526167bcdea63d982bd35cdcb181f354e
SHA512 4c9ff08c8e05f2dc269cb4db717b2d02831b8fe5afafe7fb7c88b08c2ac7d5aacec4a4ef1b95d678050222406a7e3833443862748d726266c47f28a433d3da4d

C:\Users\Admin\AppData\Local\Temp\Unicorn-2933.exe

MD5 db6a96fe0cd7015f06ff058d9472724b
SHA1 42ac480bf1982b8ab4bcd6d786c390caac397ee8
SHA256 d78ed0f63b8c5443d4ab1ceb8019967e000b0a0a5e377767521157c0f6eeea6a
SHA512 5de5bfac5c87fa67c7679447ea00f546af1190006786e62601f2e989779bda0cbb7b3236671182cae13170daa1abb6bea1f6dd7af70635e94886bf402c352d7d

C:\Users\Admin\AppData\Local\Temp\Unicorn-61270.exe

MD5 24331067eb0d4fb7e1c9d6c65110a06c
SHA1 a029be01700756b53e1a721837663125b041501d
SHA256 c5439200863f8ce9eb72d58857367e9742626fbcd7fd0b406d959ff0259635e8
SHA512 fa908cfdb6f8e3daa8e5e3f67ab6f31008a937898e7497a8bbf987fd0354ab83402fef3576f8f02debc8985fdb993ae8eeb2baa491ee2d9f1786b32e3fb7d550

C:\Users\Admin\AppData\Local\Temp\Unicorn-40863.exe

MD5 4c0f1514a65c3c60c2752bdf3f72beba
SHA1 eb009fec493e306947e86c7c4f743d3972152d4a
SHA256 33e3843860ae6ebd62680688fff476e74a18ed7bbd63f6904fdd507c69319b07
SHA512 ff7a37c27be8edb761e051d096fddcede56a733fb0389776254defcc56e88b061412fc8402ebaef30047f6a1c425f07066469c14e16532b92e90e91d2e44f548