Malware Analysis Report

2025-04-14 00:48

Sample ID 240530-retm6acc47
Target fd8fb9ec553e04b27a477b4741433580_NeikiAnalytics.exe
SHA256 1e71772b74e16e8e1b32f99426a5c100c1adbd06e30782c048c04484dc539786
Tags
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

1e71772b74e16e8e1b32f99426a5c100c1adbd06e30782c048c04484dc539786

Threat Level: Shows suspicious behavior

The file fd8fb9ec553e04b27a477b4741433580_NeikiAnalytics.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary


Executes dropped EXE

Loads dropped DLL

Program crash

Unsigned PE

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-05-30 14:06

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-30 14:06

Reported

2024-05-30 14:09

Platform

win7-20240221-en

Max time kernel

150s

Max time network

129s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fd8fb9ec553e04b27a477b4741433580_NeikiAnalytics.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44546.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34597.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63866.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44001.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-8204.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-28070.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62169.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58640.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3923.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29497.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17799.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48464.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4930.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-846.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46518.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21075.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5293.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-45579.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33881.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49663.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57831.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50218.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-43306.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19356.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47390.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47390.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-39776.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26394.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59066.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14888.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34754.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-11209.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60965.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23462.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-11764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44868.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25407.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7447.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57203.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19700.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19700.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15786.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56072.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64240.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60156.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15039.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64795.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19124.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36398.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32314.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64432.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-52735.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7063.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24059.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\fd8fb9ec553e04b27a477b4741433580_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fd8fb9ec553e04b27a477b4741433580_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44546.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44546.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fd8fb9ec553e04b27a477b4741433580_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fd8fb9ec553e04b27a477b4741433580_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44546.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44546.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63866.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63866.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-28070.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-28070.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-8204.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-8204.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44001.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44001.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\fd8fb9ec553e04b27a477b4741433580_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44546.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34597.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63866.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-28070.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-8204.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44001.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-62169.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-58640.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29497.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-3923.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17799.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48464.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4930.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-846.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-46518.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-21075.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-5293.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57831.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-50218.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33881.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-49663.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-43306.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-47390.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-47390.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19356.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14888.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-23462.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-11209.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34754.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-11764.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-60965.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27593.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26394.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57203.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-56072.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19124.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15039.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-36398.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-52735.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44868.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7447.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29103.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34125.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-109.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9045.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-8853.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25407.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12382.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25189.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12937.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-5174.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15786.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19700.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42315.exe

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\fd8fb9ec553e04b27a477b4741433580_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44546.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34597.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63866.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-8204.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-28070.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44001.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62169.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58640.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29497.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3923.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17799.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48464.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4930.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-846.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46518.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21075.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5293.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-45579.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57831.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33881.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49663.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50218.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-43306.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19356.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47390.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47390.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-39776.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26394.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59066.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34754.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14888.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-11209.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60965.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23462.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-11764.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27593.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44868.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25407.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7447.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57203.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19700.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15786.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56072.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64240.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60156.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15039.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19124.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64795.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36398.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32314.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-52735.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64432.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7063.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24059.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 112 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\fd8fb9ec553e04b27a477b4741433580_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44546.exe
PID 112 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\fd8fb9ec553e04b27a477b4741433580_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44546.exe
PID 112 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\fd8fb9ec553e04b27a477b4741433580_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44546.exe
PID 112 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\fd8fb9ec553e04b27a477b4741433580_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44546.exe
PID 2020 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44546.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe
PID 2020 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44546.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe
PID 2020 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44546.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe
PID 2020 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44546.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe
PID 112 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\fd8fb9ec553e04b27a477b4741433580_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe
PID 112 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\fd8fb9ec553e04b27a477b4741433580_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe
PID 112 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\fd8fb9ec553e04b27a477b4741433580_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe
PID 112 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\fd8fb9ec553e04b27a477b4741433580_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe
PID 112 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\fd8fb9ec553e04b27a477b4741433580_NeikiAnalytics.exe C:\Windows\SysWOW64\WerFault.exe
PID 112 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\fd8fb9ec553e04b27a477b4741433580_NeikiAnalytics.exe C:\Windows\SysWOW64\WerFault.exe
PID 112 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\fd8fb9ec553e04b27a477b4741433580_NeikiAnalytics.exe C:\Windows\SysWOW64\WerFault.exe
PID 112 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\fd8fb9ec553e04b27a477b4741433580_NeikiAnalytics.exe C:\Windows\SysWOW64\WerFault.exe
PID 2584 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe
PID 2584 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe
PID 2584 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe
PID 2584 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe
PID 3004 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe
PID 3004 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe
PID 3004 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe
PID 3004 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe
PID 2020 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44546.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34597.exe
PID 2020 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44546.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34597.exe
PID 2020 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44546.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34597.exe
PID 2020 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44546.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34597.exe
PID 2020 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44546.exe C:\Windows\SysWOW64\WerFault.exe
PID 2020 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44546.exe C:\Windows\SysWOW64\WerFault.exe
PID 2020 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44546.exe C:\Windows\SysWOW64\WerFault.exe
PID 2020 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44546.exe C:\Windows\SysWOW64\WerFault.exe
PID 2420 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63866.exe
PID 2420 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63866.exe
PID 2420 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63866.exe
PID 2420 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63866.exe
PID 2584 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44001.exe
PID 2584 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44001.exe
PID 2584 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44001.exe
PID 2584 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44001.exe
PID 3004 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-8204.exe
PID 3004 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-8204.exe
PID 3004 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-8204.exe
PID 3004 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-8204.exe
PID 2620 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-28070.exe
PID 2620 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-28070.exe
PID 2620 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-28070.exe
PID 2620 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-28070.exe
PID 2556 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34597.exe C:\Windows\SysWOW64\WerFault.exe
PID 2556 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34597.exe C:\Windows\SysWOW64\WerFault.exe
PID 2556 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34597.exe C:\Windows\SysWOW64\WerFault.exe
PID 2556 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34597.exe C:\Windows\SysWOW64\WerFault.exe
PID 2584 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe C:\Windows\SysWOW64\WerFault.exe
PID 2584 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe C:\Windows\SysWOW64\WerFault.exe
PID 2584 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe C:\Windows\SysWOW64\WerFault.exe
PID 2584 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe C:\Windows\SysWOW64\WerFault.exe
PID 3004 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe C:\Windows\SysWOW64\WerFault.exe
PID 3004 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe C:\Windows\SysWOW64\WerFault.exe
PID 3004 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe C:\Windows\SysWOW64\WerFault.exe
PID 3004 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe C:\Windows\SysWOW64\WerFault.exe
PID 2756 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63866.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-62169.exe
PID 2756 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63866.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-62169.exe
PID 2756 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63866.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-62169.exe
PID 2756 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63866.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-62169.exe

Processes

C:\Users\Admin\AppData\Local\Temp\fd8fb9ec553e04b27a477b4741433580_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\fd8fb9ec553e04b27a477b4741433580_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\Unicorn-44546.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44546.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 112 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34597.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34597.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-63866.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63866.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44001.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44001.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8204.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8204.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28070.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28070.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-62169.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62169.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58640.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58640.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3923.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3923.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29497.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29497.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17799.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17799.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48464.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48464.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-4930.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4930.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-846.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-846.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46518.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46518.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21075.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21075.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5293.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5293.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45579.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45579.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33881.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33881.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49663.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49663.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57831.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57831.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50218.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50218.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-43306.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43306.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19356.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19356.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47390.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47390.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47390.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47390.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39776.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39776.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-26394.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26394.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59066.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59066.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14888.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14888.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34754.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34754.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11209.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11209.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60965.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60965.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11764.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11764.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-27593.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27593.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44868.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44868.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25407.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25407.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7447.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7447.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57203.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57203.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19700.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19700.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19700.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19700.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15786.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15786.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56072.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56072.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64240.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64240.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60156.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60156.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15039.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15039.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64795.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64795.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19124.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19124.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36398.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36398.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32314.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32314.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64432.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64432.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52735.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52735.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7063.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7063.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 500 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-24059.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24059.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-109.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-109.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 692 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-29103.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29103.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12382.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12382.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12937.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12937.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8853.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8853.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25189.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25189.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9045.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9045.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5174.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5174.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42315.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42315.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46399.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46399.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38785.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38785.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9450.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9450.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13150.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13150.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9621.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9621.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13705.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13705.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49907.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49907.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34125.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34125.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62159.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62159.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4790.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4790.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4790.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4790.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4790.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4790.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1645.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1645.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13897.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13897.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33763.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33763.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24526.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24526.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26149.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26149.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46015.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46015.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54183.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54183.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42485.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42485.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62351.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62351.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37332.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37332.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57198.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57198.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2605.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2605.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-62050.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62050.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47421.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47421.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-42782.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42782.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-59118.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59118.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47037.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47037.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9533.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-6004.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6004.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-9725.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9725.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10280.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10280.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30146.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30146.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-50566.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50566.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62818.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62818.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55766.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55766.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-10841.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10841.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64681.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64681.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31262.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31262.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39600.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39600.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-27431.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27431.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-26301.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26301.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14603.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14603.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-51189.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51189.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51189.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51189.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59357.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59357.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63996.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63996.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63996.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63996.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35621.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35621.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44173.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44173.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40089.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40089.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36559.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36559.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44728.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44728.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7224.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7224.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23731.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23731.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13747.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13747.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-52040.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52040.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 304 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-6347.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6347.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-10623.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10623.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-52616.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52616.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53171.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53171.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24220.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24220.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60976.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60976.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19944.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19944.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35896.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35896.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57468.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57468.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20389.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20389.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-31703.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31703.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-32663.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32663.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-65335.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65335.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-16519.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16519.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65527.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65527.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-32279.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32279.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-12673.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12673.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-20458.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20458.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28626.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28626.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28626.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28626.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28626.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28626.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40878.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40878.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57598.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57598.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54474.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54474.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30716.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30716.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42222.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42222.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45730.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45730.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-997.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-997.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9165.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9165.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-22378.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22378.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17225.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17225.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 308 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1292 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 944 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-49897.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49897.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-13908.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13908.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-14868.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14868.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50172.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50172.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13223.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13223.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38112.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38112.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-62616.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62616.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-18652.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18652.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26820.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26820.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-55408.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55408.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1416 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-22928.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22928.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27012.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27012.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6399.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6399.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63192.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63192.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-23504.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23504.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52284.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52284.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-19311.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19311.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-47899.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47899.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56067.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56067.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64235.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64235.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64235.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64235.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27095.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27095.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64967.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64967.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19851.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19851.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40271.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40271.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 488 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-65351.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65351.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11189.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11189.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-61350.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61350.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-48906.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48906.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-36462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36462.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-8833.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8833.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-17002.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17002.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3980 -s 244

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-16317.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16317.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42357.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42357.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42357.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42357.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58693.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58693.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1324.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1324.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9492.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9492.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5408.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5408.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25829.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25829.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33613.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33613.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41781.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41781.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25445.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25445.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21361.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21361.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-25336.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25336.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49840.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49840.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-46716.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46716.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54884.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54884.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3232 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-6799.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6799.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-6306.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6306.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35087.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35087.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63291.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63291.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22259.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22259.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38595.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38595.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38595.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38595.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-42871.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42871.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7074.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7074.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-47915.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47915.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64635.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64635.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35855.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35855.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44023.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44023.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-61786.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61786.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-28922.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28922.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28922.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28922.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44874.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44874.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-45066.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45066.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-11132.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11132.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20453.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20453.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56825.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56825.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11708.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11708.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3628 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4036 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63548.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63548.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-50419.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50419.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-10538.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10538.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-39511.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39511.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51763.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51763.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-39594.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39594.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10512.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10512.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11628.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11628.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-52853.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52853.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-48769.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48769.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56937.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56937.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-24073.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24073.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44109.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44109.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3076.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3076.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11244.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-36901.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36901.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61789.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61789.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4596 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5112 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-28240.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28240.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44768.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44768.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-803.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-803.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-803.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-803.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-227.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-227.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5250.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5250.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4224 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5124 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5272 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-38686.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38686.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62806.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62806.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46470.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46470.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2661.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2661.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27166.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27166.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26673.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26673.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60798.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60798.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2360.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2360.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14612.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14612.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26865.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26865.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26865.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26865.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5624 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5676 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-64005.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64005.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5888 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5916 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5728 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5776 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5748 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5736 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-23994.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23994.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5860 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-23056.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23056.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6012 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5984 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-48520.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48520.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65048.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65048.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60964.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60964.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31800.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31800.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15271.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15271.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5216 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5284 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3979.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3979.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4062.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4062.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5580 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5492 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5932 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5804 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-58738.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58738.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6096 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5360 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5944 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-42594.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42594.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5532 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5720 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-9428.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9428.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5848 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3616 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5896 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-23601.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23601.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6195.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6195.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39252.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39252.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6332 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-38868.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38868.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5924 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-48188.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48188.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6456 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6544 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6632 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6492 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6524 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-64716.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64716.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6692 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-28199.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28199.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52319.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52319.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3118.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3118.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64763.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64763.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7394.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7394.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3310.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3310.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6836 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6792 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-31899.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31899.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3310.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3310.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6868 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8116 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-48702.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48702.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8821.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8821.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53554.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53554.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61914.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61914.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7088 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-1120.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1120.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17649.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17649.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6744 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6856 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6852 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6200 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7072 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8076 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7544 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7604 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7648 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7684 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7724 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7812 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7752 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7852 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-19699.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19699.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7928 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-14737.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14737.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7896 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-7337.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7337.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7913.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7913.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7596 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-20166.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20166.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7708 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7872 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-52729.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52729.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3528.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3528.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7840 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-4680.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4680.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21401.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21401.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37737.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37737.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30109.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30109.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7944 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7916 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-62480.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62480.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54696.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54696.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6538.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6538.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27919.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27919.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8128 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-32662.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32662.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3497.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3497.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7968 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-48469.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48469.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27857.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27857.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7620 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8216 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8320 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8356 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8420 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8464 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8392 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8456 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8564 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8748 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-63191.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63191.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13497.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13497.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8856 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-62890.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62890.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8924 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9016 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9000 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9056 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9088 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11471.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11471.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8340 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-11964.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11964.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9224.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9224.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33345.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33345.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33345.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33345.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8236 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-16817.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16817.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8400 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-27014.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27014.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7745.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7745.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4237.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4237.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20574.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20574.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40994.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40994.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33018.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33018.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37102.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37102.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12021.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12021.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59551.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59551.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43599.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43599.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47875.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47875.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60859.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60859.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45763.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45763.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19443.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19443.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9048 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8364 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9044 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9320 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9348 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9560 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9380 -s 236

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\Unicorn-44546.exe

MD5 8b5a71c514a53a6ed00efda4c5ae5c13
SHA1 dc85b4a306633d691e946b57edbb4d90d21d53eb
SHA256 1dadf72348ad0d85dff29618be103d9b80cc3650f304c580d7b5725b2189088d
SHA512 56e7f321104b3533175497cea5a7882bbf95cd399121dd2dc8f717df0fcee32353865cc26649fb042175a54a73d709b23e4a34369e9228940a7945277dd7ba9d

\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe

MD5 f66396074d93af58582ab447e7828c0b
SHA1 a4ce4aa0ce4b198aa1a663e18e736bf472636d7e
SHA256 662bef1639a13cd1ad2707bb2d0fc149bc19eb34452793d7660b6dedf6c37bea
SHA512 d79506574c546998831ed9c0b30cbdca08e4add842a782043463632e0cd6b4c1314cc2636214daa8062380605873b9546e651e76a1c218fbe9476920670947df

\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe

MD5 347aa9ccc5518570fe8e3cc28a08af71
SHA1 ac1bd5a88bf69bc1ff8ff0e6ef5b78d9d5da0381
SHA256 26540919ede968d69cf9471603504f4d21e7c8956f19b2011bc82d4739781b19
SHA512 0002fa670637a6b31b6613fecaed229dbe31490e581ffd7ae63e827e2310d9d2c5a8239eedea0442cc2e5ec8e22eb6961a11a36306ac6c25501844377640b18f

\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe

MD5 9e5ff1b687e46018b4abcbf1ae37c731
SHA1 1680ef8b35578716ddfd112f74032fbb16e4660b
SHA256 2c1097eab976fd488fc3debeb36064e56ad82a68993663806b90990b8511b50d
SHA512 fe0fb9a49af9e2a27d69ffbd38949368258d020597f5a967282077e6f531391d1f573fd8354afbcda90ed883d8e6c2c7f81595ca93f8e342f240b6027bda8bb6

C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe

MD5 7d46d65ddd9f59700e73b7b097c1f9ab
SHA1 b8f7ddf76bfdb6a22904912000f97881a6965e04
SHA256 18f253948e0a241df6c71313acac4874acd0a68372cfb58a1e6f3e2899fb5cf6
SHA512 0f43f03a4b42b45897b1f36d3096d99c4ae8d3d4c9afa4e1d9d8d1b3294d9eec7f9a66cfef5708ccd8d197650a2796090d628168974731491b4f375ee346e081

C:\Users\Admin\AppData\Local\Temp\Unicorn-34597.exe

MD5 492efcf614e67c2b188ea7b50fd79ebd
SHA1 81326459de674fcd10dc0cdf49537f2b6976c3eb
SHA256 b22df112657d45c0be31e174b3c06227c5ac67897a6275abb436ef7a726f3c01
SHA512 ce58b5e7bca15e5cf92bf4550fc9fbb9b16b1b5124cf6067dca619141ab6dbe5f4307d41472496ee7029cbda4bb5e5239e066d3560df1311197ae9d37134a24a

\Users\Admin\AppData\Local\Temp\Unicorn-44001.exe

MD5 4a1f6ab92b331e31cb18cd5168d7a472
SHA1 647425e789ac57ae01e231457f2cac81d4d0211c
SHA256 2f7de3418a4d689fec56bc2535b7f6dd415302767f1a19e5487211c9bce5034e
SHA512 fb7319c01b008b9da6083115c88cb70e530208159ee4cb993f5a85f64a6bae5951764f811bf32e62d056d5f0500a62d972a9fd8205eb520106a34d0941cac743

\Users\Admin\AppData\Local\Temp\Unicorn-63866.exe

MD5 63be9f8e5169f9404095463596e92ab6
SHA1 0a32c0bad9a755c190a4f5b36364d720f0332403
SHA256 e86faac92e87bfeb04cbf02812400d738e684a600aa7dc61338335663db9b9e8
SHA512 317ca1265e9f61608e37f83bc8089697c62ebb4a8682956d6bc6e2b83a92f7372a3309ad56bc68e661d538e6ad541983d37100fad7831f3b74f9aaadb9e12b7e

\Users\Admin\AppData\Local\Temp\Unicorn-8204.exe

MD5 605820050a97e9dbe1a29eb891c16f32
SHA1 0fe1bbaa53f0a02489baa3a488a875a82dc6c1bd
SHA256 100faf94fb2c75ec3170708296f5537fcc93282e5126a66422b72984fa328ae5
SHA512 85ef2b7adbe97ee3ab5becaf1bdb178a945d08ab286c8b686ce468e3471d45f06a308144e5de4b471974c47e18f31f8029d657e701930d0fa3f89cfaa6ae6bb0

\Users\Admin\AppData\Local\Temp\Unicorn-28070.exe

MD5 f4850babc97448040268f7fbd139480c
SHA1 906af761263a01810faacb1095777ff93ef17778
SHA256 5ccefc53a1db8235fb2cc68d4fdc0311cb213d813255d4a0d2562826d30abb41
SHA512 effd951750b81209e115c2929077f7e0d0e4657ec824030466a301fe8f59c1cfc5ddeef5cff5903c85b13a9b7e5ae8272a77dcc40b3777e7daa924188194d589

\Users\Admin\AppData\Local\Temp\Unicorn-62169.exe

MD5 554a4d5fd62ec489b1d30ca81a846d1e
SHA1 e4ae62e5ad4b3509b8299783d54fc6b4594545ec
SHA256 df0bfd80ec453c87b48b988ba61bef854261391f72e45953ca1d6adb0a920cb4
SHA512 f1accecde7278aaf696f3184116a5767350cee420cdf0ea104e409faa480086968bd525f8fde099d376b56666abaec25311302d0fa8ce156aa6605b1a2f09a77

C:\Users\Admin\AppData\Local\Temp\Unicorn-58640.exe

MD5 e259c85692cf82a764d3c3358aa53b30
SHA1 be143066a72326aa752629f02799b1648465f6e9
SHA256 727dde02bd655ea6abd39687330163e39e64d7efb9c5ab538b42b6493ebaff80
SHA512 bbc0b86ed4748ea194f9872460efd035566453b20dc61ca87056327dfee5fb01efb5ed0a153e78f996b112d73505abce4f3f9ac57d7a4892589dac5a8e64c00f

C:\Users\Admin\AppData\Local\Temp\Unicorn-39776.exe

MD5 0c58cb2f9370bbac85627e467d359b60
SHA1 d2e7721c799ae8f121791d52f1dcf475febea304
SHA256 710ac40fc68d796f05326de456707127b2cd68fd753646f8b4080e6057e0415e
SHA512 21d32f1d8f9ec3289094ae12c48601c21bebcd73a9dfea111048dc7492ef7c27873b40b36f44a8c26759546c6730beccb14e2c683d611365ee104c6619e39e1b

C:\Users\Admin\AppData\Local\Temp\Unicorn-10623.exe

MD5 0f70d7adacdc8e4bf098d402d9c8d7a5
SHA1 0fd07a012852b7f3d50ac431e8e092b273b8bafc
SHA256 8007e807a86d44dc5479c00ff6578d8ebbf7d6cf9f556a235f2f47588d8ee1d7
SHA512 69d7be6ff0f141566d38896dcc62ca1990bcfc3f5e99cb05917b62d832d980f7868f7d441c90628e19b3ee65e0fe37aca60cdeee935b63acbccde7d8fbd8b9e9

C:\Users\Admin\AppData\Local\Temp\Unicorn-6399.exe

MD5 2a606678131aae5204b121d59dcc7fd6
SHA1 7a309b217f8f32b225b10701474d6ccae54c02ca
SHA256 0aca3d4678cdda4207098f768cb313890aa50274c6b7504a567cc805777908f4
SHA512 72d388800f8e8ffc381f8d39f2fb8968bd3bc18527e4d22217f5cce25770d2d1dd833a54a69df58bce3d37c0157b3dbabcc18d9411643182f6eed00315af0afb

C:\Users\Admin\AppData\Local\Temp\Unicorn-6306.exe

MD5 9b0c062b0b9e2ab14e30b0461426c456
SHA1 73ca2f2c3e57986cf086735072cc03f13f1c7057
SHA256 8e286d3ca93bc50303e4791b18c911b7746d24d20321e914aad6a360c597881a
SHA512 54fe75d58c7113d531381db6c99bd9c5eb4624b1280428c29e87afd319caae66cc2216a988cc9989a428be87dc3f42a1c7282f3afdaff77937e0675fa76697a7

C:\Users\Admin\AppData\Local\Temp\Unicorn-23601.exe

MD5 87f1ce586441e46291ab631153c4855e
SHA1 eb191020afe381dbd872783889600a52ce37634e
SHA256 547a7202cd305f77df6e4060a010d6c3d38a9bf0562db4726e6ded4ab53df772
SHA512 9b3420fba371fa2e410c7220bb79df1303d53742cf3b54781deba7dc250bae0a2fee8bc94f69da171aa014cd85f1283134632f0135ef107e09563bcad63f5e85

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-30 14:06

Reported

2024-05-30 14:09

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fd8fb9ec553e04b27a477b4741433580_NeikiAnalytics.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25828.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26382.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16036.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12506.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15770.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15407.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15407.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56995.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62792.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54048.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54240.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54240.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54240.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38458.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50711.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44100.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32402.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19404.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48376.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24426.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4411.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62335.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24832.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20918.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20918.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48952.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48952.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55688.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6487.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56243.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55880.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44183.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44183.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26908.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31546.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32144.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24530.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27484.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15039.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3342.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31760.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31760.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-28230.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60348.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60903.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38318.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4899.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4899.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17322.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-45911.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54676.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1391.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1391.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6030.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22174.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50208.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\fd8fb9ec553e04b27a477b4741433580_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25828.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26382.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-16036.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12506.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15770.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15407.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15407.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-56995.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-62792.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59263.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54048.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54240.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54240.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54240.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38458.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32402.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44100.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24832.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48376.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20918.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33000.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20918.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-56243.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63420.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-40430.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35600.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-40430.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34552.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29124.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54972.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9258.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12714.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53000.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48916.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34116.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48916.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-23150.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48252.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-45320.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-47292.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63192.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-52284.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24620.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-39368.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31200.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17966.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54308.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44132.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-11651.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32072.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35772.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-46436.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25632.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42906.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17464.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-49295.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14147.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-47396.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-52248.exe

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\fd8fb9ec553e04b27a477b4741433580_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25828.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26382.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16036.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12506.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15770.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15407.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15407.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56995.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62792.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59263.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54048.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54240.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54240.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54240.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50711.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38458.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44100.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32402.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19404.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48376.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24426.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4411.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62335.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24832.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48952.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20918.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48952.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20918.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55688.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6487.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56243.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44183.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55880.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44183.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26908.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31546.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32144.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24530.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27484.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3342.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31760.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15039.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31760.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-28230.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60348.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60903.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38318.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4899.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4899.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17322.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-45911.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54676.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6030.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50208.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22174.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54484.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4788 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Local\Temp\fd8fb9ec553e04b27a477b4741433580_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe
PID 4788 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Local\Temp\fd8fb9ec553e04b27a477b4741433580_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe
PID 4788 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Local\Temp\fd8fb9ec553e04b27a477b4741433580_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe
PID 3944 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25828.exe
PID 3944 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25828.exe
PID 3944 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25828.exe
PID 4788 wrote to memory of 5080 N/A C:\Users\Admin\AppData\Local\Temp\fd8fb9ec553e04b27a477b4741433580_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26382.exe
PID 4788 wrote to memory of 5080 N/A C:\Users\Admin\AppData\Local\Temp\fd8fb9ec553e04b27a477b4741433580_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26382.exe
PID 4788 wrote to memory of 5080 N/A C:\Users\Admin\AppData\Local\Temp\fd8fb9ec553e04b27a477b4741433580_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26382.exe
PID 2012 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25828.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-16036.exe
PID 2012 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25828.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-16036.exe
PID 2012 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25828.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-16036.exe
PID 3944 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12506.exe
PID 3944 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12506.exe
PID 3944 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12506.exe
PID 5080 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26382.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe
PID 5080 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26382.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe
PID 5080 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26382.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe
PID 1416 wrote to memory of 4196 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16036.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe
PID 1416 wrote to memory of 4196 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16036.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe
PID 1416 wrote to memory of 4196 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16036.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe
PID 2012 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25828.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15770.exe
PID 2012 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25828.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15770.exe
PID 2012 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25828.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15770.exe
PID 4052 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15407.exe
PID 4052 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15407.exe
PID 4052 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15407.exe
PID 5060 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12506.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15407.exe
PID 5060 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12506.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15407.exe
PID 5060 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12506.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15407.exe
PID 5080 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26382.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-56995.exe
PID 5080 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26382.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-56995.exe
PID 5080 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26382.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-56995.exe
PID 4196 wrote to memory of 220 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-62792.exe
PID 4196 wrote to memory of 220 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-62792.exe
PID 4196 wrote to memory of 220 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-62792.exe
PID 1416 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16036.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59263.exe
PID 1416 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16036.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59263.exe
PID 1416 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16036.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59263.exe
PID 3200 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15770.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54048.exe
PID 3200 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15770.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54048.exe
PID 3200 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15770.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54048.exe
PID 3300 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56995.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54240.exe
PID 3300 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56995.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54240.exe
PID 3300 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56995.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54240.exe
PID 2332 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15407.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54240.exe
PID 2332 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15407.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54240.exe
PID 2332 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15407.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54240.exe
PID 2212 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15407.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54240.exe
PID 2212 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15407.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54240.exe
PID 2212 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15407.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54240.exe
PID 5060 wrote to memory of 4232 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12506.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38458.exe
PID 5060 wrote to memory of 4232 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12506.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38458.exe
PID 5060 wrote to memory of 4232 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12506.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38458.exe
PID 4052 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-50711.exe
PID 4052 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-50711.exe
PID 4052 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-50711.exe
PID 220 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62792.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44100.exe
PID 220 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62792.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44100.exe
PID 220 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62792.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44100.exe
PID 4196 wrote to memory of 3252 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32402.exe
PID 4196 wrote to memory of 3252 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32402.exe
PID 4196 wrote to memory of 3252 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32402.exe
PID 612 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59263.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19404.exe

Processes

C:\Users\Admin\AppData\Local\Temp\fd8fb9ec553e04b27a477b4741433580_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\fd8fb9ec553e04b27a477b4741433580_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25828.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25828.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26382.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26382.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4788 -ip 4788

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 740

C:\Users\Admin\AppData\Local\Temp\Unicorn-16036.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16036.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12506.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12506.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3944 -ip 3944

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 752

C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15770.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15770.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15407.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15407.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15407.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15407.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56995.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56995.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2012 -ip 2012

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 756

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5080 -ip 5080

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 740

C:\Users\Admin\AppData\Local\Temp\Unicorn-62792.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62792.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59263.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59263.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54048.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54048.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54240.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54240.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54240.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54240.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54240.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54240.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38458.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38458.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50711.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50711.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1416 -ip 1416

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1416 -s 764

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4052 -ip 4052

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5060 -ip 5060

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 708

C:\Users\Admin\AppData\Local\Temp\Unicorn-44100.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44100.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32402.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32402.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19404.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19404.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48376.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48376.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24426.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24426.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4411.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4411.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62335.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62335.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24832.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24832.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33000.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33000.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20918.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20918.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20918.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20918.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48952.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48952.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48952.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48952.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4196 -ip 4196

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 756

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3200 -ip 3200

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2212 -ip 2212

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3300 -ip 3300

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 752

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2332 -ip 2332

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3300 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 712

C:\Users\Admin\AppData\Local\Temp\Unicorn-55688.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55688.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6487.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6487.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56243.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56243.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55880.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55880.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44183.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44183.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44183.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44183.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26908.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26908.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31546.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31546.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32144.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32144.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24530.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24530.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27484.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27484.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15039.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15039.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3342.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3342.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31760.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31760.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31760.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31760.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28230.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28230.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60348.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60348.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60903.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60903.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 220 -ip 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 612 -ip 612

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 920 -ip 920

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 544

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 612 -s 744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 748

C:\Users\Admin\AppData\Local\Temp\Unicorn-38318.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38318.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4899.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4899.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4899.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4899.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2640 -ip 2640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 764 -ip 764

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2372 -ip 2372

C:\Users\Admin\AppData\Local\Temp\Unicorn-17322.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17322.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4232 -ip 4232

C:\Users\Admin\AppData\Local\Temp\Unicorn-45911.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45911.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-239.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-239.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2404 -ip 2404

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 764

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 724

C:\Users\Admin\AppData\Local\Temp\Unicorn-54676.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54676.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1391.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1391.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1391.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1391.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6030.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6030.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22004.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22004.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22174.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22174.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50208.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50208.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54484.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54484.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54484.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54484.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62652.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62652.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35578.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35578.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35578.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35578.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63420.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63420.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18304.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18304.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26472.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26472.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26472.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26472.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26472.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26472.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26472.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26472.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32262.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32262.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40430.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40430.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40430.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40430.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56767.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56767.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56767.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56767.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 4136 -ip 4136

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3252 -ip 3252

C:\Users\Admin\AppData\Local\Temp\Unicorn-42106.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42106.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23540.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23540.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1776 -ip 1776

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 3188 -ip 3188

C:\Users\Admin\AppData\Local\Temp\Unicorn-35600.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35600.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47852.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47852.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2456 -ip 2456

C:\Users\Admin\AppData\Local\Temp\Unicorn-41198.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41198.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41198.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41198.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 716

C:\Users\Admin\AppData\Local\Temp\Unicorn-36752.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36752.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12802.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12802.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32668.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32668.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32668.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32668.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 740

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4512 -ip 4512

C:\Users\Admin\AppData\Local\Temp\Unicorn-45475.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45475.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56596.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56596.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7395.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7395.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 756

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 5096 -ip 5096

C:\Users\Admin\AppData\Local\Temp\Unicorn-4058.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4058.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29124.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29124.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29124.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29124.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29124.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29124.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9258.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9258.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5366.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5366.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49736.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49736.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38038.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38038.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50291.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50291.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4043.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4043.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4043.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4043.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4982.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4982.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4982.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4982.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41738.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41738.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41738.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41738.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12979.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12979.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18408.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18408.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34360.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34360.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1376 -ip 1376

C:\Users\Admin\AppData\Local\Temp\Unicorn-46804.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46804.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54972.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54972.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13747.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13747.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34552.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34552.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9663.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9663.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4504 -ip 4504

C:\Users\Admin\AppData\Local\Temp\Unicorn-5579.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5579.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 4104 -ip 4104

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 736

C:\Users\Admin\AppData\Local\Temp\Unicorn-52040.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52040.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 388 -ip 388

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 2948 -ip 2948

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 740

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2940 -ip 2940

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4904 -ip 4904

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 1844 -ip 1844

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1604 -ip 1604

C:\Users\Admin\AppData\Local\Temp\Unicorn-59824.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59824.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14707.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14707.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14707.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14707.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28112.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28112.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 2296 -ip 2296

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 4528 -ip 4528

C:\Users\Admin\AppData\Local\Temp\Unicorn-59824.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59824.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24220.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24220.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7499.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7499.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52808.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52808.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 384 -ip 384

C:\Users\Admin\AppData\Local\Temp\Unicorn-27728.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27728.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 2576 -ip 2576

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1952 -ip 1952

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 388 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3272 -ip 3272

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3720 -ip 3720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 4152 -ip 4152

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 4340 -ip 4340

C:\Users\Admin\AppData\Local\Temp\Unicorn-12714.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12714.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32580.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32580.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40748.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40748.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53000.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53000.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48916.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48916.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48916.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48916.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61168.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61168.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65252.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65252.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 4568 -ip 4568

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 1032 -ip 1032

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3772 -ip 3772

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4488 -ip 4488

C:\Users\Admin\AppData\Local\Temp\Unicorn-29840.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29840.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25756.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25756.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54344.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54344.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54344.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54344.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42092.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42092.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1912 -ip 1912

C:\Users\Admin\AppData\Local\Temp\Unicorn-1059.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1059.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3120 -ip 3120

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 3180 -ip 3180

C:\Users\Admin\AppData\Local\Temp\Unicorn-10550.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10550.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46752.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46752.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 880 -ip 880

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2176 -ip 2176

C:\Users\Admin\AppData\Local\Temp\Unicorn-6658.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6658.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 3916 -ip 3916

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 3832 -ip 3832

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3160 -ip 3160

C:\Users\Admin\AppData\Local\Temp\Unicorn-18164.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18164.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38200.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38200.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34116.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34116.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34116.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34116.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 4160 -ip 4160

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 1916 -ip 1916

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 4604 -ip 4604

C:\Users\Admin\AppData\Local\Temp\Unicorn-1443.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1443.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3296 -ip 3296

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1996 -ip 1996

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 3176 -ip 3176

C:\Users\Admin\AppData\Local\Temp\Unicorn-2730.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2730.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23150.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23150.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23150.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23150.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4508 -ip 4508

C:\Users\Admin\AppData\Local\Temp\Unicorn-31318.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31318.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5076 -ip 5076

C:\Users\Admin\AppData\Local\Temp\Unicorn-51376.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51376.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47292.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47292.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 2636 -ip 2636

C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 4220 -ip 4220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 756 -ip 756

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 2556 -ip 2556

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 5056 -ip 5056

C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 1684 -ip 1684

C:\Users\Admin\AppData\Local\Temp\Unicorn-48252.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48252.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48252.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48252.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15772.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15772.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48444.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48444.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1092 -ip 1092

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 3748 -ip 3748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 1524 -ip 1524

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 3480 -ip 3480

C:\Users\Admin\AppData\Local\Temp\Unicorn-48615.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48615.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4744 -ip 4744

C:\Users\Admin\AppData\Local\Temp\Unicorn-12071.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12071.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 220 -ip 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3300 -ip 3300

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 652

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4584 -ip 4584

C:\Users\Admin\AppData\Local\Temp\Unicorn-52912.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52912.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52912.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52912.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 628

C:\Users\Admin\AppData\Local\Temp\Unicorn-61080.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61080.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61080.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61080.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56996.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56996.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56996.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56996.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2288 -ip 2288

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 4776 -ip 4776

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 4920 -ip 4920

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3196 -ip 3196

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 3448 -ip 3448

C:\Users\Admin\AppData\Local\Temp\Unicorn-16732.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16732.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3736 -ip 3736

C:\Users\Admin\AppData\Local\Temp\Unicorn-45320.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45320.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 1940 -ip 1940

C:\Users\Admin\AppData\Local\Temp\Unicorn-49404.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49404.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 3440 -ip 3440

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 1004 -ip 1004

C:\Users\Admin\AppData\Local\Temp\Unicorn-42388.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42388.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54640.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54640.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3584 -ip 3584

C:\Users\Admin\AppData\Local\Temp\Unicorn-13607.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13607.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18076.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18076.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18076.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18076.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 1072 -ip 1072

C:\Users\Admin\AppData\Local\Temp\Unicorn-38496.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38496.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 1560 -ip 1560

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 2072 -ip 2072

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1860 -ip 1860

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 464 -ip 464

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 1172 -ip 1172

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 408 -ip 408

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 2724 -ip 2724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 2816 -ip 2816

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 4132 -ip 4132

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 4512 -ip 4512

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 5204 -ip 5204

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 3588 -ip 3588

C:\Users\Admin\AppData\Local\Temp\Unicorn-35542.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35542.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5300 -ip 5300

C:\Users\Admin\AppData\Local\Temp\Unicorn-2123.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2123.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2123.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2123.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 5412 -ip 5412

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 5268 -ip 5268

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4732 -ip 4732

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5420 -ip 5420

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5380 -ip 5380

C:\Users\Admin\AppData\Local\Temp\Unicorn-55024.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55024.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55024.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55024.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63192.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63192.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42772.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42772.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5823.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5823.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47048.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47048.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2408 -ip 2408

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 2464 -ip 2464

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5412 -s 624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5380 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 652

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 1392 -ip 1392

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 5472 -ip 5472

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 5540 -ip 5540

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 532

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5404 -ip 5404

C:\Users\Admin\AppData\Local\Temp\Unicorn-27780.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27780.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20166.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20166.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20166.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20166.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5760 -ip 5760

C:\Users\Admin\AppData\Local\Temp\Unicorn-52284.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52284.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52284.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52284.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52284.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52284.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52284.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52284.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 5372 -ip 5372

C:\Users\Admin\AppData\Local\Temp\Unicorn-11251.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11251.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11251.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11251.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39456.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39456.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5968 -ip 5968

C:\Users\Admin\AppData\Local\Temp\Unicorn-11251.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11251.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5928 -ip 5928

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5916 -ip 5916

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 5828 -ip 5828

C:\Users\Admin\AppData\Local\Temp\Unicorn-7743.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7743.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 5868 -ip 5868

C:\Users\Admin\AppData\Local\Temp\Unicorn-61583.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61583.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11827.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11827.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28548.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28548.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 6052 -ip 6052

C:\Users\Admin\AppData\Local\Temp\Unicorn-65304.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65304.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7743.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7743.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61583.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61583.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32056.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32056.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 5188 -ip 5188

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 4956 -ip 4956

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 5172 -ip 5172

C:\Users\Admin\AppData\Local\Temp\Unicorn-4583.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4583.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20536.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20536.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24620.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24620.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32788.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32788.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5244 -ip 5244

C:\Users\Admin\AppData\Local\Temp\Unicorn-25174.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25174.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45040.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45040.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4200 -ip 4200

C:\Users\Admin\AppData\Local\Temp\Unicorn-57292.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57292.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5188 -s 724

C:\Users\Admin\AppData\Local\Temp\Unicorn-49124.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49124.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5152 -ip 5152

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 3452 -ip 3452

C:\Users\Admin\AppData\Local\Temp\Unicorn-9435.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9435.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9435.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9435.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5244 -s 552

C:\Users\Admin\AppData\Local\Temp\Unicorn-54360.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54360.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5796 -ip 5796

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5620 -ip 5620

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 5804 -ip 5804

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5152 -s 752

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 6112 -ip 6112

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 5820 -ip 5820

C:\Users\Admin\AppData\Local\Temp\Unicorn-46939.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46939.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46939.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46939.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29472.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29472.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37832.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37832.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33748.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33748.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34302.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34302.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 5648 -ip 5648

C:\Users\Admin\AppData\Local\Temp\Unicorn-13882.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13882.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34302.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34302.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17966.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17966.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 5812 -ip 5812

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 5980 -ip 5980

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 6136 -ip 6136

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 5324 -ip 5324

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 4528 -ip 4528

C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59020.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59020.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59020.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59020.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59020.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59020.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59020.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59020.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3358.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3358.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 6036 -ip 6036

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 6024 -ip 6024

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 612 -ip 612

C:\Users\Admin\AppData\Local\Temp\Unicorn-43815.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43815.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5768 -ip 5768

C:\Users\Admin\AppData\Local\Temp\Unicorn-23032.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23032.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23032.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23032.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 5596 -ip 5596

C:\Users\Admin\AppData\Local\Temp\Unicorn-31200.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31200.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31200.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31200.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39368.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39368.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39368.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39368.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52175.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6024 -s 740

C:\Users\Admin\AppData\Local\Temp\Unicorn-39368.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39368.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5292 -ip 5292

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2268 -ip 2268

C:\Users\Admin\AppData\Local\Temp\Unicorn-57603.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57603.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 5696 -ip 5696

C:\Users\Admin\AppData\Local\Temp\Unicorn-36990.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36990.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56856.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56856.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56856.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56856.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5992 -ip 5992

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 6040 -ip 6040

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5292 -s 640

C:\Users\Admin\AppData\Local\Temp\Unicorn-28438.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28438.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28438.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28438.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4312 -ip 4312

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5936 -ip 5936

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1924 -ip 1924

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6040 -s 724

C:\Users\Admin\AppData\Local\Temp\Unicorn-4147.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4147.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5696 -s 664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 3956 -ip 3956

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3232 -ip 3232

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 1416 -ip 1416

C:\Users\Admin\AppData\Local\Temp\Unicorn-57624.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57624.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 6064 -ip 6064

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 5824 -ip 5824

C:\Users\Admin\AppData\Local\Temp\Unicorn-53711.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53711.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53711.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53711.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53711.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53711.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53711.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53711.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21444.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21444.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 5076 -ip 5076

C:\Users\Admin\AppData\Local\Temp\Unicorn-831.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-831.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50224.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50224.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50224.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50224.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54308.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54308.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58392.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58392.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58392.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58392.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58392.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58392.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58392.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58392.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54308.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54308.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58392.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58392.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54308.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54308.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58392.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58392.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4424 -ip 4424

C:\Users\Admin\AppData\Local\Temp\Unicorn-54308.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54308.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54308.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54308.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 1928 -ip 1928

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5672 -ip 5672

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 2440 -ip 2440

C:\Users\Admin\AppData\Local\Temp\Unicorn-21806.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21806.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3200 -ip 3200

C:\Users\Admin\AppData\Local\Temp\Unicorn-26296.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26296.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63052.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63052.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63052.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63052.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 3176 -ip 3176

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2348 -ip 2348

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 2176 -ip 2176

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 4276 -ip 4276

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5672 -s 736

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 1920 -ip 1920

C:\Users\Admin\AppData\Local\Temp\Unicorn-18860.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18860.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43364.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43364.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 5640 -ip 5640

C:\Users\Admin\AppData\Local\Temp\Unicorn-27774.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27774.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 1848 -ip 1848

C:\Users\Admin\AppData\Local\Temp\Unicorn-22752.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22752.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3276 -ip 3276

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 4476 -ip 4476

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 5388 -ip 5388

C:\Users\Admin\AppData\Local\Temp\Unicorn-40048.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40048.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40048.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40048.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56384.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56384.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 5200 -ip 5200

C:\Users\Admin\AppData\Local\Temp\Unicorn-44132.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44132.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64552.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64552.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52300.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52300.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32072.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32072.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11651.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11651.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4052 -ip 4052

C:\Users\Admin\AppData\Local\Temp\Unicorn-35580.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35580.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1016 -ip 1016

C:\Users\Admin\AppData\Local\Temp\Unicorn-31688.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31688.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35772.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35772.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35772.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35772.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48024.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48024.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48024.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48024.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 2636 -ip 2636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 1496 -ip 1496

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 3792 -ip 3792

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 6028 -ip 6028

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 5888 -ip 5888

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4364 -ip 4364

C:\Users\Admin\AppData\Local\Temp\Unicorn-7951.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7951.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7951.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7951.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5744 -ip 5744

C:\Users\Admin\AppData\Local\Temp\Unicorn-17080.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17080.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 5708 -ip 5708

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 1108 -ip 1108

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 2084 -ip 2084

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 1004 -ip 1004

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4604 -ip 4604

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5888 -s 624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 5016 -ip 5016

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 4520 -ip 4520

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 1320 -ip 1320

C:\Users\Admin\AppData\Local\Temp\Unicorn-42352.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42352.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46436.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46436.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54604.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54604.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54604.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54604.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42906.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42906.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 3224 -ip 3224

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 2700 -ip 2700

C:\Users\Admin\AppData\Local\Temp\Unicorn-17464.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17464.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25632.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25632.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 2404 -ip 2404

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 5612 -ip 5612

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 1032 -ip 1032

C:\Users\Admin\AppData\Local\Temp\Unicorn-14126.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14126.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14126.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14126.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14126.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14126.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 5316 -ip 5316

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 2724 -ip 2724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 3100 -ip 3100

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 5344 -ip 5344

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 4504 -ip 4504

C:\Users\Admin\AppData\Local\Temp\Unicorn-31060.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31060.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47396.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47396.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 2272 -ip 2272

C:\Users\Admin\AppData\Local\Temp\Unicorn-14147.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14147.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 440 -ip 440

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 5524 -ip 5524

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 4164 -ip 4164

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 1504 -ip 1504

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 4104 -ip 4104

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 4392 -ip 4392

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 5464 -ip 5464

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5524 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 5484 -ip 5484

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 1940 -ip 1940

C:\Users\Admin\AppData\Local\Temp\Unicorn-52248.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52248.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 5156 -ip 5156

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 5252 -ip 5252

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 5972 -ip 5972

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 5192 -ip 5192

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 4708 -ip 4708

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 4336 -ip 4336

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 3588 -ip 3588

C:\Users\Admin\AppData\Local\Temp\Unicorn-55948.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55948.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 3556 -ip 3556

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 6092 -ip 6092

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5500 -ip 5500

C:\Users\Admin\AppData\Local\Temp\Unicorn-49295.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49295.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49295.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49295.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41126.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41126.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12175.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 4944 -ip 4944

C:\Users\Admin\AppData\Local\Temp\Unicorn-20344.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20344.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20344.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20344.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 2372 -ip 2372

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 5360 -ip 5360

C:\Users\Admin\AppData\Local\Temp\Unicorn-48932.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48932.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 5092 -ip 5092

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 3736 -ip 3736

C:\Users\Admin\AppData\Local\Temp\Unicorn-36104.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36104.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 5384 -ip 5384

C:\Users\Admin\AppData\Local\Temp\Unicorn-60608.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60608.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3239.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3239.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3239.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3239.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3239.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3239.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7707.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7707.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7707.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7707.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1960 -ip 1960

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4536 -ip 4536

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 5260 -ip 5260

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 5832 -ip 5832

C:\Users\Admin\AppData\Local\Temp\Unicorn-33424.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33424.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 4200 -ip 4200

C:\Users\Admin\AppData\Local\Temp\Unicorn-41592.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41592.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 6120 -ip 6120

C:\Users\Admin\AppData\Local\Temp\Unicorn-46231.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46231.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 604

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 5324 -ip 5324

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3384 -ip 3384

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 4608 -ip 4608

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 3304 -ip 3304

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 1604 -ip 1604

C:\Users\Admin\AppData\Local\Temp\Unicorn-50528.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50528.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17664.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17664.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 2200 -ip 2200

C:\Users\Admin\AppData\Local\Temp\Unicorn-13003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21172.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21172.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21172.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21172.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21172.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21172.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21172.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21172.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 2308 -ip 2308

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 5904 -ip 5904

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 5472 -ip 5472

C:\Users\Admin\AppData\Local\Temp\Unicorn-62396.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62396.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62396.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62396.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 6016 -ip 6016

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 3568 -ip 3568

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 5608 -ip 5608

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 728

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 5008 -ip 5008

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5804 -ip 5804

C:\Users\Admin\AppData\Local\Temp\Unicorn-59464.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59464.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 1560 -ip 1560

C:\Users\Admin\AppData\Local\Temp\Unicorn-51851.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51851.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 3836 -ip 3836

C:\Users\Admin\AppData\Local\Temp\Unicorn-26770.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26770.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39022.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39022.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 3436 -ip 3436

C:\Users\Admin\AppData\Local\Temp\Unicorn-6158.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6158.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10626.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10626.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 5620 -ip 5620

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 4876 -ip 4876

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 5732 -ip 5732

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 1168 -ip 1168

C:\Users\Admin\AppData\Local\Temp\Unicorn-19200.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19200.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27368.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27368.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 5880 -ip 5880

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5924 -ip 5924

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 1792 -ip 1792

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 6116 -ip 6116

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 4452 -ip 4452

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 5340 -ip 5340

C:\Users\Admin\AppData\Local\Temp\Unicorn-47596.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47596.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47596.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47596.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47596.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47596.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47596.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47596.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2924 -ip 2924

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 4352 -ip 4352

C:\Users\Admin\AppData\Local\Temp\Unicorn-28690.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28690.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 5768 -ip 5768

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 5936 -ip 5936

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 5596 -ip 5596

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1276 -ip 1276

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 4928 -ip 4928

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2608 -ip 2608

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 2812 -ip 2812

C:\Users\Admin\AppData\Local\Temp\Unicorn-3631.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3631.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3916 -ip 3916

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 4560 -ip 4560

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4968 -ip 4968

C:\Users\Admin\AppData\Local\Temp\Unicorn-60979.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60979.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1012 -ip 1012

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 5736 -ip 5736

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5864 -ip 5864

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 6020 -ip 6020

C:\Users\Admin\AppData\Local\Temp\Unicorn-7331.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7331.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7331.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7331.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7331.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7331.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7331.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7331.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 5288 -ip 5288

C:\Users\Admin\AppData\Local\Temp\Unicorn-53408.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53408.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 3716 -ip 3716

C:\Users\Admin\AppData\Local\Temp\Unicorn-57492.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57492.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1832 -ip 1832

C:\Users\Admin\AppData\Local\Temp\Unicorn-123.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-123.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6020 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5864 -s 628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4428 -ip 4428

C:\Users\Admin\AppData\Local\Temp\Unicorn-45432.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45432.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 1936 -ip 1936

C:\Users\Admin\AppData\Local\Temp\Unicorn-45987.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45987.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 5240 -ip 5240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5288 -s 664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 436 -ip 436

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5556 -ip 5556

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 3592 -ip 3592

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1836 -ip 1836

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 5764 -ip 5764

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 1848 -ip 1848

C:\Users\Admin\AppData\Local\Temp\Unicorn-24436.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24436.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24436.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24436.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37840.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37840.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37840.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37840.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4404 -ip 4404

C:\Users\Admin\AppData\Local\Temp\Unicorn-42116.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42116.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 3684 -ip 3684

C:\Users\Admin\AppData\Local\Temp\Unicorn-9806.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9806.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25588.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25588.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25588.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25588.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61960.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61960.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61960.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61960.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61960.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61960.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61960.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61960.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 3452 -ip 3452

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5388 -ip 5388

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 5688 -ip 5688

C:\Users\Admin\AppData\Local\Temp\Unicorn-58623.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58623.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58623.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58623.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54539.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54539.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 2168 -ip 2168

C:\Users\Admin\AppData\Local\Temp\Unicorn-25204.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25204.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63112.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63112.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13911.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13911.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63667.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63667.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17996.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17996.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 992 -ip 992

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3012 -ip 3012

C:\Users\Admin\AppData\Local\Temp\Unicorn-39354.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39354.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 656

C:\Users\Admin\AppData\Local\Temp\Unicorn-63859.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63859.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14274.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14274.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26526.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26526.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30610.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30610.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 664

C:\Users\Admin\AppData\Local\Temp\Unicorn-25780.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25780.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25780.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25780.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50668.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50668.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2022.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2022.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 656

C:\Users\Admin\AppData\Local\Temp\Unicorn-3138.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3138.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 712

C:\Users\Admin\AppData\Local\Temp\Unicorn-31172.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31172.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51592.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51592.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27642.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27642.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27642.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27642.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40086.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40086.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39510.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39510.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59376.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59376.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14259.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14259.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 5668 -ip 5668

C:\Users\Admin\AppData\Local\Temp\Unicorn-60528.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60528.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19496.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19496.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32132.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32132.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32132.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32132.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48468.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48468.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48468.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48468.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28602.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28602.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 4752 -ip 4752

C:\Users\Admin\AppData\Local\Temp\Unicorn-65359.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65359.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7606.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7606.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57191.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57191.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11519.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11519.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7798.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7798.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36386.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36386.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56252.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56252.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 3064 -ip 3064

C:\Users\Admin\AppData\Local\Temp\Unicorn-45152.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45152.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57959.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57959.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57959.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57959.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53875.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53875.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62043.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62043.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62043.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62043.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16372.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16372.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5544 -ip 5544

C:\Users\Admin\AppData\Local\Temp\Unicorn-28794.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28794.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61467.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61467.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61467.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61467.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52936.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52936.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61659.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61659.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15988.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15988.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33476.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33476.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33476.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33476.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5544 -s 540

C:\Users\Admin\AppData\Local\Temp\Unicorn-8779.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8779.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16948.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16948.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 3644 -ip 3644

C:\Users\Admin\AppData\Local\Temp\Unicorn-57596.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57596.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37730.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37730.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45899.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45899.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45899.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45899.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-227.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-227.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12479.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12479.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54067.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54067.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62235.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62235.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16564.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16564.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34244.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4776 -ip 4776

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4652 -ip 4652

C:\Users\Admin\AppData\Local\Temp\Unicorn-30906.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30906.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50196.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50196.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 460

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 752

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 2264 -ip 2264

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 5808 -ip 5808

C:\Users\Admin\AppData\Local\Temp\Unicorn-46859.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46859.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1364 -ip 1364

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 776 -ip 776

C:\Users\Admin\AppData\Local\Temp\Unicorn-43180.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43180.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6231.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6231.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14399.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14399.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 4476 -ip 4476

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 2272 -ip 2272

C:\Users\Admin\AppData\Local\Temp\Unicorn-27590.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27590.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30544.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30544.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 2364 -ip 2364

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 3744 -ip 3744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2916 -ip 2916

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 5184 -ip 5184

C:\Users\Admin\AppData\Local\Temp\Unicorn-6999.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6999.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 5588 -ip 5588

C:\Users\Admin\AppData\Local\Temp\Unicorn-15167.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15167.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 6104 -ip 6104

C:\Users\Admin\AppData\Local\Temp\Unicorn-11638.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11638.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 4496 -ip 4496

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 2484 -ip 2484

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 4884 -ip 4884

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 1268 -ip 1268

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 4276 -ip 4276

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 1992 -ip 1992

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 448 -ip 448

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 1540 -ip 1540

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 1996 -ip 1996

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 1416 -ip 1416

C:\Users\Admin\AppData\Local\Temp\Unicorn-12043.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12043.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52500.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 1940 -ip 1940

C:\Users\Admin\AppData\Local\Temp\Unicorn-7383.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7383.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 2848 -ip 2848

C:\Users\Admin\AppData\Local\Temp\Unicorn-15551.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15551.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23720.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23720.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60860.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60860.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45448.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45448.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3736 -ip 3736

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 5752 -ip 5752

C:\Users\Admin\AppData\Local\Temp\Unicorn-46003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29304.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29304.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17052.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17052.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 864 -ip 864

C:\Users\Admin\AppData\Local\Temp\Unicorn-41556.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41556.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20560.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20560.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 6000 -ip 6000

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 5088 -ip 5088

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5196 -ip 5196

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 3696 -ip 3696

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4244 -ip 4244

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 536 -ip 536

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5872 -ip 5872

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 1496 -ip 1496

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 668

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 5552 -ip 5552

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 2540 -ip 2540

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 4944 -ip 4944

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 1420 -ip 1420

C:\Users\Admin\AppData\Local\Temp\Unicorn-29688.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29688.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34732.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34732.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46984.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46984.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 5236 -ip 5236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5552 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 660

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 1844 -ip 1844

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 3984 -ip 3984

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 2172 -ip 2172

C:\Users\Admin\AppData\Local\Temp\Unicorn-59044.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59044.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5832 -ip 5832

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 2624 -ip 2624

C:\Users\Admin\AppData\Local\Temp\Unicorn-19356.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19356.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 5012 -ip 5012

C:\Users\Admin\AppData\Local\Temp\Unicorn-31032.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31032.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 1824 -ip 1824

C:\Users\Admin\AppData\Local\Temp\Unicorn-23056.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23056.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 1672 -ip 1672

C:\Users\Admin\AppData\Local\Temp\Unicorn-31032.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31032.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6527.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6527.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 4604 -ip 4604

C:\Users\Admin\AppData\Local\Temp\Unicorn-14695.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14695.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24016.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24016.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40352.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40352.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3403.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3403.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3403.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3403.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 5260 -ip 5260

C:\Users\Admin\AppData\Local\Temp\Unicorn-44436.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44436.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 5972 -ip 5972

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3272 -ip 3272

C:\Users\Admin\AppData\Local\Temp\Unicorn-48136.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48136.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56304.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56304.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5536 -ip 5536

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 4968 -ip 4968

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 3196 -ip 3196

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1920 -ip 1920

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4040 -ip 4040

C:\Users\Admin\AppData\Local\Temp\Unicorn-17170.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17170.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 6052 -ip 6052

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 5540 -ip 5540

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 5252 -ip 5252

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 3932 -ip 3932

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4660 -ip 4660

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 1952 -ip 1952

C:\Users\Admin\AppData\Local\Temp\Unicorn-40736.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40736.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32568.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32568.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32568.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32568.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32568.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32568.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32568.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32568.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28484.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28484.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 2752 -ip 2752

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 3296 -ip 3296

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 5696 -ip 5696

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 2932 -ip 2932

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3688 -ip 3688

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5564 -ip 5564

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 764 -ip 764

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 1560 -ip 1560

C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 2640 -ip 2640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4848 -ip 4848

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 720

C:\Users\Admin\AppData\Local\Temp\Unicorn-31150.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31150.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31150.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31150.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 5744 -ip 5744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 6092 -ip 6092

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 1792 -ip 1792

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 4928 -ip 4928

C:\Users\Admin\AppData\Local\Temp\Unicorn-31150.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31150.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 1108 -ip 1108

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 664

C:\Users\Admin\AppData\Local\Temp\Unicorn-62884.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62884.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14799.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14799.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 4880 -ip 4880

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 736

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 5476 -ip 5476

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5208 -ip 5208

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 3440 -ip 3440

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4388 -ip 4388

C:\Users\Admin\AppData\Local\Temp\Unicorn-18500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47088.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47088.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 1104 -ip 1104

C:\Users\Admin\AppData\Local\Temp\Unicorn-55256.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55256.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35390.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35390.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31306.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31306.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31306.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31306.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59340.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59340.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59340.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59340.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59340.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59340.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 5360 -ip 5360

C:\Users\Admin\AppData\Local\Temp\Unicorn-55448.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55448.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55448.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55448.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23736.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23736.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 4220 -ip 4220

C:\Users\Admin\AppData\Local\Temp\Unicorn-39688.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39688.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39688.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39688.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 5876 -ip 5876

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4732 -ip 4732

C:\Users\Admin\AppData\Local\Temp\Unicorn-48048.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48048.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48048.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48048.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4804 -ip 4804

C:\Users\Admin\AppData\Local\Temp\Unicorn-61260.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61260.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 5276 -ip 5276

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 6056 -ip 6056

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 2412 -ip 2412

C:\Users\Admin\AppData\Local\Temp\Unicorn-44540.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44540.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44540.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44540.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 5736 -ip 5736

C:\Users\Admin\AppData\Local\Temp\Unicorn-60876.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60876.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65152.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65152.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5272 -ip 5272

C:\Users\Admin\AppData\Local\Temp\Unicorn-21380.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21380.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 6024 -ip 6024

C:\Users\Admin\AppData\Local\Temp\Unicorn-938.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-938.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25442.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25442.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33610.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33610.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 5232 -ip 5232

C:\Users\Admin\AppData\Local\Temp\Unicorn-54031.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54031.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54031.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54031.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54031.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54031.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54031.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54031.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25442.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25442.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41970.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41970.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54031.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54031.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 5920 -ip 5920

Network

Country Destination Domain Proto
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 25.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe

MD5 0c14798a1b9a2d3820e6f48e46229ba2
SHA1 4e57eb9a5e2f14e211122ac1375fe77cb932d4fa
SHA256 6b18ab39b9966e4e005f9f73424ccbebbe6fefca6bb74cbc16ea039c9feac91c
SHA512 a0ecdd908a2c2c45b47fea9485f7daac77a46b52b585dd2dc4c2c5d2e99fc059dd8d9c139d09e88665feebb2bc6c10bb9aa2bb511980c7576c9fd578fd14a033

C:\Users\Admin\AppData\Local\Temp\Unicorn-25828.exe

MD5 af03ae3c0dac7d75e4a687425a2cd925
SHA1 ab7cb5dd26a8fcdb6205d0fbf1a9fd0177c13521
SHA256 7c859975f22cc19304a18875b98c097e993032401b2f2e6a38cbf286da796e4e
SHA512 cf160963b3a5d2a09d894096f5a39988f58ea391a098afff0524593c2c3d942c0998fdcdb9a2d96aa2bdfb62d8c57f942802f0a6a92e321db17bc9ccebcc623e

C:\Users\Admin\AppData\Local\Temp\Unicorn-26382.exe

MD5 c7f602c0a0bbe4694e7a1b438e4573ae
SHA1 382d0fce32c3527a1f6443d7dc79f47be5363408
SHA256 8050c33a2ab91797d1e8d5a28325d16090e854c9900d5789d7ee87a1eb44c513
SHA512 d2c79e24f54f7e180ce707ef370ed1cc20260c193cbe1615da79e0ac92da8cf79975df15025a8348e20a771f68104ae8a844fb2df6fc52f711d01ca4dcce846f

C:\Users\Admin\AppData\Local\Temp\Unicorn-16036.exe

MD5 c5c628c5e9ef97dcb19be52397eecbc6
SHA1 acca870c4c8deda1f808a71e45db48e4ccc44a48
SHA256 62cce7fa0c2952b99b4212b666a22cf1417fe07819acdb506504a77350a2e008
SHA512 4c8d64f8230cf9cbc68bccc5b7c1fc43a238376f825c472f25e32d38950e0e1c873a8d05af226eb81894bfff3bb2298cda08dd0264b41344c6511a2d3ad086ec

C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe

MD5 6afb698245cc383a9583277b21e9529b
SHA1 4832d2a0583d4594f7375404362e6c385d7d8199
SHA256 bda8f9b265f3ca103ee970c2360192e74fb139e3d08845d3fbe12120c31eee5f
SHA512 210919593546e71a9be5d6ffaece42df9cd3d6522030e6539c26748b3ab97c08463bf375e951c2860715f5cb902e453a6ecf38b4c5221a6c69637ce09d54c57b

C:\Users\Admin\AppData\Local\Temp\Unicorn-12506.exe

MD5 8d4deeff3b541e7fe8ca80ecdadc8064
SHA1 cc96082911fc71dbaeb2494af28852e744b5d64d
SHA256 b981ec3af5633abf8b504cf9585eec074d572609878355df0745929626026d4c
SHA512 ea893fcd322173ed06d1b3f32bd5550816cc2c9108a9c02c9e9abfcb2509f3353def26136c152a18e6385941f7a8d0ae9a6f645dcb017f06da6596f1b2ab06ea

C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe

MD5 513d467fa76b405d701eea817283b4d3
SHA1 5125247049e8aacba39c8fe26e2cb3252d486c6c
SHA256 cd8612adb213e86fd20659bacfe184c15e623ea4b6073d2c4f7e02caf79a4376
SHA512 a1f0ab08b2f6cbad894fc7ea49243ae297e14e358b795eb4917f5ea674a14fa557e423ddf1b997246ac4b0dcce9a6d40b5f1e07fe7489ad7bbb8888a637827e5

C:\Users\Admin\AppData\Local\Temp\Unicorn-15770.exe

MD5 966593341a102b9707899c187c2fea23
SHA1 2eab2e09b76be3463fdf49ae4e16b0b2155edd07
SHA256 4d751ca7dd5c36d5be94a2172692a733151c55a77df109315bdbc5c3b2c74dd6
SHA512 1c12cab64266fc5b598d40ab14185ab4049e4025c92435d32f70a8ee69836dd2c3910e8ba99533ff021d5ca45e424386a0e102106f56f46fc54e6a6bca5f532e

C:\Users\Admin\AppData\Local\Temp\Unicorn-15407.exe

MD5 dddc55fbfbebe7fbb9fb7d877a5b97de
SHA1 2a924bf0b5334ec9c88f957a276e85affeee62dd
SHA256 1f25509f3dfb86883a9d91729d32fe61c6c1b3a7fa421b5617e24578cee67b3d
SHA512 bdacf3cdccccbe627317853156ed287bc5cfa88e0f672c518f7ecaf861cdea4fd883e327c3f96058f88c9dc6abb0faedf2b3fd71505c2a450f4ecc0083c2fc8d

C:\Users\Admin\AppData\Local\Temp\Unicorn-56995.exe

MD5 f9c8cf0f6f65b4bbd86a06e280753b9f
SHA1 e375971444cdc070bf49564d7b88e47cabfe92e2
SHA256 adcfea6cc779d424116de7b4d6c6cd04ae8a62f056ebb7e3f5dd4608d091fda0
SHA512 604b0d8dbf39e1131bb1c30a1f596f6f35f7614e37b95291bfa720b794fda04bfd6d263234a128634be23c4a5b4e6174b2442131c87e6c85a33134f5676b6f4f

C:\Users\Admin\AppData\Local\Temp\Unicorn-62792.exe

MD5 63c14d332f0ca94423cfd57d7857f9b9
SHA1 e0428cc62cd3d0de5558ef23cb6b75d8df80436f
SHA256 386a4852f6cf0de61bbc3a350d61d1c15155fd0eb750cfe40dedc4ecbbf7d27c
SHA512 a22ba39820a37d3729c3232df9baf16431dee5e4ea9c87404373955987eff4079407d7e3722cd265b5f3eb69ceba4af72111a87e1c4e749847cd01bb32320246

C:\Users\Admin\AppData\Local\Temp\Unicorn-59263.exe

MD5 41d039b3ea3c10d1dc5c989fcb6f1e11
SHA1 d40ef03465abedcc59d4693f52762837789c2b46
SHA256 aad1aae4e1c3243d783a77700cb26950c83fb5eef1650648092962fef5361079
SHA512 1f0615555be936dcd0772b6d29dc0a4e641df682820b0ebaa1ef606053c63365379777bd1e224ba4c4401500633ffc2805b0e97ff67f365deb6cf859aeac5c56

C:\Users\Admin\AppData\Local\Temp\Unicorn-54048.exe

MD5 453df15231493ddb0d47127cee8a0b82
SHA1 2f2ecbe6f92e2e3397e0b02deaada81bad65db9d
SHA256 c71d55d6de9468f65d98ab8719fe1e087863450d5fbd476fc21eff9f2a7b0a56
SHA512 232b1767debbd9a123fa14938fdd8c39a40e4175c73716283079d203afb605b26340e397da16c4d98172e57ba2a5d63114edc511529c889a1d357fe592afcf42

C:\Users\Admin\AppData\Local\Temp\Unicorn-54240.exe

MD5 e63e16adf8d5797957dea0e6f5c52950
SHA1 a7f46f5594e814525c151f1b6b64fccdf215a1b2
SHA256 f833f6a0a156b88f0f9125c06728ea8b5ad8d37c339df81e170b1caa88acb60e
SHA512 ee5bde49ae6f2b3a5c9b9fc57c560d2d51e7e9e914419e75ecfb78a006dbed01a1bc71efb9f3122b30fddd36b0b6b76aa2f8bea79a90c2750afa74827fc6b49d

C:\Users\Admin\AppData\Local\Temp\Unicorn-38458.exe

MD5 f0a950b959918c5ed9c465791264437d
SHA1 06e5806ca1c3290b97108e8f2e526af4c355ab95
SHA256 5afac1373e298520b23732df7e4b249327aa67578d5e78bae5350779d50a1072
SHA512 207e46343c5e8ec32a7374c0b152c9cfd53e67a32c2b289354b5932135a3717837115678fadf9943070f2ab83752f5d0821078551f91a8bb2410a9af05d524ef

C:\Users\Admin\AppData\Local\Temp\Unicorn-50711.exe

MD5 d09a39813d7131cec31fed9322f7b00f
SHA1 33f8a71e9fe0b8d16f86d1a980e0f86c8ef3873c
SHA256 9219e94f5bc1dcfaf769ab3077bc2102b99b6a4fc8eeb461d7f00c3d8fac8b19
SHA512 bd559f41ba8e85d242f65553fdc553debc4b97d47d14bf4b6b931057315ef231cf97e6a4cf9e00d32b993ae9f531888404b7b5781ea699e1e7ab783723a398db

C:\Users\Admin\AppData\Local\Temp\Unicorn-44100.exe

MD5 ff69e3181fa47bdd5e0c8e29d4c96754
SHA1 5036476cc7ec54a768c3e30e5338308049b6d741
SHA256 e986e4883cc5995860281ed1a64ccd0fe0dbaedfcaec9d671f930d151ab1dd9b
SHA512 2680cb3684b8e7449e2dd3c633243a4881b2bb7690227167c72c810ee195687bbb98174c276b4ce5a1680ae01d70bf71aa45b8262c77cba625b94a3738d9c476

C:\Users\Admin\AppData\Local\Temp\Unicorn-32402.exe

MD5 0666759ed707814584cf359149d2f1ab
SHA1 e982e9d677d48e7e570ec964ba544073c1c9ca0a
SHA256 1e6d81033b4e1a1bccc22f7756fff37713e15c6fd1dd519468b3abbbdd50ca21
SHA512 330268e50ea74cc2451ecc6011b6a463374ccfe1695399e020edf2aac20c2f16a6873e8a757d23a38f2b8526b2f47b734aefe35af6f579dda197b188f591e1f6

C:\Users\Admin\AppData\Local\Temp\Unicorn-19404.exe

MD5 ecd1487b4a934e8449b14dbfb7b0f216
SHA1 d52005e10f70d3c3d5b64637a3edbcfbc4e8c001
SHA256 2390496226a03a38493333f4697e576004c78f967716ff343a152ef907ac394e
SHA512 9a0ab7423d1dadc440f7eb9cbf7858223b68d98264bdeb97341f375094c237c1403d20b3875125e37f4068217a56ab4657d277ba04ec7c41eab422af00a8387a

C:\Users\Admin\AppData\Local\Temp\Unicorn-48376.exe

MD5 97457198e4ebbd04322bca11922ab643
SHA1 7c68f8f9b95e33d29ef33a92940f918b3d62d7cf
SHA256 3757ccd2259412299cbc2dd3e1b18113fb428d67ec05eda188c46ca4d8dc2ecc
SHA512 c2598efa375c19889b2aec40dfd069b9f915353564cbedc782a5dbb0baae045bd96514df0038b01f5ba1743e15c70c8c8534523f5bcaa1305cf380870ed57067

C:\Users\Admin\AppData\Local\Temp\Unicorn-24426.exe

MD5 3443dee9e57c77e00f6d91f5c80c85d9
SHA1 9d29e1db871e81d8c6da10090df1a7b59020d02c
SHA256 0223669b22b5769b28d38c50cd3bc5e824971236ac16eaeedc233a26b5093b70
SHA512 ef385de0df1e3957f4274ddb2c7e260c2294edc9678b1b8d6214eca42b7ab44f28d098165f21ed6f5fc1e2840bc55de72b24cd9c9309f7a4df4fd893bde2baab

C:\Users\Admin\AppData\Local\Temp\Unicorn-4411.exe

MD5 9b134bd8f8b9f84ea3961bc95ebd3a54
SHA1 38ae4e26da8c73db962f30a74d90fe5079addbf3
SHA256 dc1f5926843519721f300ca0e50fc617e7b1eb418f77b936435c10553d6df5f1
SHA512 74c33e578959be12662939fb241f68ee590410f2f7212ad42be3ba03dca06088c4be6350067c37486e883196ee903175b27c84d661a4a74863c042bc5909c0b9

C:\Users\Admin\AppData\Local\Temp\Unicorn-62335.exe

MD5 458e917a22bac942dc51a2c3cdfb027a
SHA1 f8f1a13e0cf0261462c0b7910a673deede40562a
SHA256 793143a05356c2eef3de9109c56fdba2eea7559011382b84eda947564d513454
SHA512 fafbde8e4116fc0c76180f70c507bcdd1ad75cadeb014fbc25a5f66547dbe96cd2222286e5b6ff91b26971d2a7aacbfc17884a30ef75e5a2f707254c2d2da14a

C:\Users\Admin\AppData\Local\Temp\Unicorn-24832.exe

MD5 36eb34df64f1a63d5b2ebb07fd851a72
SHA1 ac3835b4c36d2ff3fa32a0a1488d9ece6b927bd6
SHA256 b420399d7749ef332927b4e8611c7db0d4ebf0a86556a11134c02306ebd6a727
SHA512 296255a09737d1f02c30002beeb724212402ee2fe03fa6c11aeb39191475811fcf5b9121ffb1376aaa8c89da964dcd87d635ee4ddbef8a113bc028d4d363d31c

C:\Users\Admin\AppData\Local\Temp\Unicorn-33000.exe

MD5 1ab070ff9e1676d5281e83e5901399e7
SHA1 5878672580c5e4dbf24776f9f1cb77ebf4284a26
SHA256 ed883dadeff23238a07873f8975c1c9ad0d21efe06b37b1f3ac45d439d0407e7
SHA512 1d8f7175b875e993cc9773a61476f8678ca2001ee6f525092c64d7dcb82c395a74bb7b11a6ada09aa57b5373545f9771ccb7af6806976ace1a1bfdb5232a9e79

C:\Users\Admin\AppData\Local\Temp\Unicorn-20918.exe

MD5 e7334fd5d2c9a813038458505ec9990d
SHA1 1e389564fc29abfca9ac374cbef6f1bbf9fde9da
SHA256 2dbb7c48eae64a0cfaf28e32133ab72d6084ce7e34c83876d11ffb2594bc9d5a
SHA512 e80aab8818a652de55919c94b941f593ec346d3cb45c6b8278607c02958568f87299b754d73bcad3551e6b140ed8438ad84ca75883a5deae7c4168e3cbe40e60

C:\Users\Admin\AppData\Local\Temp\Unicorn-48952.exe

MD5 8d6fbe883eff4c0a0d9d097adb5edd66
SHA1 6c6f6dabdb095eacf8dbbdc90eae5b130adf2d5a
SHA256 3b910559c8a8eb3216ac71acdd9dc9a51bf1c1149160408903855a2f152eac16
SHA512 f310cdffd6e2365d491be02807f250b8808cb26980ebaac13aefa3d0e751256cb97045df5aa2a664c8831ee97767d4249566a81b7060c6d781c742902219aa3a

C:\Users\Admin\AppData\Local\Temp\Unicorn-55688.exe

MD5 47e17b2e132885c157bc4ccef2e45d21
SHA1 31ea56654ee9a9e834e3a1d0d323e3674737613d
SHA256 e0db18e0715bb943d1025e52519f3134a1738045b6e063b73c73b35af13acf72
SHA512 059aaa7759a15bb28bba781655e8fd0188484a0400f761905f42708be6b2b23e711b963a724132c012830925284c4159592423b70731030dfb5d5ffe97763e7b

C:\Users\Admin\AppData\Local\Temp\Unicorn-6487.exe

MD5 38c88acb2ec703b5ba184c581a515717
SHA1 d6739356ffa21f755f59dabc6bff1905d98456e7
SHA256 6b9f2564bd5b7f46cb46d643e0888c54879d03f947eb397a458bb706e6e0c74d
SHA512 7abfac31df0a67df1f65e8f86a799efb609290150641fcf86c4ca8074babe09207bbd84fa7903f4e9bc628d695bf84b4bcc389b5716dba6ba3355810e6dc7766

C:\Users\Admin\AppData\Local\Temp\Unicorn-4899.exe

MD5 4b060be14eeed7e0d92c81116549fa1f
SHA1 598f9d144b4f7c43b55ba9e0bccc3ed90eddc31f
SHA256 06f352b026bbdf1a4a88d9507eab1a3380171b097db21f1e9f63edfd79ba6ec5
SHA512 b36ef2d56cbb5d189e2dbfe7af0aebc4a7c008b732c311b3dec231169be24654e74dcb3793e28475989095d7d629de386f7970ab782a2b3092a4abc790b03a31

C:\Users\Admin\AppData\Local\Temp\Unicorn-34360.exe

MD5 141863721634faa54fb45047bc7fa4e8
SHA1 72ecd0933de28c73e3523918a6e8b03942e32a61
SHA256 b1ea160cd6ceab7a57db33ea603d5f4d5275b1cb74b7cd1d94de7e3d741934f1
SHA512 b49a8bb1ba8bbd955550eeca00819ad802344465186f5c6a2149e6010a66d804ce65fbf5f665f4b064eb252b6003bfc4512189b90a561a1fdedbe2826d30fd20

C:\Users\Admin\AppData\Local\Temp\Unicorn-22636.exe

MD5 e88030dc8b4a65b150c78a39725cf001
SHA1 7e7147250122083deaeb065a7a925b4d74c5b52e
SHA256 d910d77b2a2f4d2ba9d026a85e81f11918ba57c895f5a46db4a9ddfb6b63eb67
SHA512 3fc566125841c8c51e809a060a75777ba600222395b5c287779a281ec18ec73e707a7b03e6c34915e8d543c5813760eb9f63db7903d3a81d5f1256591944e076

C:\Users\Admin\AppData\Local\Temp\Unicorn-42428.exe

MD5 8a3b9074402b5332ccf980f04ef54896
SHA1 81a0532ceb82d2dd7b01425b6ec060117137187e
SHA256 fcc74f9324a0f6dba44c75189420c799e22ecc479fe5c5871d76398f64b69897
SHA512 934cdfe8ead4137d071f2e803538b1ff836ec34537790edabc1ffb41fddc8b8dc92e05720b24b661937a8c63cee01f91f7437efef1bea28cd7f4afd8970a187b

C:\Users\Admin\AppData\Local\Temp\Unicorn-48920.exe

MD5 ef44597501bbf8f7571fb5d971380660
SHA1 895f3c1b9a95165df792b283f38c3b7cbc15401f
SHA256 445f5a7756fe0df6682b08fad8cea764def0388234dba9db93320de36031507d
SHA512 5ad32622e4a83984fa9d1a8873dff59cfb1681eb17d1b2ae4a63f97bd5892f9ac518fc3be1aa1f904aacf08f5fef505c5a7e5a7b148e21701863db4e9de882a8

C:\Users\Admin\AppData\Local\Temp\Unicorn-61172.exe

MD5 f5a3a6cf6d03eff90f642b2b34771362
SHA1 6e9aca816ce93850d1ee31175020da8762d94d15
SHA256 5b25526f4fd17d6bd7b847d3c42cdc815e255b39007b8a319686936ce3bb8ad5
SHA512 818d8f2d0fbae6d3aa5d9c924d4c6258f6c551b0eea725303a999e4f7400c60f8f1126b2bcb67e389398df2cab8d94d85168e14dbaa60b146f7970b23ee16d0c

C:\Users\Admin\AppData\Local\Temp\Unicorn-21116.exe

MD5 0d4bf382232211095caceffb454f61b8
SHA1 f66d8f58d984aa1dcab1cee80227e90388b86506
SHA256 f61b438082bcfaa9252631c40d01f09a0b2755cd7c0f7ba77ba05e8be01014c6
SHA512 232d0c33d944d09830c4a3257f8121a63c3a00880ce6e45770c280c8d6d7690d7cb7765650025dc6aa9748cfbe0f446ec8529867e569b42b2940c631b79e43e3

C:\Users\Admin\AppData\Local\Temp\Unicorn-41152.exe

MD5 b32cc713c798a6ef748fa67d76298d2c
SHA1 1a8a8cdd86ce0254b4c3494a3d794010231808e9
SHA256 0f6af3e8015364e3a9055e1794c815a6ad6706dd3bef7ffe1c764146e256a35d
SHA512 e7d7df667fea5a1f7358766baf20e85f3b6001fd706bb94acc4c7c44863babe710718d34fda4125ed11e6da736de84dcb9018c89273e25f390e0b7e98f51a54c

C:\Users\Admin\AppData\Local\Temp\Unicorn-51219.exe

MD5 af2dbcb5a87bbdbf793a8b176154e330
SHA1 9400cfe7ff97e700bd6f65d172aa2a5b334d370d
SHA256 cb738f44bd6092977aff5f082d0870d4b2cf21c493a33d7472a876328566f5ed
SHA512 1ea07ee5c0f468a721606f66d66767158ae1ceb37adac3bd5570dbdfffa87b31fb0118a3567fc2574517210fc2ed9b017565950526854aa9a025017e115eb1b9

C:\Users\Admin\AppData\Local\Temp\Unicorn-14382.exe

MD5 46cd28e64d499309ce9a33a2c58b29df
SHA1 71e69c5dee146c302d95d08846097318341aeb9e
SHA256 40aa2c3b296cc642dc33bb1738f0998ea55c4c6f8f8c6db086d6046f3dd45cda
SHA512 f8d11586e583b2fc0d53ed5c780634cc1c74ea11270fe4b387a85c4dc2f1f415ff88769837c69d3a0f196fafdeb5641bf131f67d021edf6a8fd97b3d5bf5c370