Malware Analysis Report

2025-06-16 07:16

Sample ID 240531-2b2jpsge35
Target 618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e
SHA256 618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e
Tags
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e

Threat Level: Shows suspicious behavior

The file 618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e was found to be: Shows suspicious behavior.

Malicious Activity Summary


Executes dropped EXE

Loads dropped DLL

Unsigned PE

Program crash

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-05-31 22:25

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-31 22:25

Reported

2024-05-31 22:27

Platform

win7-20240419-en

Max time kernel

150s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30607.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15663.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34220.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13607.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59279.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19036.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29704.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14759.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55792.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31842.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51708.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-28334.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20982.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47707.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-43623.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62652.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58568.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35455.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50400.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50385.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-11490.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3322.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14183.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10099.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34049.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1760.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55621.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14266.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34132.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4474.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48522.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44438.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33617.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62720.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38770.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19742.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19742.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42300.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61329.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57245.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-11573.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-8641.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4557.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15418.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27116.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46145.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53758.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-473.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29808.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9196.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29062.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20894.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4365.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-45953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26924.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57650.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15663.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15663.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30607.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30607.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17718.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34220.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34220.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59279.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59279.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15663.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15663.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13607.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13607.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30607.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30607.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19036.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17718.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15663.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-30607.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34220.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59279.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-13607.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19036.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14759.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55792.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31842.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-28334.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-51708.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20982.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-47707.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-43623.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-62652.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-58568.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35455.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-11490.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-50400.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-50385.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-3322.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14183.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34049.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-10099.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-473.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1760.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14266.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44438.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38770.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-62720.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48522.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-61329.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33617.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4474.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55621.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-45953.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-28870.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26924.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57650.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-46145.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-8641.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19742.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54697.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20894.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4557.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-39752.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4365.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-46529.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-16618.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-13088.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35668.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9196.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-65299.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-60618.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37505.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-41349.exe

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17718.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15663.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30607.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34220.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13607.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59279.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19036.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14759.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29704.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55792.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31842.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-28334.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51708.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20982.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47707.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62652.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58568.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-43623.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35455.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50400.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50385.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-11490.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3322.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10099.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14183.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34049.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1760.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55621.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14266.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34132.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4474.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48522.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44438.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33617.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62720.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19742.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38770.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61329.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42300.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57245.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19742.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-11573.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-8641.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4557.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15418.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27116.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46145.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53758.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9196.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-473.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29808.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20894.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29062.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26924.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-45953.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57650.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1704 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe
PID 1704 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe
PID 1704 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe
PID 1704 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe
PID 2404 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17718.exe
PID 2404 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17718.exe
PID 2404 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17718.exe
PID 2404 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17718.exe
PID 1704 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe
PID 1704 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe
PID 1704 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe
PID 1704 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe
PID 1704 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e.exe C:\Windows\SysWOW64\WerFault.exe
PID 1704 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e.exe C:\Windows\SysWOW64\WerFault.exe
PID 1704 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e.exe C:\Windows\SysWOW64\WerFault.exe
PID 1704 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e.exe C:\Windows\SysWOW64\WerFault.exe
PID 2820 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe
PID 2820 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe
PID 2820 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe
PID 2820 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe
PID 2408 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17718.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15663.exe
PID 2408 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17718.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15663.exe
PID 2408 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17718.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15663.exe
PID 2408 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17718.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15663.exe
PID 2404 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-30607.exe
PID 2404 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-30607.exe
PID 2404 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-30607.exe
PID 2404 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-30607.exe
PID 2404 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe C:\Windows\SysWOW64\WerFault.exe
PID 2404 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe C:\Windows\SysWOW64\WerFault.exe
PID 2404 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe C:\Windows\SysWOW64\WerFault.exe
PID 2404 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe C:\Windows\SysWOW64\WerFault.exe
PID 2820 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe
PID 2820 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe
PID 2820 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe
PID 2820 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe
PID 2656 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34220.exe
PID 2656 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34220.exe
PID 2656 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34220.exe
PID 2656 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34220.exe
PID 2616 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15663.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe
PID 2616 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15663.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe
PID 2616 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15663.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe
PID 2616 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15663.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe
PID 2808 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30607.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-13607.exe
PID 2808 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30607.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-13607.exe
PID 2808 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30607.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-13607.exe
PID 2808 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30607.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-13607.exe
PID 2408 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17718.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59279.exe
PID 2408 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17718.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59279.exe
PID 2408 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17718.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59279.exe
PID 2408 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17718.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59279.exe
PID 2820 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe C:\Windows\SysWOW64\WerFault.exe
PID 2820 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe C:\Windows\SysWOW64\WerFault.exe
PID 2820 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe C:\Windows\SysWOW64\WerFault.exe
PID 2820 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe C:\Windows\SysWOW64\WerFault.exe
PID 2408 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17718.exe C:\Windows\SysWOW64\WerFault.exe
PID 2408 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17718.exe C:\Windows\SysWOW64\WerFault.exe
PID 2408 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17718.exe C:\Windows\SysWOW64\WerFault.exe
PID 2408 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17718.exe C:\Windows\SysWOW64\WerFault.exe
PID 2288 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19036.exe
PID 2288 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19036.exe
PID 2288 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19036.exe
PID 2288 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19036.exe

Processes

C:\Users\Admin\AppData\Local\Temp\618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e.exe

"C:\Users\Admin\AppData\Local\Temp\618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e.exe"

C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17718.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17718.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15663.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15663.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30607.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30607.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34220.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34220.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13607.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13607.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59279.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59279.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-19036.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19036.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14759.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14759.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29704.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29704.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55792.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55792.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51708.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51708.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31842.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31842.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20982.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20982.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28334.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28334.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-47707.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47707.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62652.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62652.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43623.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43623.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58568.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58568.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35455.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35455.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50400.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50400.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50385.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50385.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11490.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11490.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3322.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3322.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14183.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14183.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10099.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10099.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34049.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34049.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-1760.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1760.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-55621.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55621.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34132.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34132.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14266.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14266.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4474.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4474.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48522.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48522.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33617.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33617.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44438.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44438.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62720.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62720.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38770.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38770.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19742.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19742.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19742.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19742.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42300.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42300.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61329.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61329.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57245.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57245.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11573.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11573.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-8641.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8641.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-4557.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4557.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15418.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15418.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46145.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-473.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-473.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27116.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27116.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 672 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-53758.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53758.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29808.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29808.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9196.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9196.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29062.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29062.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20894.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20894.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4365.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4365.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26924.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26924.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57650.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57650.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13088.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13088.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28870.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28870.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16618.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16618.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39752.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39752.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54697.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54697.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35668.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35668.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23394.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23394.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4941.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4941.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4941.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4941.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11718.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11718.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7634.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7634.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46529.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46529.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 272 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-60618.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60618.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14946.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14946.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 292 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-37505.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37505.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37505.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37505.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13555.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13555.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 112 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-18839.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18839.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21531.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21531.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58288.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58288.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25445.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25445.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23307.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23307.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58117.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58117.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56726.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56726.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33613.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33613.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44474.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44474.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44474.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44474.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36113.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36113.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25253.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25253.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39643.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39643.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54588.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54588.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8916.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8916.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35559.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35559.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62201.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62201.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62201.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62201.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42335.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42335.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-7546.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7546.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53218.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53218.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53218.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53218.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42357.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42357.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42357.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42357.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42357.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42357.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18407.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18407.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10239.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10239.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30105.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30105.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60831.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60831.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17661.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17661.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17661.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17661.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63332.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63332.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63332.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63332.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63332.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63332.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17661.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17661.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5408.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5408.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5408.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5408.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-65299.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65299.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41349.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41349.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30489.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30489.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-50717.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50717.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42549.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42549.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10431.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10431.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6155.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6155.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-24651.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24651.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21636.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21636.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52362.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52362.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28412.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28412.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48278.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48278.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1023.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1023.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42610.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42610.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9746.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9746.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13275.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13275.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-39726.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39726.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46503.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46503.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4915.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4915.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50587.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50587.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-55247.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55247.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-1215.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1215.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2538.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2538.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-748.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-748.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-14391.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14391.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-55232.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55232.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 264 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 324 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 484 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-35388.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35388.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53670.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53670.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16399.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16399.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36265.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36265.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-56363.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56363.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6607.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6607.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54739.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54739.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38211.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38211.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38211.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38211.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38211.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38211.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34127.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34127.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14261.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14261.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49093.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49093.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51786.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51786.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32757.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32757.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28673.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28673.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28673.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28673.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-12144.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12144.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38787.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38787.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18367.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18367.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-32565.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32565.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32565.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32565.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51039.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51039.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51039.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51039.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61708.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61708.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10561.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10561.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26343.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26343.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61153.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61153.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4360.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4360.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10390.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10390.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 224

C:\Users\Admin\AppData\Local\Temp\Unicorn-41117.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41117.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2222.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2222.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-24781.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24781.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20697.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20697.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 692 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1280 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-31278.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31278.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 608 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-33970.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33970.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49752.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49752.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-45668.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45668.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59243.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59243.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13571.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13571.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40214.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40214.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40214.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40214.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1127.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1127.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62580.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62580.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62580.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62580.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11433.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11433.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1682.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1682.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21548.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21548.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1682.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1682.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1682.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1682.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21548.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21548.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-24240.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24240.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24240.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24240.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10426.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10426.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3457.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3457.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15710.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15710.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 892 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-32622.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32622.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53042.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53042.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4056 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3884 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 356 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-1594.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1594.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 876 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3648 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-11708.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11708.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64993.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64993.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-14422.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14422.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-8200.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8200.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8200.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8200.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-40873.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40873.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1978.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1978.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12092.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12092.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38735.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38735.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41449.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41449.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37365.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37365.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51563.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51563.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1320 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-39311.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39311.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35227.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35227.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12668.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12668.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49425.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49425.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2362.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2362.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2362.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2362.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4308.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4308.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4308.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4308.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30951.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30951.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61677.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61677.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15190.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15190.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56031.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56031.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-55214.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55214.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-61436.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61436.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59874.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59874.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14757.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14757.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-47430.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47430.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31094.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31094.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-62396.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62396.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4128 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-55982.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55982.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 584 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-54612.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54612.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-34192.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34192.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3465.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3465.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44306.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44306.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29916.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29916.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21556.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21556.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-17856.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17856.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3348 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-20570.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20570.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3824 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-61410.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61410.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3548.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3548.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-28437.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28437.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28437.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28437.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28437.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28437.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-34467.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34467.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-15993.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15993.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39127.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39127.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-41819.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41819.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-16652.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16652.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47378.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47378.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-55930.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55930.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-13335.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13335.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-37840.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37840.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7113.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7113.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4392 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-17119.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17119.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3972 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-46610.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46610.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52661.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52661.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13766.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13766.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50523.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50523.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65489.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65489.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-22511.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22511.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22511.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22511.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3584 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3512 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-59158.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59158.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40492.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40492.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50606.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50606.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49236.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49236.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24732.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24732.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18318.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18318.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10149.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10149.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36792.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36792.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3927.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3927.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49620.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49620.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49620.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49620.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-12671.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12671.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29008.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29008.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-17140.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17140.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-803.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-803.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58172.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58172.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12863.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12863.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-7409.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7409.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29968.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29968.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64778.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64778.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48250.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48250.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-3133.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3133.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52142.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52142.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39397.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39397.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-502.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-502.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6532.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6532.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41343.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41343.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58255.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58255.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-54171.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54171.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30029.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30029.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60777.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60777.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-64669.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64669.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38581.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38581.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6444 -s 200

C:\Users\Admin\AppData\Local\Temp\Unicorn-13221.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13221.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19828.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19828.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19828.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19828.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58530.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58530.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5460 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5528 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5672 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-9905.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9905.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5768 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5864 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-45256.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45256.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5980 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5196 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6036 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-30674.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30674.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6104 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5480 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5380 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-60030.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60030.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5764 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6032 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5876 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5280 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5396 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5680 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-63792.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63792.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5896 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5860 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6004 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5748 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6008 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6096 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5452 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6000 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6304 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5548 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6392 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6476 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6664 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5804 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6764 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6120 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6876 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5456 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5648 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6056 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-25962.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25962.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52604.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52604.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5996 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-57264.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57264.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7008 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-35090.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35090.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61732.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61732.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6336 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6220 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6820 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-55209.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55209.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6992 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7068 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7000 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7280 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-65536.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65536.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7156 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6320 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-17597.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17597.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7600 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-51037.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51037.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7640 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-45967.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45967.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64441.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64441.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-850.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-850.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36538.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36538.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61789.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61789.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8972 -s 200

C:\Users\Admin\AppData\Local\Temp\Unicorn-31660.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31660.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5593.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5593.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56740.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56740.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13569.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13569.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44872.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44872.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44872.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44872.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40788.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40788.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8536 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-48956.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48956.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24260.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24260.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16969.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16969.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7252 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-7394.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7394.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9340.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9340.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35983.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35983.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8608 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-62433.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62433.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19455.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19455.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7360 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-22169.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22169.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15755.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15755.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11670.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11670.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7540 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-19839.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19839.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40835.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40835.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10108.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10108.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28945.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28945.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9916.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9916.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45111.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45111.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63585.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63585.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41603.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41603.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33435.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33435.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51717.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51717.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19922.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19922.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30804.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30804.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7296 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8180 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7536 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7444 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-18360.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18360.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40918.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40918.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35272.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35272.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61722.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61722.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39164.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39164.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47908.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47908.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45770.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45770.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19704.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19704.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42262.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42262.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7312 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-21650.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21650.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8312 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8244 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7712 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7612 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8468 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8588 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8692 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8820 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9040 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9160 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8364 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8264 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8200 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8968 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-17457.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17457.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8272 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8296 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-63149.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63149.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8348 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-21925.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21925.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8432 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8484 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8580 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8756 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8636 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-30669.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30669.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50596.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50596.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8880 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8792 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-30560.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30560.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8940 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8920 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9008 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-24338.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24338.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8252 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9104 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8220 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8308 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8236 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8732 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8676 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9048 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9244 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9208 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9384 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9524 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-17369.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17369.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35651.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35651.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17945.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17945.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8196 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-31951.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31951.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10344 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8448 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-40503.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40503.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8628 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10588 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10768 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-18390.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18390.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9732 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-37078.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37078.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47192.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47192.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47192.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47192.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-513.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-513.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31515.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31515.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10372 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 11024 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10452 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 11096 -s 216

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe

MD5 e2723a5e28a3687c9b3173e19eb28364
SHA1 4dc6aa0bcdda844bf1d31554fc3b7328523b25ed
SHA256 963a95cba0adc3d8860ddc71025cb330e90a2416e58b85ae55d8ac61bf047983
SHA512 41292aca452dc1c34ec75e8381380489b9b6af55d53b3278ed532465e63726b66f45b62e82068127e55f578bebccaa0ab6f4ae62851ef3d13112711a3ba54164

\Users\Admin\AppData\Local\Temp\Unicorn-17718.exe

MD5 fb70eef41e0e1f074cb599748bdef55c
SHA1 63970eb3baf8619c8dfed1fd2bd4f4631e72c8d2
SHA256 8e382e8dda6dc4540523cff2282d225b3772e7f33b70f768791801ef47a024c0
SHA512 8f8f9d33e8101e5c06daea5ba90100670440e437de5fd390ecb281ebf5bf29151466d471b61a165628da0c7c2e6d45814992cb07594233fcc1678d45f8f3a9ec

\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe

MD5 7f96caf99a62ebdf06648763b8579472
SHA1 908fa0cfe1a200bd1c6968da66bcf26987020c73
SHA256 79077e816edf1720cf37715de3dbeac39ebc2b3b308d738709732817929201be
SHA512 34e31f49c4df13a323ec80be9bad04e9f9235b6e9009711389a8fc7b8b1043c7730c1e9c39aa19cdb9521743142933ce34570a80a88d1b41c331b20b8173e0a8

\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe

MD5 2530883dc69275c7a129e758d82b73f4
SHA1 11f9f2b010010fe0a6496fbd90bf2da00c0dcf15
SHA256 19435f10c233cdb5724f58a23944151aea67dd7b1dbde6915432db53c6a54212
SHA512 d9d4112b9c209f78ac4531457e1353aa765a3d901fbd8ae941946e3021aeffc72219162abd0f243e24982ce1b0564a1dce2c2a736cbc62dfdfed905651cfc273

\Users\Admin\AppData\Local\Temp\Unicorn-15663.exe

MD5 23bd6b57ade3419b98f9cc7b475cf98f
SHA1 9bfe4c3cb1e207b7c8b8a9d1e9bfc0223d66f745
SHA256 d32755f98a7d7a4d501a0ea74bd7eca6d3b668dc728236e73e56ba17a3073e26
SHA512 e9efea854d31ce98e1eb30df9cc1c02d7c5234dfc5484f322845751c5b04058500a88117dd964739a102e31a0b6b8befbfcf03c1812ade9f4dd4e3e105f064f2

\Users\Admin\AppData\Local\Temp\Unicorn-30607.exe

MD5 3bf144e3b7fce141375b41bc6d6d8c39
SHA1 041f8c1b3f9b8b52efe5118b2d7f18459a2d4077
SHA256 3e62f5291a880b1f38c556eaff2c625038c4d88685ee94122cfbd7a3b42be5d0
SHA512 a9a5c73ac1b0c15ee6efc4568d4140f39b4879653c305bca89a67842d7a9c07e08036278d008a89035016bf49347c94aa0f53e7ad36537300b12983b9a9471af

\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe

MD5 a64ac58a5e1d7e342dfc33fbf0b4fe61
SHA1 2b04a0bd30e148bf27ee65d74141297a0620ed70
SHA256 827ac5dfc7a510dea33ec42a9bb0c3031c0a238e2461e32e45d3929638247494
SHA512 7698d796ee90f42407fb1cb9195437fd54e8a3852f5e30c4f461aa519f3351ddca442360dbb9c4b8fd4288c541f1c825bde5c4949f3f010c1f7e31f64138ae04

C:\Users\Admin\AppData\Local\Temp\Unicorn-34220.exe

MD5 5099138d8e268a7a61a76b7180a6c8fa
SHA1 72d9efa74a506e57f3603ec5e0c435fb31da154d
SHA256 c82826f953edf2182a540f072f2ddce0bb0f9fe79f5dd1febc580971afbd9ec5
SHA512 e58187f2ca6785758e16c6fe22344a989bb7a7af3036569aaaa66ecbc9feb19928803b820ca0cdb115e6d4307e56599b12d229a7ab2b4436baac147ccca7911d

\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe

MD5 b0126e933fbd523f6920e589a3118049
SHA1 95054bffd54358dd3f0da95d4c909f93b33b172f
SHA256 d9860faaa9ce638d6292d8e0cef17e0e91fbf5603ed1e483556796e4011651b2
SHA512 833dd07827e70d4fa6d02a2643cecfa7db0d8635a0fb2ea64f5173bf70582836ce2f08897ff27d464e2f634fcd64d5f84f934df053bbb88dd8e8176179259d6e

\Users\Admin\AppData\Local\Temp\Unicorn-13607.exe

MD5 b194aa561f00d4b9e130c5a1ce7905bb
SHA1 23a9b099da8e7fb03efdb4d4e6a38f687e124ed0
SHA256 1d5a743cffe643ef677de52e5248ec42b17d9f5656351565ae2d452fd68beed6
SHA512 4f46a44bf9da88d9e95a03ca09f00d5e577366ecc9adeb39c316d092d1f3d377c0faf90bc52f8502bec4937d61a54335780c2b538e9f55239478d7a5bbd00974

\Users\Admin\AppData\Local\Temp\Unicorn-59279.exe

MD5 e6822e64961f30aeac75acfdd053cfc1
SHA1 ebd2793af53674acd33175c45deeba2756c86af8
SHA256 da26aabdd8447aa674a0a495a295e427591544c4694f40b38434b6d74d01d960
SHA512 54b8319890ff349f17cb85cb011b1fd14ffeec60284b04fca4dc42394a6094cafbb0f0476477c8d06e7222ae50bdd1f97f0618b291db0245b34a82a5951cd81e

C:\Users\Admin\AppData\Local\Temp\Unicorn-19036.exe

MD5 38702631418c3d6bd04f7474debbd804
SHA1 a11fb98976f109de69afeb56d592eaf2b45aca51
SHA256 28daa159d92b494f4d7cd648f7d3ad942235b82a5f71678e7b1792ca3bbf7a63
SHA512 f338ef77ee6561c87094a603ce0a613b0593fbf95c060793ad414e868d032ccd47f0bbfe12f0c52478cb1b2396556d54d858b31fa2dc6922f0a27294964fb303

\Users\Admin\AppData\Local\Temp\Unicorn-29704.exe

MD5 42d1240870253e23852f660cc7c668aa
SHA1 5e62c6aaba0f8b5816c3c80db4b2ef9b9f8bef4a
SHA256 2e3055e998a5a0103171d3ba919cdcdf2308f35d6194a986967ae0636cc98b8e
SHA512 7dcaf993e99dd59046f91e99413006618dc79f8b77c0c90875367b6c7994eebf6b60d58106df5426e80d66f2ee0c5ab6ef52da058ba4cf73407190a78adf753e

\Users\Admin\AppData\Local\Temp\Unicorn-14759.exe

MD5 2f8f608e744590c8b5e33c9bbd23613c
SHA1 0fb0704b11f5f3e0b0cab507d04d97e1eab060e5
SHA256 f5c81b12b57d53e29093a54a176a1ac9f2c28c28bd25bcc8519c0fc215b97bfb
SHA512 ed761f4a697146837d92cd2c07780c90590acf1ec2d9c1697b4b1c115eecf1e7ab41302bc0e03cc1f0d01a5f59560d90630ebba4c849c6904054926b339c59fc

C:\Users\Admin\AppData\Local\Temp\Unicorn-18407.exe

MD5 d81165d1de2191c2e4b844d401da389e
SHA1 065c897a7cc15969e6c0c4ffdbc1265b0a322e50
SHA256 8e7c7af755c683aa67dc1059944b9a620af3d7731fee63cb85df9fddac0c503e
SHA512 ea8d18bddab189912218beabba9042d68108a8203c10ac565b8c87a52d63aaf8163a573ffdd5b51641e77708b7845313f1c936d2e135f96e7018a521c89b3cf3

C:\Users\Admin\AppData\Local\Temp\Unicorn-14757.exe

MD5 ca87e6de334f1dabf2b226d641a53705
SHA1 862d090f1934eeaabb65c5ab020663baa83dc50e
SHA256 95d9de566d1460cd7b102100d07d7e5af945e5b34b57fad6eccffdd2cfa03199
SHA512 e08ddbc68f52bdbc147ad297792be562eec103c83ae856881b83401be77932ed34bcab3a211245fd10df33c2d5dcbb8b5fddb54aa21abcb3a4ec6d1c1a42b8fd

C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe

MD5 ba99b8083a97300e3d9f4cd0e7d4b8ea
SHA1 3263f60c56fb19d800f6ecef940399ee6d0e9155
SHA256 99914b2ac453be110c7ffbe0e706393e2395a967569987bd22001be9dde8df1f
SHA512 139202832e5b96f48e761f5c583f145b47c3867b2df5de3c2f6ab01cb5deefa8a44f53cacdf3e6b06cd789cfae66425c21c7761802a06f11a409597a20844663

C:\Users\Admin\AppData\Local\Temp\Unicorn-5593.exe

MD5 22080353059e593870114b7922d505a4
SHA1 f6ded1bd0828626059551601413d03a48f6d9d15
SHA256 62895643ec64913597c98c6fe465922a9d449b2e60d8ad7f272a427be99fe0e5
SHA512 08fad3648c2ab070c4943bb6b871eb7686e1c09b29847832070bae59747deada8e9e91fb64ea7c3f0f61ffe85b3f611ba418a1d668698ff9fee88ae8086e2e76

C:\Users\Admin\AppData\Local\Temp\Unicorn-40835.exe

MD5 7eb3a3ac8121f2cd785941ec10f74ded
SHA1 7b908b47895ec5d3a81a82abaea26824a6cef0ed
SHA256 a3d39a75174bd3b7d653fcf5ede2c805fad2d3e93c54c7eea446a093071837ff
SHA512 8b49e481a35c6b83cb13a7cd5b0b815bf728eae25179bb0b2a0b8c98cd890121322b480d297f206f8d66be22b831b77251324d900e45abc2bec5148f6aa84b97

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-31 22:25

Reported

2024-05-31 22:27

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22352.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18927.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4214.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3514.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54339.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17713.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19441.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31370.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65434.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53182.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34193.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29638.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33975.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-28268.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46550.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19393.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24546.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7738.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31920.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24651.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35511.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-8122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4915.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46503.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62715.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23306.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27713.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-39450.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37334.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10177.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30043.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25143.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-11267.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-41994.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22128.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22352.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18927.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4214.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34193.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-65434.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-3514.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54339.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17713.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33975.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19441.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31370.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53182.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-28268.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29638.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-46550.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24546.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7738.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24651.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31920.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-62715.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37334.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-46503.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9321.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-10665.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-65299.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55756.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-40572.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15333.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-40907.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34550.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34166.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22490.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-40964.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7736.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9267.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24836.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-49594.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-938.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6667.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18204.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-50300.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55510.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12147.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29553.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-62500.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59916.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-10497.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27772.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-45500.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32838.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-62002.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42459.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32454.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38588.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17291.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-2194.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31489.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-43030.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31162.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31991.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-47690.exe

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22352.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18927.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4214.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3514.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54339.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17713.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19441.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31370.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65434.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53182.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34193.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29638.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33975.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-28268.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46550.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19393.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24546.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7738.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31920.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24651.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4915.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-8122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46503.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62715.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23306.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-39450.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27713.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37334.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10177.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30043.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25143.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3968 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22352.exe
PID 3968 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22352.exe
PID 3968 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22352.exe
PID 1064 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22352.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18927.exe
PID 1064 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22352.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18927.exe
PID 1064 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22352.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18927.exe
PID 3968 wrote to memory of 5052 N/A C:\Users\Admin\AppData\Local\Temp\618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4214.exe
PID 3968 wrote to memory of 5052 N/A C:\Users\Admin\AppData\Local\Temp\618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4214.exe
PID 3968 wrote to memory of 5052 N/A C:\Users\Admin\AppData\Local\Temp\618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4214.exe
PID 4128 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18927.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-3514.exe
PID 4128 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18927.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-3514.exe
PID 4128 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18927.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-3514.exe
PID 1064 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22352.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54339.exe
PID 1064 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22352.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54339.exe
PID 1064 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22352.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54339.exe
PID 5052 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4214.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17713.exe
PID 5052 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4214.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17713.exe
PID 5052 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4214.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17713.exe
PID 2288 wrote to memory of 720 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3514.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19441.exe
PID 2288 wrote to memory of 720 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3514.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19441.exe
PID 2288 wrote to memory of 720 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3514.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19441.exe
PID 4128 wrote to memory of 3480 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18927.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31370.exe
PID 4128 wrote to memory of 3480 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18927.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31370.exe
PID 4128 wrote to memory of 3480 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18927.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31370.exe
PID 2644 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54339.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-65434.exe
PID 2644 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54339.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-65434.exe
PID 2644 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54339.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-65434.exe
PID 1776 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17713.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53182.exe
PID 1776 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17713.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53182.exe
PID 1776 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17713.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53182.exe
PID 5052 wrote to memory of 3224 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4214.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34193.exe
PID 5052 wrote to memory of 3224 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4214.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34193.exe
PID 5052 wrote to memory of 3224 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4214.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34193.exe
PID 720 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19441.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29638.exe
PID 720 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19441.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29638.exe
PID 720 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19441.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29638.exe
PID 2288 wrote to memory of 4256 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3514.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33975.exe
PID 2288 wrote to memory of 4256 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3514.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33975.exe
PID 2288 wrote to memory of 4256 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3514.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33975.exe
PID 3480 wrote to memory of 4572 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31370.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-28268.exe
PID 3480 wrote to memory of 4572 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31370.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-28268.exe
PID 3480 wrote to memory of 4572 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31370.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-28268.exe
PID 2652 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53182.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-46550.exe
PID 2652 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53182.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-46550.exe
PID 2652 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53182.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-46550.exe
PID 1776 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17713.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19393.exe
PID 1776 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17713.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19393.exe
PID 1776 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17713.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19393.exe
PID 2644 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54339.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24546.exe
PID 2644 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54339.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24546.exe
PID 2644 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54339.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24546.exe
PID 2880 wrote to memory of 4636 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29638.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7738.exe
PID 2880 wrote to memory of 4636 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29638.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7738.exe
PID 2880 wrote to memory of 4636 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29638.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7738.exe
PID 720 wrote to memory of 4004 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19441.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31920.exe
PID 720 wrote to memory of 4004 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19441.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31920.exe
PID 720 wrote to memory of 4004 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19441.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31920.exe
PID 4572 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-28268.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24651.exe
PID 4572 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-28268.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24651.exe
PID 4572 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-28268.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24651.exe
PID 3480 wrote to memory of 4300 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31370.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35511.exe
PID 3480 wrote to memory of 4300 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31370.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35511.exe
PID 3480 wrote to memory of 4300 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31370.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35511.exe
PID 3020 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46550.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-8122.exe

Processes

C:\Users\Admin\AppData\Local\Temp\618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e.exe

"C:\Users\Admin\AppData\Local\Temp\618079e3c19b078163b44aeb333801ed39132a9fff55af569722678a133d1d6e.exe"

C:\Users\Admin\AppData\Local\Temp\Unicorn-22352.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22352.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18927.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18927.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4214.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4214.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3968 -ip 3968

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 712

C:\Users\Admin\AppData\Local\Temp\Unicorn-3514.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3514.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54339.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54339.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17713.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1064 -ip 1064

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 744

C:\Users\Admin\AppData\Local\Temp\Unicorn-19441.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19441.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31370.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31370.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65434.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65434.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53182.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53182.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34193.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34193.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 4128 -ip 4128

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4128 -s 736

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 5052 -ip 5052

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 752

C:\Users\Admin\AppData\Local\Temp\Unicorn-29638.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29638.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33975.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33975.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28268.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28268.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46550.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46550.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3224 -ip 3224

C:\Users\Admin\AppData\Local\Temp\Unicorn-19393.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19393.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 3356 -ip 3356

C:\Users\Admin\AppData\Local\Temp\Unicorn-24546.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24546.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 728

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 2288 -ip 2288

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 756

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2644 -ip 2644

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 728

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1776 -ip 1776

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 744

C:\Users\Admin\AppData\Local\Temp\Unicorn-7738.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7738.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4256 -ip 4256

C:\Users\Admin\AppData\Local\Temp\Unicorn-31920.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31920.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 720

C:\Users\Admin\AppData\Local\Temp\Unicorn-24651.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24651.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35511.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35511.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8122.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8122.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4915.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4915.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46503.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46503.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35642.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35642.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 720 -ip 720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 720 -s 744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3480 -ip 3480

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2652 -ip 2652

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 752

C:\Users\Admin\AppData\Local\Temp\Unicorn-62715.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62715.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23306.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23306.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39450.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39450.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37334.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37334.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10177.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10177.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30043.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30043.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25143.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25143.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11267.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11267.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41994.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41994.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22128.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22128.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2880 -ip 2880

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4572 -ip 4572

C:\Users\Admin\AppData\Local\Temp\Unicorn-5429.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5429.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65299.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65299.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3020 -ip 3020

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 760

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 752

C:\Users\Admin\AppData\Local\Temp\Unicorn-9321.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9321.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2912 -ip 2912

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4580 -ip 4580

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 740

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2440 -ip 2440

C:\Users\Admin\AppData\Local\Temp\Unicorn-55569.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55569.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 632

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2440 -ip 2440

C:\Users\Admin\AppData\Local\Temp\Unicorn-5621.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5621.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5621.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5621.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54007.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54007.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4636 -ip 4636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 720

C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45476.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45476.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45476.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45476.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41392.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41392.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10665.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10665.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9082.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9082.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59674.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59674.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4004 -ip 4004

C:\Users\Admin\AppData\Local\Temp\Unicorn-12611.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12611.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36300.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36300.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27386.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27386.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4068 -ip 4068

C:\Users\Admin\AppData\Local\Temp\Unicorn-29332.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29332.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25248.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25248.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54583.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54583.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50499.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50499.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-250.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-250.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 2008 -ip 2008

C:\Users\Admin\AppData\Local\Temp\Unicorn-54220.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54220.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46052.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46052.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41968.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41968.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22102.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22102.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2258.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2258.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 724

C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-504.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-504.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 724

C:\Users\Admin\AppData\Local\Temp\Unicorn-14531.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14531.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59456.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59456.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47204.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47204.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2164 -ip 2164

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2276 -ip 2276

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 2224 -ip 2224

C:\Users\Admin\AppData\Local\Temp\Unicorn-59840.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59840.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59840.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59840.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55756.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55756.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5052 -ip 5052

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3672 -ip 3672

C:\Users\Admin\AppData\Local\Temp\Unicorn-15491.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15491.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11407.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11407.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 3660 -ip 3660

C:\Users\Admin\AppData\Local\Temp\Unicorn-42518.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42518.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42518.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42518.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5036 -ip 5036

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 712

C:\Users\Admin\AppData\Local\Temp\Unicorn-16945.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16945.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60992.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60992.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48740.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48740.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40572.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40572.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40139.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40139.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49376.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49376.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2832 -ip 2832

C:\Users\Admin\AppData\Local\Temp\Unicorn-7274.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7274.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 4940 -ip 4940

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4300 -ip 4300

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1156 -ip 1156

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1040 -ip 1040

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 748 -ip 748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 744

C:\Users\Admin\AppData\Local\Temp\Unicorn-4451.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4451.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2252 -ip 2252

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2932 -ip 2932

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1628 -ip 1628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 3556 -ip 3556

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4128 -ip 4128

C:\Users\Admin\AppData\Local\Temp\Unicorn-15333.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15333.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54228.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54228.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27586.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27586.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27586.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27586.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27586.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27586.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40907.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40907.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40907.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40907.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3696 -ip 3696

C:\Users\Admin\AppData\Local\Temp\Unicorn-24571.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24571.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 232 -ip 232

C:\Users\Admin\AppData\Local\Temp\Unicorn-55105.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55105.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55105.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55105.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2889.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2889.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2889.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2889.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 4548 -ip 4548

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 732

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 2996 -ip 2996

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 3568 -ip 3568

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 2608 -ip 2608

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 872 -ip 872

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2412 -ip 2412

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4596 -ip 4596

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 1240 -ip 1240

C:\Users\Admin\AppData\Local\Temp\Unicorn-17856.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17856.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13771.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13771.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57819.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57819.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57819.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57819.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 2272 -ip 2272

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4516 -ip 4516

C:\Users\Admin\AppData\Local\Temp\Unicorn-56449.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56449.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4288 -ip 4288

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3428 -ip 3428

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3560 -ip 3560

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1072 -ip 1072

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4988 -ip 4988

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 5264 -ip 5264

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 5068 -ip 5068

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 5368 -ip 5368

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 3760 -ip 3760

C:\Users\Admin\AppData\Local\Temp\Unicorn-39105.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39105.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50118.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50118.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43595.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43595.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 5620 -ip 5620

C:\Users\Admin\AppData\Local\Temp\Unicorn-10730.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10730.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 5208 -ip 5208

C:\Users\Admin\AppData\Local\Temp\Unicorn-7139.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7139.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21914.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21914.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1212 -ip 1212

C:\Users\Admin\AppData\Local\Temp\Unicorn-38250.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38250.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34166.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34166.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34166.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34166.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 5776 -ip 5776

C:\Users\Admin\AppData\Local\Temp\Unicorn-22490.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22490.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22490.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22490.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40964.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40964.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40964.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40964.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2069.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2069.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5516 -ip 5516

C:\Users\Admin\AppData\Local\Temp\Unicorn-55162.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55162.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5208 -s 648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 808 -ip 808

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1108 -ip 1108

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 3356 -ip 3356

C:\Users\Admin\AppData\Local\Temp\Unicorn-34550.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34550.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28027.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28027.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49516.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49516.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 5352 -ip 5352

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 5768 -ip 5768

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5540 -ip 5540

C:\Users\Admin\AppData\Local\Temp\Unicorn-24881.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24881.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11690.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11690.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 652 -ip 652

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 5636 -ip 5636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 5512 -ip 5512

C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 5924 -ip 5924

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 6012 -ip 6012

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 5952 -ip 5952

C:\Users\Admin\AppData\Local\Temp\Unicorn-52614.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52614.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5932 -ip 5932

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 6044 -ip 6044

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5540 -s 660

C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 5992 -ip 5992

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 5980 -ip 5980

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 1456 -ip 1456

C:\Users\Admin\AppData\Local\Temp\Unicorn-5935.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5935.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40746.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40746.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1796 -ip 1796

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 5312 -ip 5312

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 5536 -ip 5536

C:\Users\Admin\AppData\Local\Temp\Unicorn-20482.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20482.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5980 -s 720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 2644 -ip 2644

C:\Users\Admin\AppData\Local\Temp\Unicorn-53154.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53154.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26704.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26704.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-938.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-938.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65105.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65105.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 5300 -ip 5300

C:\Users\Admin\AppData\Local\Temp\Unicorn-61514.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61514.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61514.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61514.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6667.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6667.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7736.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7736.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64913.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64913.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26019.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26019.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26019.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26019.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 6068 -ip 6068

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5528 -ip 5528

C:\Users\Admin\AppData\Local\Temp\Unicorn-60336.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60336.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29610.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29610.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34571.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34571.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32433.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32433.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1248 -ip 1248

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 480

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2008 -ip 2008

C:\Users\Admin\AppData\Local\Temp\Unicorn-10450.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10450.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2652 -ip 2652

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 2876 -ip 2876

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5320 -ip 5320

C:\Users\Admin\AppData\Local\Temp\Unicorn-50113.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50113.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4364 -ip 4364

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 5944 -ip 5944

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 5296 -ip 5296

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 524 -ip 524

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3900 -ip 3900

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5812 -ip 5812

C:\Users\Admin\AppData\Local\Temp\Unicorn-50196.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50196.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5712 -ip 5712

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1424 -ip 1424

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5240 -ip 5240

C:\Users\Admin\AppData\Local\Temp\Unicorn-61078.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61078.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5392 -ip 5392

C:\Users\Admin\AppData\Local\Temp\Unicorn-12261.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12261.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 5400 -ip 5400

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 4876 -ip 4876

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 3080 -ip 3080

C:\Users\Admin\AppData\Local\Temp\Unicorn-45318.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45318.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61654.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61654.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32874.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32874.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 2488 -ip 2488

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5204 -ip 5204

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5400 -s 724

C:\Users\Admin\AppData\Local\Temp\Unicorn-10891.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10891.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41618.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41618.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60092.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60092.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38411.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38411.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38411.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38411.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 5792 -ip 5792

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3156 -ip 3156

C:\Users\Admin\AppData\Local\Temp\Unicorn-36273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49594.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49594.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49594.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49594.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54747.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54747.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2531.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2531.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2531.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2531.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 5836 -ip 5836

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2560 -ip 2560

C:\Users\Admin\AppData\Local\Temp\Unicorn-55323.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55323.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5976 -ip 5976

C:\Users\Admin\AppData\Local\Temp\Unicorn-29750.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29750.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 6140 -ip 6140

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5648 -ip 5648

C:\Users\Admin\AppData\Local\Temp\Unicorn-17690.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17690.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 324 -ip 324

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5204 -s 664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 3888 -ip 3888

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 5216 -ip 5216

C:\Users\Admin\AppData\Local\Temp\Unicorn-30518.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30518.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 5264 -ip 5264

C:\Users\Admin\AppData\Local\Temp\Unicorn-15936.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15936.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 1648 -ip 1648

C:\Users\Admin\AppData\Local\Temp\Unicorn-24836.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24836.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 4068 -ip 4068

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 872 -ip 872

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 3916 -ip 3916

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5848 -ip 5848

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 4860 -ip 4860

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5448 -ip 5448

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5844 -ip 5844

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 1724 -ip 1724

C:\Users\Admin\AppData\Local\Temp\Unicorn-40186.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40186.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 1836 -ip 1836

C:\Users\Admin\AppData\Local\Temp\Unicorn-9267.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9267.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 2584 -ip 2584

C:\Users\Admin\AppData\Local\Temp\Unicorn-10336.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10336.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23658.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23658.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50300.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50300.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3813.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3813.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3813.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3813.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22288.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22288.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43777.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43777.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43777.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43777.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18204.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18204.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18204.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18204.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18204.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18204.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 5156 -ip 5156

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 732

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5248 -ip 5248

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5140 -ip 5140

C:\Users\Admin\AppData\Local\Temp\Unicorn-18204.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18204.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5376 -ip 5376

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 1244 -ip 1244

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 5144 -ip 5144

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 916 -ip 916

C:\Users\Admin\AppData\Local\Temp\Unicorn-8089.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8089.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 2996 -ip 2996

C:\Users\Admin\AppData\Local\Temp\Unicorn-60881.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60881.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 5164 -ip 5164

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4288 -ip 4288

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 2428 -ip 2428

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 5684 -ip 5684

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 5780 -ip 5780

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3952 -ip 3952

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 1300 -ip 1300

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1104 -ip 1104

C:\Users\Admin\AppData\Local\Temp\Unicorn-54358.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54358.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42167.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42167.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42167.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42167.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28593.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28593.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11187.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11187.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 1456 -ip 1456

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 836 -ip 836

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 4988 -ip 4988

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5416 -ip 5416

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 4372 -ip 4372

C:\Users\Admin\AppData\Local\Temp\Unicorn-64363.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64363.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29553.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29553.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29553.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29553.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8063.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8063.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12147.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12147.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42874.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42874.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4436 -ip 4436

C:\Users\Admin\AppData\Local\Temp\Unicorn-10009.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10009.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55126.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55126.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 808 -ip 808

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 4364 -ip 4364

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5508 -ip 5508

C:\Users\Admin\AppData\Local\Temp\Unicorn-55510.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55510.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55510.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55510.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29745.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29745.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61540.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61540.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 3284 -ip 3284

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 5352 -ip 5352

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 1536 -ip 1536

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 2016 -ip 2016

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 5580 -ip 5580

C:\Users\Admin\AppData\Local\Temp\Unicorn-62500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62500.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 652 -ip 652

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 1248 -ip 1248

C:\Users\Admin\AppData\Local\Temp\Unicorn-56833.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56833.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 524 -ip 524

C:\Users\Admin\AppData\Local\Temp\Unicorn-14176.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14176.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58224.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58224.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27498.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27498.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1568 -ip 1568

C:\Users\Admin\AppData\Local\Temp\Unicorn-11737.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11737.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49241.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49241.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 4896 -ip 4896

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 1228 -ip 1228

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 4264 -ip 4264

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 716

C:\Users\Admin\AppData\Local\Temp\Unicorn-35028.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35028.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35028.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35028.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1412 -ip 1412

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 6116 -ip 6116

C:\Users\Admin\AppData\Local\Temp\Unicorn-45334.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45334.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 3396 -ip 3396

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5552 -ip 5552

C:\Users\Admin\AppData\Local\Temp\Unicorn-26668.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26668.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10331.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10331.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40866.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40866.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43004.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43004.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40866.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40866.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 3708 -ip 3708

C:\Users\Admin\AppData\Local\Temp\Unicorn-59916.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59916.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 216 -ip 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6116 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 60 -ip 60

C:\Users\Admin\AppData\Local\Temp\Unicorn-2355.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2355.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18391.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18391.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58354.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58354.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 1776 -ip 1776

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 6100 -ip 6100

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2100 -ip 2100

C:\Users\Admin\AppData\Local\Temp\Unicorn-46486.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46486.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3315.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3315.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 3104 -ip 3104

C:\Users\Admin\AppData\Local\Temp\Unicorn-4384.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4384.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 6104 -ip 6104

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 5052 -ip 5052

C:\Users\Admin\AppData\Local\Temp\Unicorn-27820.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27820.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 3360 -ip 3360

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 5640 -ip 5640

C:\Users\Admin\AppData\Local\Temp\Unicorn-6906.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6906.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 216 -s 628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 5564 -ip 5564

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 1240 -ip 1240

C:\Users\Admin\AppData\Local\Temp\Unicorn-39387.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39387.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 5724 -ip 5724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 4300 -ip 4300

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 1156 -ip 1156

C:\Users\Admin\AppData\Local\Temp\Unicorn-45116.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45116.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34295.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34295.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45116.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45116.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53092.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53092.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50632.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50632.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 220 -ip 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-27772.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27772.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27772.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27772.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 5104 -ip 5104

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 5464 -ip 5464

C:\Users\Admin\AppData\Local\Temp\Unicorn-45500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23819.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23819.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10497.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10497.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 5396 -ip 5396

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 2856 -ip 2856

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5140 -ip 5140

C:\Users\Admin\AppData\Local\Temp\Unicorn-19050.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19050.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3896 -ip 3896

C:\Users\Admin\AppData\Local\Temp\Unicorn-34400.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34400.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5396 -s 720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 6072 -ip 6072

C:\Users\Admin\AppData\Local\Temp\Unicorn-52874.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52874.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28178.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28178.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 2164 -ip 2164

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 5144 -ip 5144

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4256 -ip 4256

C:\Users\Admin\AppData\Local\Temp\Unicorn-22833.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22833.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3920 -ip 3920

C:\Users\Admin\AppData\Local\Temp\Unicorn-16310.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16310.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2144 -ip 2144

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 1800 -ip 1800

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 5544 -ip 5544

C:\Users\Admin\AppData\Local\Temp\Unicorn-32454.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32454.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 736 -ip 736

C:\Users\Admin\AppData\Local\Temp\Unicorn-32838.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32838.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 496 -ip 496

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 1660 -ip 1660

C:\Users\Admin\AppData\Local\Temp\Unicorn-19216.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19216.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 5176 -ip 5176

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5416 -ip 5416

C:\Users\Admin\AppData\Local\Temp\Unicorn-7840.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7840.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62002.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62002.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53834.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53834.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9786.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9786.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58795.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58795.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-549.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-549.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6579.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6579.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5832 -ip 5832

C:\Users\Admin\AppData\Local\Temp\Unicorn-42459.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42459.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 2428 -ip 2428

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3816 -ip 3816

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5884 -ip 5884

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 5676 -ip 5676

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2272 -ip 2272

C:\Users\Admin\AppData\Local\Temp\Unicorn-42843.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42843.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56164.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56164.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53704.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53704.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57809.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57809.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 4012 -ip 4012

C:\Users\Admin\AppData\Local\Temp\Unicorn-56548.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56548.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 5300 -ip 5300

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 6040 -ip 6040

C:\Users\Admin\AppData\Local\Temp\Unicorn-34566.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34566.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 6044 -ip 6044

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 5548 -ip 5548

C:\Users\Admin\AppData\Local\Temp\Unicorn-13953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53403.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53403.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53403.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53403.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 2688 -ip 2688

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 4068 -ip 4068

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 1744 -ip 1744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5712 -ip 5712

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 6108 -ip 6108

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 5460 -ip 5460

C:\Users\Admin\AppData\Local\Temp\Unicorn-51826.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51826.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5636 -ip 5636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 1108 -ip 1108

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 5324 -ip 5324

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 3668 -ip 3668

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 4248 -ip 4248

C:\Users\Admin\AppData\Local\Temp\Unicorn-16331.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16331.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 1568 -ip 1568

C:\Users\Admin\AppData\Local\Temp\Unicorn-56294.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56294.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 5804 -ip 5804

C:\Users\Admin\AppData\Local\Temp\Unicorn-39958.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39958.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44042.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44042.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1836 -ip 1836

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 5216 -ip 5216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5408 -ip 5408

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 1176 -ip 1176

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 6084 -ip 6084

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3668 -s 716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 1520 -ip 1520

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 732

C:\Users\Admin\AppData\Local\Temp\Unicorn-27898.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27898.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27898.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27898.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27898.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27898.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60570.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60570.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 3284 -ip 3284

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 940 -ip 940

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 3760 -ip 3760

C:\Users\Admin\AppData\Local\Temp\Unicorn-31489.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31489.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5704 -ip 5704

C:\Users\Admin\AppData\Local\Temp\Unicorn-38588.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38588.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38588.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38588.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7861.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7861.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2194.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2194.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5723.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5723.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 3968 -ip 3968

C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25328.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25328.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25328.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25328.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17291.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17291.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9184.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9184.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55692.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55692.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14659.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14659.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41302.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41302.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2224 -ip 2224

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 5576 -ip 5576

C:\Users\Admin\AppData\Local\Temp\Unicorn-34011.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34011.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7067.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7067.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34587.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34587.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4737.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4737.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45770.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45770.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1988 -ip 1988

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 5644 -ip 5644

C:\Users\Admin\AppData\Local\Temp\Unicorn-9952.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9952.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9952.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9952.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5868.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5868.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4680 -ip 4680

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 5860 -ip 5860

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5644 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5640 -ip 5640

C:\Users\Admin\AppData\Local\Temp\Unicorn-15812.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15812.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2490.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2490.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30010.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30010.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-352.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-352.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 5316 -ip 5316

C:\Users\Admin\AppData\Local\Temp\Unicorn-47114.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47114.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43030.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43030.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61312.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61312.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44976.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44976.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30586.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30586.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 640 -ip 640

C:\Users\Admin\AppData\Local\Temp\Unicorn-2874.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2874.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 4544 -ip 4544

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 5596 -ip 5596

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 5444 -ip 5444

C:\Users\Admin\AppData\Local\Temp\Unicorn-14633.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14633.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28832.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28832.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 5580 -ip 5580

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 1000 -ip 1000

C:\Users\Admin\AppData\Local\Temp\Unicorn-8411.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8411.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2500 -ip 2500

C:\Users\Admin\AppData\Local\Temp\Unicorn-43798.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43798.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43798.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43798.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 5196 -ip 5196

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 5248 -ip 5248

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 6028 -ip 6028

C:\Users\Admin\AppData\Local\Temp\Unicorn-43606.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43606.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8795.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8795.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47690.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47690.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31162.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31162.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31162.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31162.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27078.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27078.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5568 -ip 5568

C:\Users\Admin\AppData\Local\Temp\Unicorn-44182.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44182.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39906.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39906.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1011.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1011.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 5908 -ip 5908

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1240 -ip 1240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2952 -ip 2952

C:\Users\Admin\AppData\Local\Temp\Unicorn-32122.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32122.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 576 -ip 576

C:\Users\Admin\AppData\Local\Temp\Unicorn-23954.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23954.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 1120 -ip 1120

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 4892 -ip 4892

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 5372 -ip 5372

C:\Users\Admin\AppData\Local\Temp\Unicorn-31991.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31991.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18116.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18116.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 5960 -ip 5960

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 4780 -ip 4780

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3260 -ip 3260

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 5992 -ip 5992

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5116 -ip 5116

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 5876 -ip 5876

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 1860 -ip 1860

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 6008 -ip 6008

C:\Users\Admin\AppData\Local\Temp\Unicorn-56865.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56865.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56865.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56865.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56865.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56865.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35184.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35184.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4457.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4457.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10186.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10186.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 3044 -ip 3044

C:\Users\Admin\AppData\Local\Temp\Unicorn-54234.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54234.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19424.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19424.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 1096 -ip 1096

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5712 -ip 5712

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 5148 -ip 5148

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 5836 -ip 5836

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5728 -ip 5728

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5352 -ip 5352

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5712 -s 724

C:\Users\Admin\AppData\Local\Temp\Unicorn-55002.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55002.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16108.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16108.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 1744 -ip 1744

C:\Users\Admin\AppData\Local\Temp\Unicorn-3855.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3855.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3855.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3855.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36528.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36528.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58017.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58017.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18054.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18054.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38666.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38666.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38666.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38666.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43627.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43627.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52864.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52864.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6008 -s 632

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 3176 -ip 3176

C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34582.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5684 -ip 5684

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5728 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5624 -ip 5624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 496 -ip 496

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5324 -ip 5324

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4920 -ip 4920

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5944 -ip 5944

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 4772 -ip 4772

C:\Users\Admin\AppData\Local\Temp\Unicorn-2293.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2293.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12106.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12106.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 5176 -ip 5176

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2936 -ip 2936

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5988 -ip 5988

C:\Users\Admin\AppData\Local\Temp\Unicorn-17814.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17814.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52625.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52625.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13730.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13730.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4288 -ip 4288

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5204 -ip 5204

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 4548 -ip 4548

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 1444 -ip 1444

C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 1412 -ip 1412

C:\Users\Admin\AppData\Local\Temp\Unicorn-9475.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9475.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3696 -ip 3696

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5232 -ip 5232

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5036 -ip 5036

C:\Users\Admin\AppData\Local\Temp\Unicorn-19590.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19590.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19590.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19590.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19590.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19590.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19590.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19590.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 4596 -ip 4596

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 5748 -ip 5748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 5300 -ip 5300

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 2608 -ip 2608

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1628 -ip 1628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 5348 -ip 5348

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3900 -ip 3900

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 3636 -ip 3636

C:\Users\Admin\AppData\Local\Temp\Unicorn-22688.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22688.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18604.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18604.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44177.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44177.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44177.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44177.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 2272 -ip 2272

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5280 -ip 5280

C:\Users\Admin\AppData\Local\Temp\Unicorn-60513.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60513.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34940.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34940.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4213.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4213.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34940.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34940.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4213.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4213.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34940.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34940.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34940.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34940.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 2088 -ip 2088

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3440 -ip 3440

C:\Users\Admin\AppData\Local\Temp\Unicorn-46699.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46699.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5816 -ip 5816

C:\Users\Admin\AppData\Local\Temp\Unicorn-20934.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20934.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 2708 -ip 2708

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3660 -ip 3660

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 5576 -ip 5576

C:\Users\Admin\AppData\Local\Temp\Unicorn-17234.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17234.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5280 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 636

C:\Users\Admin\AppData\Local\Temp\Unicorn-1473.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1473.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 5336 -ip 5336

C:\Users\Admin\AppData\Local\Temp\Unicorn-7695.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7695.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43876.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43876.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43876.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43876.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43876.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43876.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 1800 -ip 1800

C:\Users\Admin\AppData\Local\Temp\Unicorn-27924.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27924.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 660

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 1108 -ip 1108

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 1432 -ip 1432

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 6076 -ip 6076

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 2644 -ip 2644

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4940 -ip 4940

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5716 -ip 5716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 5672 -ip 5672

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1072 -ip 1072

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 3272 -ip 3272

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5700 -ip 5700

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 1900 -ip 1900

C:\Users\Admin\AppData\Local\Temp\Unicorn-43238.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43238.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 4748 -ip 4748

C:\Users\Admin\AppData\Local\Temp\Unicorn-32932.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32932.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24764.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24764.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 5240 -ip 5240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1568 -ip 1568

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 4056 -ip 4056

C:\Users\Admin\AppData\Local\Temp\Unicorn-32740.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32740.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62651.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62651.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 5940 -ip 5940

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 916 -ip 916

C:\Users\Admin\AppData\Local\Temp\Unicorn-11504.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11504.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11504.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11504.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19995.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19995.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6673.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6673.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 6028 -ip 6028

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 2688 -ip 2688

C:\Users\Admin\AppData\Local\Temp\Unicorn-1328.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1328.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5548 -ip 5548

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5520 -ip 5520

C:\Users\Admin\AppData\Local\Temp\Unicorn-3850.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3850.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 6096 -ip 6096

C:\Users\Admin\AppData\Local\Temp\Unicorn-4426.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4426.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 348 -ip 348

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 6072 -ip 6072

C:\Users\Admin\AppData\Local\Temp\Unicorn-51489.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51489.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51489.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51489.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64810.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64810.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 5136 -ip 5136

C:\Users\Admin\AppData\Local\Temp\Unicorn-28416.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28416.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46891.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46891.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 5704 -ip 5704

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 1256 -ip 1256

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 3968 -ip 3968

C:\Users\Admin\AppData\Local\Temp\Unicorn-34468.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34468.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9771.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9771.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2016 -ip 2016

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4544 -ip 4544

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 5788 -ip 5788

C:\Users\Admin\AppData\Local\Temp\Unicorn-15863.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15863.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 2252 -ip 2252

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5788 -s 744

C:\Users\Admin\AppData\Local\Temp\Unicorn-51250.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51250.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 3688 -ip 3688

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 4240 -ip 4240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 640 -ip 640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5448 -ip 5448

C:\Users\Admin\AppData\Local\Temp\Unicorn-52641.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52641.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46097.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46097.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 5512 -ip 5512

C:\Users\Admin\AppData\Local\Temp\Unicorn-19777.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19777.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19777.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19777.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 628

C:\Users\Admin\AppData\Local\Temp\Unicorn-29014.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29014.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29014.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29014.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16570.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16570.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 4948 -ip 4948

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 5880 -ip 5880

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 5572 -ip 5572

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 2632 -ip 2632

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 105.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 216.58.213.10:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 10.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 105.193.132.51.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\Unicorn-22352.exe

MD5 c2943b43e13db3e48e892962b8b83af3
SHA1 4de732e4f14e0298fbdcca9dd06ecde4ed12b2ad
SHA256 b427a6568a880566b10badf6c15314d08390d29da7c177d8766f558cff2ca43c
SHA512 eb8f29409a788b98f268f40210f7cd07b04e94f57d9d1d38ab516e7ad037d9eaf14ebd91502f2d127131c9cfb09186d611b6762e1262b72a7f414fbb1a8c14d0

C:\Users\Admin\AppData\Local\Temp\Unicorn-18927.exe

MD5 a4972a070b0b97f7e45f1f9f21084629
SHA1 d4ee707b6e061719ff0ca7df866668f6f995f115
SHA256 74ff98b960b8bfd53eb3d998d85a287edd8aa200a555b30e33c61ac21c11000d
SHA512 170e79e99ad0620e5e5095bea41d0c5af834e6776ef93f618312c066c2ee344869e3cbb761f26ccd3f4968c7b2b9febf47a96ce8084c41f3a92ec006f1c9fc1e

C:\Users\Admin\AppData\Local\Temp\Unicorn-4214.exe

MD5 cb092b94cbc2d7ce42c097969f070cee
SHA1 80528c56bbd8108696d1f77ebd4de509c0a17535
SHA256 ca91b7dddbb3816026c0a5567fd53ae5066d657939af24686fb786c0df8a2d90
SHA512 a553e0a66b96f2d29f96fb31ea8ac53ce0caf88d90adc79a31d9a6cca57baff7b34df968882b2f2d7f945c1033654bb4087e0988d828daca7009528aa0258a75

C:\Users\Admin\AppData\Local\Temp\Unicorn-3514.exe

MD5 9924a1075573f268849926129ce6804a
SHA1 162fbf81a37add82cbd7789e8b9d967cf3a9dadd
SHA256 ee54fbe9d035547fa20da438f52afbec554b2255221439963fc59b719f43b7e7
SHA512 7899465a81565a35b3c752f2ccfcd112653293e937f69807e056304adc9c719bb0066eee3b3d9cb5f4e75409ea88d8a20a78252bd7eaf218adb1d608f3157bad

C:\Users\Admin\AppData\Local\Temp\Unicorn-54339.exe

MD5 14f4bb81a5668c9c7a4c9ee58c288966
SHA1 cea5548c4d5fab34ebd760a600118726a704580f
SHA256 72d5c5c59351b46f9a03908e7072bd72d6e8fef420a17ac8d0aace10454a03b1
SHA512 958b3de37bfd8fb0ffd797e6da320f72e67ca34935504678c389a95357289ea07633c43716a990e1046a69c208e99e5f90db63c4a718a327d1766bc73a80dc1c

C:\Users\Admin\AppData\Local\Temp\Unicorn-17713.exe

MD5 737b545a647fec8cd29bbb912d475a9d
SHA1 618141c6dd54fe4812a3c133e7d6bcde75ff7455
SHA256 d9ff9e9228cfa746d244acdbe7dcb7b5b9df66879813f4c238ea57b62255a37f
SHA512 6a9dd532c43517bad54b722d8923e7073564bc37273334c1a639c4b68571063c6b8931a7a79bc4b5fc3dbe5db997d0e0436181a61caa48b09942035ceed1d4dc

C:\Users\Admin\AppData\Local\Temp\Unicorn-19441.exe

MD5 e11faf871a49b7c1aaa591f571e7cb15
SHA1 443dffe4979033365b170ad87eff31278dc497b8
SHA256 09231a5a982a9dc9d6fd69f9259a1a787a5990fdb2c6515fbfb1d1f3e498006a
SHA512 08ae63a3449592c58c2313288c3a92c94e7bd4c7f69ae9279f0f39f64facf7eb215faa47ea71d6383ded24f4e30c2cf93b8dd417c8f4ec2b87a08f285b6d9ace

C:\Users\Admin\AppData\Local\Temp\Unicorn-31370.exe

MD5 e46399e5e6ead57a58840d84689cafcc
SHA1 f4bad6889cf40d1f3cd568239d2cb21404525bec
SHA256 4f16ae32568b2ebf73d435c48d0e8104a5e646ea8964daa0d3c30c444e58e34c
SHA512 4738778db1c84bea8cb8d5cfbdda1747d2346f6b4848ad613bb813d5e5e2c5f9a4debec1915c5af6e8b568520b4c4ed3ee41dfbceb97bdb86b83107aa7cf62b0

C:\Users\Admin\AppData\Local\Temp\Unicorn-65434.exe

MD5 f4fa0bdc08c351d644afe27439d2d6a1
SHA1 d5376ddbe8438333eb9e574f09804a9f5aab5c1c
SHA256 4b07df7d3f1eb7bf66c5c9a5ed31c336288c2417da0b15257328a5740723b606
SHA512 c35b2584c74f595026ad4548f5956cbdae2995d5f9fef56563d3ef76db7b7a8c0a94846c571926a555bccd6bcd8cfeb7eee6399d44d9746ee497c1d74bd80346

C:\Users\Admin\AppData\Local\Temp\Unicorn-34193.exe

MD5 084c24c2562b20435ecc9d40796568b8
SHA1 5fd0a8b19829596039505420b8f6404d8c3d73bd
SHA256 d9caa751c0325ba974b19a5b00c39cb1dfd07fec3108fc0cb6161375adf47ed3
SHA512 6228868c755cd2988701b63c3bde0dd91803f58b4c3e1c444c5e24bfe40bf216bfc08831a69e376871cfc9024c50db3d5d10d862b0fe2b577750a61b7f84595a

C:\Users\Admin\AppData\Local\Temp\Unicorn-53182.exe

MD5 c6db5c2ef927d59da2e435bde57ec71e
SHA1 1be025f2afccb15548408addd21bdce223d075cd
SHA256 7dae3fee737d1104fafc3e4b7aa1fdbb469944910f56ccff860216a9608aada1
SHA512 3e32d17f4f808716bb9d4edf4d530c58cacf4ba76e5f22f49800bb0e7905012223eab163f5af18f0867f60b7a877066f7b3b0d5b0ef45c76b5be50f1aadab64a

C:\Users\Admin\AppData\Local\Temp\Unicorn-29638.exe

MD5 47290644600e143cbb955bdde5e230db
SHA1 1577590ba3d1bab45c6bd7511c539f1e2e155eef
SHA256 5c951d3dafa9e048b12bd5657787709d7a6faecd8a37f8129ec86c4cf9f08481
SHA512 25039d25f584597471762ff96d3a7bc55d0a26ab76e1d626e35414a2e08d54eede57b32816b6b574e5d16c2ccfcb3ab0a31c0a4daceb7a6da5e56b1cf726e894

C:\Users\Admin\AppData\Local\Temp\Unicorn-33975.exe

MD5 0ebf92cc52ee1411c44b80a5d8624810
SHA1 039517e3205092c98a8ae40dbbc0f8b81163fb75
SHA256 f27af0d3a279003d7bedba0b8b52f4bec8567dd67f8415ea3377450e22eb3750
SHA512 15fd45674d3a6e7eb95e13ed84f440fcc1bead08a3efe34910b70874d9c672fb66fba2b949192da19143bf9fe62176a4c079063af57af4ca165d633fa7bc2e2f

C:\Users\Admin\AppData\Local\Temp\Unicorn-28268.exe

MD5 18cadebd299bd778ca54a93238a455f0
SHA1 4d77611b6e4c1b7f1b1def9c305425a8603aeefa
SHA256 51ffa200d5966c64b08993591bfdc70e0ac1e3bcc4b325f9c3c6966fe1da5242
SHA512 387f5dfa30f83bc662cc06aee1c807529f1769423a8547f34182fadc34848ae5158d2465f9e825de2ad8cdf4e73d9822828feb7788bc820a58e16455981bda67

C:\Users\Admin\AppData\Local\Temp\Unicorn-46550.exe

MD5 e1655ffe05bf39cd294e9b0f6d2bd35a
SHA1 2ca824d48671b58a44c3277e52c560caeaf44958
SHA256 5485734dac5ce9d61d433b9b2981532570f4c9cff3134acbca346951bab9cef9
SHA512 49fb1f2cbe581a320210056de49c20ca4e81920902f0d6ec5223758a763d0eb1835717f1c8c8d268c5f2224fa7db844f0da2d2bfc1a9dbdaae501f8aefc7551d

C:\Users\Admin\AppData\Local\Temp\Unicorn-19393.exe

MD5 fe25bbb7f3831e43e8cfb5741e26f33e
SHA1 3bc0702a19636e558d0f1dc8e93ca4bd1a4265d3
SHA256 5be5cee3dd5551b09dbede05c219da452a5b2291aea04c12572e0fac874f43b8
SHA512 a3f73c1b3fd2962f841fd42fd5b19359f3d8d30c0ba834e09896ec1edd25b5a8b08f96055c6a60330a5e33e25499aa6560a5eceac7dfe377f24bb9ff4619b1c6

C:\Users\Admin\AppData\Local\Temp\Unicorn-24546.exe

MD5 ed2f20f682bdd775916618ab8c8bd53b
SHA1 452adeb536893bfa5fdbcbc7ee61549474b70c9b
SHA256 b3ea6b2973cf6b6a450bf2e0fb0f20731cb7bfb4957608a14c425f18fbb6267c
SHA512 130a9b84f10e7409a0a1b8c8721906155edc7321a3630be2e993f775e118968cfd92ec56e05b19502d9e9300b957cabc216fa0e84a08461f8e1c42573558cf34

C:\Users\Admin\AppData\Local\Temp\Unicorn-7738.exe

MD5 813055255a639b3bfd21e8f4e8bc6cff
SHA1 5a079cfc79dcb921f60f23578db20dee543c133d
SHA256 89ad70a96c2fb8e82c7d0f51bc9afb0209400aa245e0cfd8b3ac14db9a3ae229
SHA512 51270c87dbf925e610346b56b816a80e0734ef218e6a5a607e1af760afa65ef8cdfdb1d6e06a408672fd122b205163cbeb2193cef8ceacce9e77f48f028deab6

C:\Users\Admin\AppData\Local\Temp\Unicorn-31920.exe

MD5 8a54225aaa7cdab15cfe0662491ff256
SHA1 2023daa83b2f1af5ad4bdc1b8726511d5cf9c90c
SHA256 20d9462ef6fd5b3e003b4136b590b5aeacf23de5931e85040dab6d7f25df8ab0
SHA512 d5868b5026fc022c259b237a6498e6744aaffde833f34fe5174a2c2cdcf4271aed286fc73def1062d8a929fa85e61c8df175e0ccf32e0a6b80bef1ccf120dcf4

C:\Users\Admin\AppData\Local\Temp\Unicorn-24651.exe

MD5 fd6e285bf6666bcd302f3160365b96a5
SHA1 15c7c927ae2b76dd13009f0de0cf83c76ea9f209
SHA256 c1ea3d8e87f5b087c9e87acda32a6e038e5c8b025ff1a9594399b6a619c65892
SHA512 4978bfa8eeec6842935208ac3acbee105fa2268f7b5cdf2d8c0f3f8eeae21d0097ef5c912950e32d89b8593a3f4e3d6463a1758b368f1c0ce5b8ab1a5f8898fd

C:\Users\Admin\AppData\Local\Temp\Unicorn-35511.exe

MD5 179327de111dff3a913df8f1c2e4df3c
SHA1 f151c168423450517c7f3760b0f0ef1366c84787
SHA256 f22d555be2637a7f12d3c6a0c239aa2227301af8c7e3b94797770afe470f09f6
SHA512 ae8df7329b7773d57906a0fd1096f5a2964acbcfd13151a1739a7147fb82609c5e12c864968501b3576b7c12c2ed346a9602ecbc4f7d0a2ff2ea95f2e269f16e

C:\Users\Admin\AppData\Local\Temp\Unicorn-8122.exe

MD5 d46bb7e0f32fe2fdef6fa37e22ed62b3
SHA1 cd16396d24ae0b93712a5d6da1cf6308db2fdc78
SHA256 b772e33e637c3b2ab3d60f8e06ffcb4d16b0dc5bf58c51d8478ff023213b388a
SHA512 f9869ca048549567eb797db415e6c79a59c8b58a71fa046087f80002271175f0d1139257e7b8d4698f506b13e4ab9f850c42509d9621c7f31364be581aaea644

C:\Users\Admin\AppData\Local\Temp\Unicorn-4915.exe

MD5 3e1bb2c7f9a463b8582426435851b281
SHA1 ab669307de3f5840cd3aa555d6970d2c6e20c21f
SHA256 748a64d0d1b57520a8752b23880309534d83dbe9c45a89aad911517ee7f64f1d
SHA512 272a83669306a746176f5e79e13cd4732f2c41d6658fd5770e3d1e060ee1f0e435378efbdfc5caa35f99dfdb9272a0082ba0815af5d795d8ca1380be03969e8d

C:\Users\Admin\AppData\Local\Temp\Unicorn-46503.exe

MD5 f400cff7bbaad9b8e229d4c6fd34a299
SHA1 12317ecaf6d895a0f110a1ad8511bf471c27108f
SHA256 42a0f05c6992b419e1f184d9e037bbd8b5a8f71a7d3ccb6d6b74086d2e95d51a
SHA512 7356907d6b20a975a70921f1185cc8044b15ab1964f646a4e004a4add0058a2eb09338484bac69c34172be0ff1d691a3ea884bbb310b8759262c60e847300bb4

C:\Users\Admin\AppData\Local\Temp\Unicorn-35642.exe

MD5 8fc99a52a03f812c14e4969796b98ee7
SHA1 dea5a796c86909193f04d16a3f8251dbe37bdebe
SHA256 bb17a7c41d3c59ae13d9871188730f42c6cdf86fec7a586c73a9dbf44da3fc75
SHA512 d1eee832dcd395d2394435923d98099b6ea32a80907db5e8672e7d1ff8f6d243dded0301ee214f830abf64497c694826c28f82442ede69a620353cadb04bd1b8

C:\Users\Admin\AppData\Local\Temp\Unicorn-62715.exe

MD5 69d92182678199b0f7b952ea84b3f7da
SHA1 d64198d22048ac4161e94a494dc85d5b5b6f3a9e
SHA256 80c2bc55508aecdcb6598c7ecd4580032383354cd108ed4812b347e10af93845
SHA512 a26a0babc6913f4217f2b887f1d354034d1457cd9a842ffd24de3daff720701727ab40909125479b3bdd94e5d5df01978c9745adc40bca9be9d5be21df4c8b0f

C:\Users\Admin\AppData\Local\Temp\Unicorn-23306.exe

MD5 3e8ef2debfa9d0288fa28eb0d1701088
SHA1 9bb2d8b330f961525db614a75b78bb89bf7978ec
SHA256 533b000f06ab662c7654aa72faa269f8bf464082e36f622156e4a5a70c7c49f9
SHA512 704dd1b549f63ebdf44d4852b1b558baf0ac940a66944f40e9e11fea233e3a4c42fb23706856cc2520485ebe62bf12c924b2c45fcc76ccef1d0832d0b5cf16cb

C:\Users\Admin\AppData\Local\Temp\Unicorn-1.exe

MD5 5d6eec0377188b086ae2123d2e5f7638
SHA1 0f9095398023d20f35e99919b4379c0cd56204b9
SHA256 5859be696b1d98e6fd56e177a0caf8a13e7872c23f3fff54c11bd9174d650709
SHA512 65a4cfdcc62eba414d20a6675b703013d5a712f0ee50b899a99afaff27da71311637a70a2658e299d099dbc289a14f6ab6c819a84bdc82a05678bc006dafae9f

C:\Users\Admin\AppData\Local\Temp\Unicorn-27713.exe

MD5 0d620b23e18fcb2a14c5a132d6b41663
SHA1 b2f488e150b8b71b9966933675f40e160c243591
SHA256 851839175997696d258e6e231857634280a369df949bf27b31605772aad384c7
SHA512 abc58c55a9f249b3d026a433ec62b9baba3023af01fe8021c44b5ea1b46831c66e8eaccdf477993485072f69a397c7f2fb860e8c9652a7d5a9543363c6cad7c4

C:\Users\Admin\AppData\Local\Temp\Unicorn-39450.exe

MD5 5bf09e4d44d5c68d95f82991342c64b2
SHA1 5f09b3bfdfac7e6a3fc4daccb8b5bfef2d5bc8e1
SHA256 46767cbcedf4d08a07ba884281ef287c9b3f6196d470567ba67d7418164c8929
SHA512 dc7fd1807febc8b1768d69ac65479a0036812a82dca4492b120edabe6f7d45018a9fce0ac8d079056d681e7a31f5bc1afbcec1b99ef53a0a7bd03106514a0294

C:\Users\Admin\AppData\Local\Temp\Unicorn-37334.exe

MD5 03fbdc3928bb1ffd33d390fb0f0a3797
SHA1 78d98ea68461264773bbd4b9e95ee8f42b98d262
SHA256 1d8ab5be789d86d4346d46761d7ca50e1fd8531d6c7a8309d988f686364901e8
SHA512 6d7a0867310253aad041199798448aca5a61e985477e001de1f075b9405f45f43eed5c6fcde0aa87a495c02d54ac52f2bd69a77106f5e81ac7f45e115ff456c5

C:\Users\Admin\AppData\Local\Temp\Unicorn-10177.exe

MD5 4ea952d57a37033ed3e5a92806a940c3
SHA1 03d55660ac1de7f8bb1caee8d561dba8df5c07db
SHA256 3f49cb147911627e54f5061099c78e8d2bb0de5de27f3050967c0983e3e5be71
SHA512 3c7ee79304849fd2b0bebeac2738b90ce9bdec8342e803d7da40da9dafc66b090c2c92aee648f8b1de6c8e03e64dbec0b135ec28a39d92989a05911bb6748911

C:\Users\Admin\AppData\Local\Temp\Unicorn-54220.exe

MD5 8022dc8c097a43efb5a11ec8683944ac
SHA1 67c4fbfdaa8c12598d89de06fb91a7b14595c77b
SHA256 9df80eb7322a75671dd16840ab0d94c5b85490ca95004f1627383188df6e2aa2
SHA512 97833c9dbf20400b59377833f1227c8a9ad08c828e6b1ac511f239c6fef48500bc08c403c4fe9090c1be9f50f0a6d5b1a9fece66b1b13da1020ed51c4dd93ba5

C:\Users\Admin\AppData\Local\Temp\Unicorn-55323.exe

MD5 9277be8e764e0c6c2d5d8378e6d3a007
SHA1 5c33369786c12a254666c7c13ea9aa0d366fd7b8
SHA256 0609ba669d2cb03dd2db6d1ff53b12463be3e0cf528086ac129250f2730fe77f
SHA512 c3bee99c760c0052a60af42ad651878d5cf4b9f475fc9d6c04ac6ff353507ff493de8afe69af08daf7f8882d973180fab6b6f7fe1dfe30c3343da1390ed07627

C:\Users\Admin\AppData\Local\Temp\Unicorn-40186.exe

MD5 7a7a2ff6f128bac9989420ae54e75cff
SHA1 adfcdcdf3731b92b75bbf4f2ce12794daaf3a28e
SHA256 1d55a1cbf75b222d2d098e09d4930243c111e3981350c37bf7de58154e95231d
SHA512 339683934cf83017c96eb9a64ac986bd4dcc1705d898e1d9e1aa766810c90cc3ce9ec423ad2883bb00cee748aabd40f89d2ee2147ef79222158329d3577c8550

C:\Users\Admin\AppData\Local\Temp\Unicorn-44042.exe

MD5 cae9193308a4b8bb8d518ee1a69ed059
SHA1 141353edd3bc430eb06ac79e438793fe98a52044
SHA256 7e5dbe3f03db3baf46fa9cd5179072831d4ba0bfea2206caf25e3d0482e10a29
SHA512 25cab778c714cedddb3115f17e2cc62e1a9af89b9603f465b41a9cedb43e5942beea9d71bbcc5dbf404c6ce1423fc2a99339cefe19e16ddd57006668f5eac3e7

C:\Users\Admin\AppData\Local\Temp\Unicorn-10186.exe

MD5 cc97e7fdce345cd96cb28e17db8cb1d6
SHA1 1a9390ba2fff0d2f6c4f6c7c4966a265af52ee35
SHA256 54997d0adc955f10fef6017c675dd19274e88dc7f323110688e007184adfa670
SHA512 9f0a1c761d6531884bcb1ca2df2e8746d0111782c3f36ebdc527d9386daec56137aca9eb52690fc52878637a0b75b6131618cc28272fd882959ee1d664b0bb2e