Malware Analysis Report

2025-06-16 07:17

Sample ID 240531-2bx7aage32
Target 6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8
SHA256 6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8
Tags
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8

Threat Level: Shows suspicious behavior

The file 6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8 was found to be: Shows suspicious behavior.

Malicious Activity Summary


Executes dropped EXE

Loads dropped DLL

Unsigned PE

Program crash

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-05-31 22:25

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-31 22:25

Reported

2024-05-31 22:27

Platform

win7-20240221-en

Max time kernel

150s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14572.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61936.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51075.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19040.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1957.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4650.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59326.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20515.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25175.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62678.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25175.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12922.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54510.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58423.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3747.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26881.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30219.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60945.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63638.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44609.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59554.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48968.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14157.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25018.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36524.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12574.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-322.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54998.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57499.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-43286.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34926.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37618.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57484.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53400.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64261.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33233.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26649.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63960.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18289.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50961.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6591.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-52907.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63768.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4474.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27033.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31117.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33617.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18673.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60260.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20619.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49207.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60068.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2144.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2144.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2144.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1329.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1329.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56005.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58698.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14572.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14572.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51075.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51075.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14572.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14572.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61936.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61936.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19040.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19040.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59326.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59326.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4650.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4650.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61936.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61936.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1957.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1957.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51075.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51075.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20515.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20515.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19040.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19040.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62678.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25175.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62678.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25175.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59326.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-56160.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14572.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-51075.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-61936.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19040.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4650.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59326.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1957.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20515.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25175.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-62678.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25175.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12922.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54510.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-3747.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7188.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-58423.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59554.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-30219.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26881.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63638.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44609.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-60945.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14157.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25018.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-36524.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-322.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12574.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-43286.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54998.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18289.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57484.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48968.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34926.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63960.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-2144.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33617.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63768.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57499.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31117.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6591.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-2144.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1329.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1329.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33233.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20619.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64261.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-49207.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-58698.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-36331.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-60260.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26649.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-60068.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-56005.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53400.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-2144.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64557.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-52907.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18673.exe

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14572.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51075.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61936.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19040.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1957.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4650.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59326.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20515.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25175.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62678.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25175.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12922.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54510.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58423.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3747.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26881.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30219.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44609.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63638.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59554.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60945.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48968.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14157.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25018.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36524.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12574.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-322.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57499.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54998.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-43286.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34926.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53400.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37618.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57484.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64261.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33233.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26649.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18289.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63960.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50961.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-52907.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6591.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63768.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4474.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27033.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31117.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33617.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18673.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60260.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20619.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60068.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49207.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2144.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2144.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2144.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1329.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1329.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56005.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2764 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe
PID 2764 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe
PID 2764 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe
PID 2764 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe
PID 2692 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14572.exe
PID 2692 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14572.exe
PID 2692 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14572.exe
PID 2692 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14572.exe
PID 2764 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-56160.exe
PID 2764 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-56160.exe
PID 2764 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-56160.exe
PID 2764 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-56160.exe
PID 2764 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8.exe C:\Windows\SysWOW64\WerFault.exe
PID 2764 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8.exe C:\Windows\SysWOW64\WerFault.exe
PID 2764 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8.exe C:\Windows\SysWOW64\WerFault.exe
PID 2764 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8.exe C:\Windows\SysWOW64\WerFault.exe
PID 2692 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-61936.exe
PID 2692 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-61936.exe
PID 2692 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-61936.exe
PID 2692 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-61936.exe
PID 3048 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14572.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-51075.exe
PID 3048 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14572.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-51075.exe
PID 3048 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14572.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-51075.exe
PID 3048 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14572.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-51075.exe
PID 2692 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe C:\Windows\SysWOW64\WerFault.exe
PID 2692 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe C:\Windows\SysWOW64\WerFault.exe
PID 2692 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe C:\Windows\SysWOW64\WerFault.exe
PID 2692 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe C:\Windows\SysWOW64\WerFault.exe
PID 2452 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56160.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19040.exe
PID 2452 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56160.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19040.exe
PID 2452 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56160.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19040.exe
PID 2452 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56160.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19040.exe
PID 2492 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51075.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1957.exe
PID 2492 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51075.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1957.exe
PID 2492 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51075.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1957.exe
PID 2492 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51075.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1957.exe
PID 3048 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14572.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4650.exe
PID 3048 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14572.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4650.exe
PID 3048 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14572.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4650.exe
PID 3048 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14572.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4650.exe
PID 2368 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61936.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59326.exe
PID 2368 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61936.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59326.exe
PID 2368 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61936.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59326.exe
PID 2368 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61936.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59326.exe
PID 2452 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56160.exe C:\Windows\SysWOW64\WerFault.exe
PID 2452 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56160.exe C:\Windows\SysWOW64\WerFault.exe
PID 2452 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56160.exe C:\Windows\SysWOW64\WerFault.exe
PID 2452 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56160.exe C:\Windows\SysWOW64\WerFault.exe
PID 3048 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14572.exe C:\Windows\SysWOW64\WerFault.exe
PID 3048 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14572.exe C:\Windows\SysWOW64\WerFault.exe
PID 3048 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14572.exe C:\Windows\SysWOW64\WerFault.exe
PID 3048 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14572.exe C:\Windows\SysWOW64\WerFault.exe
PID 2376 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19040.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20515.exe
PID 2376 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19040.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20515.exe
PID 2376 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19040.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20515.exe
PID 2376 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19040.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20515.exe
PID 1012 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59326.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25175.exe
PID 1012 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59326.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25175.exe
PID 1012 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59326.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25175.exe
PID 1012 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59326.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25175.exe
PID 2336 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4650.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25175.exe
PID 2336 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4650.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25175.exe
PID 2336 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4650.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25175.exe
PID 2336 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4650.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25175.exe

Processes

C:\Users\Admin\AppData\Local\Temp\6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8.exe

"C:\Users\Admin\AppData\Local\Temp\6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8.exe"

C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14572.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14572.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56160.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56160.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-51075.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51075.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61936.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61936.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-19040.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19040.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1957.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1957.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4650.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4650.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59326.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59326.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-20515.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20515.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62678.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62678.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12922.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12922.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54510.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54510.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-58423.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58423.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3747.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3747.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26881.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26881.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30219.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30219.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60945.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60945.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63638.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63638.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59554.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59554.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44609.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44609.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-48968.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48968.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14157.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14157.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25018.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25018.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-36524.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36524.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12574.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12574.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-322.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-322.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54998.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54998.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57499.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57499.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43286.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43286.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34926.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34926.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37618.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37618.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57484.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57484.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53400.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53400.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64261.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64261.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-33233.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33233.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26649.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26649.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63960.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63960.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18289.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18289.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-50961.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50961.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-6591.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6591.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52907.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52907.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63768.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63768.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4474.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4474.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27033.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27033.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31117.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31117.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33617.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33617.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18673.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18673.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60260.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60260.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20619.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20619.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49207.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49207.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60068.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60068.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2144.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2144.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2144.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2144.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2144.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2144.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1329.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1329.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1329.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1329.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56005.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56005.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58698.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58698.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47837.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47837.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-7188.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7188.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 180

C:\Users\Admin\AppData\Local\Temp\Unicorn-64557.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64557.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36331.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36331.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 476 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-1542.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1542.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-10265.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10265.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-37422.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37422.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-55896.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55896.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55896.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55896.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23778.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23778.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23778.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23778.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5325.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5325.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54526.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54526.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57219.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57219.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-46358.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46358.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22216.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22216.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9217.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9217.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-50250.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50250.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26300.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26300.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-9793.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9793.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-24184.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24184.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-56856.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56856.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40328.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40328.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1433.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1433.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58802.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58802.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22408.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22408.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-60748.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60748.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-60748.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60748.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40904.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40904.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12870.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12870.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2009.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2009.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55294.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55294.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57240.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57240.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20292.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20292.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12123.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12123.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39896.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39896.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62585.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62585.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-48771.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48771.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 708 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 844 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-64313.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64313.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21143.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21143.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-22560.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22560.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-62030.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62030.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57946.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57946.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6799.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6799.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 832 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-12829.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12829.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43556.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43556.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6607.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6607.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47448.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47448.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16722.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16722.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35196.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35196.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37910.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37910.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17298.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17298.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62222.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62222.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 324 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-58138.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58138.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-40240.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40240.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23712.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23712.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-30318.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30318.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13981.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13981.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-47785.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47785.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24672.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24672.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8335.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8335.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61428.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61428.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27495.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27495.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-34293.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34293.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44407.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44407.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60743.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60743.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-32539.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32539.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24179.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24179.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4142.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4142.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38953.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-57702.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57702.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-21138.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21138.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35336.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35336.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53810.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53810.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60587.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60587.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-1101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1101.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-7323.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7323.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-13161.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13161.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25990.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25990.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23852.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23852.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25798.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25798.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9461.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9461.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5953.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 812 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-12175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12175.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-19083.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19083.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-9988.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9988.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 596 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-12702.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12702.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-12209.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12209.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-341.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-341.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3980 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-49926.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49926.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-29698.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29698.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48172.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48172.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-28629.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28629.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8784.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8784.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57985.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57985.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-55847.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55847.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3820 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-50201.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50201.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60315.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60315.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58753.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58753.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34057.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34057.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3138.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3138.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25697.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25697.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63605.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63605.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3864 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-14259.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14259.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-51592.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51592.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-11135.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11135.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40793.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40793.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-4420.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4420.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-26787.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26787.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14534.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14534.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-43123.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43123.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31447.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31447.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41753.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41753.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-47783.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47783.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35339.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35339.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59843.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59843.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37861.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37861.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37861.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37861.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13356.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13356.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-5572.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5572.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-54773.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54773.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3848 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-64202.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64202.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3133.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3133.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34628.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34628.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14015.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14015.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-35012.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35012.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-39672.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39672.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63107.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63107.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64176.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64176.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-14482.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14482.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5436 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-65437.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65437.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-24789.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24789.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-37617.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37617.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-43647.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43647.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27851.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27851.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6020 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6580 -s 188

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-29605.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29605.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5696 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5320 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5356 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5128 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-10118.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10118.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5872 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-30347.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30347.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5512 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-30731.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30731.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5408 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-57373.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57373.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6226.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6226.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21001.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21001.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37337.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37337.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2526.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2526.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54249.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54249.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5468 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-772.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-772.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5912 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5732 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-12531.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12531.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63678.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63678.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51234.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51234.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5940 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-41696.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41696.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47726.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47726.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39558.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39558.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7077.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7077.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17192.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17192.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27498.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27498.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15822.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15822.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36097.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36097.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6324 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6484 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-51063.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51063.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5444 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-47363.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47363.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12552.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12552.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5632 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6176 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5728 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-31411.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31411.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18967.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18967.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37441.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37441.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5948 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5848 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-3507.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3507.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6032 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5476 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5648 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5900 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5764 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6116 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-40046.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40046.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5800 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6272 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5868 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6148 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-58328.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58328.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25547.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25547.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13294.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13294.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18317.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18317.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6672 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6564 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6888 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6720 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6812 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6916 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7056 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6956 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6696 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7064 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6388 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-28640.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28640.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22418.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22418.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40892.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40892.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12111.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12111.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20856.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20856.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47498.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47498.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41276.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41276.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41276.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41276.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55474.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55474.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26694.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26694.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57420.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57420.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43798.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43798.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25132.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25132.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-435.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-435.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41468.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41468.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26585.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26585.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48951.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48951.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28531.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28531.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41167.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41167.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19808.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19808.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23700.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23700.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15531.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15531.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25646.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25646.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16108.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16108.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16492.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16492.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12407.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12407.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4239.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4239.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7304 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7500 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7660 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7244 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-57140.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57140.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7436 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7472 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7708 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7560 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7596 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-51494.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51494.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7604 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7856 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7884 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7824 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-43902.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43902.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8000 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7944 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8036 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7240 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8128 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8160 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-21043.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21043.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7312 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 236

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe

MD5 943c18d55dc6ae82a4016974b2542a81
SHA1 1fb5b98eacab2fea1c917f281ac37e2bad7d6de5
SHA256 74586499248c99c79e157473164b958efffdb47dd8a111c4b5c5d68b65dad8ab
SHA512 7308244ef922521d84ba50269716a89215a1cf041755a1fb809e13125ca0ad75a5e098c21f7d36823287231d48900a1f26ab2a866d87fe45831af37d829343fb

\Users\Admin\AppData\Local\Temp\Unicorn-14572.exe

MD5 1327e29775eef0e06d6d5c849e55a4b7
SHA1 95733037c0530dc45c7d1555a9aca266ec75b593
SHA256 aae207d224213b224fb2dbe0ca831bf808a7554b390b271ceb98514915487092
SHA512 f7dc50518721f3353a9295e1c8069681ef458edc3782c7898e27661d0480e02911c43c01b00524aba7ae8ef83363964e1a43df4e440656891a02b251ab8278c2

\Users\Admin\AppData\Local\Temp\Unicorn-56160.exe

MD5 719057658cf71906f700da9c65d3e102
SHA1 de069b5cb7382847480a21270a90a386ffd0b809
SHA256 948a72c132cea7da2398d7a13646c01e4988b9bc4f43eef4436741b5b6b9a7a9
SHA512 376b13614b0000b2eea2b34394c0f428744a9902f3583f2cd87c649fb4175c710957846f69884859eb1187c96d62fc0ad170b5d3e370d8a846aa622fe62112c3

\Users\Admin\AppData\Local\Temp\Unicorn-61936.exe

MD5 82919a567b528ea6105f1daba31dd7b6
SHA1 19371274f5cc877656cb3e001269e6218b7dc938
SHA256 0406919eb94d5db1de1440e6ecb02dfa06c181eef6d2e57903d463292535b2bc
SHA512 41e017eb200ba02dfa6302e78019fe988c694d9001ab3810153c7c7da41b7264725f2908032229b78374cf62d858bc6e97792d735a2373733e06b295eb08cadd

C:\Users\Admin\AppData\Local\Temp\Unicorn-51075.exe

MD5 03c905822d08dd48ee7c64e3de6cf87a
SHA1 8516ba7b7890284389840dafd70978429d21ebcd
SHA256 749aac46ea95adb2b33948f40add494479de598b5de6d1738ec3e9c71e8a71f4
SHA512 2ec51f7464dc05e3cf63420904005210394615761c57ce490db36adafa819cba3aeef4bec5ffe1ab3cc6d1e4738b8a4f1bc35a22ae59c3cea063b7d17050f543

\Users\Admin\AppData\Local\Temp\Unicorn-19040.exe

MD5 2af0985fb8c6aeccf3162a460e1343ed
SHA1 dcb055c45d7630a8900a1b3505d220a7c3db8bcf
SHA256 64fee5d3688538f9779a583672ccb31997f9f45b236f53069e0730d3f24f9603
SHA512 745de220ffb06530d7a49e37a316bf53405442b5e372058580f592998c0e126ae153a99880084f36bd74675807eadf5c20a431e209b8480ab4874d922ab2e696

\Users\Admin\AppData\Local\Temp\Unicorn-1957.exe

MD5 0897f14105ad0aba53accf3f49734390
SHA1 adb3d95c38f7f78a38278b2c4bf187453edb81b1
SHA256 1c61369987156e61479bce2c3713415614dbcf7f6e159a316b7f46d77a6a3800
SHA512 b5c7844d9489c862404e90d977d867fe7dd8be547fd5bc8daf19188ae1fe554ffec594143becc7839e37b016eb89f526cd8580bb546565933f910a81a0b5ccc4

\Users\Admin\AppData\Local\Temp\Unicorn-4650.exe

MD5 a03f1a72fbcb399750b584a6325ae0f6
SHA1 444bf44b112749c1c104f35484be88c321075221
SHA256 3ba547c5d54e10d58b05dcc6820d9033a3112ff8ae2a0ee0ac37f5c457868cc5
SHA512 824d7caf0d3fd464aa7d5227a801c4315b463ddc0c8471fcec7a6ce8c88cd307dbbf3dc2fdb33883731b6a12192b7289d5849f95d1b5892e0caf90cb33ee1e4c

\Users\Admin\AppData\Local\Temp\Unicorn-59326.exe

MD5 d365907b5ceb26fb84da33254541a4f3
SHA1 0914b5472a2daf5253b4cc3a6d9245a28a4d4dca
SHA256 5c3546a97b3a52c7ced61ec76235d243268333f2417acc8a5d1592031004c331
SHA512 10911279caf3ce825bf8fc39b756ae83b9c4daa9afd5787f8abf25d4fd420a3cfac80b7039d41453279026f300ebd8a784cc72dc3d6e8fe866d4b23ae2f7be01

\Users\Admin\AppData\Local\Temp\Unicorn-20515.exe

MD5 1257a30ba9dc1c4105dd9afeb041cfb8
SHA1 6a7528e0a9af0dec44a4ae23039eab4d7b2a4a15
SHA256 09c7b481a361c38628fc864ea4dd65f027bb4943c4806891f9d6776a07900b03
SHA512 064f9529ce4c29f3c40f64bd2c5c57a80ebb9746b2c5c500020e9cb081d97afbbcd2a2967e94f1c7ae8baac76f5b855b429a3a9fe4b8a4f2912f009f0134a203

C:\Users\Admin\AppData\Local\Temp\Unicorn-25175.exe

MD5 621a63eaa536618dd5726a40dbb5f2a5
SHA1 efc1bcd2cd9bb3fdc547a7398c1181dacf0d1bc2
SHA256 cb8ebc473b33231352e674c0649f2b66cb062ab0f8e67a902a89465faded41c5
SHA512 81a4e5a01dfb758e8c761b354ff5a956b03352079eb84850ba93ab60191d037a22dbe1e5f40f2a21801cc6d2d0647ac149f6790d0ddfe1bca499ecf661671101

C:\Users\Admin\AppData\Local\Temp\Unicorn-62678.exe

MD5 efa9fbfaf4b998bf909dbcd3563b8412
SHA1 de451b988c905d1aa50dd08bb4e44ecce7788a1d
SHA256 c2f49fb9cc603f352830e05a98759042450a77e0e0fa6557adacd159115f7160
SHA512 d1a7f917f78f12ac46d660f36479c295d7f3e4f676a2b80f5e4eb94b28001aab82d0d93ee1f44d713197d6c9df093d4e8abd9518730cfdd4a8b67906356edb59

C:\Users\Admin\AppData\Local\Temp\Unicorn-39896.exe

MD5 50dc5770ec48bbc6d3206940323aa087
SHA1 e666797bcd751fc3ed99fbda6242a4b7cbf1ed99
SHA256 a4e746158652a66165a1dac69a149edeb57c377bc477c060f4e93e851c58f698
SHA512 2a4b92684f115d872db7c4f1f5858a2881a92e3c3a528952b942e2c5a59757c358651804e21f1d91ff566e0c2b6aa5c88edabe3de450753c293aecd2de18f931

C:\Users\Admin\AppData\Local\Temp\Unicorn-10118.exe

MD5 47f706ebbf39d8c07fc807198618de34
SHA1 2fb66fd7acbef0ce1461bdc95c7082943441bedf
SHA256 519acfce1fa302ba7145dae332098cee898f2471c02a1a93c4ee21e13b09db37
SHA512 760d72a613791639350fc1f2936a879967d817c50ec27aa8fb9f9a1604e1905e312deddfb42aa50646fef8b32f09a31c827392c0588cf5550f96c88ea10280c3

C:\Users\Admin\AppData\Local\Temp\Unicorn-41167.exe

MD5 54761718e11ccf5dd0c248a28f23494c
SHA1 6a73b2de0583d52574c7df95c37ec66cac25d8ad
SHA256 bf8ac7d0ce439f626e12dc5b39db5bf59aae0cb0e607d886773a973ef2736e8c
SHA512 256b661f31e28e32ffbb2771ce3a399b744f48069c2b3e1c76436ef8f358f79444f91ee1e307709c62f9b77bf2a08f7640251da4c63ec6a18e63e47dc664635f

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-31 22:25

Reported

2024-05-31 22:27

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

130s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30359.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49985.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26035.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18273.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14188.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59860.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58859.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30825.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15881.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42523.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53384.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6726.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44230.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51651.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-8672.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-8672.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31231.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7857.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7857.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9824.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-43820.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30821.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-8262.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49850.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49103.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10208.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12901.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32767.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29259.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-40119.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-40119.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48501.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20467.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58615.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9969.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14053.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9990.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44801.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-40525.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12299.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61521.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61521.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64214.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49269.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49269.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-41101.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-41101.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17151.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-39517.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61713.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33679.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63659.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20681.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23373.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35071.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-11697.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31563.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50037.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62844.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21257.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17173.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-30359.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-49985.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26035.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18273.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59860.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14188.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-58859.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-30825.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15881.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42523.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53384.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6726.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44230.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-51651.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7857.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-8672.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31231.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-8672.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9824.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-43820.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-30821.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-49850.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32767.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-40119.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20467.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48501.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-61521.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-40525.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17173.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38517.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44801.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17281.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7551.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-49399.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-16981.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17687.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-47261.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31069.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37095.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-46955.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-46955.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-46955.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6088.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-36815.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-16177.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-2554.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33507.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32739.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31753.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-45520.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-5276.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14430.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-2946.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-23497.exe
N/A N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22319.exe
N/A N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe
N/A N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65245.exe
N/A N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18567.exe
N/A N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14482.exe
N/A N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-43507.exe
N/A N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14482.exe

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30359.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49985.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26035.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18273.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14188.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59860.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58859.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30825.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15881.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42523.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53384.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6726.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44230.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51651.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-8672.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-8672.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7857.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31231.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7857.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9824.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-43820.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30821.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-8262.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49850.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49103.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-40119.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12901.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29259.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10208.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32767.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-40119.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48501.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20467.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58615.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9969.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14053.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9990.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44801.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-40525.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12299.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61521.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61521.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64214.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49269.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49269.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-41101.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17151.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-41101.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-39517.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33679.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63659.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23373.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20681.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35071.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31563.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-11697.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50037.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62844.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21257.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23949.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17173.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4848 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-30359.exe
PID 4848 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-30359.exe
PID 4848 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-30359.exe
PID 4928 wrote to memory of 4924 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30359.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-49985.exe
PID 4928 wrote to memory of 4924 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30359.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-49985.exe
PID 4928 wrote to memory of 4924 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30359.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-49985.exe
PID 4848 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26035.exe
PID 4848 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26035.exe
PID 4848 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26035.exe
PID 4924 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49985.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18273.exe
PID 4924 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49985.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18273.exe
PID 4924 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49985.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18273.exe
PID 1524 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26035.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14188.exe
PID 1524 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26035.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14188.exe
PID 1524 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26035.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14188.exe
PID 4928 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30359.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59860.exe
PID 4928 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30359.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59860.exe
PID 4928 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30359.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59860.exe
PID 3876 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18273.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-58859.exe
PID 3876 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18273.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-58859.exe
PID 3876 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18273.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-58859.exe
PID 4924 wrote to memory of 3632 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49985.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-30825.exe
PID 4924 wrote to memory of 3632 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49985.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-30825.exe
PID 4924 wrote to memory of 3632 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49985.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-30825.exe
PID 3692 wrote to memory of 4044 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59860.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15881.exe
PID 3692 wrote to memory of 4044 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59860.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15881.exe
PID 3692 wrote to memory of 4044 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59860.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15881.exe
PID 4880 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14188.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42523.exe
PID 4880 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14188.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42523.exe
PID 4880 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14188.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42523.exe
PID 1524 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26035.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53384.exe
PID 1524 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26035.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53384.exe
PID 1524 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26035.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53384.exe
PID 896 wrote to memory of 3544 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58859.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6726.exe
PID 896 wrote to memory of 3544 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58859.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6726.exe
PID 896 wrote to memory of 3544 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58859.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6726.exe
PID 3876 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18273.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44230.exe
PID 3876 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18273.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44230.exe
PID 3876 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18273.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44230.exe
PID 3632 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30825.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-51651.exe
PID 3632 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30825.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-51651.exe
PID 3632 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30825.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-51651.exe
PID 4044 wrote to memory of 1236 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15881.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-8672.exe
PID 4044 wrote to memory of 1236 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15881.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-8672.exe
PID 4044 wrote to memory of 1236 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15881.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-8672.exe
PID 4704 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42523.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-8672.exe
PID 4704 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42523.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-8672.exe
PID 4704 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42523.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-8672.exe
PID 2788 wrote to memory of 4304 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53384.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31231.exe
PID 2788 wrote to memory of 4304 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53384.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31231.exe
PID 2788 wrote to memory of 4304 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53384.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31231.exe
PID 4880 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14188.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7857.exe
PID 4880 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14188.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7857.exe
PID 4880 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14188.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7857.exe
PID 3692 wrote to memory of 3464 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59860.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7857.exe
PID 3692 wrote to memory of 3464 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59860.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7857.exe
PID 3692 wrote to memory of 3464 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59860.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7857.exe
PID 3544 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6726.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9824.exe
PID 3544 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6726.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9824.exe
PID 3544 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6726.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9824.exe
PID 896 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58859.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-43820.exe
PID 896 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58859.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-43820.exe
PID 896 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58859.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-43820.exe
PID 952 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44230.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-30821.exe

Processes

C:\Users\Admin\AppData\Local\Temp\6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8.exe

"C:\Users\Admin\AppData\Local\Temp\6166c23de979c08bd858aa4d7da4f0f2b92e7292f31757570d8c597175ce07c8.exe"

C:\Users\Admin\AppData\Local\Temp\Unicorn-30359.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30359.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49985.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49985.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26035.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26035.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4848 -ip 4848

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 752

C:\Users\Admin\AppData\Local\Temp\Unicorn-18273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14188.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14188.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59860.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59860.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4928 -ip 4928

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 756

C:\Users\Admin\AppData\Local\Temp\Unicorn-58859.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58859.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30825.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30825.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15881.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15881.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42523.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42523.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53384.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53384.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4924 -ip 4924

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 712

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1524 -ip 1524

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 728

C:\Users\Admin\AppData\Local\Temp\Unicorn-6726.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6726.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44230.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44230.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51651.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51651.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8672.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8672.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8672.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8672.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31231.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31231.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7857.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7857.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7857.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7857.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3876 -ip 3876

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 740

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3692 -ip 3692

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3692 -s 740

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4880 -ip 4880

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 744

C:\Users\Admin\AppData\Local\Temp\Unicorn-9824.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9824.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43820.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43820.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30821.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30821.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8262.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8262.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49850.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49850.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49103.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49103.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10208.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10208.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32767.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32767.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12901.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12901.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29259.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29259.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40119.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40119.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40119.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40119.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 896 -ip 896

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 896 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3632 -ip 3632

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 740

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4044 -ip 4044

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4704 -ip 4704

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 660

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2788 -ip 2788

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 716

C:\Users\Admin\AppData\Local\Temp\Unicorn-48501.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48501.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20467.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20467.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58615.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58615.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34111.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34111.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9969.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9969.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14053.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14053.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9990.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9990.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44801.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44801.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-239.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-239.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40525.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40525.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12299.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12299.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61521.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61521.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61521.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61521.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64214.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64214.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49269.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49269.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49269.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49269.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17151.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17151.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39517.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39517.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3544 -ip 3544

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 952 -ip 952

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 720

C:\Users\Admin\AppData\Local\Temp\Unicorn-61713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33679.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33679.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1400 -ip 1400

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 752

C:\Users\Admin\AppData\Local\Temp\Unicorn-63659.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63659.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20681.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20681.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2740 -ip 2740

C:\Users\Admin\AppData\Local\Temp\Unicorn-23373.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23373.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1236 -ip 1236

C:\Users\Admin\AppData\Local\Temp\Unicorn-35071.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35071.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11697.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11697.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31563.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31563.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4304 -ip 4304

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 620 -ip 620

C:\Users\Admin\AppData\Local\Temp\Unicorn-50037.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50037.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3464 -ip 3464

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 720

C:\Users\Admin\AppData\Local\Temp\Unicorn-21257.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21257.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62844.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62844.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17173.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17173.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23949.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23949.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 756

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 744

C:\Users\Admin\AppData\Local\Temp\Unicorn-62097.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62097.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 692

C:\Users\Admin\AppData\Local\Temp\Unicorn-16981.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16981.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58568.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58568.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35455.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35455.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54832.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54832.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5076.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5076.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42579.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42579.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20043.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20043.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7790.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7790.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49378.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49378.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38517.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38517.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 928 -ip 928

C:\Users\Admin\AppData\Local\Temp\Unicorn-26265.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26265.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21989.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21989.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28765.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28765.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 3712 -ip 3712

C:\Users\Admin\AppData\Local\Temp\Unicorn-20597.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20597.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20597.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20597.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 2752 -ip 2752

C:\Users\Admin\AppData\Local\Temp\Unicorn-26073.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26073.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28573.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28573.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40271.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40271.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 736

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 724

C:\Users\Admin\AppData\Local\Temp\Unicorn-58745.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58745.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53846.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53846.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1240 -ip 1240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4676 -ip 4676

C:\Users\Admin\AppData\Local\Temp\Unicorn-1952.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1952.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28595.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28595.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12066.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12066.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42793.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42793.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42793.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42793.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3898.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3898.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 3084 -ip 3084

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 716

C:\Users\Admin\AppData\Local\Temp\Unicorn-23503.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23503.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2000 -ip 2000

C:\Users\Admin\AppData\Local\Temp\Unicorn-7167.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7167.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27033.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27033.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53483.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53483.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53483.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53483.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53483.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53483.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49399.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49399.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 3276 -ip 3276

C:\Users\Admin\AppData\Local\Temp\Unicorn-17281.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17281.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17281.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17281.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 4428 -ip 4428

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 676 -ip 676

C:\Users\Admin\AppData\Local\Temp\Unicorn-35563.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35563.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47261.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47261.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8366.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8366.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4282.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4282.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19227.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19227.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 3488 -ip 3488

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2728 -ip 2728

C:\Users\Admin\AppData\Local\Temp\Unicorn-7551.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7551.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7551.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7551.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51729.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51729.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51729.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51729.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12834.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12834.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4572 -ip 4572

C:\Users\Admin\AppData\Local\Temp\Unicorn-14780.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14780.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14780.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14780.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 676 -s 740

C:\Users\Admin\AppData\Local\Temp\Unicorn-41423.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41423.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41423.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41423.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17473.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17473.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3240 -ip 3240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4324 -ip 4324

C:\Users\Admin\AppData\Local\Temp\Unicorn-33255.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33255.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2804 -ip 2804

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 684

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 3328 -ip 3328

C:\Users\Admin\AppData\Local\Temp\Unicorn-54998.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54998.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 3752 -ip 3752

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 724

C:\Users\Admin\AppData\Local\Temp\Unicorn-64557.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64557.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5797.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5797.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25663.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25663.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25663.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25663.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21387.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21387.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21387.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21387.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21387.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21387.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24079.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24079.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24079.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24079.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 1564 -ip 1564

C:\Users\Admin\AppData\Local\Temp\Unicorn-33639.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33639.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33639.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33639.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29555.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29555.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19825.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19825.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65496.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65496.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56581.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56581.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17687.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17687.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17687.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17687.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63358.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63358.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63358.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63358.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63358.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63358.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2848 -ip 2848

C:\Users\Admin\AppData\Local\Temp\Unicorn-23717.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23717.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23717.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23717.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 2688 -ip 2688

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 2656 -ip 2656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5060 -ip 5060

C:\Users\Admin\AppData\Local\Temp\Unicorn-24293.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24293.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31069.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31069.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-343.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-343.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20209.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20209.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28931.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28931.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2244 -ip 2244

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4904 -ip 4904

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 760 -ip 760

C:\Users\Admin\AppData\Local\Temp\Unicorn-11848.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11848.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42575.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42575.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53457.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53457.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14562.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14562.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49373.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49373.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10478.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10478.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2856 -ip 2856

C:\Users\Admin\AppData\Local\Temp\Unicorn-6949.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6949.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6202.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6202.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 732

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 2104 -ip 2104

C:\Users\Admin\AppData\Local\Temp\Unicorn-28761.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28761.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35345.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35345.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24485.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24485.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4792 -ip 4792

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 2252 -ip 2252

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 2020 -ip 2020

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 4928 -ip 4928

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4012 -ip 4012

C:\Users\Admin\AppData\Local\Temp\Unicorn-33421.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33421.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 4924 -ip 4924

C:\Users\Admin\AppData\Local\Temp\Unicorn-1111.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1111.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16893.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16893.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16893.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16893.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1412 -ip 1412

C:\Users\Admin\AppData\Local\Temp\Unicorn-47619.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47619.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29337.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29337.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62009.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62009.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3057.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3057.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 752

C:\Users\Admin\AppData\Local\Temp\Unicorn-60426.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60426.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31091.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31091.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 3732 -ip 3732

C:\Users\Admin\AppData\Local\Temp\Unicorn-60447.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60447.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9855.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9855.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3792 -ip 3792

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 3092 -ip 3092

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 2236 -ip 2236

C:\Users\Admin\AppData\Local\Temp\Unicorn-33613.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33613.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33613.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33613.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60255.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60255.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 5108 -ip 5108

C:\Users\Admin\AppData\Local\Temp\Unicorn-51895.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51895.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21169.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21169.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43727.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43727.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8916.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8916.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8916.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8916.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11609.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11609.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46420.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46420.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46420.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46420.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 4476 -ip 4476

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 868 -ip 868

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 992 -ip 992

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3664 -ip 3664

C:\Users\Admin\AppData\Local\Temp\Unicorn-7354.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7354.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7354.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7354.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7354.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7354.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7354.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7354.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7354.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7354.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7354.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7354.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7354.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7354.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7354.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7354.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42165.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42165.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 3544 -ip 3544

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 4268 -ip 4268

C:\Users\Admin\AppData\Local\Temp\Unicorn-31859.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31859.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 3432 -ip 3432

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4416 -ip 4416

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2096 -ip 2096

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3648 -ip 3648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2868 -ip 2868

C:\Users\Admin\AppData\Local\Temp\Unicorn-12569.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12569.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 864 -ip 864

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4496 -ip 4496

C:\Users\Admin\AppData\Local\Temp\Unicorn-45071.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45071.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 632

C:\Users\Admin\AppData\Local\Temp\Unicorn-14899.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14899.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14899.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14899.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14899.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14899.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3104 -ip 3104

C:\Users\Admin\AppData\Local\Temp\Unicorn-12206.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12206.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1320 -ip 1320

C:\Users\Admin\AppData\Local\Temp\Unicorn-10644.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10644.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55569.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55569.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4216 -ip 4216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 3392 -ip 3392

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 448 -ip 448

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2028 -ip 2028

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3840 -ip 3840

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 1872 -ip 1872

C:\Users\Admin\AppData\Local\Temp\Unicorn-41179.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41179.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14536.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14536.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 3272 -ip 3272

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5304 -ip 5304

C:\Users\Admin\AppData\Local\Temp\Unicorn-6368.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6368.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33011.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33011.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37095.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37095.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37095.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37095.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37095.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37095.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39809.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39809.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43893.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43893.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3460 -ip 3460

C:\Users\Admin\AppData\Local\Temp\Unicorn-31641.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31641.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62367.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62367.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62367.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62367.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 5336 -ip 5336

C:\Users\Admin\AppData\Local\Temp\Unicorn-62367.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62367.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33935.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33935.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54007.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54007.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6944.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6944.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 5408 -ip 5408

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 5360 -ip 5360

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4176 -ip 4176

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5244 -ip 5244

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5408 -s 632

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 5312 -ip 5312

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 5832 -ip 5832

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 2360 -ip 2360

C:\Users\Admin\AppData\Local\Temp\Unicorn-16229.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16229.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46955.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46955.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46955.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46955.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42871.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42871.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12144.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12144.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46955.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46955.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46955.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46955.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 424 -ip 424

C:\Users\Admin\AppData\Local\Temp\Unicorn-46955.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46955.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 5648 -ip 5648

C:\Users\Admin\AppData\Local\Temp\Unicorn-46955.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46955.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5360 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4864 -ip 4864

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 3396 -ip 3396

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5916 -ip 5916

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 5328 -ip 5328

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 5344 -ip 5344

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 6100 -ip 6100

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 5636 -ip 5636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2588 -ip 2588

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 5840 -ip 5840

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 6012 -ip 6012

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2152 -ip 2152

C:\Users\Admin\AppData\Local\Temp\Unicorn-16613.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16613.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15221.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15221.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15221.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15221.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 5172 -ip 5172

C:\Users\Admin\AppData\Local\Temp\Unicorn-41117.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41117.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 4136 -ip 4136

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 700

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 3344 -ip 3344

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 6064 -ip 6064

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 5624 -ip 5624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 6040 -ip 6040

C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4424 -ip 4424

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 5612 -ip 5612

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 5416 -ip 5416

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5924 -ip 5924

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5940 -ip 5940

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 2428 -ip 2428

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5732 -ip 5732

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5496 -ip 5496

C:\Users\Admin\AppData\Local\Temp\Unicorn-33717.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33717.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37801.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37801.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 3068 -ip 3068

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 5240 -ip 5240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4916 -ip 4916

C:\Users\Admin\AppData\Local\Temp\Unicorn-23411.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23411.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 6004 -ip 6004

C:\Users\Admin\AppData\Local\Temp\Unicorn-38377.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38377.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38377.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38377.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22041.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22041.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2908 -ip 2908

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 644

C:\Users\Admin\AppData\Local\Temp\Unicorn-5512.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5512.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5848 -ip 5848

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 5592 -ip 5592

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5296 -ip 5296

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 6136 -ip 6136

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 5572 -ip 5572

C:\Users\Admin\AppData\Local\Temp\Unicorn-9404.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9404.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40131.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40131.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 5596 -ip 5596

C:\Users\Admin\AppData\Local\Temp\Unicorn-1236.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1236.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62689.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62689.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62689.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62689.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62689.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62689.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1236.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1236.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62689.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62689.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 4640 -ip 4640

C:\Users\Admin\AppData\Local\Temp\Unicorn-27879.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27879.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27879.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27879.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54521.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54521.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54521.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54521.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46929.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46929.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22425.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22425.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23795.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23795.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2684 -ip 2684

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5656 -ip 5656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 5424 -ip 5424

C:\Users\Admin\AppData\Local\Temp\Unicorn-5320.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5320.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5572 -s 632

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 5692 -ip 5692

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 2060 -ip 2060

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 2116 -ip 2116

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1348 -ip 1348

C:\Users\Admin\AppData\Local\Temp\Unicorn-26701.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26701.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44983.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44983.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 6112 -ip 6112

C:\Users\Admin\AppData\Local\Temp\Unicorn-36815.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36815.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36815.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36815.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36815.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36815.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6088.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6088.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2004.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2004.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28647.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28647.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4552 -ip 4552

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 5984 -ip 5984

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 5700 -ip 5700

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 6048 -ip 6048

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 4164 -ip 4164

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 3904 -ip 3904

C:\Users\Admin\AppData\Local\Temp\Unicorn-997.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-997.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 5672 -ip 5672

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2008 -ip 2008

C:\Users\Admin\AppData\Local\Temp\Unicorn-1018.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1018.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7795.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7795.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5712 -ip 5712

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 5932 -ip 5932

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5288 -ip 5288

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5720 -ip 5720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 4568 -ip 4568

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 3668 -ip 3668

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 5516 -ip 5516

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 3276 -ip 3276

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 5224 -ip 5224

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5716 -ip 5716

C:\Users\Admin\AppData\Local\Temp\Unicorn-60141.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60141.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 6436 -ip 6436

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1448 -ip 1448

C:\Users\Admin\AppData\Local\Temp\Unicorn-44381.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44381.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5486.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5486.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5516 -s 628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 2580 -ip 2580

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 2536 -ip 2536

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 2564 -ip 2564

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5392 -ip 5392

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 5324 -ip 5324

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 4452 -ip 4452

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 5512 -ip 5512

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 3188 -ip 3188

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 6120 -ip 6120

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 4068 -ip 4068

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 4808 -ip 4808

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 1316 -ip 1316

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 6420 -ip 6420

C:\Users\Admin\AppData\Local\Temp\Unicorn-34629.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34629.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34629.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34629.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 4012 -ip 4012

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 1208 -ip 1208

C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 4024 -ip 4024

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 2880 -ip 2880

C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3732 -ip 3732

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 3640 -ip 3640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 4728 -ip 4728

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 7108 -ip 7108

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 4928 -ip 4928

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 7044 -ip 7044

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 6448 -ip 6448

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 6948 -ip 6948

C:\Users\Admin\AppData\Local\Temp\Unicorn-26291.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26291.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 6424 -ip 6424

C:\Users\Admin\AppData\Local\Temp\Unicorn-58963.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58963.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54879.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54879.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54879.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54879.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54879.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54879.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54879.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54879.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19877.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19877.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46519.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46519.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38351.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38351.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7624.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7624.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58963.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58963.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 6940 -ip 6940

C:\Users\Admin\AppData\Local\Temp\Unicorn-54879.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54879.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49233.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49233.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 1804 -ip 1804

C:\Users\Admin\AppData\Local\Temp\Unicorn-57956.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57956.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12284.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12284.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 6336 -ip 6336

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 6380 -ip 6380

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 3792 -ip 3792

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 6796 -ip 6796

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 2856 -ip 2856

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 2124 -ip 2124

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 5768 -ip 5768

C:\Users\Admin\AppData\Local\Temp\Unicorn-20261.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20261.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16177.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16177.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16177.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16177.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16177.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16177.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 4460 -ip 4460

C:\Users\Admin\AppData\Local\Temp\Unicorn-16177.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16177.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16177.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16177.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52310.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52310.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52310.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52310.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2554.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2554.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2554.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2554.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37365.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37365.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59923.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59923.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 7096 -ip 7096

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 6388 -ip 6388

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 6404 -ip 6404

C:\Users\Admin\AppData\Local\Temp\Unicorn-55647.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55647.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55647.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55647.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55647.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55647.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31505.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31505.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 6904 -ip 6904

C:\Users\Admin\AppData\Local\Temp\Unicorn-49980.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49980.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 6372 -ip 6372

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 6272 -ip 6272

C:\Users\Admin\AppData\Local\Temp\Unicorn-17883.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17883.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40441.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40441.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 6956 -ip 6956

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6412 -ip 6412

C:\Users\Admin\AppData\Local\Temp\Unicorn-7577.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7577.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 6576 -ip 6576

C:\Users\Admin\AppData\Local\Temp\Unicorn-12860.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12860.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 5012 -ip 5012

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4972 -ip 4972

C:\Users\Admin\AppData\Local\Temp\Unicorn-52391.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52391.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25749.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25749.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44223.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44223.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44223.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44223.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3745.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3745.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 6716 -ip 6716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 6512 -ip 6512

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 6396 -ip 6396

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 7148 -ip 7148

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 1268 -ip 1268

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 2028 -ip 2028

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 2392 -ip 2392

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 4324 -ip 4324

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 3136 -ip 3136

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 6728 -ip 6728

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 4356 -ip 4356

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2652 -ip 2652

C:\Users\Admin\AppData\Local\Temp\Unicorn-10180.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10180.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32739.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32739.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32739.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32739.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32739.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32739.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32739.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32739.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32739.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32739.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 6748 -ip 6748

C:\Users\Admin\AppData\Local\Temp\Unicorn-32739.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32739.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32739.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32739.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32739.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32739.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 6456 -ip 6456

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 6924 -ip 6924

C:\Users\Admin\AppData\Local\Temp\Unicorn-38769.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38769.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 6284 -ip 6284

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 7128 -ip 7128

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 4884 -ip 4884

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 6972 -ip 6972

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 2108 -ip 2108

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 5372 -ip 5372

C:\Users\Admin\AppData\Local\Temp\Unicorn-24379.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24379.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6324 -ip 6324

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 7060 -ip 7060

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 6292 -ip 6292

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 724 -ip 724

C:\Users\Admin\AppData\Local\Temp\Unicorn-2951.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2951.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2951.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2951.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 5536 -ip 5536

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 1568 -ip 1568

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7128 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5880 -ip 5880

C:\Users\Admin\AppData\Local\Temp\Unicorn-4150.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4150.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 3076 -ip 3076

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 6492 -ip 6492

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5528 -ip 5528

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 1740 -ip 1740

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 3868 -ip 3868

C:\Users\Admin\AppData\Local\Temp\Unicorn-33507.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33507.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 5920 -ip 5920

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 1960 -ip 1960

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 3116 -ip 3116

C:\Users\Admin\AppData\Local\Temp\Unicorn-29423.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29423.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29423.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29423.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64233.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64233.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25339.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25339.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25339.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25339.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21255.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21255.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21255.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21255.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21255.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21255.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21255.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21255.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21255.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21255.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21255.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21255.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 5328 -ip 5328

C:\Users\Admin\AppData\Local\Temp\Unicorn-21255.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21255.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5960 -ip 5960

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 3648 -ip 3648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 6560 -ip 6560

C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5492 -ip 5492

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 3520 -ip 3520

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 2212 -ip 2212

C:\Users\Admin\AppData\Local\Temp\Unicorn-45567.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45567.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45567.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45567.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18109.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18109.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 6148 -ip 6148

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 5896 -ip 5896

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5280 -ip 5280

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 916 -ip 916

C:\Users\Admin\AppData\Local\Temp\Unicorn-31753.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31753.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4316 -ip 4316

C:\Users\Admin\AppData\Local\Temp\Unicorn-50227.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50227.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 4508 -ip 4508

C:\Users\Admin\AppData\Local\Temp\Unicorn-46143.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46143.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46143.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46143.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46143.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46143.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19501.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19501.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 5792 -ip 5792

C:\Users\Admin\AppData\Local\Temp\Unicorn-45951.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45951.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32883.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32883.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5896 -s 740

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5160 -ip 5160

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 5816 -ip 5816

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 5200 -ip 5200

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 5592 -ip 5592

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1668 -ip 1668

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2180 -ip 2180

C:\Users\Admin\AppData\Local\Temp\Unicorn-36029.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36029.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 3544 -ip 3544

C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3932.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3932.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 2588 -ip 2588

C:\Users\Admin\AppData\Local\Temp\Unicorn-45520.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45520.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45520.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45520.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2541.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2541.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1794.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1794.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5432 -ip 5432

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5160 -s 640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 5748 -ip 5748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 6968 -ip 6968

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 1440 -ip 1440

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 6516 -ip 6516

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 6868 -ip 6868

C:\Users\Admin\AppData\Local\Temp\Unicorn-57025.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57025.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57025.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57025.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52941.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52941.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48857.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48857.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 5784 -ip 5784

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 6848 -ip 6848

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 5316 -ip 5316

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 6004 -ip 6004

C:\Users\Admin\AppData\Local\Temp\Unicorn-36989.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36989.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 3240 -ip 3240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 4992 -ip 4992

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 5520 -ip 5520

C:\Users\Admin\AppData\Local\Temp\Unicorn-14430.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14430.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14430.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14430.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2020 -ip 2020

C:\Users\Admin\AppData\Local\Temp\Unicorn-28629.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28629.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28629.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28629.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55271.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55271.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61493.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61493.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61493.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61493.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27237.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27237.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 4468 -ip 4468

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6004 -s 648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 5728 -ip 5728

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 644

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 5620 -ip 5620

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5304 -ip 5304

C:\Users\Admin\AppData\Local\Temp\Unicorn-22983.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22983.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 5440 -ip 5440

C:\Users\Admin\AppData\Local\Temp\Unicorn-14814.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14814.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53709.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53709.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49625.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49625.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17315.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17315.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17315.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17315.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 6132 -ip 6132

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2144 -ip 2144

C:\Users\Admin\AppData\Local\Temp\Unicorn-2946.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2946.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64399.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64399.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 952 -ip 952

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 5608 -ip 5608

C:\Users\Admin\AppData\Local\Temp\Unicorn-62261.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62261.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62261.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62261.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62261.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62261.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62261.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62261.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 5108 -ip 5108

C:\Users\Admin\AppData\Local\Temp\Unicorn-62261.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62261.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4848 -ip 4848

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 4676 -ip 4676

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 5128 -ip 5128

C:\Users\Admin\AppData\Local\Temp\Unicorn-17145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40279.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40279.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5468.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5468.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58753.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58753.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62837.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62837.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 2928 -ip 2928

C:\Users\Admin\AppData\Local\Temp\Unicorn-5276.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5276.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 6508 -ip 6508

C:\Users\Admin\AppData\Local\Temp\Unicorn-64591.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64591.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33865.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33865.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 2564 -ip 2564

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5128 -s 664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3188 -ip 3188

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 6012 -ip 6012

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 6084 -ip 6084

C:\Users\Admin\AppData\Local\Temp\Unicorn-3714.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3714.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28219.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28219.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28219.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28219.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5808 -ip 5808

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 5924 -ip 5924

C:\Users\Admin\AppData\Local\Temp\Unicorn-24135.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24135.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63029.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63029.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 3464 -ip 3464

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 6192 -ip 6192

C:\Users\Admin\AppData\Local\Temp\Unicorn-8182.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8182.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 1056 -ip 1056

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 4452 -ip 4452

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 5384 -ip 5384

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3276 -ip 3276

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 4376 -ip 4376

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4424 -ip 4424

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 5512 -ip 5512

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5384 -s 652

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5224 -ip 5224

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 4312 -ip 4312

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5820 -ip 5820

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 7048 -ip 7048

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5644 -ip 5644

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 5148 -ip 5148

C:\Users\Admin\AppData\Local\Temp\Unicorn-57575.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57575.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53491.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53491.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18681.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18681.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26849.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26849.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26849.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26849.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5320 -ip 5320

C:\Users\Admin\AppData\Local\Temp\Unicorn-7004.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7004.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53491.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53491.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 7088 -ip 7088

C:\Users\Admin\AppData\Local\Temp\Unicorn-44316.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44316.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5904 -ip 5904

C:\Users\Admin\AppData\Local\Temp\Unicorn-2728.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2728.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3676 -ip 3676

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 6536 -ip 6536

C:\Users\Admin\AppData\Local\Temp\Unicorn-64721.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64721.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56553.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56553.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 6828 -ip 6828

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 6520 -ip 6520

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 5508 -ip 5508

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 2548 -ip 2548

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 6236 -ip 6236

C:\Users\Admin\AppData\Local\Temp\Unicorn-23497.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23497.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23497.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23497.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1572 -ip 1572

C:\Users\Admin\AppData\Local\Temp\Unicorn-15328.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15328.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 6120 -ip 6120

C:\Users\Admin\AppData\Local\Temp\Unicorn-52853.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52853.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52853.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52853.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5952 -ip 5952

C:\Users\Admin\AppData\Local\Temp\Unicorn-44685.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44685.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 6604 -ip 6604

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 424 -ip 424

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5272 -ip 5272

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 4972 -ip 4972

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 6660 -ip 6660

C:\Users\Admin\AppData\Local\Temp\Unicorn-19797.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19797.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 3996 -ip 3996

C:\Users\Admin\AppData\Local\Temp\Unicorn-61405.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61405.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61405.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61405.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61405.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61405.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 4008 -ip 4008

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 3488 -ip 3488

C:\Users\Admin\AppData\Local\Temp\Unicorn-20373.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20373.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 6640 -ip 6640

C:\Users\Admin\AppData\Local\Temp\Unicorn-26403.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26403.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26403.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26403.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22319.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22319.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22319.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22319.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22319.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22319.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57129.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57129.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 6780 -ip 6780

C:\Users\Admin\AppData\Local\Temp\Unicorn-40793.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40793.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12012.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12012.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 4500 -ip 4500

C:\Users\Admin\AppData\Local\Temp\Unicorn-10642.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10642.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10642.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10642.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45453.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45453.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 600

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 6576 -ip 6576

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 7132 -ip 7132

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4504 -ip 4504

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 948 -ip 948

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 5300 -ip 5300

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5468 -ip 5468

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 6440 -ip 6440

C:\Users\Admin\AppData\Local\Temp\Unicorn-39039.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39039.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39039.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39039.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3068 -ip 3068

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 432 -ip 432

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2740 -ip 2740

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 6048 -ip 6048

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 5852 -ip 5852

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5300 -s 648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 4912 -ip 4912

C:\Users\Admin\AppData\Local\Temp\Unicorn-55759.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55759.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43507.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43507.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43507.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43507.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43507.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43507.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12780.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12780.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 6248 -ip 6248

C:\Users\Admin\AppData\Local\Temp\Unicorn-19579.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19579.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 2000 -ip 2000

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 6344 -ip 6344

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 6920 -ip 6920

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 6384 -ip 6384

C:\Users\Admin\AppData\Local\Temp\Unicorn-21525.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21525.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 2768 -ip 2768

C:\Users\Admin\AppData\Local\Temp\Unicorn-35723.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35723.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3605.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3605.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38415.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38415.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38415.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38415.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5472 -ip 5472

C:\Users\Admin\AppData\Local\Temp\Unicorn-15302.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15302.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15302.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15302.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 7156 -ip 7156

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 232 -ip 232

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 4176 -ip 4176

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 6568 -ip 6568

C:\Users\Admin\AppData\Local\Temp\Unicorn-9080.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9080.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 5380 -ip 5380

C:\Users\Admin\AppData\Local\Temp\Unicorn-11794.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11794.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46605.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46605.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 7084 -ip 7084

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 6396 -ip 6396

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 4884 -ip 4884

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3180 -ip 3180

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 6584 -ip 6584

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6568 -s 628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 6532 -ip 6532

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 5708 -ip 5708

C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 5196 -ip 5196

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 548 -ip 548

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 5176 -ip 5176

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 5372 -ip 5372

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 992 -ip 992

C:\Users\Admin\AppData\Local\Temp\Unicorn-61187.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61187.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30461.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30461.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30461.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30461.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57103.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57103.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22293.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22293.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22293.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22293.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 3344 -ip 3344

C:\Users\Admin\AppData\Local\Temp\Unicorn-44851.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44851.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5764.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5764.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44851.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44851.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6864 -ip 6864

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 6368 -ip 6368

C:\Users\Admin\AppData\Local\Temp\Unicorn-18017.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18017.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 5680 -ip 5680

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 7036 -ip 7036

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 6296 -ip 6296

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 6352 -ip 6352

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 1080 -ip 1080

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 5460 -ip 5460

C:\Users\Admin\AppData\Local\Temp\Unicorn-55349.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55349.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55349.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55349.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55349.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55349.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55349.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55349.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55349.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55349.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55349.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55349.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55349.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55349.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55349.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55349.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55349.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55349.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55349.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55349.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55349.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55349.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16455.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16455.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 6340 -ip 6340

C:\Users\Admin\AppData\Local\Temp\Unicorn-57295.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57295.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45043.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45043.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45043.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45043.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 5884 -ip 5884

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5680 -s 648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2808 -ip 2808

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6296 -s 640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 5112 -ip 5112

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 6656 -ip 6656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5504 -ip 5504

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 920 -ip 920

C:\Users\Admin\AppData\Local\Temp\Unicorn-37259.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37259.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51649.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51649.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 5920 -ip 5920

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 5856 -ip 5856

C:\Users\Admin\AppData\Local\Temp\Unicorn-37835.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37835.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37835.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37835.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 6664 -ip 6664

C:\Users\Admin\AppData\Local\Temp\Unicorn-4970.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4970.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4970.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4970.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4970.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4970.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35697.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35697.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35697.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35697.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31613.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31613.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 6492 -ip 6492

C:\Users\Admin\AppData\Local\Temp\Unicorn-4970.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4970.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39781.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39781.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58063.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58063.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7471.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7471.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 6188 -ip 6188

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 6484 -ip 6484

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 6924 -ip 6924

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5536 -ip 5536

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4572 -ip 4572

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 996 -ip 996

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 6416 -ip 6416

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 5172 -ip 5172

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 6760 -ip 6760

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 7120 -ip 7120

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6492 -s 628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4704 -ip 4704

C:\Users\Admin\AppData\Local\Temp\Unicorn-65245.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65245.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65245.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65245.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2401.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2401.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63854.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63854.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 5868 -ip 5868

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 5784 -ip 5784

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 6400 -ip 6400

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 2240 -ip 2240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 60 -ip 60

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 868 -ip 868

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 1976 -ip 1976

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3104 -ip 3104

C:\Users\Admin\AppData\Local\Temp\Unicorn-53377.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53377.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18567.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18567.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18567.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18567.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18567.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18567.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18567.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18567.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 2172 -ip 2172

C:\Users\Admin\AppData\Local\Temp\Unicorn-14482.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14482.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14482.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14482.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 5728 -ip 5728

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 7160 -ip 7160

C:\Users\Admin\AppData\Local\Temp\Unicorn-10761.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10761.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45572.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45572.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 6292 -ip 6292

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 3804 -ip 3804

C:\Users\Admin\AppData\Local\Temp\Unicorn-23035.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23035.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59791.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59791.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20897.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20897.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 1232 -ip 1232

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 6868 -ip 6868

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 5844 -ip 5844

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 3840 -ip 3840

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5284 -ip 5284

C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28873.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28873.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2880 -ip 2880

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4332 -ip 4332

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3244 -ip 3244

C:\Users\Admin\AppData\Local\Temp\Unicorn-43263.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43263.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51431.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51431.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12536.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12536.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12536.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12536.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43263.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43263.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12536.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12536.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51431.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51431.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43263.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43263.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15250.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15250.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12536.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12536.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 5048 -ip 5048

C:\Users\Admin\AppData\Local\Temp\Unicorn-50061.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50061.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54145.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 688

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 6412 -ip 6412

C:\Users\Admin\AppData\Local\Temp\Unicorn-51431.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51431.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2614.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2614.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5560 -ip 5560

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5936 -ip 5936

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 35.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\Unicorn-30359.exe

MD5 bc2417cc763472d05c9351476941b561
SHA1 76897e1549a8a058ae6daaa5feaee247c5dbe073
SHA256 969f7c78824b74e49e21020faafdf35482f91a746006eb2b610586d586b4928a
SHA512 44a5a832d12b1b301289d50efb11b8301c871b75ce571fba1aca77a47d7ea238b06580cd17cc58116d647c4f8824603d23795031f862ea8785ee2f13038b0b49

C:\Users\Admin\AppData\Local\Temp\Unicorn-49985.exe

MD5 8581c7690fc68c365889d3c1b4647bd3
SHA1 b9a90aba566f5df6bf0fb495f0d8ad340701aed7
SHA256 ea4400c3ab6f83295065cd21d768064e6da5b804bb198f11073057a8673c29a8
SHA512 75662f63a04c36e9888aa4f23180d4aec709b5fe86098c2c613bd1fcd2cfe0fb35b7707bf8955e484ee429a59b64dec35a9b4a7d9bb921cde1d0d9d6b6cea0df

C:\Users\Admin\AppData\Local\Temp\Unicorn-26035.exe

MD5 eb39a40c0c88d7e7b4128e69789c8594
SHA1 93d5595a76a2467929397b37071e5c34ea1ed366
SHA256 5b70b0573006a14ee73cda0c904af677221fefe2b17c72abd71a7d68ac5d297f
SHA512 3824a2557e9f9c7b7b6df8e1ea159d783d4ca5cadffb9322a54c5aa517b506c6acdaf08d9d56f7a8b10aa5e0f671b3f6e1363a1245664dabbb2b42a93433954c

C:\Users\Admin\AppData\Local\Temp\Unicorn-18273.exe

MD5 c570a3bd759a5421b8ccb83f49310fa7
SHA1 1b46812697a1a4ce8a83ce7df4c34b83ff640376
SHA256 5641430bda7d7dc51fe04c30ac47703de4b15f2b3a82d4f3dda2ee448916ec67
SHA512 ab29859f5094fb137accdcd6a86de599b14d27e03966da1d3ad6feb93a6d60376d2865e9938355ed106fdc49685d28ecca1b56f0034e00f6ba183b827f69a552

C:\Users\Admin\AppData\Local\Temp\Unicorn-14188.exe

MD5 24fc8699e637384484b6ef98c1ab9dd2
SHA1 65dc9700715a96ca5d6608932afa5d0b5d515f46
SHA256 ad3eb8c557a6c828eb9f31c014281eec5b5d4cdc64f1ee51dde89d2e846d2ee2
SHA512 403a7bfcd6e60a3fff7b2e12cbf9d0b442919d80f55864e76e4e43ae0dc39cc46304fe3fb0a7e49a49e22e0f74e927c400536f7e8de2dda99ebc41efcc9c77d6

C:\Users\Admin\AppData\Local\Temp\Unicorn-59860.exe

MD5 2d3c1b2ef373f8e7b9efc59f97ebfbe7
SHA1 589250a9d87954330094f706a25611d88c6c48e3
SHA256 97885d9fdb6128923f5291fba3ec15d043fec9ac29bcdf58d1e9e9d8d96d4ea5
SHA512 82eb3905bb0bb28339dad1d364c8bc041a58ab68dab95a9b762903a80a6b36f8144302fa442d12249462d9c3da0b31761bcc4f0287186957e650b42e2a6dc67e

C:\Users\Admin\AppData\Local\Temp\Unicorn-58859.exe

MD5 d5b0bdad12c702721ee6651ae8f90906
SHA1 1d69fe40d2b3f4a27b00a1b34d6878c2ef5e2c94
SHA256 a302b5aa71bee1ef4754554f2cc5ea0480a9726165b195b2fad8df3d3770cc9e
SHA512 9a83331354392330b4b43acfc72b94a437cce28ea45e8d57796f453daf9c93143e593f79138d3ca275a8b4ea4d3df0dd916ae7197e39e7763303aa19188f75aa

C:\Users\Admin\AppData\Local\Temp\Unicorn-30825.exe

MD5 15f2fb96b125ad2b8f6d2eb1612a98cd
SHA1 cba92e382ab571172f039e909e9d180ad9b09790
SHA256 1381fda5081790aa993f406332403923ff7c55174052fa51bedd12204921631a
SHA512 9967f6040a7a13d6609e7ad05093609a42f0eee6edb3a756572de6328aa5f509f4f62871430febd0f891778b5ff8f49a9331e43378ef7fef0b3107c37185de9e

C:\Users\Admin\AppData\Local\Temp\Unicorn-15881.exe

MD5 d7fc831e087d2d1cd39d9ba59f69f53b
SHA1 bd02fff9a7ee87a957df321cfc0c9c2525dac2cb
SHA256 a26d80d82e89dc94bd003077d6324bd687d59e90edf7323160e2ad340b733d3e
SHA512 ac5ea7c61d90afa5f0e0fa197e6cfbc055c54aaf35326f91891a27da73b7275573a56fcf39fce525360200d6ccf2ef197b684eb935c18e4737c53238c31ccf32

C:\Users\Admin\AppData\Local\Temp\Unicorn-42523.exe

MD5 2a130c8032eb7732fee59aadad2639f5
SHA1 59b4b131c817051b94202c6170f73ca80a36ff74
SHA256 aaa08b3bfb871d658d8cccf14c7f8fbe40fef2ffa66bde3b280f33c6335bb778
SHA512 92d5518105ded0b6e0fee5925b5b4dee646f05cf52313aaf1d5be1f66b52c6899251e2931adaa28f4620c1ce714e03470ad83ffef4733a395f9e32d49205c5cd

C:\Users\Admin\AppData\Local\Temp\Unicorn-53384.exe

MD5 c18136cc4baf295e0347fd0aea2700bc
SHA1 a3114cf8f9c68578097cd74175829dcee6a30f33
SHA256 4429a5c55e352b7125401caf75a4508b72d276a227455f100077ba138f361d49
SHA512 e0d360b389fbf060f1a4e4edf5641889b4d69db7180becde1731dd3fa9411c51de0444a2e896e5cae4889cbca50df75af56ad4e85ac68a1191fe4299411020fc

C:\Users\Admin\AppData\Local\Temp\Unicorn-6726.exe

MD5 4c90e788f57bf8d9621106860dd04122
SHA1 9a1507a35d5c1ee621733265eb006c31924db16a
SHA256 0137001b135783e1c948d12943aff5473c0f921106e10378e00e4dc9ca5bbaec
SHA512 c757db97f3709b59b5d12e61fb0d96965f537d76e903ac63c35183ef7f58f149cda214bc69b13a4e7363b80b41b721aa6ad0f475b73b8f6d161f95042082f1f8

C:\Users\Admin\AppData\Local\Temp\Unicorn-44230.exe

MD5 ec7899d8eb1060da6b938ed4e9d0ae9b
SHA1 354f2a93b62efcc8685e33c491e5da76fe61e679
SHA256 1a23842ea864343f0a099012f3cb41a2752f040f915066919e5e2caf636e6939
SHA512 e9e91563c5328837f8c7b2bcf4c14728a900d63cca5273c6445fdabe6e543a7b0a12f1ebf254f9e61ea6e4b8b456edd686c6aebf71ce80d7a9dd2b3c9d95f633

C:\Users\Admin\AppData\Local\Temp\Unicorn-51651.exe

MD5 9aa5b52e235be7d25048c82db56d8684
SHA1 d55989ed0d7330f4f5667d414a2edeee76ce8090
SHA256 3fd8f0b6b6679f4481b3af6862cd4579185924963ab0aa7c98ca8d6232e63b11
SHA512 f123f67d20c566144de86dfe39ed3ce65117269ffd0522e8ea5e0ed9d259f5b73a2a4f5de17952c5ed078aabdf2867bf09ad3620e3385f668e2bf2ced510b317

C:\Users\Admin\AppData\Local\Temp\Unicorn-8672.exe

MD5 28092b20215223c60314fde163251058
SHA1 69d6e721a181d333c9af977292fad6a824f596c1
SHA256 416340fa56b7e9b679bcff27158e71fd95153b03c0599ecc678e54c400830581
SHA512 a2745f31c362a62f6e63b2bbe4c98e168f54b70b53ba9fdb3dffd24369028c0cfbc1ae87039a979283094db7f66a666efce5a9d5b18e36ecb039db8b96b144a3

C:\Users\Admin\AppData\Local\Temp\Unicorn-7857.exe

MD5 7779409c8ef53c44e2dcf9a7d3244682
SHA1 e8076a7e6157f1b38baba313ff59e3d9c30e5446
SHA256 b796b1e361f414e96ccf234689f8e024d01257349895c7df31ccd1bc416aabf4
SHA512 39beae6c6a3630a7698619d8c1f7dc10b47ab4c3ba6b1d051d19329be93aade99ec7c60632852c77dae72d98be1de6d932f6a56fdd8ecee171e028a0716596ff

C:\Users\Admin\AppData\Local\Temp\Unicorn-31231.exe

MD5 7630169a7de8a769ec53754b4f618b8a
SHA1 3e50361494abe176fe181c53d1eb59c4e6342a30
SHA256 80b3c91723a2737109356234959d1c3f46d53b94142df6147f8bcec7b1531ae4
SHA512 a10310e2d144a89e37ce30126927ebae0ad8dd1261047190cc811d0d8fcd37e20ee399f3e2e30fe3a2a15d94d57d9cf50c5890ca5f78740963d6b8059cc0612f

C:\Users\Admin\AppData\Local\Temp\Unicorn-9824.exe

MD5 f422562fbe8cf5b0e18cb6345e7a79ad
SHA1 5d02ad569c833e825301598d626dfaa9000fda45
SHA256 6a08fe385facf9becd6fa2bdf9a8ac2e0516fe78213b102ebb4892d5de8ffb10
SHA512 a1007f07806befe337ee70576726377afd00eb69be7bd441dd7ebbcc999dd72e35383f7b0fa5e8436cbf9bfa9b3eac9b82a9a42a2c29863fc677dfa1afaa6d42

C:\Users\Admin\AppData\Local\Temp\Unicorn-43820.exe

MD5 32aa71568ed7ae2039cea99d47c56461
SHA1 b7816729a4ece74dff652b2552096b5129ba6eac
SHA256 4a294e81685dac40b1cd7c0415642028108d08a7ed44d852b935612c545bb854
SHA512 fee30c3cf497ab023a03096ec679a1dfbb1cd31d9bafabacf27a160c8da98f7317cd8b1a0b68e3e78013f24a5e09d036bff1ec6cb73f6355bd5e0aded2def945

C:\Users\Admin\AppData\Local\Temp\Unicorn-30821.exe

MD5 c51c2611268b02bbfe96ad29d640566b
SHA1 dd7422d3122f8cfdb36dbae85238479e722147ad
SHA256 f7dfee1330a475bfc6d12e771e5db11359e12b42d4722f32692535e67214d53e
SHA512 0ba0bcc6b105f976aba91aadb8a0b5919d0e48bf9bab1479f6e779dcd3dce642ffecd24cbab2daca05913bf226c6e0c132a3d8f4bf0d474a38da78aa88916f30

C:\Users\Admin\AppData\Local\Temp\Unicorn-8262.exe

MD5 89c21a7ee86e168a9568fb1703ee3af6
SHA1 3c45d3938b854c7c343912abec9f67af04b17409
SHA256 f190fb26b7ebb29dfd918aa0973992720f259bb69868434aa088919fc3424a38
SHA512 ba9011af6b7c90d85f89ddf65e7d7630db48c82d11ddd61a6879b6c52a3592dbb6fb9a3960cd80542a2892ee27236791732c6f05e3bb0bcec47acd547b501519

C:\Users\Admin\AppData\Local\Temp\Unicorn-49850.exe

MD5 4e5f0367fa9d561a3378ca1df39d8e02
SHA1 d6c59019ae74d2c9048cf89332623ad66c5f3b12
SHA256 b6ad90c9f3d3b5bafc1589230d390d94334707a2d004fd5572aacadb0be16aa2
SHA512 9cb06b40e258cd3e69f8eeb928b2f7faea3b0cffc7f3ea75db81a9cc78803253b3a562da46426c722922c80187b98309a3590aa1efd280e2d6b01f15715b66e2

C:\Users\Admin\AppData\Local\Temp\Unicorn-49103.exe

MD5 a1f62594ddadbdee76b06404e41ac5a2
SHA1 354190f09211f32ae2b57505893467dc9e04af77
SHA256 d8d041c0442c41db427a21f971cf0881ea9746da10797f16ac51e01798a89684
SHA512 b16df0a75721166dc049d3a1594534b630e478e4bf817833a677ff07e74b2e9247107eba528a15674afe41512165b79b5048d8b1bf15583092f1a3e7396fc690

C:\Users\Admin\AppData\Local\Temp\Unicorn-10208.exe

MD5 16a1bd03c3382b95450aa00f5dddebf0
SHA1 ac4485c33cb4f9c8ac634b1dd1747211056f6af0
SHA256 342c7aa8e497dd1533134e23b284e64c5d5be1f219db96c0d8cb61854aeeaa41
SHA512 7e0353e1fbf52fdae2946b4a083dd22f5ad8a1791a76fcf93bbc5290067a53618477c642de425a5b69c783846d812af03efdc7c9d1f6f332b45df026586e7774

C:\Users\Admin\AppData\Local\Temp\Unicorn-12901.exe

MD5 4afd9a52e0480cfca7e4dafd1040246b
SHA1 059b9532ac8445c36d6689b4f73ebd152f8004ae
SHA256 d936de556680a8ffe16b6a39beb9f0087201b6affa326c6a1b7fb48770b9902f
SHA512 1929b02de9a0f82875158dfed0232a4d334aad012db74f8ea257c3751e313e98b25d60827634cf8057814124ec977a44582b5db82ede0d4a76a0db8d0659fc49

C:\Users\Admin\AppData\Local\Temp\Unicorn-29259.exe

MD5 35185c0ee41594f3ccc4304c04bf6da7
SHA1 cfd408537b704d7cb38e2d3e704ebae366c0da99
SHA256 3c44cf8663e491b7f36dd3f1254b067a4ef189f9d10462deeb023977b628f4b4
SHA512 c062a9e670690afa851bae893aa946671b6ee80810c63d83674c3dd11c2f40d3113cf0b64e86e8f6786766acd3415b96f5561ff341d083f14dc989308e12970a

C:\Users\Admin\AppData\Local\Temp\Unicorn-40119.exe

MD5 afeacb78bf044f0d286cc3ed8041e08c
SHA1 51976d2135b2aafa9fdcf45fe5149ead05d150dd
SHA256 9efca22832754386374c331e14ae0698ff3bd21bd1fc030e618501b8f82d9091
SHA512 c151d5451b96ff82fd3368edc8979a7f24226e493227ca20b92873cee2084882723af5ab83395a9ea0352cf3445fd2fd791dbf46fcc9787cf66e5933eedc9492

C:\Users\Admin\AppData\Local\Temp\Unicorn-32767.exe

MD5 4e5c60c07f6080657768f3b7bc6e28bd
SHA1 ada55d4c35dc4670ec050b05eeb17ad962769891
SHA256 40f428efae4cddbf374d3527da8cd5b6fd0e4a20138fb4a64353e295929942c2
SHA512 d72e120e20e7fa92085f5294cd0a2f0cc0ae3b400d8a15f4fc00e420e393bdc35be1682fc896b72244f6c599692897dcb19e2c3c5e0ae9e00d789c3cdeabf2d9

C:\Users\Admin\AppData\Local\Temp\Unicorn-48501.exe

MD5 bcdf2297cc3b1989db85a6fdbd873de7
SHA1 a348d8eac21f9aa292c491208a6fd3c3cb714e3d
SHA256 aaf1e08817f8db4e01c29e992cbc1b75dfc0d3e60d083f9baaf2c02bbf5b9ef4
SHA512 3c2f665958525ab9c22f1f23f5cc3c630c165cbc8db43c4ba6e6e1b6287905facef47b8f574f797f82d9058e437325605bf9827af323652a6be1788f535877c6

C:\Users\Admin\AppData\Local\Temp\Unicorn-20467.exe

MD5 ed0281d65fc04228ff8a19b9295c384e
SHA1 5dcdf78897989e4b81013456973190213f5c4e27
SHA256 b826f05b13bb3a902c59c9823b8a83037d764a1ddb53552432d80cec09dd71a9
SHA512 3fc6730b7d4583d2b1f1a9a73c22cd47ce75b7076db03e865d93ca8f983fbc88e380a656706532bb22add510e2f4d058df11ac9d448955e5f13a4f60ec33549f

C:\Users\Admin\AppData\Local\Temp\Unicorn-58615.exe

MD5 7cf8d67de2453573ff2d0cb2454b2ab4
SHA1 2b86cf154232972b7859ff5c7770a15692da9a71
SHA256 ae694a84dd09cb5b7e9d80e3da36ce8a6011d064894a9a7f4503b368fb84ec61
SHA512 96a1c531942f8d1d2672117a9e3c8ad57d837649249cce06b75857e3fcfd0e8eba128b992524da0ba066b06479789d1f19a21d7c7287d2dc80eb0142a18c2234

C:\Users\Admin\AppData\Local\Temp\Unicorn-41101.exe

MD5 b029c02ed27130e72d08fc14445d8195
SHA1 fac22dfe5cd8538ebf882cc5e14f25fef891ca44
SHA256 b14d3117504cb29686b4788ef6b8714188ca50fecc9211485b39d725c3214823
SHA512 66d0c35cd93118019f3ed4f2d4012bfb1abda2f8dc519eda6ca96c685fdda5b75e29259795f6dce94d00bac96c49d6e5b3abb3ca67d2cb2f61074d56267d3795

C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe

MD5 ce374933884bdf14d8e546b6b2935b4b
SHA1 8d59f839b3fef7ee1b462b667e6e17679cd6f776
SHA256 c1aa7eee1eb430bc08aeb88d062e532fa1e27ad527fa96670b9986feca58e727
SHA512 a65b5791642dd3e281e22c55d3285d7ee5cf6798386a3050ca8d5697ac80ba98c2fbbf9fb534087516131e349f20749147dbfeaf5143c5ae398244a452bafe48

C:\Users\Admin\AppData\Local\Temp\Unicorn-16455.exe

MD5 c119d56c3c9b9b88b06bae63f3a125f3
SHA1 73c376443bbd66ab905eaabca8cecf842c557f40
SHA256 6e4992bd6f285293fc36a49c9fa4c195bcca329406e31e5f82ddce3a55212572
SHA512 31dd3995c85765ad1153d377e2bbc9466fc8cc770b79879f0cdc6c3a1559edfe790529d3d2fd9c873b06d9b6f8cefe84b239444ff10cb2e9f045a4c4252afc4d

C:\Users\Admin\AppData\Local\Temp\Unicorn-65245.exe

MD5 e87b636754cb1bccc2cb63e5f3220da4
SHA1 7df3408f2ce36433695f17377c7d68a59bdc2ad9
SHA256 a6cb40be572305e5a691f77c279307e981c4bf7610c2f99ad1237bdbc51b9e50
SHA512 bc5bdc367a591205cdf8e107509d2b04380d3cc39ec9b38cdf59113872bc53f7e94964bbca9ed87e309f440571f10f5e7322a62f337f56ec344071f3d6fc3228

C:\Users\Admin\AppData\Local\Temp\Unicorn-8530.exe

MD5 1d6a6ab9c8b7c5e8e9fb81cd197e6ee3
SHA1 5dc66739935ff35f3b138fab13c16eee3e3da22a
SHA256 1fc2dbd883d481c7f3e51d3f560ddc238eaf21c4f1831d8d5b6bdbeac68a2a8d
SHA512 d59e406036b8fa6eb2a367e15ac077cb3caa99877c2cb7eb1aa7f5163665141b3810dfed926ccc6b113d3f3739c59bb8cb30a0ede1070983103df8b3f5d707ce

C:\Users\Admin\AppData\Local\Temp\Unicorn-9106.exe

MD5 5bd6cf7e3894fc9000e781e0e3f40f1e
SHA1 3fe02bf4c0b48fb80f3eb5e953bf57d2c58120e6
SHA256 bcca03bc5bde8a0be285fb1af5927f3bfcd4398da8255ea9f8af6170a060809b
SHA512 821903377dbce49de9ad47020847df1a51bc664a432868981712d4a8eef618f63adc163053b7c9065768122260bbbcaf5c3cd3fcd8d4d2d1a67184a31d50e31f

C:\Users\Admin\AppData\Local\Temp\Unicorn-32615.exe

MD5 021af93dd95616e006952a44ecac4375
SHA1 caac144472807b62f8ad87411c8b60c431ff6905
SHA256 dd24d569a25c8bc5be35f0f385b2232fbeb41dd45b5ddf78e21ee7976862deee
SHA512 48560ce0c087ff55215c30fdb1d421474afd5a05f30b638f665de25fb38d0fb681a55a91e2087f43bcd3998c2ee82137dec61d8b6375b1a3d56f2e8789c9b9e5