Malware Analysis Report

2025-04-14 01:48

Sample ID 240602-2elyesae25
Target 76f599ac518b411869ad43d004550320_NeikiAnalytics.exe
SHA256 e050354aacb823edadb0f59d4960ebf30e4b64555760b5ae9d2e326f08ed035f
Tags
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

e050354aacb823edadb0f59d4960ebf30e4b64555760b5ae9d2e326f08ed035f

Threat Level: Shows suspicious behavior

The file 76f599ac518b411869ad43d004550320_NeikiAnalytics.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary


Executes dropped EXE

Loads dropped DLL

Program crash

Unsigned PE

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-02 22:29

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-02 22:29

Reported

2024-06-02 22:32

Platform

win7-20240508-en

Max time kernel

150s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\76f599ac518b411869ad43d004550320_NeikiAnalytics.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7476.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18337.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20366.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-40232.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30201.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26693.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6827.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57419.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37553.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38115.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14165.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48229.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5250.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46838.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1166.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12027.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35977.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36252.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1249.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42836.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23808.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34668.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42282.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14056.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-52396.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17586.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44228.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9417.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24362.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20278.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38281.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-45058.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26029.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48395.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-40227.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-40227.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16277.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16277.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54617.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50341.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22307.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29921.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-40781.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21753.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-52479.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63916.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29105.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55748.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37295.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13345.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33211.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1093.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16683.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31073.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7123.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7144.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31649.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62375.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\76f599ac518b411869ad43d004550320_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\76f599ac518b411869ad43d004550320_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\76f599ac518b411869ad43d004550320_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\76f599ac518b411869ad43d004550320_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7476.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18337.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7476.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18337.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-40232.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-40232.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7476.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7476.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20366.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20366.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18337.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18337.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30201.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30201.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6827.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6827.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37553.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37553.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20366.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26693.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20366.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26693.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-40232.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-40232.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57419.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57419.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\76f599ac518b411869ad43d004550320_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7476.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18337.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-40232.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20366.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6827.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37553.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57419.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26693.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14165.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38115.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48229.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-5250.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-46838.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1166.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12027.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35977.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-36252.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42836.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34668.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-23808.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14056.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42282.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1249.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-52396.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44228.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9417.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24362.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17586.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20278.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7144.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38281.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26029.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-45058.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48395.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-40227.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14160.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-16277.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-52479.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54617.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33211.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29105.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-13345.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-16683.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63916.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22307.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55748.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-10076.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29921.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31073.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33080.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22220.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-40371.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14051.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19759.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55084.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55084.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22220.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6075.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33595.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7123.exe

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\76f599ac518b411869ad43d004550320_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7476.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18337.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20366.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-40232.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30201.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26693.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6827.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37553.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57419.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14165.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38115.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48229.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5250.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46838.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12027.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35977.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1166.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36252.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1249.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42836.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23808.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34668.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42282.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14056.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-52396.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17586.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44228.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9417.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20278.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24362.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38281.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-45058.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26029.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48395.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-40227.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-40227.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16277.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16277.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54617.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50341.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22307.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29921.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-40781.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21753.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29105.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-52479.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63916.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55748.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37295.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13345.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33211.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1093.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16683.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31073.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7123.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7144.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62375.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2236 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\76f599ac518b411869ad43d004550320_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe
PID 2236 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\76f599ac518b411869ad43d004550320_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe
PID 2236 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\76f599ac518b411869ad43d004550320_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe
PID 2236 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\76f599ac518b411869ad43d004550320_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe
PID 2092 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7476.exe
PID 2092 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7476.exe
PID 2092 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7476.exe
PID 2092 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7476.exe
PID 2236 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\76f599ac518b411869ad43d004550320_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18337.exe
PID 2236 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\76f599ac518b411869ad43d004550320_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18337.exe
PID 2236 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\76f599ac518b411869ad43d004550320_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18337.exe
PID 2236 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\76f599ac518b411869ad43d004550320_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18337.exe
PID 2236 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\76f599ac518b411869ad43d004550320_NeikiAnalytics.exe C:\Windows\SysWOW64\WerFault.exe
PID 2236 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\76f599ac518b411869ad43d004550320_NeikiAnalytics.exe C:\Windows\SysWOW64\WerFault.exe
PID 2236 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\76f599ac518b411869ad43d004550320_NeikiAnalytics.exe C:\Windows\SysWOW64\WerFault.exe
PID 2236 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\76f599ac518b411869ad43d004550320_NeikiAnalytics.exe C:\Windows\SysWOW64\WerFault.exe
PID 2776 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7476.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
PID 2776 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7476.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
PID 2776 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7476.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
PID 2776 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7476.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
PID 2092 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20366.exe
PID 2092 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20366.exe
PID 2092 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20366.exe
PID 2092 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20366.exe
PID 2328 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18337.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-40232.exe
PID 2328 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18337.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-40232.exe
PID 2328 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18337.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-40232.exe
PID 2328 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18337.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-40232.exe
PID 2092 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe C:\Windows\SysWOW64\WerFault.exe
PID 2092 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe C:\Windows\SysWOW64\WerFault.exe
PID 2092 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe C:\Windows\SysWOW64\WerFault.exe
PID 2092 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe C:\Windows\SysWOW64\WerFault.exe
PID 2660 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-30201.exe
PID 2660 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-30201.exe
PID 2660 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-30201.exe
PID 2660 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-30201.exe
PID 2820 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-40232.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26693.exe
PID 2820 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-40232.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26693.exe
PID 2820 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-40232.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26693.exe
PID 2820 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-40232.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26693.exe
PID 2776 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7476.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6827.exe
PID 2776 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7476.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6827.exe
PID 2776 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7476.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6827.exe
PID 2776 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7476.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6827.exe
PID 2528 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20366.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57419.exe
PID 2528 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20366.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57419.exe
PID 2528 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20366.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57419.exe
PID 2528 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20366.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57419.exe
PID 2328 wrote to memory of 1316 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18337.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37553.exe
PID 2328 wrote to memory of 1316 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18337.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37553.exe
PID 2328 wrote to memory of 1316 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18337.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37553.exe
PID 2328 wrote to memory of 1316 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18337.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37553.exe
PID 2776 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7476.exe C:\Windows\SysWOW64\WerFault.exe
PID 2776 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7476.exe C:\Windows\SysWOW64\WerFault.exe
PID 2776 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7476.exe C:\Windows\SysWOW64\WerFault.exe
PID 2776 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7476.exe C:\Windows\SysWOW64\WerFault.exe
PID 2328 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18337.exe C:\Windows\SysWOW64\WerFault.exe
PID 2328 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18337.exe C:\Windows\SysWOW64\WerFault.exe
PID 2328 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18337.exe C:\Windows\SysWOW64\WerFault.exe
PID 2328 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18337.exe C:\Windows\SysWOW64\WerFault.exe
PID 1612 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30201.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38115.exe
PID 1612 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30201.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38115.exe
PID 1612 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30201.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38115.exe
PID 1612 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30201.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38115.exe

Processes

C:\Users\Admin\AppData\Local\Temp\76f599ac518b411869ad43d004550320_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\76f599ac518b411869ad43d004550320_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7476.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7476.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18337.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18337.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40232.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40232.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20366.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20366.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-30201.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30201.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26693.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26693.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6827.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6827.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57419.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57419.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37553.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37553.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-38115.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38115.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14165.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14165.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48229.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48229.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5250.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5250.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46838.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46838.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1166.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1166.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12027.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12027.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35977.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35977.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-36252.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36252.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1249.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1249.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42836.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42836.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23808.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23808.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34668.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34668.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42282.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42282.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14056.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14056.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52396.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52396.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17586.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17586.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24362.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24362.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44228.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44228.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20278.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20278.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9417.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9417.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-38281.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38281.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45058.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45058.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26029.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26029.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48395.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48395.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40227.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40227.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40227.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40227.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16277.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16277.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16277.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16277.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54617.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54617.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50341.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50341.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22307.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22307.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29921.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29921.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40781.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40781.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21753.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21753.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52479.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52479.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63916.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63916.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29105.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29105.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14160.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14160.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14160.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14160.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55748.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55748.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10076.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10076.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-37295.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37295.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 672 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-13345.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13345.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33211.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33211.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-1093.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1093.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16683.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16683.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31073.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31073.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7123.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7123.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7144.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7144.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31649.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31649.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62375.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62375.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38425.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38425.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3615.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3615.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23481.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23481.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6075.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6075.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56708.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56708.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55084.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55084.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55084.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55084.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33595.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33595.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40371.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40371.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56153.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56153.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12982.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12982.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12982.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12982.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30388.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30388.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19759.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19759.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39625.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39625.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22220.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22220.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22220.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22220.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37164.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37164.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33080.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33080.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62183.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62183.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14051.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14051.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24912.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24912.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 704 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-14819.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14819.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-14004.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14004.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-35816.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35816.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11866.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11866.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58374.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58374.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23564.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23564.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54290.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54290.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50206.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50206.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22172.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22172.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23948.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23948.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 244

C:\Users\Admin\AppData\Local\Temp\Unicorn-26640.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26640.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57367.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57367.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56620.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56620.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58566.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58566.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58566.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58566.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23756.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23756.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54482.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54482.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46314.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46314.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22364.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22364.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18856.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18856.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30554.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30554.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61280.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61280.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26470.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26470.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57196.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57196.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53112.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53112.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18302.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18302.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55805.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55805.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10133.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10133.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51529.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51529.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51529.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51529.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5857.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5857.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47445.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47445.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1773.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1773.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43360.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43360.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63226.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63226.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56682.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56682.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4466.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4466.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22940.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22940.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62712.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62712.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-26278.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26278.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26278.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26278.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42291.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42291.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-49713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49713.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-37461.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37461.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17595.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17595.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36069.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36069.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-31683.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31683.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-3670.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3670.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56955.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56955.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56955.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56955.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56955.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56955.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59648.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59648.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44703.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44703.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20561.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20561.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40427.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40427.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51288.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51288.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36343.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36343.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24091.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24091.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-141.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-141.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64931.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64931.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40981.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40981.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52679.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52679.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48595.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48595.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5424.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5424.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51096.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51096.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-10831.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10831.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-28751.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28751.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12414.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12414.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-19767.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19767.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31465.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31465.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34157.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34157.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-3753.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3753.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-52762.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52762.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-53317.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53317.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-37002.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37002.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-18336.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18336.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-32726.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32726.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-46924.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46924.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-61890.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61890.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61890.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61890.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57806.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57806.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22996.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22996.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52331.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52331.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52331.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52331.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52331.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52331.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29026.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29026.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24942.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24942.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51584.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51584.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51584.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51584.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41832.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41832.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57614.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57614.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57614.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57614.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57614.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57614.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41278.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41278.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41278.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41278.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48055.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48055.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59560.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59560.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59560.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59560.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35056.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35056.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27464.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27464.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27464.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27464.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54106.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54106.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-2959.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2959.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-8989.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8989.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-4905.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4905.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35632.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35632.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-25880.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25880.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64220.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64220.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-39524.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39524.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27848.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27848.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46322.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46322.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-56436.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56436.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52352.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52352.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9373.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9373.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31932.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31932.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31932.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31932.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-40462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48076.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48076.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35824.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35824.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28232.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28232.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15980.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15980.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35331.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35331.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17926.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17926.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17926.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17926.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47583.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47583.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49529.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49529.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14718.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14718.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17987.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17987.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-50873.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50873.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-65455.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65455.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-1864.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1864.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13815.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13815.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-62824.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62824.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38320.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38320.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-39052.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39052.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-26800.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26800.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45082.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45082.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24662.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24662.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3884 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-2679.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2679.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3656 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-27184.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27184.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23100.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23100.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-63940.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63940.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3268 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-50126.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50126.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7147.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7147.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3460 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-19208.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19208.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3508 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-60240.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60240.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-25430.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25430.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-4132.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4132.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-57417.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57417.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53333.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53333.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-29405.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29405.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56047.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56047.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-23183.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23183.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12876.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12876.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57801.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57801.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48263.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48263.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-13452.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13452.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5092.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5092.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-46125.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46125.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25513.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25513.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-816.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-816.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13836.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13836.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28035.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28035.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7614.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7614.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38703.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38703.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57178.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57178.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57199.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57199.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 300

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-1776.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1776.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42809.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42809.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7998.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7998.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57007.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57007.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41548.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41548.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41548.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41548.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11397.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11397.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-25788.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25788.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-13343.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13343.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13919.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13919.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-44646.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44646.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44646.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44646.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44646.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44646.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21896.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21896.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21896.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21896.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36286.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36286.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-42892.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42892.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65450.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65450.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3805.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3805.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29078.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29078.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4976 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-53390.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53390.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3280 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-4189.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4189.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3628 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-3182.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3182.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-29545.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29545.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43935.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43935.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5100 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4160 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4492 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4596 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-24797.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24797.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-64651.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64651.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38476.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38476.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28902.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28902.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8289.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8289.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52337.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52337.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58559.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58559.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37947.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37947.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37947.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37947.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56805.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56805.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52721.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52721.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42991.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42991.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8180.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8180.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1958.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1958.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8735.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8735.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50967.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50967.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34631.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34631.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65357.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65357.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-18679.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18679.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45321.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45321.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45321.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45321.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29923.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29923.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29923.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29923.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16925.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16925.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8756.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8756.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41429.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41429.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1164.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1164.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61356.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61356.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6544 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-35290.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35290.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14869.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14869.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5244 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-32960.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32960.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50064.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50064.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-33536.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33536.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6701.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6701.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15638.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15638.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48865.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48865.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6364 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-1055.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1055.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44418.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44418.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62892.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62892.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15144.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15144.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6976.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6976.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5412 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6580 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5464 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-58699.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58699.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23889.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23889.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54615.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54615.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7356 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-30111.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30111.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6400 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7144 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7008 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-32441.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32441.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20573.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20573.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16489.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16489.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6760 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5500 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-57329.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57329.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5352 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6992 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6376 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5900 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-18819.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18819.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5872 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6724 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7152 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6936 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-32524.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32524.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5928 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5512 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6560 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6824 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6680 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-14397.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14397.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20428.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20428.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6872 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5516 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-12835.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12835.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5808 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5852 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9220 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-54060.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54060.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6976 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9568 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6628 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-34024.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34024.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9519.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9519.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9808 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-17003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4750.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4750.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-21663.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21663.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5800 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-31777.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31777.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7972 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-54335.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54335.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21471.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21471.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5844 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7204 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7296 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-26131.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26131.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23993.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23993.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56665.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56665.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62695.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62695.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62695.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62695.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5480 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6492 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5716 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6196 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6232 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-38466.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38466.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6900 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6532 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7468 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6656 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8000 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6812 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7076 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6216 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6500 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6692 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7160 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9532 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7068 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7560 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6668 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7004 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6848 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6808 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6676 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7092 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8964 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-33910.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33910.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20755.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20755.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30869.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30869.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12202.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12202.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41559.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41559.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12778.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12778.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35337.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35337.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41367.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41367.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43313.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43313.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61787.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61787.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52249.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52249.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62363.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62363.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23277.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23277.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49919.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49919.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56717.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56717.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65440.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65440.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9270.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9270.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1102.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1102.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41450.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41450.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16514.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16514.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9280 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-46878.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46878.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63022.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63022.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10277.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10277.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59369.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59369.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10064 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9416 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9820 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-37003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37003.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9440 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9960 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-62083.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62083.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 11116 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10604 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-31165.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31165.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9356 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-7236.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7236.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9328 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-9374.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9374.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23573.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23573.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9116 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-25519.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25519.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17351.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17351.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10980 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10124 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-51476.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51476.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9632 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-35140.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35140.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6359.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6359.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9980 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9852 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-60220.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60220.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9936 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9844 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9728 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-10225.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10225.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34730.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34730.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10968 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-63318.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63318.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10208 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9956 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-19847.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19847.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9816 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-17901.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17901.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10076 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10212 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9448 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9556 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10296 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10544 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9392 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-6271.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6271.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 12184 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10624 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-14247.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14247.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20470.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20470.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10852 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-35244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35244.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9836 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-433.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-433.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41274.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41274.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29022.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29022.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55664.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55664.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9756 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-45934.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45934.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9660 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-15015.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15015.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10068 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-60407.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60407.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9968 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10168 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10160 -s 216

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe

MD5 1f3fd9bb41d4b58bee1beb86686e9f20
SHA1 e6c7d3a7de76be6e9a7234c06909be272e22c738
SHA256 2ea739e06494735c7c6bb3383fd9458682ebf25b12d3a838cd39af9ce8835262
SHA512 02bbf4bbef14fe2fbe51533804044fd09132da0488635804a860db25b5efbde0bd4357ed79c65f5283af70c3cde4ed055371ddb5a031a92cbbb938a5c3ef8ee2

\Users\Admin\AppData\Local\Temp\Unicorn-7476.exe

MD5 1264306608430546dc3225f383e5ba7d
SHA1 530e6a7d5ee64685776f2423a7f0185a85b264e3
SHA256 dbe3ad1f3fb03aa5809aed9cbb93f1d935f2a8374b9bf0a19c8d570704f7a3ad
SHA512 1099e5ff1495d58d40ea71483935aafdcd3309ce208d3b6e56dbeee3a05c49d678c83d932f851fc3a8b6c76f754e4329f7f531949a1e4e6e87d5330e30f86d93

\Users\Admin\AppData\Local\Temp\Unicorn-18337.exe

MD5 d83f7b111cf4ca7d582cae58442182d0
SHA1 9250915878d8b756243045f1c71ec9d870fc41fa
SHA256 9d161f68081aaca3c3fd6529337d0925f6bd226bd9a20c7a93a5471357299c28
SHA512 8127dc7863de26091d472e32584705b28fb8ea4bd5d4cd570c83166c048348f1ef8b6a1fc22996702683181608a927c1c1ff6f6d401e5d12da2b740fd55bb3fb

\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe

MD5 6a047f92be472da7c7f078f7cea64a24
SHA1 d2c347925b235934dd07f1408c921b6a898006f0
SHA256 57e2abcd4ddc169fdcb04052577de1cc03d71c6539fcdbb37dde483d24e015be
SHA512 d9f0c6c9cc828b4797857134d5ebd6fe57e613c8791fe7bf2387a496035e625fe4ade6927dc81ec5feec6027cee63c4867fde190e2def93c5be445c10b16def1

\Users\Admin\AppData\Local\Temp\Unicorn-40232.exe

MD5 4efa7283bdb415c7609d9883efb9dd1d
SHA1 9497f55a81c16889ddde8388aafc6027bf66eb02
SHA256 98f1628a825b67e869ee943025a882f5f9f58080fc187d9ad639efbeaa5c1f38
SHA512 dcbbc3bdb61e5b6048278cb88dac4a25d20519e7c149be4506b82129d7555f3fd04a5c0e0ed2f0de91ce2ecd50d1832fd0699619707dcf59e0e79105dc4224ea

C:\Users\Admin\AppData\Local\Temp\Unicorn-20366.exe

MD5 94d6f1d0836ca2179361aef8ea72f840
SHA1 c7dda96e0d002dcb6a27ee80547115ce9b6c31ef
SHA256 6a1e5f8bac7c52622fcf77be896ae195e82718ebb077c5c79420191ca1b5e729
SHA512 137009ae5262f67f5dc582dc106b27bc178a92a7149050a641c80897aecd4cc01a11d6bc9e7a714255b1c52c7b6416da2ddb5d42119ecabf498a76007567927c

\Users\Admin\AppData\Local\Temp\Unicorn-30201.exe

MD5 3981c9743d58a37aa60a3ea0f5609843
SHA1 de8a5c174aab04002c0f749fc16e904a776c5324
SHA256 624bbc9339d4a4e1ed5000cde288de11e88e197e09ce229ecb52440b405bf1cc
SHA512 140ba93f3730e86c7f6316727d97348cd90e4c329db572d7b4c7b93eae50057a60029901f73f48c3c53c153346b748e1c408aa54ade3054a2bf2ada9c68e285e

\Users\Admin\AppData\Local\Temp\Unicorn-26693.exe

MD5 411760dc5e56d568c343fca7af4a9556
SHA1 c40edaf3bba8e890c9dab271367f28c1b5162933
SHA256 e54065e98c83aa1595f6b36f23b97f1604b014459c4699a8bd5fee84b7ff4885
SHA512 779dd8d9b632bd22775a4e39b6bc791d61ba17fae61395bbe6d668701f3e7aa900370a63d6f46d8b29e6e4122105ec532228d9ec5ed0b3dc7f71b6f367724931

\Users\Admin\AppData\Local\Temp\Unicorn-6827.exe

MD5 20c6941eb80649ea080103fcb90c3d0d
SHA1 32e6efb2c2fbe088f4400cd954e0198b5d8fc935
SHA256 bc5e683011d6b89c2ec9808f6e27391cd5278bccbe812745d55365667afa6637
SHA512 d40e87459222ecff5d158726b493238b4039c1d483962372be89e3ae0f425a6530f15297bcecd9b9474de25208b7c1ada8a11a19c70bf4909a9ce6bab8e650d6

C:\Users\Admin\AppData\Local\Temp\Unicorn-57419.exe

MD5 3e988324a739a0928cc6beafafa1deaa
SHA1 43d5f313bc1c4f22bed701f0fde88fa2a024d609
SHA256 8e307e80e56a84c8882818f60e4f0958fd20e7f3a5576bed0ca6907ddb0040c3
SHA512 d9a3bae8fe1cd58fd14f35fa2373ce5490335650500304a31f1b3b6a77bbdb797fc55fe5f8b7cc86106e5ff6e5de683abcd24af82740629abf042d08ba5af33b

\Users\Admin\AppData\Local\Temp\Unicorn-37553.exe

MD5 cd8dc12f45f9e7274b5d9c90c1999a7b
SHA1 6cd7bad06f2ae0129c7e21336f18659e2722f3b1
SHA256 0debafdc3214613c7917048c393a82d62640f88e5c6fc7a0372f276e8d1ad436
SHA512 86169a89626bb3ae8cd0099bb5f5d861f2c3f514f3f68b826b6641ec3afda1fab3f9f6e263de01d03798a22bfa5978ada9763bf95b4193ba8663313c2ba6e465

\Users\Admin\AppData\Local\Temp\Unicorn-38115.exe

MD5 f16a335337ba69e9a0712a2c6cb26d48
SHA1 45e3417e4ab71015e175dcdad8fa40ea7e38e77c
SHA256 eb499d0c41aeeef40ab98ef84f8f7d9b13fbfeb1bd30b0523ccb07c0aa0db35d
SHA512 ff2a9c5d9423d15ee2badf558e2f60b8188757b19b2c2b2de227e70215bfb19450e90680fd9b78417480be42e6f4f1869b4672f5c0e1a0f3078e9defe45ad64e

\Users\Admin\AppData\Local\Temp\Unicorn-14165.exe

MD5 a5012df407f076938652106a08284b3d
SHA1 bef5bc8ac307fc238ba184060b0aafbcada0ccf2
SHA256 a34f24997bc1bb54f6ddc73e66b1e51f6b23b90dee437f4913f6fb6052eed59e
SHA512 bd818a8ae4feb4145ffeadae204001c56f10c75aef3feb61b88f842a56a7017df141bc3ce52047d38d826a82a4989b1b137664f10f3dde86819685cf0748f04a

\Users\Admin\AppData\Local\Temp\Unicorn-48229.exe

MD5 dd8aa31ec337cdd3e4e386d18594e87f
SHA1 e26c94acca44ddbf75beeb7ae472c9ad133d6012
SHA256 296465b808df035c7d1366e4c661ac7a11c34f3b8cb2f3b2afc4a03533827689
SHA512 22ce09eb400c2fe648d8bce08140e1979791a665abcd45a172a097003a2af13fbc8e4c5d0006d8c74953c416484108328188d9a81f952ed0cf28eef1e1e4bd09

C:\Users\Admin\AppData\Local\Temp\Unicorn-40781.exe

MD5 92bf7b9ee9c8f506c11bd196f2b8c28e
SHA1 39a965353926fb3949140de8e7952e9ddaaea6c5
SHA256 c076d8d88ad12ef0ac6507160f13fe62ac9208b38e0f91ccaea5476295762d45
SHA512 28beedc982a629cb5239ac510f73dd3c6f56601212bd3d3b4aafe2158f4b3150e038f9574e4567a78092950fa937425dcb51bee9bfcba6ba6e71b00576252407

C:\Users\Admin\AppData\Local\Temp\Unicorn-6075.exe

MD5 3310688d49712be777661123fe378b2d
SHA1 ed78695d9aeb96b286e35fea3baba7363eaca54d
SHA256 5d398591aebd9746b30ae7183ab2b38a0efb2d15424a15cf8780637dcc68cd66
SHA512 db25948553a086a8bb9becceeb8e30507289aa178af335274e0e0b5f534b954e09d25a14edeb41f1ae8668bfa708dd5476f04d3909ae226e87b6a5a47904bb6a

C:\Users\Admin\AppData\Local\Temp\Unicorn-10133.exe

MD5 01508046c755b5ae576b5429c51d806d
SHA1 ea64b3f439181c27f52f1140018e15c0548c3758
SHA256 9a6116e460d27f66899d9ed9fcbd16060360cd01ccf5fdcc244e335a9014b28d
SHA512 432dbe75907d82b6fe7ec9d815017865bb954e09b5eaa1bd9de5a7f505b5b9d1ed1968da65c81bcbb40b080cfe460bf7b732b0e6bef025db8312408b3f832c18

C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe

MD5 91b58ea331506e907423cdb61fa5b521
SHA1 a70dce37752dfef3337d088b6515d75f6fbd7336
SHA256 cd5e360da0c6729a3318ffe1aeecfe93b87790eb182b78a81594f90a6162d600
SHA512 e2985464f19a724e6da879c65da928ad04b13f2141864a3d7aa399fcd2ab1a9b156df1a72c47f703c6dd4a43baca976f032084d9c4f119025a69c046f1ab7f47

C:\Users\Admin\AppData\Local\Temp\Unicorn-40427.exe

MD5 30076dc0db9bb9179e49a3d580842f84
SHA1 d4984fa75edecddd81baabaa27a10559531cb900
SHA256 78f60d30fa8244e40b9036ec443f08de2fb8df7bfb4911ea96c271f76d492c86
SHA512 966c8886d32e3c61fb7c4bb26ad571f175cfdcc7cec0afcb1ab4f3df0ac92056923b27117e564df8786da13fe08a754e0b90cc53d66b62529a11219e315bb45d

C:\Users\Admin\AppData\Local\Temp\Unicorn-40462.exe

MD5 970e2b2d0ac6cb288c5e6452795e4ecc
SHA1 2ac6a2549bfbec201af8911a69d83dae2b793cc6
SHA256 e470586d6f13755cae42b19086ad06a8c854848900b9ab4f48b616e5d631b9de
SHA512 1962b0832f0e04acae224627b499eb3020679761e0614c3a0e84d551713a02c5120c46081266cd45c64d0d5f258be7aefcb230d84b5838687f6c722cfdd69c8f

C:\Users\Admin\AppData\Local\Temp\Unicorn-25513.exe

MD5 2cd67c41379d8e680ac5532bdaedce6b
SHA1 0ea9665bc676363d0815e998be4e16d9a9680762
SHA256 872458907dec9c5a7b62e1d68179bee33aa85c87850e231e6f1ac17eb1fa1d12
SHA512 b033f7154fb642a4883c95477c9f2476e9acf7003a661a4ecae70761b8d3256a9c601dcc0a94a75a2432f07bfec641c7ade57dbff0ec8795b5c198aedba47e17

C:\Users\Admin\AppData\Local\Temp\Unicorn-1102.exe

MD5 e31fbde4f5a0d22ea174209cfca42fd7
SHA1 a2191e06dd49948f1482b9086105893b1537ef83
SHA256 27a34bf75de6078e383d2f33166c9428b85e010dd068972ce8ca6d46c8493c71
SHA512 7b7ee13805f25eb275796f4303aa7d3e29f2882251ff54c728cc133c2a170d0f64bec825ef38955d7cf4d18ea6a895f21b55be97b8ecb071f15f3ba6a7c0c588

C:\Users\Admin\AppData\Local\Temp\Unicorn-17901.exe

MD5 fc0c44adcde0f93f14051a14c21a032d
SHA1 f04846491874e23c68f3457f5db202259f82da21
SHA256 39d438f12683ec4273151169f04b71a0274bcce044e939e4a905a8ab742731c7
SHA512 8d87b6db7d4c258e1f99e2859636437d2022a847d16915cdb7408223b2cabca3f7c048bdab1c6115b6e75e66c6603f529d26675d493a3b6d35b48fc075c4cf9c

C:\Users\Admin\AppData\Local\Temp\Unicorn-14247.exe

MD5 4ffa5d23ee3200ab549d32f164dafcd1
SHA1 87f24ec3fc47cf02a6c566910bf1fbb3766fd874
SHA256 1aa082f7c9b83f2384970f6485a3a0dbf28f2a41ed0e6c65835d41df05c4fa82
SHA512 200f911d1f9319e9827af5ce788cc9d2c7ae0f84bc22a9d2513342e5d3b41720454131bf5d32701784bf08f502071edbf2a34939acb08a1d12da32069eee96d2

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-02 22:29

Reported

2024-06-02 22:32

Platform

win10v2004-20240226-en

Max time kernel

153s

Max time network

161s

Command Line

"C:\Users\Admin\AppData\Local\Temp\76f599ac518b411869ad43d004550320_NeikiAnalytics.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9780.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46283.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10081.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47243.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36937.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59640.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36527.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42557.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-45250.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24419.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60621.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21727.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7891.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38639.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61197.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59614.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35685.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31623.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58517.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22123.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44127.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-39851.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-39851.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\76f599ac518b411869ad43d004550320_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9780.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-46283.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-10081.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-47243.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-36937.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-45250.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42557.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59640.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24419.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-61197.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-60621.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22123.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-58491.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31623.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19597.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9264.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-52435.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29877.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15102.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33873.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-11506.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33873.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-61755.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-36561.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-2134.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-188.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34553.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44039.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-39571.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17013.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-49877.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-50583.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-58751.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44553.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24491.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24081.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59109.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34797.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-47983.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-23095.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-8621.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-3214.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-16811.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-51403.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64423.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14454.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-47319.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64013.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57215.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-16759.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44517.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-3266.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-43505.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-50692.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-36685.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26483.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4584.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-47926.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-40703.exe

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\76f599ac518b411869ad43d004550320_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9780.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46283.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10081.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47243.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36937.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59640.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36527.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42557.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-45250.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24419.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60621.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21727.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7891.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38639.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61197.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59614.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35685.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31623.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58517.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22123.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4836 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\76f599ac518b411869ad43d004550320_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9780.exe
PID 4836 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\76f599ac518b411869ad43d004550320_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9780.exe
PID 4836 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\76f599ac518b411869ad43d004550320_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9780.exe
PID 3456 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9780.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-46283.exe
PID 3456 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9780.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-46283.exe
PID 3456 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9780.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-46283.exe
PID 4836 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\76f599ac518b411869ad43d004550320_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-10081.exe
PID 4836 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\76f599ac518b411869ad43d004550320_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-10081.exe
PID 4836 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\76f599ac518b411869ad43d004550320_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-10081.exe
PID 3396 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46283.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-47243.exe
PID 3396 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46283.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-47243.exe
PID 3396 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46283.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-47243.exe
PID 3456 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9780.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe
PID 3456 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9780.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe
PID 3456 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9780.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe
PID 2560 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10081.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-36937.exe
PID 2560 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10081.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-36937.exe
PID 2560 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10081.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-36937.exe
PID 2952 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47243.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe
PID 2952 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47243.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe
PID 2952 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47243.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe
PID 3396 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46283.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59640.exe
PID 3396 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46283.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59640.exe
PID 3396 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46283.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59640.exe
PID 4472 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-36527.exe
PID 4472 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-36527.exe
PID 4472 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-36527.exe
PID 4064 wrote to memory of 3080 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36937.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42557.exe
PID 4064 wrote to memory of 3080 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36937.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42557.exe
PID 4064 wrote to memory of 3080 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36937.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42557.exe
PID 2560 wrote to memory of 4636 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10081.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-45250.exe
PID 2560 wrote to memory of 4636 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10081.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-45250.exe
PID 2560 wrote to memory of 4636 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10081.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-45250.exe
PID 2460 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe
PID 2460 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe
PID 2460 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe
PID 2952 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47243.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24419.exe
PID 2952 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47243.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24419.exe
PID 2952 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47243.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24419.exe
PID 3104 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59640.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-60621.exe
PID 3104 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59640.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-60621.exe
PID 3104 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59640.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-60621.exe
PID 2252 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36527.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-21727.exe
PID 2252 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36527.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-21727.exe
PID 2252 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36527.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-21727.exe
PID 4472 wrote to memory of 4328 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7891.exe
PID 4472 wrote to memory of 4328 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7891.exe
PID 4472 wrote to memory of 4328 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7891.exe
PID 4636 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-45250.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38639.exe
PID 4636 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-45250.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38639.exe
PID 4636 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-45250.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38639.exe
PID 3080 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42557.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-61197.exe
PID 3080 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42557.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-61197.exe
PID 3080 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42557.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-61197.exe
PID 4064 wrote to memory of 4688 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36937.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59614.exe
PID 4064 wrote to memory of 4688 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36937.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59614.exe
PID 4064 wrote to memory of 4688 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36937.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59614.exe
PID 4144 wrote to memory of 3152 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18603.exe
PID 4144 wrote to memory of 3152 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18603.exe
PID 4144 wrote to memory of 3152 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18603.exe
PID 2460 wrote to memory of 3568 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35685.exe
PID 2460 wrote to memory of 3568 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35685.exe
PID 2460 wrote to memory of 3568 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35685.exe
PID 1212 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24419.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31623.exe

Processes

C:\Users\Admin\AppData\Local\Temp\76f599ac518b411869ad43d004550320_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\76f599ac518b411869ad43d004550320_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\Unicorn-9780.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9780.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46283.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46283.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10081.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10081.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4836 -ip 4836

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 736

C:\Users\Admin\AppData\Local\Temp\Unicorn-47243.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47243.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36937.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36937.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3456 -ip 3456

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 716

C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59640.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59640.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36527.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36527.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42557.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42557.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45250.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45250.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3396 -ip 3396

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2560 -ip 2560

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 748

C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24419.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24419.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60621.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60621.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21727.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21727.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7891.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7891.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38639.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38639.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61197.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61197.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59614.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59614.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2952 -ip 2952

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4064 -ip 4064

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 736

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4472 -ip 4472

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 740

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 720

C:\Users\Admin\AppData\Local\Temp\Unicorn-18603.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18603.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35685.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35685.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31623.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31623.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58517.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58517.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22123.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22123.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44127.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44127.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39851.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39851.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39851.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39851.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7733.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7733.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2460 -ip 2460

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 756

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4636 -ip 4636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3080 -ip 3080

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3104 -ip 3104

C:\Users\Admin\AppData\Local\Temp\Unicorn-55201.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55201.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53618.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53618.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2252 -ip 2252

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 712

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 712

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 648

C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31081.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31081.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55948.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55948.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8906.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8906.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21713.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4144 -ip 4144

C:\Users\Admin\AppData\Local\Temp\Unicorn-40017.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40017.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58491.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58491.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19597.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19597.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19597.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19597.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1212 -ip 1212

C:\Users\Admin\AppData\Local\Temp\Unicorn-7152.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7152.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48740.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48740.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44656.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44656.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9845.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9845.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 724

C:\Users\Admin\AppData\Local\Temp\Unicorn-54791.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54791.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26757.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26757.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64905.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64905.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48377.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48377.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3284 -ip 3284

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2732 -ip 2732

C:\Users\Admin\AppData\Local\Temp\Unicorn-10058.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10058.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59259.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59259.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50899.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50899.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38455.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38455.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6337.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6337.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32979.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32979.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39777.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39777.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8496.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8496.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 664

C:\Users\Admin\AppData\Local\Temp\Unicorn-53613.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53613.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18803.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18803.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3644 -ip 3644

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4312 -ip 4312

C:\Users\Admin\AppData\Local\Temp\Unicorn-15102.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15102.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4296 -ip 4296

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 3176 -ip 3176

C:\Users\Admin\AppData\Local\Temp\Unicorn-29877.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29877.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52435.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52435.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52435.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52435.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9264.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9264.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35907.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35907.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9264.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9264.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4848 -ip 4848

C:\Users\Admin\AppData\Local\Temp\Unicorn-3810.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3810.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4908 -ip 4908

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 3152 -ip 3152

C:\Users\Admin\AppData\Local\Temp\Unicorn-62933.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62933.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28123.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28123.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58849.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58849.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4600 -ip 4600

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 4820 -ip 4820

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4688 -ip 4688

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 1604 -ip 1604

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2412 -ip 2412

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 4328 -ip 4328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4124 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 4212 -ip 4212

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 2044 -ip 2044

C:\Users\Admin\AppData\Local\Temp\Unicorn-61755.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61755.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 3628 -ip 3628

C:\Users\Admin\AppData\Local\Temp\Unicorn-26945.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26945.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4180 -ip 4180

C:\Users\Admin\AppData\Local\Temp\Unicorn-13130.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13130.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 5468 -ip 5468

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4432 -ip 4432

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 4680 -ip 4680

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 744

C:\Users\Admin\AppData\Local\Temp\Unicorn-40135.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40135.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 2344 -ip 2344

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 4908 -ip 4908

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 3568 -ip 3568

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2440 -ip 2440

C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13478.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13478.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 3836 -ip 3836

C:\Users\Admin\AppData\Local\Temp\Unicorn-31761.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31761.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2644 -ip 2644

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4576 -ip 4576

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 752

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 716

C:\Users\Admin\AppData\Local\Temp\Unicorn-5694.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5694.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9778.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9778.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9778.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9778.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 2468 -ip 2468

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 3256 -ip 3256

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 636

C:\Users\Admin\AppData\Local\Temp\Unicorn-61309.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61309.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30583.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30583.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49057.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49057.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6078.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6078.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6078.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6078.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36613.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36613.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36613.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36613.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4528 -ip 4528

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3596 -ip 3596

C:\Users\Admin\AppData\Local\Temp\Unicorn-24937.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24937.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4632 -ip 4632

C:\Users\Admin\AppData\Local\Temp\Unicorn-22799.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22799.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3760 -ip 3760

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 636 -ip 636

C:\Users\Admin\AppData\Local\Temp\Unicorn-41657.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41657.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 3752 -ip 3752

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 4480 -ip 4480

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 2172 -ip 2172

C:\Users\Admin\AppData\Local\Temp\Unicorn-33873.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33873.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33873.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33873.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1844 -ip 1844

C:\Users\Admin\AppData\Local\Temp\Unicorn-21621.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21621.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21621.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21621.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 2900 -ip 2900

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3896 -ip 3896

C:\Users\Admin\AppData\Local\Temp\Unicorn-34257.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34257.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5184 -ip 5184

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 5192 -ip 5192

C:\Users\Admin\AppData\Local\Temp\Unicorn-62845.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62845.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4604 -ip 4604

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 5144 -ip 5144

C:\Users\Admin\AppData\Local\Temp\Unicorn-11506.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11506.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5400 -ip 5400

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 5444 -ip 5444

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 5436 -ip 5436

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 5312 -ip 5312

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 5664 -ip 5664

C:\Users\Admin\AppData\Local\Temp\Unicorn-61091.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61091.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61091.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61091.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5436 -s 744

C:\Users\Admin\AppData\Local\Temp\Unicorn-1584.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1584.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1584.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1584.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 5684 -ip 5684

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 5384 -ip 5384

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 5408 -ip 5408

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 5656 -ip 5656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 5452 -ip 5452

C:\Users\Admin\AppData\Local\Temp\Unicorn-47277.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47277.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10520.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10520.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10520.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10520.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39493.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39493.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 5528 -ip 5528

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5312 -s 624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 6040 -ip 6040

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 6092 -ip 6092

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5408 -s 716

C:\Users\Admin\AppData\Local\Temp\Unicorn-16743.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16743.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28995.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28995.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54246.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54246.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47469.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47469.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5384 -s 752

C:\Users\Admin\AppData\Local\Temp\Unicorn-20827.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20827.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3675.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3675.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 5180 -ip 5180

C:\Users\Admin\AppData\Local\Temp\Unicorn-19457.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19457.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8958.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8958.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1366.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1366.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1366.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1366.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47038.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47038.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40815.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40815.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5600 -ip 5600

C:\Users\Admin\AppData\Local\Temp\Unicorn-36561.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36561.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61065.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61065.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 5844 -ip 5844

C:\Users\Admin\AppData\Local\Temp\Unicorn-26255.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26255.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26255.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26255.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 5852 -ip 5852

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5704 -ip 5704

C:\Users\Admin\AppData\Local\Temp\Unicorn-41007.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41007.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61449.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61449.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28777.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28777.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2134.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2134.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2134.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2134.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43529.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43529.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3176 -ip 3176

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 6136 -ip 6136

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5928 -ip 5928

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 5736 -ip 5736

C:\Users\Admin\AppData\Local\Temp\Unicorn-61641.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61641.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-188.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-188.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5636 -ip 5636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 2908 -ip 2908

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 3360 -ip 3360

C:\Users\Admin\AppData\Local\Temp\Unicorn-19587.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19587.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58481.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58481.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 6008 -ip 6008

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 5340 -ip 5340

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4328 -ip 4328

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2044 -ip 2044

C:\Users\Admin\AppData\Local\Temp\Unicorn-28139.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28139.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6008 -s 720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 2008 -ip 2008

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 724

C:\Users\Admin\AppData\Local\Temp\Unicorn-54973.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54973.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20163.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20163.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42721.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42721.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34553.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34553.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65279.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65279.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61771.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61771.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3826.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3826.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49519.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49519.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59633.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59633.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59633.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59633.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24823.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24823.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51465.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51465.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62326.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62326.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4402.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4402.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 5924 -ip 5924

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 4068 -ip 4068

C:\Users\Admin\AppData\Local\Temp\Unicorn-61579.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61579.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-318.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-318.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 740

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5352 -ip 5352

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 5860 -ip 5860

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 5584 -ip 5584

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 6100 -ip 6100

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 1176 -ip 1176

C:\Users\Admin\AppData\Local\Temp\Unicorn-5170.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5170.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46011.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46011.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 4288 -ip 4288

C:\Users\Admin\AppData\Local\Temp\Unicorn-22445.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22445.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 4856 -ip 4856

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 3284 -ip 3284

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 2144 -ip 2144

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5308 -ip 5308

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5784 -ip 5784

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4684 -ip 4684

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 5548 -ip 5548

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 720 -ip 720

C:\Users\Admin\AppData\Local\Temp\Unicorn-27297.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27297.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 4688 -ip 4688

C:\Users\Admin\AppData\Local\Temp\Unicorn-16437.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16437.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17013.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17013.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1744 -ip 1744

C:\Users\Admin\AppData\Local\Temp\Unicorn-39571.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39571.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 6072 -ip 6072

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 5276 -ip 5276

C:\Users\Admin\AppData\Local\Temp\Unicorn-44039.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44039.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 2460 -ip 2460

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 5692 -ip 5692

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 5612 -ip 5612

C:\Users\Admin\AppData\Local\Temp\Unicorn-23235.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23235.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49877.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49877.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5472 -ip 5472

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 5460 -ip 5460

C:\Users\Admin\AppData\Local\Temp\Unicorn-36255.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36255.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31979.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31979.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62705.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62705.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54537.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54537.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 1612 -ip 1612

C:\Users\Admin\AppData\Local\Temp\Unicorn-21673.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21673.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 4836 -ip 4836

C:\Users\Admin\AppData\Local\Temp\Unicorn-36063.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36063.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18165.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18165.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11942.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11942.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11942.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11942.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1460 -ip 1460

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 4320 -ip 4320

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 4184 -ip 4184

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 4664 -ip 4664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 4292 -ip 4292

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 1844 -ip 1844

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 5688 -ip 5688

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 4604 -ip 4604

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 2192 -ip 2192

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 5912 -ip 5912

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 632

C:\Users\Admin\AppData\Local\Temp\Unicorn-35653.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35653.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4350.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4350.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1708 -ip 1708

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 5944 -ip 5944

C:\Users\Admin\AppData\Local\Temp\Unicorn-45959.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45959.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15232.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15232.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15232.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15232.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 4480 -ip 4480

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 944 -ip 944

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 5844 -ip 5844

C:\Users\Admin\AppData\Local\Temp\Unicorn-37599.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37599.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 1900 -ip 1900

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2912 -ip 2912

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 4212 -ip 4212

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 2336 -ip 2336

C:\Users\Admin\AppData\Local\Temp\Unicorn-61081.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61081.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26271.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26271.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 1444 -ip 1444

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 6032 -ip 6032

C:\Users\Admin\AppData\Local\Temp\Unicorn-26271.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26271.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44553.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44553.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19857.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19857.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50583.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50583.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50583.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50583.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 5224 -ip 5224

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 1056 -ip 1056

C:\Users\Admin\AppData\Local\Temp\Unicorn-58751.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58751.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12264.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12264.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38907.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38907.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 5232 -ip 5232

C:\Users\Admin\AppData\Local\Temp\Unicorn-14210.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14210.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 4608 -ip 4608

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 5216 -ip 5216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6032 -s 720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 5396 -ip 5396

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 5128 -ip 5128

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 5200 -ip 5200

C:\Users\Admin\AppData\Local\Temp\Unicorn-53873.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53873.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 5556 -ip 5556

C:\Users\Admin\AppData\Local\Temp\Unicorn-13032.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13032.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43759.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43759.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5956 -ip 5956

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 5792 -ip 5792

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5296 -ip 5296

C:\Users\Admin\AppData\Local\Temp\Unicorn-21585.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21585.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 5252 -ip 5252

C:\Users\Admin\AppData\Local\Temp\Unicorn-52311.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52311.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20193.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20193.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 5680 -ip 5680

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 5552 -ip 5552

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5852 -ip 5852

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 5628 -ip 5628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 5212 -ip 5212

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 5268 -ip 5268

C:\Users\Admin\AppData\Local\Temp\Unicorn-59109.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59109.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28575.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28575.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 1676 -ip 1676

C:\Users\Admin\AppData\Local\Temp\Unicorn-32659.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32659.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63385.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63385.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46665.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46665.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5852 -s 624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 3816 -ip 3816

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 4552 -ip 4552

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 3460 -ip 3460

C:\Users\Admin\AppData\Local\Temp\Unicorn-28959.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28959.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 5136 -ip 5136

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5212 -s 628

C:\Users\Admin\AppData\Local\Temp\Unicorn-63577.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63577.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24491.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24491.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20407.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20407.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34797.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34797.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34797.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34797.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57931.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57931.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 4548 -ip 4548

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 5040 -ip 5040

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 5656 -ip 5656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5268 -s 736

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 4432 -ip 4432

C:\Users\Admin\AppData\Local\Temp\Unicorn-35373.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35373.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 5936 -ip 5936

C:\Users\Admin\AppData\Local\Temp\Unicorn-57739.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57739.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49571.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49571.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47433.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47433.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47433.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47433.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46063.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46063.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 5924 -ip 5924

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 2984 -ip 2984

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 4528 -ip 4528

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 5332 -ip 5332

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 1804 -ip 1804

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 3672 -ip 3672

C:\Users\Admin\AppData\Local\Temp\Unicorn-44693.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44693.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24081.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24081.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 3192 -ip 3192

C:\Users\Admin\AppData\Local\Temp\Unicorn-15913.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15913.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5256 -ip 5256

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 3632 -ip 3632

C:\Users\Admin\AppData\Local\Temp\Unicorn-24657.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24657.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 5720 -ip 5720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 2164 -ip 2164

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 6076 -ip 6076

C:\Users\Admin\AppData\Local\Temp\Unicorn-61221.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61221.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 3760 -ip 3760

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 392 -ip 392

C:\Users\Admin\AppData\Local\Temp\Unicorn-37293.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37293.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 5308 -ip 5308

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5744 -ip 5744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 5996 -ip 5996

C:\Users\Admin\AppData\Local\Temp\Unicorn-56151.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56151.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3276 -ip 3276

C:\Users\Admin\AppData\Local\Temp\Unicorn-47983.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47983.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47983.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47983.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 392 -s 628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 5400 -ip 5400

C:\Users\Admin\AppData\Local\Temp\Unicorn-9088.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9088.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43899.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43899.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43899.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43899.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43899.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43899.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5004.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5004.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 2780 -ip 2780

C:\Users\Admin\AppData\Local\Temp\Unicorn-43899.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43899.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 712

C:\Users\Admin\AppData\Local\Temp\Unicorn-51875.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51875.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 576 -ip 576

C:\Users\Admin\AppData\Local\Temp\Unicorn-23095.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23095.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4576 -ip 4576

C:\Users\Admin\AppData\Local\Temp\Unicorn-3214.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3214.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11766.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11766.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 5376 -ip 5376

C:\Users\Admin\AppData\Local\Temp\Unicorn-30241.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30241.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26157.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26157.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 5488 -ip 5488

C:\Users\Admin\AppData\Local\Temp\Unicorn-50469.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50469.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 5804 -ip 5804

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 644

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 5528 -ip 5528

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5700 -ip 5700

C:\Users\Admin\AppData\Local\Temp\Unicorn-8813.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8813.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12897.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12897.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44823.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44823.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5928.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5928.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8621.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8621.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 6024 -ip 6024

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 6104 -ip 6104

C:\Users\Admin\AppData\Local\Temp\Unicorn-18949.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18949.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5700 -s 732

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 5360 -ip 5360

C:\Users\Admin\AppData\Local\Temp\Unicorn-25171.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25171.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37423.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37423.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2612.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2612.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16811.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16811.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55897.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55897.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55897.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55897.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 3696 -ip 3696

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 3540 -ip 3540

C:\Users\Admin\AppData\Local\Temp\Unicorn-46167.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46167.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 1628 -ip 1628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 1412 -ip 1412

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 3568 -ip 3568

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 4608 -ip 4608

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 4600 -ip 4600

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 2412 -ip 2412

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 2468 -ip 2468

C:\Users\Admin\AppData\Local\Temp\Unicorn-28461.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28461.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28461.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28461.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28823.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28823.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51403.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51403.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47319.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47319.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8424.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8424.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8424.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8424.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43235.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43235.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43235.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43235.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8424.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8424.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43235.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43235.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14454.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14454.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 5316 -ip 5316

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 656

C:\Users\Admin\AppData\Local\Temp\Unicorn-14454.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14454.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 5944 -ip 5944

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 4180 -ip 4180

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5252 -ip 5252

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4820 -ip 4820

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 5828 -ip 5828

C:\Users\Admin\AppData\Local\Temp\Unicorn-64423.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64423.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25529.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25529.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51979.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51979.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9000.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9000.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19115.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19115.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 5732 -ip 5732

C:\Users\Admin\AppData\Local\Temp\Unicorn-64423.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64423.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1944 -ip 1944

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 5292 -ip 5292

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5992 -ip 5992

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 5884 -ip 5884

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 1872 -ip 1872

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 4020 -ip 4020

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 3676 -ip 3676

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 2708 -ip 2708

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 3592 -ip 3592

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 5136 -ip 5136

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 4924 -ip 4924

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 5688 -ip 5688

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5200 -ip 5200

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 5724 -ip 5724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 5792 -ip 5792

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3968 -ip 3968

C:\Users\Admin\AppData\Local\Temp\Unicorn-55824.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55824.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 4528 -ip 4528

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 5288 -ip 5288

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 5668 -ip 5668

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 5432 -ip 5432

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 5372 -ip 5372

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 636 -ip 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 6132 -ip 6132

C:\Users\Admin\AppData\Local\Temp\Unicorn-57215.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57215.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5132 -ip 5132

C:\Users\Admin\AppData\Local\Temp\Unicorn-64013.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64013.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64013.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64013.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64013.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64013.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64013.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64013.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59929.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59929.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59929.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59929.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59929.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59929.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59929.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59929.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20843.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20843.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16759.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16759.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5372 -s 648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2728 -ip 2728

C:\Users\Admin\AppData\Local\Temp\Unicorn-64013.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64013.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64013.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64013.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6132 -s 652

C:\Users\Admin\AppData\Local\Temp\Unicorn-30957.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30957.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26873.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26873.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4696 -ip 4696

C:\Users\Admin\AppData\Local\Temp\Unicorn-55845.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55845.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55845.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55845.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51761.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51761.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23727.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23727.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5132 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 5812 -ip 5812

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2916 -ip 2916

C:\Users\Admin\AppData\Local\Temp\Unicorn-54439.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54439.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 3192 -ip 3192

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 1548 -ip 1548

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4804 -ip 4804

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 5736 -ip 5736

C:\Users\Admin\AppData\Local\Temp\Unicorn-44517.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44517.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56769.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56769.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20375.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20375.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 5624 -ip 5624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5624 -s 648

C:\Users\Admin\AppData\Local\Temp\Unicorn-63759.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63759.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 5244 -ip 5244

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 5480 -ip 5480

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 1752 -ip 1752

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 1924 -ip 1924

C:\Users\Admin\AppData\Local\Temp\Unicorn-63567.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63567.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3272 -ip 3272

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1424 -ip 1424

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5608 -ip 5608

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5772 -ip 5772

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 4424 -ip 4424

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1640 -ip 1640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5480 -s 664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 620

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5832 -ip 5832

C:\Users\Admin\AppData\Local\Temp\Unicorn-19219.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19219.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5612 -ip 5612

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5244 -s 652

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 6064 -ip 6064

C:\Users\Admin\AppData\Local\Temp\Unicorn-21165.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21165.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21165.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21165.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17081.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17081.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43531.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43531.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47807.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47807.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47807.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47807.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37309.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37309.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 5352 -ip 5352

C:\Users\Admin\AppData\Local\Temp\Unicorn-55783.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55783.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 3752 -ip 3752

C:\Users\Admin\AppData\Local\Temp\Unicorn-54413.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54413.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13935.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13935.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50692.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50692.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24071.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24071.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24071.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24071.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 2604 -ip 2604

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3752 -s 696

C:\Users\Admin\AppData\Local\Temp\Unicorn-14319.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14319.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10235.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10235.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36877.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36877.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3266.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3266.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36685.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36685.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29093.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29093.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29093.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29093.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42545.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42545.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30293.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30293.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57319.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57319.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5357.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5357.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5357.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5357.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12778.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12778.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43505.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43505.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-526.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-526.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 2644 -ip 2644

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 4180 -ip 4180

C:\Users\Admin\AppData\Local\Temp\Unicorn-23085.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23085.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5976 -ip 5976

C:\Users\Admin\AppData\Local\Temp\Unicorn-57895.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57895.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 5332 -ip 5332

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 3104 -ip 3104

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 6128 -ip 6128

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 6076 -ip 6076

C:\Users\Admin\AppData\Local\Temp\Unicorn-62363.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62363.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6940.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6940.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 5304 -ip 5304

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 752

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 5900 -ip 5900

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 2276 -ip 2276

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6128 -s 652

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 5684 -ip 5684

C:\Users\Admin\AppData\Local\Temp\Unicorn-13546.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13546.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5332 -s 748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 5916 -ip 5916

C:\Users\Admin\AppData\Local\Temp\Unicorn-58663.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58663.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23853.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23853.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4144 -ip 4144

C:\Users\Admin\AppData\Local\Temp\Unicorn-13354.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13354.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48165.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48165.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 6028 -ip 6028

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 5808 -ip 5808

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 664 -ip 664

C:\Users\Admin\AppData\Local\Temp\Unicorn-61185.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61185.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57101.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 5796 -ip 5796

C:\Users\Admin\AppData\Local\Temp\Unicorn-59047.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59047.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24237.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24237.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 568 -ip 568

C:\Users\Admin\AppData\Local\Temp\Unicorn-4371.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4371.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54963.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54963.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 1776 -ip 1776

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 944 -ip 944

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 5272 -ip 5272

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 3676 -ip 3676

C:\Users\Admin\AppData\Local\Temp\Unicorn-43649.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43649.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 6092 -ip 6092

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 2792 -ip 2792

C:\Users\Admin\AppData\Local\Temp\Unicorn-24429.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24429.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 5964 -ip 5964

C:\Users\Admin\AppData\Local\Temp\Unicorn-4584.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4584.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35311.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35311.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46172.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46172.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31227.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31227.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29089.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29089.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 348 -ip 348

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 5152 -ip 5152

C:\Users\Admin\AppData\Local\Temp\Unicorn-18783.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18783.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18783.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18783.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41149.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41149.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 5460 -ip 5460

C:\Users\Admin\AppData\Local\Temp\Unicorn-47926.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47926.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 2112 -ip 2112

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 4616 -ip 4616

C:\Users\Admin\AppData\Local\Temp\Unicorn-45617.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45617.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26483.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26483.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 1068 -ip 1068

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 3468 -ip 3468

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5964 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 2444 -ip 2444

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 2424 -ip 2424

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 3932 -ip 3932

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 2584 -ip 2584

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 5140 -ip 5140

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1020 -ip 1020

C:\Users\Admin\AppData\Local\Temp\Unicorn-1808.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1808.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 5428 -ip 5428

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5428 -s 636

C:\Users\Admin\AppData\Local\Temp\Unicorn-14060.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14060.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9976.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9976.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40703.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40703.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44787.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44787.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14444.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14444.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 1104 -ip 1104

C:\Users\Admin\AppData\Local\Temp\Unicorn-51969.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51969.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6852.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6852.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53915.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53915.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17159.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17159.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 5652 -ip 5652

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 5672 -ip 5672

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 1412 -ip 1412

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 2708 -ip 2708

C:\Users\Admin\AppData\Local\Temp\Unicorn-17543.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17543.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17543.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17543.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48269.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48269.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48269.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48269.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2632 -ip 2632

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 5656 -ip 5656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5652 -s 752

C:\Users\Admin\AppData\Local\Temp\Unicorn-27465.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27465.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1014.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1014.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27657.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27657.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50215.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50215.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50215.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50215.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5672 -s 736

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 4608 -ip 4608

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 4804 -ip 4804

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 4228 -ip 4228

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 5660 -ip 5660

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 5572 -ip 5572

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 5452 -ip 5452

C:\Users\Admin\AppData\Local\Temp\Unicorn-50407.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50407.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 4424 -ip 4424

C:\Users\Admin\AppData\Local\Temp\Unicorn-61844.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61844.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 5556 -ip 5556

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 3416 -ip 3416

C:\Users\Admin\AppData\Local\Temp\Unicorn-9950.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9950.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 5716 -ip 5716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 5196 -ip 5196

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 2984 -ip 2984

C:\Users\Admin\AppData\Local\Temp\Unicorn-64366.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64366.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64366.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64366.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 4848 -ip 4848

C:\Users\Admin\AppData\Local\Temp\Unicorn-64366.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64366.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26671.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26671.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26671.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26671.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 4284 -ip 4284

C:\Users\Admin\AppData\Local\Temp\Unicorn-6058.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6058.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 3272 -ip 3272

C:\Users\Admin\AppData\Local\Temp\Unicorn-55259.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55259.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57973.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57973.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 4892 -ip 4892

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 5984 -ip 5984

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 6064 -ip 6064

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 3972 -ip 3972

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 2220 -ip 2220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 1072 -ip 1072

C:\Users\Admin\AppData\Local\Temp\Unicorn-54273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62441.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62441.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41637.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41637.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 5232 -ip 5232

C:\Users\Admin\AppData\Local\Temp\Unicorn-54657.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54657.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28015.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28015.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19847.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19847.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 2344 -ip 2344

C:\Users\Admin\AppData\Local\Temp\Unicorn-3318.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3318.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 3356 -ip 3356

C:\Users\Admin\AppData\Local\Temp\Unicorn-13624.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13624.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 5712 -ip 5712

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 4292 -ip 4292

C:\Users\Admin\AppData\Local\Temp\Unicorn-13432.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13432.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 3760 -ip 3760

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 3360 -ip 3360

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 2348 -ip 2348

C:\Users\Admin\AppData\Local\Temp\Unicorn-39259.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39259.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 2408 -ip 2408

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 1444 -ip 1444

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 4024 -ip 4024

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 4748 -ip 4748

C:\Users\Admin\AppData\Local\Temp\Unicorn-16531.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16531.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 3696 -ip 3696

C:\Users\Admin\AppData\Local\Temp\Unicorn-24507.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24507.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59317.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59317.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 4180 -ip 4180

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 1400 -ip 1400

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 6076 -ip 6076

C:\Users\Admin\AppData\Local\Temp\Unicorn-55809.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55809.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35943.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35943.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1133.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1133.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 1924 -ip 1924

C:\Users\Admin\AppData\Local\Temp\Unicorn-39281.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39281.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4470.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4470.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-386.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-386.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 5284 -ip 5284

C:\Users\Admin\AppData\Local\Temp\Unicorn-194.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-194.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 5216 -ip 5216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5596 -ip 5596

C:\Users\Admin\AppData\Local\Temp\Unicorn-56001.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56001.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 5628 -ip 5628

C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5468 -ip 5468

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 640

C:\Users\Admin\AppData\Local\Temp\Unicorn-31845.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31845.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5464 -ip 5464

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5284 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 1804 -ip 1804

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 5520 -ip 5520

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5628 -s 636

C:\Users\Admin\AppData\Local\Temp\Unicorn-59042.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59042.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13370.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13370.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13370.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13370.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13370.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13370.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5224 -ip 5224

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5536 -ip 5536

C:\Users\Admin\AppData\Local\Temp\Unicorn-52841.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52841.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5778.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5778.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15893.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15893.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11808.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11808.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 3104 -ip 3104

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 1176 -ip 1176

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 4308 -ip 4308

C:\Users\Admin\AppData\Local\Temp\Unicorn-34175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65477.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65477.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 3284 -ip 3284

C:\Users\Admin\AppData\Local\Temp\Unicorn-32613.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32613.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48949.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48949.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 6080 -ip 6080

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 4080 -ip 4080

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5224 -s 752

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 2548 -ip 2548

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 1944 -ip 1944

C:\Users\Admin\AppData\Local\Temp\Unicorn-59639.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59639.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59639.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59639.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35135.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35135.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5236 -ip 5236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 3644 -ip 3644

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5828 -ip 5828

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5068 -ip 5068

C:\Users\Admin\AppData\Local\Temp\Unicorn-8876.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8876.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 4036 -ip 4036

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 5988 -ip 5988

C:\Unicorn-10822.exe

\Unicorn-10822.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 2644 -ip 2644

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 4492 -ip 4492

C:\Users\Admin\AppData\Local\Temp\Unicorn-38041.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38041.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 1628 -ip 1628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 452 -ip 452

C:\Users\Admin\AppData\Local\Temp\Unicorn-25405.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25405.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 5252 -ip 5252

C:\Users\Admin\AppData\Local\Temp\Unicorn-40925.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40925.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 5624 -ip 5624

C:\Users\Admin\AppData\Local\Temp\Unicorn-33957.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33957.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29873.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29873.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 1856 -ip 1856

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 3480 -ip 3480

C:\Users\Admin\AppData\Local\Temp\Unicorn-55529.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55529.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 5776 -ip 5776

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 1240 -ip 1240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 1612 -ip 1612

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 2584 -ip 2584

C:\Users\Admin\AppData\Local\Temp\Unicorn-61367.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61367.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1800 -ip 1800

C:\Users\Admin\AppData\Local\Temp\Unicorn-51829.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51829.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 216.58.204.74:443 chromewebstore.googleapis.com tcp
GB 216.58.204.74:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 74.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 209.143.182.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\Unicorn-9780.exe

MD5 35670fc4b17b2e4da3b94b68c5ac0418
SHA1 5cd442870b05a2f804eb0c756dda498ca3ea8c28
SHA256 b31b4f43ebba07f3b41f9d9979792c9b92008b8389c7e499fd032b90bdecc28a
SHA512 aaf3fba2b54c32773f11743f59aeceb8fb017b0ac09f4cb435e028d0122bb337f52657eada41522d4a609eba9d5f8b80a88a59ed60c692288cb86cc43bbbf332

C:\Users\Admin\AppData\Local\Temp\Unicorn-46283.exe

MD5 1f8f2414a2edcf2d8fc2862318bdd21e
SHA1 722c0fa3fac7716c8ffb299aa55e3ab3d3058981
SHA256 feae463f183200055afbd2a521edfc6ee9b2a2974edb5ab2ddbc87ea9494c4dc
SHA512 e4cdbe97a0b3a9a29f766df1f4fdf6abc699693d328102110e1581632cce7e77b194315c387c3e02a846f3d0cc7d12c5f567125dcd6e394a136766f1084d7b25

C:\Users\Admin\AppData\Local\Temp\Unicorn-10081.exe

MD5 88870c230c22a2637744ce9d2229d15e
SHA1 6b37a41875e09da825b2744065448a7d2fea862c
SHA256 25f08b7b4e6848f3ac05dd928c484a39be9fdcadcfe4f9d5003b8886f93b4f80
SHA512 050091349e7cb72fedd6981463f73f314d34cc5b362d62b3c5e6d3b05d94d198a725d10a75880ed87530bf3de73e1d0cecabb9f0166ef1fd00817846ed928f0e

C:\Users\Admin\AppData\Local\Temp\Unicorn-47243.exe

MD5 5f430036e9d8c09f9856dbce0f1d8957
SHA1 711a3274172df38385a3c1755915e1d80ddc8a1b
SHA256 e92c8c048bf95b3653c1b836e56d9036ef865926da14dcf96a043e458e72b5d2
SHA512 187eba93b428b173a9512bd784eeacd6f7db9a9a0b23de2ac0cf9563789e643e2c7108c618b62e2880372fcf5dd292dcc85045338ed09645edfe938285ce32af

C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe

MD5 6f121a2c89a1ad39362f1b3c05e6efa0
SHA1 1f51b23a919ddc88b1e7fbf1ae05a85e250dfe02
SHA256 9fb1cda247829ea0d14d483d71fd7d9a2019429abf58c2652e3c1d4791aed04a
SHA512 62e00d87926e289b9ea9c0451107bd54d7b5cea0b7f2c498fda56d218340dacc1f921797a944296ac731938bf3e9908406cb99426adbd2ad088351e6084a51f7

C:\Users\Admin\AppData\Local\Temp\Unicorn-36937.exe

MD5 f48c57c5ac70e78cfc709eff9fe783aa
SHA1 02443b2de0e3cc579620cfe0e095f3ae10f648a4
SHA256 4b368748ca6ef2d28e583bb5130ed6fabe445c8032f037539bf0b61b937f03ae
SHA512 b4e9eb8ad7d12299dc58b86ac44cfb81be53d22cfe1492e67dade4e835e77cc19794bcdc8d1e4654ebc87a617b4d4673bdeeab253690d24e712d007738be3a11

C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe

MD5 cf8311fbdb2d418412d880431869bc28
SHA1 0e48b530007c5fadc5953ec1d9cdcdf964b15e02
SHA256 b25a5e0a60cd5660d9b348ad6741061ad590a67ea5c63ec3898e7910c1f9f618
SHA512 2c7b14afe0926793235e8a07ab78e01f93f2562c810d4423051076a1c7b4691e8b5e8ada09c54efc43d7cbca5c65059818648f763451edbad9e0e39d3f50ee39

C:\Users\Admin\AppData\Local\Temp\Unicorn-59640.exe

MD5 8a8c272fe36fe7bbe7a7103cf91a4b72
SHA1 5393a6ae8cf4e556548c0366dc9929353cab2c0f
SHA256 6e3bb91cfc8112d9906e66f76c86f646f836645b40683a8aff07ca269914cf79
SHA512 b38410de4f2a4c993193f11660af67971e7f9308a5f67067e8ceab0483395cbca858159ac54ece3c8bb2e3b3283156249e5abf74298c39394068c6baa260f4b5

C:\Users\Admin\AppData\Local\Temp\Unicorn-36527.exe

MD5 a4071f5f57b5c38f43e2d8210f60a93d
SHA1 9780d35a9c59a864c9844e3cb4fb1a7fcf5ba768
SHA256 70341a4b80302f3229ff03cbdca5b2f90c492655bf4636311968b570c8d4f700
SHA512 8be6637379bce5f88f5985df03ee132b53e2153de08a3d415139439201590ce10bd180bf1de175c584a4179021ceeab61663512d3a5e750e3742a629920b2a2a

C:\Users\Admin\AppData\Local\Temp\Unicorn-42557.exe

MD5 42c772f1e635cf77af47ee484bc0cee3
SHA1 329cc4c17cf170041fab2767983efa56fcf42963
SHA256 d62570a103bf47ebf83935a5767f1ca617224a642551e07096deccfb90abc71c
SHA512 238cf352b39cebd7463583672979c2dfa45b1ce8f746bdbbaed69fc9a2e5cdaa1b796365b0c3e6cea7825b811aab80c2785bf4d2f82463750e67814ffa806308

C:\Users\Admin\AppData\Local\Temp\Unicorn-45250.exe

MD5 1f858c3db81ee420752adfdde3db4283
SHA1 3bccdf3657b12ce37512ffb4bbbb6eb7e7bdbec7
SHA256 e3c370b96e1ddfdb599ab958b7867ccb9595564e3e3049b56290a1141e8451cb
SHA512 f0fd140e58b239078832f6af608982d5d44531df97f12f7f2d0416bafc12f2cb0f6db0387039916207adf180db918566c2a3baaf99503f1284b9b1e2bda86e6e

C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe

MD5 0f61d9f4f41e77790b33dbf372ef1d98
SHA1 7a38cbbc2bb4dfba0dc663bc70c5160775badb51
SHA256 68a0d3febd9987e0d5c83a40993c8453bb3532fc6a31c2e00cc4743a69e5c76f
SHA512 eb54327ad0cb8e31b0248fa09e7dca04a3c7ab5b350317e3fb364e9cf8332eb970d25ce667673b424ec2f32ed524cede98919122c2feb9066a57cc30ba88b870

C:\Users\Admin\AppData\Local\Temp\Unicorn-24419.exe

MD5 5eb9e778b69cfe182194992e2ef980ac
SHA1 6cbbfa2e0fbfd6a4f48d630375e70ff47900512f
SHA256 3e560d728c41a581ba743bf37ee88977e0180504313e2caf8fb1bd511a2b7a99
SHA512 e244ca779a1ec0ac61f054e24728fbc3dfa7187211f077f0e3eddb1cf2f8d39762d002ee2d8fa0dbe8af85226db409ba36aa00a0e63b6c98388b82e256b71f6e

C:\Users\Admin\AppData\Local\Temp\Unicorn-60621.exe

MD5 ca231506eb6200f5cba086fd6c5a5b23
SHA1 ab8a870c18f0e10b0a4370c35171eb70043a9c86
SHA256 f76c0c21cc1f174fb365f3fa1f50921374599ccf5fc1bfe3a8d001a4dd02aefb
SHA512 b4360a64ecdeaedbc9f653bd967bd831dc1cd12c9144f23aafe62c176e5ee7d7a00b302a01909d16a735433285d7e1f39e977c2f31ee3a27ee1c2de76d83acfc

C:\Users\Admin\AppData\Local\Temp\Unicorn-21727.exe

MD5 4d40211d5afc8691025c0f3fcf7833f1
SHA1 accdc1e72f0b3a23551e029628a2a54197c0468a
SHA256 aceb8c03535683f3402efbff59ed07a8eb8dc62334bdef64ff6992029197e706
SHA512 95d509ad71cd09873f075c898dcb2af7a21676352c7cc05ef648443549337376e452ad6c947132fa72c1e670c48bfb476c8ad6ede6474bbb3f7e3db4eccb7da0

C:\Users\Admin\AppData\Local\Temp\Unicorn-7891.exe

MD5 7e8c6c423d0fbd953c3350769136a9c8
SHA1 99782569b708da8207b2ed4929cbea026d92fff6
SHA256 9b85fe92ae084af4ca06866c978331dd43796461b9b526c0a5d9e600c975f764
SHA512 73a737e6ac2a70073eb270645d1f6f3d40ea9a80a6317f937722d3362364ade4b3ae583918693b2134dcf0ab70cbb7b7ace693afea84ee74d463b1615d5ef10a

C:\Users\Admin\AppData\Local\Temp\Unicorn-38639.exe

MD5 d322af86db25b7579dda91b454b84e10
SHA1 a43682503035afea752db81e58e4b2747ad5862f
SHA256 0f2e3bb4f8eebca04dd930c5620de5b8bd0f6444022ac64f7527a4f4a846ad88
SHA512 8227cbffaebafaedf4ac3fdfbf0f4ffb0f4440c3658d0dc86835ec874deaf10c1cc82f5115a5b80a67539ec33479b578febc019d16787cf1819ee312dbe35a13

C:\Users\Admin\AppData\Local\Temp\Unicorn-61197.exe

MD5 5eb34d694e6b60e8e5dfaaacc95a33d9
SHA1 3b51c2ca3d5bba64f6fcbbc66010e8fa77db9916
SHA256 b90df81e50269bda872401e671cb19e0d23d9c0d009c2444b28c3846a82bfb87
SHA512 49182977012e50c2aaa4e8c0bc51329362f459e1105a52d556881a7bd0c8e9d80d18be7a0096bb8846fc62dc9dfeb37d149f88abb5d70897b552ad91d98c2aba

C:\Users\Admin\AppData\Local\Temp\Unicorn-59614.exe

MD5 4c9cbf443a5d8e246ed6d368713ee8bb
SHA1 1fc902cc8adbb094ab0b126360543fb2558da752
SHA256 cd64767ed3e8fd3da7c4c7459c6139b130f2e0fb7abcac85e30f4569e13f3c01
SHA512 bfdea7e848ffea53167478509efb143712bff30e6fad04445843faa6899a592d7a2aa50b8fd9ee07b2d502508a5347d86473c293bbdc80f72f9ee4c86939cbdd

C:\Users\Admin\AppData\Local\Temp\Unicorn-18603.exe

MD5 bce55280bb45bd5514f614709ebdb1f9
SHA1 01505d8f16f42220cf79ce8599bde426170f5c6c
SHA256 a4cae1971bf002d54ba22e07767276f33ec2ecb506b28fc7bdfb86698dd054f1
SHA512 cf2b518f4a26a1dd7528368983781ced201bd909d8c4c5ac6ace01fc30ccaf2fee2fce0a716cee37ec5cce682cec165e4ab7d0c6956f30621d5c72ca905d7ce7

C:\Users\Admin\AppData\Local\Temp\Unicorn-35685.exe

MD5 24c05ebb56b02d5721980de0b6bbea44
SHA1 8a594e237ef309b3e67a0ab1561efa50f60623e8
SHA256 5ac4b038f4e594be3f4ba88930bffd81fb9b3efd12213d208cc63ed9c1b2b02b
SHA512 f6d0240af50dc8689a30f9630dcbc689e66270bf623a11b445b6d02f4c502d2545010188c789430d8fa4469b69dbc0bf8425f5aed6483a70ded79b9b23b623a5

C:\Users\Admin\AppData\Local\Temp\Unicorn-31623.exe

MD5 d134324dc525258a4539d3cf6cd99da3
SHA1 ddc8ebc1d1b22d8ac9d4b96388096b96768d017e
SHA256 b5a63387b70c7e1896b791f00c6665e183f1a1598de1508dec38bc496024b19f
SHA512 a2dd59f47dd0ca348b998ee87066e17e5087250eabb8bc7d2a09d1572824081cadfdbe15f25b450bb121df123299ae461228257075b940d46b749960a6186c62

C:\Users\Admin\AppData\Local\Temp\Unicorn-58517.exe

MD5 a5acfb1fb147911b7c2916a373b64071
SHA1 bf313d11450327561dbf50e6a48bc15e6ec4e231
SHA256 07f95454475e81f530ca756e20366116a8b57ec3e33de5257980f79735a3c081
SHA512 cf3e74f91c28c728ad1cf13ca347ccf0625597e8549fdba17c9c82b37bd3d9e27e6f62aee60c03faa31011e9991aec802fcea1ab25ed5140904ea50e8d317509

C:\Users\Admin\AppData\Local\Temp\Unicorn-44127.exe

MD5 2bd9d98502dc48365d48f32c3bc3f992
SHA1 da77f10b380ee6464b5277c3cf455be195d967f8
SHA256 117be2bbe5e1c381a942be4e113628b6fb99d985763167b4560b2ba548aa693b
SHA512 16e80cc631fcfc5ef8a5c1c3d800bac25e96ed72e90ac7599530ac4cf10fe7e14e399826dcaf5212023367feea9275c14c759cfaee97df34526f1ac9f8d3ce2a

C:\Users\Admin\AppData\Local\Temp\Unicorn-7733.exe

MD5 45afce976503f686c552371127fdc9e3
SHA1 d89d86662a65ed10e226459b68da741d68389945
SHA256 51d0c0874c45fbdb9fbe550ba79897d7bafb84a730f45bd06537acec380467d2
SHA512 82c319a1b67f10ad3208e6acb5c05cf64d41b1b0da521faf23a889b8f6555bd046e5e05f83d137e8055a636a9ea73e20de039565c12cba87727acac21578979a

C:\Users\Admin\AppData\Local\Temp\Unicorn-39851.exe

MD5 f72ce928a48729e089f75fd0b019c31b
SHA1 3c5c8f568d7204ec55d19ca0849a80d1deb66dd4
SHA256 42d38e98f5b29fffc290637e92803555d6756a9f363c7b0877a8dbd11e8343e9
SHA512 f63fb2827f4ba0c1e258b61abad32c206e07c3b911de6f7b58b5a05eefc4e6a6ac6804173f1e9217773a2bcc0085a920bd0eec97e893a608ac356cbeb666fbe4

C:\Users\Admin\AppData\Local\Temp\Unicorn-22123.exe

MD5 9aa0beb38321f6054e3e47a01dddbddf
SHA1 49ce717cd217980ea422a176c15a1be4e3d7dbf9
SHA256 f5f12ffa3ae9c9b1ce423cc9ed35bad9e9d07ac4b158007c99db5fc854094ce3
SHA512 7af0a8f3a9a8af998712e2fbd75d29939da7811d215d39dd23579f63c6c2f0ce09b8efe4cdba6e391ccb141472b6e43f4b676a4a4ca3129023abf0b9a2c410b7

C:\Users\Admin\AppData\Local\Temp\Unicorn-55201.exe

MD5 47ed15853772d20e60b4543e4f6765fb
SHA1 224a40b6ac3ce87301f93436984087687f1c60e9
SHA256 76b7321b8bd553c4b6070c71aa9edbb90411ae9a972bf8f7d3eb80a8510a12fb
SHA512 06576d3e685fd6f5ae14a199e256f03842ac9d6b649dbd38a631b859113921e5847f92e5ec9d1989e61b564da5712a38b4231e85227a25125b81a94ea7eafd8d

C:\Users\Admin\AppData\Local\Temp\Unicorn-53618.exe

MD5 3c648467499a04d64b8f5e697c671000
SHA1 52e433cec758982e4e8a2821eb9a125be2a58e19
SHA256 d577454ecc26856d2588acb9614ce3ba8d1b2505c0e264aa6fe4d47fd920c6f5
SHA512 2a3cc0d4094de7743b6654e37a7b30661cfd3726f0ca13426219a8fd46fba1aa8726acd88e50374fa42c79430b31d4cbfd9e067d2d307f9bb1ac7fb94e1db84c

C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe

MD5 694ab087f8dd8183c8e05aff4cfc2160
SHA1 a989def178a4041109744b951197c5145b82357d
SHA256 51bda63306286fa108bc50bd38f61df9547a8284b86e85a86550abee6b021a14
SHA512 81bd7af520ae10e5449d961db879017f97810f7110875a60481bbd55973c12f3fcb8a92bf2985dd21c9b304f3c3e65fbd4d521aa0f0cb56fe5f5f8616eb02137

C:\Users\Admin\AppData\Local\Temp\Unicorn-10520.exe

MD5 197a0fb70eedf172f78f7fec4a659261
SHA1 04c88a893c0b503c3ac081bdc18869d3771edbf4
SHA256 537fe3009535b91501b7eedc332e97865376d0dc0281e62d4b0cad21d639c45a
SHA512 ca76d4eac89b15f9e7e42ec98f25774961f23d96e6ea78070a772c2d8b7655451054e9f6dd974ebb62f16728e111277a245d31982376444ede4210eb257ba2fe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8958.exe

MD5 01d89993bc814e1f6f43306b45e2ad94
SHA1 9bef674f5acf03bf4243302f5e0ad0a1fb251c8b
SHA256 7d6f5b1ee836ed9f9436b28aeb66a9a25a73bd42f0e5f5b90aaf3e4f0c2a714f
SHA512 2101f2953165f9a40ff63891861f307ae15f518b7eceb79a35e47e0bf3f5efe2568948966c078fb5a8ca5ca78a78bcc24e59e107427cc6d63bb61f47ac357f43

C:\Users\Admin\AppData\Local\Temp\Unicorn-61579.exe

MD5 e22c908ea8ea22b626b582f6c3602c2d
SHA1 9995627abd514ca792ae34e661fbac0eb6849f8e
SHA256 c93a300d36fa4010fe10ee9383e033233dad71068cc9f5c1f31633c4c62b6bc4
SHA512 869a8ba080ff17d3e9434a130e90a654f903f322a22820df2ea024e41c0c4ff4bd09361266faabfb1b3b14deac50ba10483502ecbc2aac7227d2f93f9ebdfff5

C:\Users\Admin\AppData\Local\Temp\Unicorn-39571.exe

MD5 2bc6557dc935345a0f03837e83a957d1
SHA1 73fc84648991b3d7e03632d24954a46461b9dcd9
SHA256 d57a64513895708ec9f653351cfbab2e61db30067de8efdc4affdf2a29b0d5c7
SHA512 8e7fbda7d92f0c916cd2eee852265f6f29daf09bf430ebbeb1f856ac65e2a1addb995f80dc528c5a19a5c11c5c6c5deb478ccbd637c5c821a950b4c637676ed9

C:\Users\Admin\AppData\Local\Temp\Unicorn-35135.exe

MD5 39552dd9cacadac971436948ce6ee271
SHA1 85cb8e7f1fdd9fa5d378d1fa76107dbd6d363f46
SHA256 47d3b2a1d7843c0cf8a98413d735534d4b91e65a178d092333146c2377fb2031
SHA512 fb6b77051dc10668788a8a4323f47adfb038a47d220995e434097d64037ea973440018b69ff8b3897e5130bcfce861ac569c03ae339e693e79dc198985b5713b