Malware Analysis Report

2025-01-17 22:38

Sample ID 240603-pxd93sgb52
Target a3cbcf6789537206564620d9055794b0_NeikiAnalytics.exe
SHA256 2bbacd9962856d33bc1564cd5ae0c1a0f5146f74fa2b7eff6181caa0774ba8c6
Tags
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

2bbacd9962856d33bc1564cd5ae0c1a0f5146f74fa2b7eff6181caa0774ba8c6

Threat Level: Shows suspicious behavior

The file a3cbcf6789537206564620d9055794b0_NeikiAnalytics.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary


Executes dropped EXE

Loads dropped DLL

Unsigned PE

Program crash

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-03 12:42

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 12:42

Reported

2024-06-03 12:44

Platform

win7-20240221-en

Max time kernel

150s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a3cbcf6789537206564620d9055794b0_NeikiAnalytics.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15746.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32828.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29041.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33125.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50208.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34516.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38600.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18734.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55683.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1817.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5901.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46934.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51573.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51018.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35236.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-39320.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59186.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37225.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21443.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20889.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5107.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24973.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33141.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33141.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53924.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-8252.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53924.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5787.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9871.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63711.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38268.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46436.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6150.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13763.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34546.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1127.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22294.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1874.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21740.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25824.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58174.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27251.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6830.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-52502.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63130.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64754.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-39311.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34158.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17822.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2040.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38988.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47157.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33966.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58662.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58662.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58662.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46965.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a3cbcf6789537206564620d9055794b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a3cbcf6789537206564620d9055794b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a3cbcf6789537206564620d9055794b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a3cbcf6789537206564620d9055794b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32828.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32828.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15746.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15746.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33125.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33125.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15746.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15746.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29041.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29041.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32828.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32828.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50208.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50208.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55683.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55683.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18734.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50208.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50208.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18734.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38600.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38600.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29041.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29041.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34516.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33125.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34516.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33125.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\a3cbcf6789537206564620d9055794b0_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32828.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15746.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33125.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29041.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-50208.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55683.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18734.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38600.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34516.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1817.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-51573.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-46934.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-5901.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59186.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-39320.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-51018.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34546.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37225.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-21443.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-5107.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20889.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33141.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24973.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53924.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-8252.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53924.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33141.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34712.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9871.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-5787.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63711.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38268.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-46436.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-13763.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22294.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25824.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-21740.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-58174.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38076.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6150.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1874.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6830.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27251.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34158.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-2040.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42326.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-47622.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63130.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38988.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64754.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-52502.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-2972.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-51049.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-58662.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-39311.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31369.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19117.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44368.exe

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a3cbcf6789537206564620d9055794b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32828.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15746.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29041.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33125.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50208.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18734.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34516.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55683.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38600.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1817.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5901.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51573.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46934.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-39320.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51018.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59186.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37225.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21443.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20889.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5107.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24973.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33141.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33141.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53924.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53924.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-8252.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5787.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9871.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63711.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38268.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46436.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6150.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13763.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34546.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22294.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21740.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1874.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25824.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58174.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27251.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-52502.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6830.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63130.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64754.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-39311.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34158.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17822.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38988.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2040.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47157.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33966.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58662.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58662.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58662.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46965.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51049.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2868 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\a3cbcf6789537206564620d9055794b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe
PID 2868 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\a3cbcf6789537206564620d9055794b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe
PID 2868 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\a3cbcf6789537206564620d9055794b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe
PID 2868 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\a3cbcf6789537206564620d9055794b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe
PID 2944 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15746.exe
PID 2944 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15746.exe
PID 2944 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15746.exe
PID 2944 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15746.exe
PID 2868 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\a3cbcf6789537206564620d9055794b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32828.exe
PID 2868 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\a3cbcf6789537206564620d9055794b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32828.exe
PID 2868 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\a3cbcf6789537206564620d9055794b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32828.exe
PID 2868 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\a3cbcf6789537206564620d9055794b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32828.exe
PID 2868 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\a3cbcf6789537206564620d9055794b0_NeikiAnalytics.exe C:\Windows\SysWOW64\WerFault.exe
PID 2868 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\a3cbcf6789537206564620d9055794b0_NeikiAnalytics.exe C:\Windows\SysWOW64\WerFault.exe
PID 2868 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\a3cbcf6789537206564620d9055794b0_NeikiAnalytics.exe C:\Windows\SysWOW64\WerFault.exe
PID 2868 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\a3cbcf6789537206564620d9055794b0_NeikiAnalytics.exe C:\Windows\SysWOW64\WerFault.exe
PID 2644 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32828.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29041.exe
PID 2644 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32828.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29041.exe
PID 2644 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32828.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29041.exe
PID 2644 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32828.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29041.exe
PID 2972 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15746.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33125.exe
PID 2972 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15746.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33125.exe
PID 2972 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15746.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33125.exe
PID 2972 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15746.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33125.exe
PID 2944 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-50208.exe
PID 2944 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-50208.exe
PID 2944 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-50208.exe
PID 2944 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-50208.exe
PID 2944 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe C:\Windows\SysWOW64\WerFault.exe
PID 2944 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe C:\Windows\SysWOW64\WerFault.exe
PID 2944 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe C:\Windows\SysWOW64\WerFault.exe
PID 2944 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe C:\Windows\SysWOW64\WerFault.exe
PID 2948 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33125.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34516.exe
PID 2948 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33125.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34516.exe
PID 2948 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33125.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34516.exe
PID 2948 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33125.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34516.exe
PID 2972 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15746.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18734.exe
PID 2972 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15746.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18734.exe
PID 2972 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15746.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18734.exe
PID 2972 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15746.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18734.exe
PID 2560 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29041.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38600.exe
PID 2560 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29041.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38600.exe
PID 2560 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29041.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38600.exe
PID 2560 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29041.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38600.exe
PID 2644 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32828.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55683.exe
PID 2644 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32828.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55683.exe
PID 2644 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32828.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55683.exe
PID 2644 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32828.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55683.exe
PID 2444 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50208.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe
PID 2444 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50208.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe
PID 2444 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50208.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe
PID 2444 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50208.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe
PID 2644 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32828.exe C:\Windows\SysWOW64\WerFault.exe
PID 2644 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32828.exe C:\Windows\SysWOW64\WerFault.exe
PID 2644 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32828.exe C:\Windows\SysWOW64\WerFault.exe
PID 2644 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32828.exe C:\Windows\SysWOW64\WerFault.exe
PID 2972 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15746.exe C:\Windows\SysWOW64\WerFault.exe
PID 2972 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15746.exe C:\Windows\SysWOW64\WerFault.exe
PID 2972 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15746.exe C:\Windows\SysWOW64\WerFault.exe
PID 2972 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15746.exe C:\Windows\SysWOW64\WerFault.exe
PID 1772 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1817.exe
PID 1772 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1817.exe
PID 1772 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1817.exe
PID 1772 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1817.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a3cbcf6789537206564620d9055794b0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\a3cbcf6789537206564620d9055794b0_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15746.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15746.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32828.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32828.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-29041.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29041.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33125.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33125.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50208.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50208.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-34516.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34516.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18734.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18734.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38600.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38600.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55683.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55683.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-1817.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1817.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5901.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5901.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46934.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46934.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51573.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51573.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51018.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51018.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35236.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35236.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59186.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59186.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39320.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39320.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-37225.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37225.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21443.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21443.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20889.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20889.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5107.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5107.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24973.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24973.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33141.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33141.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33141.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33141.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53924.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53924.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53924.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53924.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8252.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8252.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-5787.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5787.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9871.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9871.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63711.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63711.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38268.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38268.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46436.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46436.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6150.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6150.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13763.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13763.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34546.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34546.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1127.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1127.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38076.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38076.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38076.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38076.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22294.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22294.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1874.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1874.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21740.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21740.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25824.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25824.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58174.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58174.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1416 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1004 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 596 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-27251.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27251.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6830.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6830.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52502.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52502.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63130.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63130.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64754.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64754.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39311.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39311.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34158.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34158.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17822.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17822.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2040.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2040.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38988.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38988.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47157.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47157.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33966.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33966.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58662.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58662.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58662.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58662.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58662.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58662.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46965.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46965.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51049.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51049.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42326.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42326.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46410.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46410.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-30628.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30628.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34712.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34712.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54578.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54578.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47622.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47622.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55790.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55790.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40008.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40008.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-2972.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2972.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52728.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52728.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-31369.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31369.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-15032.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15032.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19117.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19117.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-44368.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44368.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-35261.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35261.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23563.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23563.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10756.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10756.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51789.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51789.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59957.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59957.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59957.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59957.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41435.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41435.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20631.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20631.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24715.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24715.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15993.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15993.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52941.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52941.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-19885.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19885.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19885.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19885.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23969.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23969.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49220.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49220.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11716.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11716.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32883.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32883.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31945.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31945.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36029.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36029.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36029.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36029.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40113.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40113.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44197.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44197.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3911.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3911.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23777.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23777.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44944.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44944.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7995.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7995.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7995.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7995.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64809.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64809.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11524.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11524.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57196.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57196.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48473.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48473.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32691.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32691.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52557.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52557.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36775.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36775.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-41156.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41156.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-25374.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25374.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45240.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45240.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 888 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-33948.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33948.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38032.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38032.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26334.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26334.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26334.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26334.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29480.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29480.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-891.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-891.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54176.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54176.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13890.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13890.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33756.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33756.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28603.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28603.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62707.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62707.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53470.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53470.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4269.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4269.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-57959.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57959.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17119.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17119.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57767.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57767.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 288 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-41431.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41431.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29179.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29179.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49962.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49962.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12458.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12458.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37709.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37709.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61659.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61659.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33071.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33071.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41239.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41239.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28987.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28987.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18597.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18597.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50715.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50715.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30295.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30295.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9874.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9874.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54607.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54607.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62775.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62775.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1322.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1322.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42355.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42355.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30657.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30657.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6153.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6153.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10237.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10237.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10237.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10237.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9682.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9682.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9682.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9682.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46802.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46802.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1130.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1130.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-29911.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29911.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9490.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9490.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34357.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34357.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54223.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54223.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-2282.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2282.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63413.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63413.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-13273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13273.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-13081.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13081.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-26678.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26678.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2173.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2173.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-42630.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42630.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-5873.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5873.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38354.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38354.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32084.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32084.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15556.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15556.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3304.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3304.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-15364.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15364.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-38053.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38053.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21717.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21717.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-39397.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39397.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-52396.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52396.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-55925.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55925.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31037.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31037.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-6532.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6532.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-18593.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18593.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-43289.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43289.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26569.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26569.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10232.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10232.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10232.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10232.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59433.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59433.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64861.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64861.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 880 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-15468.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15468.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-56501.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56501.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 608 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-7191.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7191.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-2915.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2915.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-27612.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27612.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27612.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27612.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10891.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10891.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19060.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19060.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-6807.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6807.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47840.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47840.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-56008.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56008.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-22952.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22952.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-43564.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43564.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27228.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27228.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31312.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31312.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-16128.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16128.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7959.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7959.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53076.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53076.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28572.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28572.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52884.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52884.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32464.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32464.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11659.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11659.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56776.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56776.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28188.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28188.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28188.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28188.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32272.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32272.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23720.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23720.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48416.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48416.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48416.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48416.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27996.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27996.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49724.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49724.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61976.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61976.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37472.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37472.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-33087.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33087.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16751.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16751.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-50554.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50554.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54638.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54638.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-13688.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13688.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-41146.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41146.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-9817.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9817.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-25578.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25578.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-58442.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58442.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3784 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-6309.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6309.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42189.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42189.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-13216.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13216.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3668 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-63377.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63377.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55017.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55017.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-56169.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56169.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-60253.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60253.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60253.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60253.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-52085.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52085.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-19029.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19029.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60061.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60061.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3616 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3820 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-17576.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17576.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62692.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62692.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50440.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50440.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-27244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27244.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-19076.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19076.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2355.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2355.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3508 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-43388.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43388.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-10715.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10715.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3280 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51364.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51364.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39112.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39112.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39112.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39112.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1971.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1971.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47088.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47088.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51172.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51172.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55256.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55256.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14415.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14415.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19652.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19652.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41032.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41032.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16528.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16528.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52023.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52023.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-27519.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27519.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-65022.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65022.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-3014.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3014.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3972 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-44218.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44218.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24949.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24949.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20311.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20311.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28287.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28287.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61706.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61706.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3782.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3782.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48515.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48515.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36263.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36263.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20289.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20289.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65406.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65406.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60767.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60767.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57835.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57835.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4056 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-4249.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4249.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49174.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49174.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-61426.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61426.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62386.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62386.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29330.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29330.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14145.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-41665.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41665.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5444 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5776 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5488 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4220 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5536 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5396 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5412 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5260 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5384 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5476 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5500 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-31079.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31079.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5572 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-15703.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15703.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5376 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-64519.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64519.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5288 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5804 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5620 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-39330.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39330.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36014.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36014.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4128 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-65225.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65225.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58401.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58401.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-54125.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54125.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5172 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5132 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-49657.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49657.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29237.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29237.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-923.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-923.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61992.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61992.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61992.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61992.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4623.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4623.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54784.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54784.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54784.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54784.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42148.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42148.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25812.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25812.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41956.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41956.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19350.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19350.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63336.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63336.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18495.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18495.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26663.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26663.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22387.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22387.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6004 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-47275.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47275.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6032 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-35454.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35454.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35262.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35262.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10373.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10373.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6289.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6289.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39154.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39154.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55298.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55298.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30794.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30794.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6112 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-40306.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40306.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11333.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11333.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15417.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15417.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63466.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63466.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23394.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23394.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64426.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64426.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52174.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52174.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15033.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15033.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31562.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31562.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5408 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-11909.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11909.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15994.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15994.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15994.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15994.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2672.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2672.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31261.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31261.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5188 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-44281.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44281.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44281.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44281.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48365.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48365.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41541.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41541.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12952.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12952.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52895.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52895.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5796 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-24520.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24520.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33050.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33050.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5676 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5844 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6052 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6068 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6216 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5820 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5700 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6332 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6188 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-14187.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14187.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20903.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20903.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6760 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6728 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6544 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5616 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6180 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6304 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6736 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6964 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5852 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-47950.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47950.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23446.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23446.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18978.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18978.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7100 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6644 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6992 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7044 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6244 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6792 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-7685.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7685.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6972 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6908 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6840 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-6424.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6424.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6356 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6604 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-26653.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26653.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7020 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7072 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-48417.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48417.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7032 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6832 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6556 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7068 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7084 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6712 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6596 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6636 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6532 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6756 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6588 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6212 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6624 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7248 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7204 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7416 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7320 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7284 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7472 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7432 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7544 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8332 -s 200

C:\Users\Admin\AppData\Local\Temp\Unicorn-57740.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57740.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9691.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9691.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15228.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15228.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35841.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35841.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53329.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53329.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24357.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24357.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44969.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44969.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39370.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39370.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63490.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63490.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56666.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56666.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61113.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61113.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64642.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64642.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27502.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27502.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2997.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2997.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11165.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11165.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27310.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27310.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10973.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10973.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28654.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28654.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32546.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32546.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29339.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29339.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20979.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20979.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-558.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-558.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22323.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22323.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42359.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42359.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50719.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50719.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54803.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54803.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47595.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47595.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47595.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47595.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47403.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47403.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51679.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51679.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24736.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24736.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28820.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28820.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46479.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46479.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5083.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5083.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8144 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-36433.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36433.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20097.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20097.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27881.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27881.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40495.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40495.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8228 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9432 -s 200

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8608 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8636 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9172 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8752 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9472 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-6557.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6557.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10208 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9188 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9004 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-20455.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20455.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8632 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9324 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-25691.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25691.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8356 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9284 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9080 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9860 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9196 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8604 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8968 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9228 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9720 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8616 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9400 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9940 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10168 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9512 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9948 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9440 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10100 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9888 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-53724.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53724.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53724.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53724.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24752.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24752.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9384 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-29713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29713.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9816 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-51477.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51477.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8292 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9340 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-19573.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19573.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60221.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60221.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14912.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14912.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4689.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4689.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10032 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-29194.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29194.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10200 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-17902.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17902.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9792 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9968 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-59702.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59702.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9612 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10084 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9704 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-26584.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26584.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55364.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55364.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48540.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48540.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32396.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32396.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-792.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-792.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9996 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9692 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9756 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-9536.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9536.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9820 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10128 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-2328.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2328.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9740 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9256 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9840 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9688 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9748 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9300 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9252 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10604 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10544 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10912 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-57445.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57445.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 12112 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-50237.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50237.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62681.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62681.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58021.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58021.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10852 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10972 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-53034.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53034.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10576 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10752 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-51519.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51519.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 11916 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-36719.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36719.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48779.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48779.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48587.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48587.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12515.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12515.exe

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe

MD5 287dc354768c7e40a36635dc91ebd7b0
SHA1 3680e970bb2b872575acd179952b2c6ee631d84f
SHA256 5e7fe2e46fcc12d5458e2601ce0989ccf0d26b5ef275cab6b86c8aec4f1c57cb
SHA512 9c85b6b924f97697b6cf67daf9f9c571d608b3a972552178d693031719091830471987c916ff240cd2d5295c534abbc81572c3ec13fe58df14beb4a1d637b200

\Users\Admin\AppData\Local\Temp\Unicorn-15746.exe

MD5 3442651c4da593d1e211ef9a97fe1d9a
SHA1 eac55d5b68eed2e616f09011cb6046fcb3e56e90
SHA256 08bdaa24dc77aa0be4a2556b4a93b8d355890bebde4ea6c20cb9b895413786bd
SHA512 0f3d04535887f7c4e9ace3ee4bc2ba7ef46a9e8c15f4b2e1e560efa5039e6d00f8c86e85cb0675426dd37e88143f7076a1d87b69644e8d9ec10fd07752acae7f

\Users\Admin\AppData\Local\Temp\Unicorn-32828.exe

MD5 eca2b7c001f8a2bb78cc70f602166576
SHA1 4dbebb46658c3bb85d222fc2522876a9207dad73
SHA256 3dad20df9a47ef0d60274cffaa39379c530ba9d3357c957a2f95f73973968b48
SHA512 9f3100555bf668f1fee383532699c5fc33df9cd7ab9822d8a54ac65085d16de85047988f00d396e8e761572a94a0c16165224eafe7d8ea7e88fbab0524e0cb2f

\Users\Admin\AppData\Local\Temp\Unicorn-29041.exe

MD5 fd8217890a800783b66e0b6c19f8bbc1
SHA1 d492eb46465351b23bc382a2c82f7edad737d855
SHA256 ff1e2216f614c3a12a162c009cf69ddc3659e85c48f7848cbbe6617801cf08a8
SHA512 83c41dac9f10e8472238df89ebe10466fab3bb58eaa064e69bcd4fac498ffabb30df6dc3d156ba9cb14e30fffaf7b37f40ff89cc18bede7eb3f2af928fd5bf61

\Users\Admin\AppData\Local\Temp\Unicorn-33125.exe

MD5 88d9b2b832d2de25df22733684c02b47
SHA1 9bd574a5a97d8bde85ae549587280c2ca5656714
SHA256 1d1da439bb33bba43d45abbdae21afcef8c10bbb0a3f9135022ab594bdcee882
SHA512 d78b720d4628a9074f0654ffbf52e3973795526a0736f5192993212d26d11deab1b6f7defb71a6e8e8f405c3b96db3f6bca1c4b46352243505b7e914dece4c51

\Users\Admin\AppData\Local\Temp\Unicorn-50208.exe

MD5 a4640aca5ecd165d74829fb257191df6
SHA1 82c7b38aadd8e4dcc9725dad63eab387098bea08
SHA256 e791b37406eb77d9a50b0df0b6d040b51f7e5f2d15cc69429a9ac25daa3291dd
SHA512 4dd5ddb7bc41e3bc7f425c1feedf71b8797bc722d17246d272b12c1e6ab1d6875a0ca2038d6b62a5f6ec03f84df15ceb925492d62daa206fbc4215f3fbcb4aec

\Users\Admin\AppData\Local\Temp\Unicorn-34516.exe

MD5 45f229c8c504f8190ad9598efd5d9fd3
SHA1 b990d68a6f5237f91dde264dd885be969d42391d
SHA256 c01404acbab12a3962481802cdac86ad8234a202c7d2f72e322e5750e80f776c
SHA512 52f3c48e806fdf874f6d26abd82780a5f2e1ff782c89cf3b5d9af2ff5c08ab592151ff003c65c345efa879aa633a0cfc87061bba0faaad82d1260a3ffd00c253

\Users\Admin\AppData\Local\Temp\Unicorn-18734.exe

MD5 d26103ed8cb94cf006d28450bc026f1a
SHA1 63b71f63f2137214ccb8c94e1aeaf32a043a7fdf
SHA256 014416db1bd9c7754533f640d91876821053aee7d1d378b1be6178ea07332a0b
SHA512 8a90fd308993a94e95f4d24e01091757546ce295b065f6d63abb480d69b15d431c4d3ae378fe222989112ee190f6e74b64a6e4f49118c9ec0ab8512d8233eaa1

\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe

MD5 8296e35fddf4ecc745a2940310e1c911
SHA1 ff6dcb22d7cc8e437c77df1d7904d7a7f35f1e44
SHA256 a315f5c9c929d80319c044eb98f9209791855129cdf39c727c66af56339961e7
SHA512 c8cf149d42e19d86edb578638c357da4ff2b5ecd5c1852e26669d2114447a2c0dd6383a19917a6f5d31a8ef2b03779f2ad8cb86286c831b1dda68b8435669a58

C:\Users\Admin\AppData\Local\Temp\Unicorn-55683.exe

MD5 47575cf828f1a8070f9d97e0dc2e6bbb
SHA1 1d88fd49831da299ab86005b37f602811ed02e60
SHA256 3d404d872e63a01d5094139e188189153caba5cc5a4848a317eea5b5a4d8d099
SHA512 70d7665c13b515b01579ff63e97be617b3bc3a98adc903daf6f329d48c3b2153f57f7691401f2f974be0e77b9f80a3b9c84413d43439f562a195176fb4895974

C:\Users\Admin\AppData\Local\Temp\Unicorn-38600.exe

MD5 ca57a1ffb661fa51d2008a7458d7d87b
SHA1 2967770fc03e06cf1098fedbd1646b1c5124ca2e
SHA256 e37c466083b852a4e781258434fbabe0966c3a8c15b086629c95df64968d3003
SHA512 94bcbfba8f6e317400b88cb2af0c28461e81400cadc582ae73689e2197f22c886db5aad50ba92347d871b536d6aa4dcbc8feadfe81756ea6578c2dde7931863b

C:\Users\Admin\AppData\Local\Temp\Unicorn-1817.exe

MD5 70f32aa2e9aceb110c0ba12af29b2817
SHA1 ad250c18fd3f655741d326dcbb55e11920bda1d5
SHA256 5a7c6fabc24f07005933929abd313476bb5b6f9f4a737e6cc25a85e8b5b52c79
SHA512 af11c78f066650731d9bd25c41d66fbef3632c36bdbcf280b863a1b7d6a6c50f04ef8a0cf3e6e0cec5fd9c4963054a4da9fde35a1545c1571dc42a4dea849a2c

\Users\Admin\AppData\Local\Temp\Unicorn-5901.exe

MD5 63dbb0c0accd87a2a67db7d32f06e959
SHA1 118a69c0bf72f858f27c766b432b92bece182d6b
SHA256 d674f603dee557b64a2c8da006d7791b2d230fe8dff798ad646151f3e74a4985
SHA512 c352e98aaca1fab931d349ee382f37a4fee9e94d56842d282f10b3ef504ce768deae5f22f3596cf3641a086583374be24e121397951a4c0df0ffffbc70bb0c62

\Users\Admin\AppData\Local\Temp\Unicorn-46934.exe

MD5 e4fe2d1a89372aa11aced7a75d83d00d
SHA1 21c935ce89cba74335ae4468d021772c6d12fa1b
SHA256 a0c1c6dd360e9c5bf1e8abb47fcc1e35699f204e29ee76d09753baec0318dc26
SHA512 1bcf02aeaaf6d13b729c1aae9c072d7699476f9c31e310df2fe3cf17b52d2a742da11d247f6d1c8913f563ea0097f68bc60b03ab3262941ddf8c80f1ffbb2c25

C:\Users\Admin\AppData\Local\Temp\Unicorn-5787.exe

MD5 ed041039dab2d5082b8f4690b9c438e7
SHA1 899b9ae748fb02c3730ac1c9b9c1985bc0a7ad3d
SHA256 4e56799d9a5a47973c721151fb1fe1c671bcd434e79242077362958866194324
SHA512 f789a10102a0a5908aa42332c67ce6c9fa8f92eda3fc7460d02ba7134d1497f1aaf5d7bcd957c6e81f5ad2d5b6d8326f051f79d37af79df5c74c81a6f3415e45

C:\Users\Admin\AppData\Local\Temp\Unicorn-6830.exe

MD5 cc8a5b3ab6c6cae8df0a571c796c4f90
SHA1 855cd670a41f32a4a459dd70fb374d238f50bdcb
SHA256 cc094d8366041822ffefe42776be358ba9d6c5926733dedf544cc0083cfb1e4b
SHA512 4e4641583fe6228bc34b3ab0fd3f54e8593627c217feba7441f8c51d4fcee9c745cdfd5a496ce0ba80798ddaa4870556d425d6cefaaf0675a57bebb3bf89e2ce

C:\Users\Admin\AppData\Local\Temp\Unicorn-36775.exe

MD5 253798715d689e7d95f7ba55f1aac0e6
SHA1 9bdfbeb09696b9e2c5d3fb50e4e19214842fa38a
SHA256 5bb5e149bc02fa6f8382e78b05affc06cc7b9b99bde8dc0387b7cec1e1505e0f
SHA512 4495d5a5b8aa80285b5b78f5a958e2900b6ab6f172cc84dcce09f468f3ca003cbe948f3bf08f0d387e0402314c80c7e01cd50844702a20fd2feba09e97e57e7e

C:\Users\Admin\AppData\Local\Temp\Unicorn-2355.exe

MD5 400f73f6b04609bc9f2a831f91e0d9b2
SHA1 27c25277dcbae9283499f6388ab238183651e27c
SHA256 fb119e6618797d5143b93c7beee3168acf68b417d71285ae2000f4b78bd08e50
SHA512 a61d666dc5c067d622517a568dbd4298b5932af3c822d41be7e8305b66797439dc4aa7a7266fdcac379e6c88eb779cae4a6f8f9aec7b835ff40c4cbdc300cba6

C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe

MD5 523d5d37b229720032e58e73322f2bc2
SHA1 b7c4cc41968c52cb8ff2ed77495e79d00e9e7417
SHA256 55d712d60e4a571ad5547201ab2f65f969446dd7d41039cd6d05bbbfddaa3072
SHA512 8000d1ad7b4599cd2169e6efa3519a09b9a73a6fdebb55d8c5e862e954a6a4798b0ca96392276257814036687b4c2792b1762f347ffbf1f3ed3850bc30afc266

C:\Users\Admin\AppData\Local\Temp\Unicorn-22387.exe

MD5 fed0dc9615272694c27954483418557d
SHA1 2c0c5e5934361e8d4f08858f3d84cb0f3759dd7d
SHA256 e52891a9fe524aadc006db15860b0458e7282bc856754ba57088fdb9763abb0b
SHA512 d03821ed95301891312d39986a8bc7157a1042dde41d902d2afbd2dfa32a83c01ca4435f11210b2526726ce9be0c35e93406e3c2cad604edf72aa45649de464f

C:\Users\Admin\AppData\Local\Temp\Unicorn-51477.exe

MD5 a9f8538395cef0d366ade6a81cfe3787
SHA1 bb9391cfd19e87b8fc7fadc39345cb3b62bbc493
SHA256 4cc1177621fabd8c38b84f436e7fa705b2370138264a8be407696b9859bd5cc5
SHA512 729d61644bbb67fef2c42e7afdbf192b25c1904312679063816a0dc31d04a8480a43432d73ae7d4f8feb4216951bdadeddd0ef82590ab37737ea8340258609e5

C:\Users\Admin\AppData\Local\Temp\Unicorn-2328.exe

MD5 b1e6e01c475adfe8f25525f96353d901
SHA1 4c487a36bd1f136dcafa736d52863fc4034e44ad
SHA256 7e0ca47225b61d93db7915d5681c45c7b177b5c17f41a9679cc188c54d8235bf
SHA512 5421f669c0000a9c25917e6745b5b0d0043e31d924d785278774bd093832f3e6572306b3fbed3c428bebcd29158e31a2e7d0f7fe97d6d06f2c3e443b5a37d7e8

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-03 12:42

Reported

2024-06-03 12:44

Platform

win10v2004-20240426-en

Max time kernel

31s

Max time network

98s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a3cbcf6789537206564620d9055794b0_NeikiAnalytics.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50665.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32165.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53332.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44137.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32439.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35969.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13192.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1495.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54225.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33805.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58672.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33141.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57453.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24781.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57816.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12144.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-8060.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37395.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64609.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-28407.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36021.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2964.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3711.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15024.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2772.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-43805.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35637.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16369.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62040.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26901.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27669.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19309.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48089.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-28223.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32307.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-52173.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19117.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7419.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-40689.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-8571.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33267.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33267.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-41265.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-979.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33865.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22167.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1747.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13615.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23127.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54861.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63029.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63029.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-39677.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2920.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35401.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35401.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\a3cbcf6789537206564620d9055794b0_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-50665.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32165.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53332.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44137.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32439.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35969.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-13192.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1495.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54225.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-58672.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33141.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-8060.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37395.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24781.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12144.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64609.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-28407.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-36021.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-2964.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-3711.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-47876.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-62040.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-2772.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19309.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-28223.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7419.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48089.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-979.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35017.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-39677.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27403.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-50881.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25993.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-39485.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24213.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32167.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48696.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57269.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24317.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14472.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-2412.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64301.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55624.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-16637.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17073.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20965.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63637.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64021.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-13440.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-50005.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-28433.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19178.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12161.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-40366.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-16246.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-205.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44590.exe

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a3cbcf6789537206564620d9055794b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50665.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32165.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53332.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44137.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32439.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35969.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13192.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1495.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54225.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33805.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58672.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33141.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57453.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37395.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12144.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-8060.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24781.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57816.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64609.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-28407.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36021.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2964.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3711.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15024.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2772.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-43805.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62040.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35637.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16369.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26901.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27669.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19309.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48089.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32307.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-52173.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-28223.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7419.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19117.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-40689.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-8571.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33267.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33267.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-41265.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-979.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33865.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1747.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22167.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13615.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23127.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54861.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63029.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63029.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-39677.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2920.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3704 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\a3cbcf6789537206564620d9055794b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-50665.exe
PID 3704 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\a3cbcf6789537206564620d9055794b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-50665.exe
PID 3704 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\a3cbcf6789537206564620d9055794b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-50665.exe
PID 832 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50665.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32165.exe
PID 832 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50665.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32165.exe
PID 832 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50665.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32165.exe
PID 3704 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\a3cbcf6789537206564620d9055794b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53332.exe
PID 3704 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\a3cbcf6789537206564620d9055794b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53332.exe
PID 3704 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\a3cbcf6789537206564620d9055794b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53332.exe
PID 4444 wrote to memory of 3660 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32165.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44137.exe
PID 4444 wrote to memory of 3660 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32165.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44137.exe
PID 4444 wrote to memory of 3660 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32165.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44137.exe
PID 832 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50665.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32439.exe
PID 832 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50665.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32439.exe
PID 832 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50665.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32439.exe
PID 3968 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53332.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35969.exe
PID 3968 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53332.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35969.exe
PID 3968 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53332.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35969.exe
PID 3660 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44137.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-13192.exe
PID 3660 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44137.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-13192.exe
PID 3660 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44137.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-13192.exe
PID 4444 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32165.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1495.exe
PID 4444 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32165.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1495.exe
PID 4444 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32165.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1495.exe
PID 4240 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32439.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54225.exe
PID 4240 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32439.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54225.exe
PID 4240 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32439.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54225.exe
PID 2200 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35969.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33805.exe
PID 2200 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35969.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33805.exe
PID 2200 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35969.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33805.exe
PID 3968 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53332.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-58672.exe
PID 3968 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53332.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-58672.exe
PID 3968 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53332.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-58672.exe
PID 4680 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13192.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33141.exe
PID 4680 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13192.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33141.exe
PID 4680 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13192.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33141.exe
PID 3660 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44137.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe
PID 3660 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44137.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe
PID 3660 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44137.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe
PID 3656 wrote to memory of 3132 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1495.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57453.exe
PID 3656 wrote to memory of 3132 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1495.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57453.exe
PID 3656 wrote to memory of 3132 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1495.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57453.exe
PID 1636 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54225.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24781.exe
PID 1636 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54225.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24781.exe
PID 1636 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54225.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24781.exe
PID 4240 wrote to memory of 4448 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32439.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57816.exe
PID 4240 wrote to memory of 4448 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32439.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57816.exe
PID 4240 wrote to memory of 4448 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32439.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57816.exe
PID 1392 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58672.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12144.exe
PID 1392 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58672.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12144.exe
PID 1392 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58672.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12144.exe
PID 4236 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33805.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-8060.exe
PID 4236 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33805.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-8060.exe
PID 4236 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33805.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-8060.exe
PID 2200 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35969.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37395.exe
PID 2200 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35969.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37395.exe
PID 2200 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35969.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37395.exe
PID 3580 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33141.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64609.exe
PID 3580 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33141.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64609.exe
PID 3580 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33141.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64609.exe
PID 4680 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13192.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-28407.exe
PID 4680 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13192.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-28407.exe
PID 4680 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13192.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-28407.exe
PID 1548 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-36021.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a3cbcf6789537206564620d9055794b0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\a3cbcf6789537206564620d9055794b0_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\Unicorn-50665.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50665.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32165.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32165.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53332.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53332.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3704 -ip 3704

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 720

C:\Users\Admin\AppData\Local\Temp\Unicorn-44137.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44137.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32439.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32439.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35969.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35969.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 832 -ip 832

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 832 -s 756

C:\Users\Admin\AppData\Local\Temp\Unicorn-13192.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13192.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1495.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1495.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54225.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54225.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33805.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33805.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58672.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58672.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4444 -ip 4444

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 736

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3968 -ip 3968

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 736

C:\Users\Admin\AppData\Local\Temp\Unicorn-33141.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33141.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57453.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57453.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24781.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24781.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57816.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57816.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12144.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12144.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8060.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8060.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37395.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37395.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3660 -ip 3660

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3660 -s 744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4240 -ip 4240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 712

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2200 -ip 2200

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 740

C:\Users\Admin\AppData\Local\Temp\Unicorn-64609.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64609.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28407.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28407.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36021.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36021.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2964.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2964.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3711.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3711.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15024.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15024.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2772.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2772.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43805.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43805.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35637.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35637.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16369.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16369.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62040.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62040.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4680 -ip 4680

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 736

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3656 -ip 3656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1636 -ip 1636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3656 -s 728

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4236 -ip 4236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1392 -ip 1392

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 744

C:\Users\Admin\AppData\Local\Temp\Unicorn-26901.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26901.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47876.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47876.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27669.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27669.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19309.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19309.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48089.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48089.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28223.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28223.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32307.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32307.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52173.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52173.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19117.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19117.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7419.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7419.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40689.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40689.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8571.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8571.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33267.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33267.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33267.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33267.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3580 -ip 3580

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3244 -ip 3244

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 320 -ip 320

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3244 -s 720

C:\Users\Admin\AppData\Local\Temp\Unicorn-41265.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41265.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-979.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-979.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 748

C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2104 -ip 2104

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 2348 -ip 2348

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1548 -ip 1548

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 4448 -ip 4448

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 3132 -ip 3132

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 720

C:\Users\Admin\AppData\Local\Temp\Unicorn-33865.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33865.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22167.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22167.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1747.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1747.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13615.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13615.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23127.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23127.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54861.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54861.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63029.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63029.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63029.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63029.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 464 -ip 464

C:\Users\Admin\AppData\Local\Temp\Unicorn-39677.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39677.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 464 -s 720

C:\Users\Admin\AppData\Local\Temp\Unicorn-2920.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2920.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35401.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35401.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35401.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35401.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39485.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39485.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19427.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19427.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23511.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23511.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35017.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35017.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43185.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43185.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27403.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27403.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48016.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48016.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24073.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24073.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2992 -ip 2992

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 3952 -ip 3952

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3740 -ip 3740

C:\Users\Admin\AppData\Local\Temp\Unicorn-27581.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27581.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 716

C:\Users\Admin\AppData\Local\Temp\Unicorn-44664.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44664.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 2080 -ip 2080

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 1160 -ip 1160

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 1840 -ip 1840

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4300 -ip 4300

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2472 -ip 2472

C:\Users\Admin\AppData\Local\Temp\Unicorn-12396.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12396.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57513.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57513.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12204.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12204.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41539.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41539.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40985.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40985.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32433.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32433.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25011.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25011.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25011.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25011.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3536 -ip 3536

C:\Users\Admin\AppData\Local\Temp\Unicorn-58281.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58281.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 912 -ip 912

C:\Users\Admin\AppData\Local\Temp\Unicorn-25971.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25971.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16865.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16865.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 2096 -ip 2096

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 4940 -ip 4940

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4776 -ip 4776

C:\Users\Admin\AppData\Local\Temp\Unicorn-35291.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35291.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55157.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55157.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 3024 -ip 3024

C:\Users\Admin\AppData\Local\Temp\Unicorn-18017.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18017.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 4036 -ip 4036

C:\Users\Admin\AppData\Local\Temp\Unicorn-50881.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50881.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25993.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25993.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 2728 -ip 2728

C:\Users\Admin\AppData\Local\Temp\Unicorn-27891.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27891.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27891.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27891.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47757.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47757.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47757.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47757.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39205.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39205.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10616.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10616.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14700.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14700.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 720

C:\Users\Admin\AppData\Local\Temp\Unicorn-26761.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26761.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22677.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22677.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22677.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22677.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39759.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39759.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2256.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2256.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52012.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52012.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 468 -ip 468

C:\Users\Admin\AppData\Local\Temp\Unicorn-12131.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12131.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31997.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31997.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2540 -ip 2540

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 4352 -ip 4352

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 1908 -ip 1908

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4240 -ip 4240

C:\Users\Admin\AppData\Local\Temp\Unicorn-44612.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44612.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48696.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48696.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52225.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52225.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27337.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27337.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27337.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27337.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 636

C:\Users\Admin\AppData\Local\Temp\Unicorn-32167.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32167.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 3776 -ip 3776

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 480

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 740

C:\Users\Admin\AppData\Local\Temp\Unicorn-8623.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8623.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57269.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57269.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57269.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57269.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36465.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36465.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16599.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16599.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24213.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24213.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3280 -ip 3280

C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57269.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57269.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56885.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56885.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25365.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25365.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58229.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58229.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38363.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38363.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17559.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17559.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58592.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58592.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20491.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20491.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1223.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1223.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25919.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25919.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3280 -s 628

C:\Users\Admin\AppData\Local\Temp\Unicorn-58961.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58961.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 4256 -ip 4256

C:\Users\Admin\AppData\Local\Temp\Unicorn-22375.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22375.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4436 -ip 4436

C:\Users\Admin\AppData\Local\Temp\Unicorn-42049.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42049.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10528.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10528.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 1948 -ip 1948

C:\Users\Admin\AppData\Local\Temp\Unicorn-59900.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59900.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 5036 -ip 5036

C:\Users\Admin\AppData\Local\Temp\Unicorn-55624.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55624.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27035.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27035.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39885.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39885.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22973.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22973.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6636.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6636.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6636.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6636.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 1548 -ip 1548

C:\Users\Admin\AppData\Local\Temp\Unicorn-2552.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2552.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47669.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47669.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35417.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35417.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 3612 -ip 3612

C:\Users\Admin\AppData\Local\Temp\Unicorn-24317.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24317.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28209.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28209.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12064.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12064.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12064.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12064.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12064.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12064.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24125.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24125.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28401.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28401.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53097.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53097.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61265.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61265.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49013.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49013.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32485.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32485.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 1684 -ip 1684

C:\Users\Admin\AppData\Local\Temp\Unicorn-11680.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11680.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12064.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12064.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11488.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11488.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4600 -ip 4600

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3404 -ip 3404

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 4384 -ip 4384

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3548 -ip 3548

C:\Users\Admin\AppData\Local\Temp\Unicorn-4280.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4280.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 4236 -ip 4236

C:\Users\Admin\AppData\Local\Temp\Unicorn-1348.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1348.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4948 -ip 4948

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4540 -ip 4540

C:\Users\Admin\AppData\Local\Temp\Unicorn-29745.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29745.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 928 -ip 928

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1476 -ip 1476

C:\Users\Admin\AppData\Local\Temp\Unicorn-34191.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34191.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 752

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1720 -ip 1720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 968 -ip 968

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 3668 -ip 3668

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2904 -ip 2904

C:\Users\Admin\AppData\Local\Temp\Unicorn-26429.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26429.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34597.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34597.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34597.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34597.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26429.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26429.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 2344 -ip 2344

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 3400 -ip 3400

C:\Users\Admin\AppData\Local\Temp\Unicorn-19221.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19221.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4008 -ip 4008

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 516 -ip 516

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1012 -ip 1012

C:\Users\Admin\AppData\Local\Temp\Unicorn-35365.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35365.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3800 -ip 3800

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3956 -ip 3956

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3724 -ip 3724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4704 -ip 4704

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 3472 -ip 3472

C:\Users\Admin\AppData\Local\Temp\Unicorn-16637.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16637.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 4336 -ip 4336

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 2844 -ip 2844

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 4416 -ip 4416

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 4896 -ip 4896

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 3656 -ip 3656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 728

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 3228 -ip 3228

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3948 -ip 3948

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2288 -ip 2288

C:\Users\Admin\AppData\Local\Temp\Unicorn-61369.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61369.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 3660 -ip 3660

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1792 -ip 1792

C:\Users\Admin\AppData\Local\Temp\Unicorn-48925.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48925.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28505.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28505.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 636

C:\Users\Admin\AppData\Local\Temp\Unicorn-40757.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40757.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1264 -ip 1264

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 912 -ip 912

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3732 -ip 3732

C:\Users\Admin\AppData\Local\Temp\Unicorn-33741.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33741.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37825.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37825.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3040 -ip 3040

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 3996 -ip 3996

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 2528 -ip 2528

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4836 -ip 4836

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 4508 -ip 4508

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 4020 -ip 4020

C:\Users\Admin\AppData\Local\Temp\Unicorn-10004.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10004.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5260 -ip 5260

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 1696 -ip 1696

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4516 -ip 4516

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5260 -s 740

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 4320 -ip 4320

C:\Users\Admin\AppData\Local\Temp\Unicorn-38209.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38209.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 1484 -ip 1484

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4368 -ip 4368

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5292 -ip 5292

C:\Users\Admin\AppData\Local\Temp\Unicorn-27109.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27109.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27109.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27109.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6688.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6688.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 2272 -ip 2272

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5480 -ip 5480

C:\Users\Admin\AppData\Local\Temp\Unicorn-14664.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14664.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14664.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14664.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14664.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14664.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14664.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14664.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14664.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14664.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14664.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14664.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14664.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14664.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14664.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14664.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14664.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14664.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 1824 -ip 1824

C:\Users\Admin\AppData\Local\Temp\Unicorn-2412.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2412.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2412.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2412.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6496.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6496.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10580.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10580.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14472.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14472.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18557.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18557.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 624

C:\Users\Admin\AppData\Local\Temp\Unicorn-26725.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26725.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26725.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26725.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63673.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63673.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14280.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14280.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18365.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18365.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22449.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22449.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22449.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22449.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22449.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22449.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22449.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22449.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22449.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22449.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22449.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22449.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 2816 -ip 2816

C:\Users\Admin\AppData\Local\Temp\Unicorn-22449.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22449.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4464 -ip 4464

C:\Users\Admin\AppData\Local\Temp\Unicorn-3372.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3372.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 5420 -ip 5420

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 4764 -ip 4764

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3196 -ip 3196

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 5532 -ip 5532

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5340 -ip 5340

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4472 -ip 4472

C:\Users\Admin\AppData\Local\Temp\Unicorn-40129.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40129.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4248 -ip 4248

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 5412 -ip 5412

C:\Users\Admin\AppData\Local\Temp\Unicorn-52957.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52957.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52957.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52957.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57041.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57041.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57041.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57041.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 5124 -ip 5124

C:\Users\Admin\AppData\Local\Temp\Unicorn-48681.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48681.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52765.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52765.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57041.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57041.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5216 -ip 5216

C:\Users\Admin\AppData\Local\Temp\Unicorn-50196.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50196.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50196.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50196.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50196.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50196.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 960 -ip 960

C:\Users\Admin\AppData\Local\Temp\Unicorn-24753.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24753.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9724.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9724.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24753.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24753.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 3652 -ip 3652

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 5204 -ip 5204

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4412 -ip 4412

C:\Users\Admin\AppData\Local\Temp\Unicorn-46289.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46289.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 5240 -ip 5240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 2632 -ip 2632

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 2080 -ip 2080

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 2704 -ip 2704

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 1316 -ip 1316

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3764 -ip 3764

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5428 -ip 5428

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5492 -ip 5492

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5960 -ip 5960

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 5444 -ip 5444

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1220 -ip 1220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 5180 -ip 5180

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 5188 -ip 5188

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 5304 -ip 5304

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 5752 -ip 5752

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 5716 -ip 5716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5188 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5508 -ip 5508

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5884 -ip 5884

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 5148 -ip 5148

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 5856 -ip 5856

C:\Users\Admin\AppData\Local\Temp\Unicorn-60845.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60845.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60845.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60845.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5808 -ip 5808

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4936 -ip 4936

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 6012 -ip 6012

C:\Users\Admin\AppData\Local\Temp\Unicorn-61997.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61997.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20965.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20965.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20965.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20965.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20965.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20965.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 6032 -ip 6032

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 5500 -ip 5500

C:\Users\Admin\AppData\Local\Temp\Unicorn-352.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-352.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41385.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41385.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41385.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41385.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 5132 -ip 5132

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 712

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5852 -ip 5852

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6012 -s 636

C:\Users\Admin\AppData\Local\Temp\Unicorn-45277.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45277.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5092 -ip 5092

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5232 -ip 5232

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 5760 -ip 5760

C:\Users\Admin\AppData\Local\Temp\Unicorn-1312.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1312.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 6140 -ip 6140

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 5404 -ip 5404

C:\Users\Admin\AppData\Local\Temp\Unicorn-38069.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38069.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2056 -ip 2056

C:\Users\Admin\AppData\Local\Temp\Unicorn-8904.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8904.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17073.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17073.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21157.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21157.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21157.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21157.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46045.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46045.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54213.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54213.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 2836 -ip 2836

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 1504 -ip 1504

C:\Users\Admin\AppData\Local\Temp\Unicorn-42044.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42044.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43113.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43113.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 5748 -ip 5748

C:\Users\Admin\AppData\Local\Temp\Unicorn-42921.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42921.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42921.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42921.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51089.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51089.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 5328 -ip 5328

C:\Users\Admin\AppData\Local\Temp\Unicorn-13948.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13948.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 4448 -ip 4448

C:\Users\Admin\AppData\Local\Temp\Unicorn-42537.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42537.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23269.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23269.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64301.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64301.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64301.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64301.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5336 -ip 5336

C:\Users\Admin\AppData\Local\Temp\Unicorn-6740.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6740.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 3092 -ip 3092

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5396 -ip 5396

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5228 -ip 5228

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 1416 -ip 1416

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 4152 -ip 4152

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 5460 -ip 5460

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5676 -ip 5676

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 5348 -ip 5348

C:\Users\Admin\AppData\Local\Temp\Unicorn-16195.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16195.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16195.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16195.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24363.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24363.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 5728 -ip 5728

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3620 -ip 3620

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3024 -ip 3024

C:\Users\Admin\AppData\Local\Temp\Unicorn-44592.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44592.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44592.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44592.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44592.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44592.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44592.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44592.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16195.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16195.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 5828 -ip 5828

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 2760 -ip 2760

C:\Users\Admin\AppData\Local\Temp\Unicorn-52760.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52760.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 4804 -ip 4804

C:\Users\Admin\AppData\Local\Temp\Unicorn-33683.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33683.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33683.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33683.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33683.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33683.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33683.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33683.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5528 -ip 5528

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 4664 -ip 4664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 5984 -ip 5984

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 3100 -ip 3100

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2996 -ip 2996

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 5656 -ip 5656

C:\Users\Admin\AppData\Local\Temp\Unicorn-53165.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53165.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61141.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61141.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61141.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61141.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28469.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28469.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13284.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13284.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13284.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13284.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34451.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34451.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 5248 -ip 5248

C:\Users\Admin\AppData\Local\Temp\Unicorn-58209.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58209.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 5540 -ip 5540

C:\Users\Admin\AppData\Local\Temp\Unicorn-37789.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37789.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 2844 -ip 2844

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 4536 -ip 4536

C:\Users\Admin\AppData\Local\Temp\Unicorn-17177.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17177.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57825.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57825.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 2704 -ip 2704

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5248 -s 624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 1456 -ip 1456

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3008 -ip 3008

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1604 -ip 1604

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2416 -ip 2416

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 5864 -ip 5864

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 464

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 5684 -ip 5684

C:\Users\Admin\AppData\Local\Temp\Unicorn-21837.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21837.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64021.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64021.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64021.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64021.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64021.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64021.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35433.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35433.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35433.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35433.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39517.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39517.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39517.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39517.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39517.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39517.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31349.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31349.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 1476 -ip 1476

C:\Users\Admin\AppData\Local\Temp\Unicorn-63637.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63637.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10544.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10544.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 2096 -ip 2096

C:\Users\Admin\AppData\Local\Temp\Unicorn-6076.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6076.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 4468 -ip 4468

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 436 -ip 436

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5864 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 4612 -ip 4612

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5684 -s 648

C:\Users\Admin\AppData\Local\Temp\Unicorn-56429.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56429.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1488 -ip 1488

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3164 -ip 3164

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 2208 -ip 2208

C:\Users\Admin\AppData\Local\Temp\Unicorn-56045.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56045.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56045.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56045.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56045.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56045.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64213.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64213.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35625.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35625.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23373.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23373.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 6132 -ip 6132

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 5892 -ip 5892

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 3780 -ip 3780

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 3160 -ip 3160

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4756 -ip 4756

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 1124 -ip 1124

C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33653.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33653.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 2300 -ip 2300

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 5980 -ip 5980

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 5932 -ip 5932

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 3956 -ip 3956

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 6072 -ip 6072

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4760 -ip 4760

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 5384 -ip 5384

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 1824 -ip 1824

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 4828 -ip 4828

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 912 -ip 912

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4992 -ip 4992

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 4308 -ip 4308

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4056 -ip 4056

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 960 -ip 960

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 6052 -ip 6052

C:\Users\Admin\AppData\Local\Temp\Unicorn-41977.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41977.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41977.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41977.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4388 -ip 4388

C:\Users\Admin\AppData\Local\Temp\Unicorn-13388.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13388.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 3740 -ip 3740

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 4616 -ip 4616

C:\Users\Admin\AppData\Local\Temp\Unicorn-10456.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10456.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 384 -ip 384

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3648 -ip 3648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 5320 -ip 5320

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 5824 -ip 5824

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 4384 -ip 4384

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3648 -s 744

C:\Users\Admin\AppData\Local\Temp\Unicorn-11224.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11224.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47789.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47789.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47789.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47789.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27369.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27369.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55957.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55957.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39621.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39621.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 5208 -ip 5208

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 5380 -ip 5380

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 3400 -ip 3400

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 3704 -ip 3704

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 3500 -ip 3500

C:\Users\Admin\AppData\Local\Temp\Unicorn-65277.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65277.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65277.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65277.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65277.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65277.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48941.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48941.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57109.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57109.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28521.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28521.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65277.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65277.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65277.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65277.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3824.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3824.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 428 -ip 428

C:\Users\Admin\AppData\Local\Temp\Unicorn-28329.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28329.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32413.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32413.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36497.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36497.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24245.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24245.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5208 -s 632

C:\Users\Admin\AppData\Local\Temp\Unicorn-7524.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7524.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44473.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44473.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44473.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44473.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44473.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44473.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44473.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44473.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 3916 -ip 3916

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 4892 -ip 4892

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5380 -s 628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 2024 -ip 2024

C:\Users\Admin\AppData\Local\Temp\Unicorn-19777.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19777.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 4632 -ip 4632

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5352 -ip 5352

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 6032 -ip 6032

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 64 -ip 64

C:\Users\Admin\AppData\Local\Temp\Unicorn-16845.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16845.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20929.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20929.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3196 -ip 3196

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 3640 -ip 3640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 2400 -ip 2400

C:\Users\Admin\AppData\Local\Temp\Unicorn-58453.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58453.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17613.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17613.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25781.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25781.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 4680 -ip 4680

C:\Users\Admin\AppData\Local\Temp\Unicorn-49901.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49901.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39547.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39547.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10959.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10959.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 4600 -ip 4600

C:\Users\Admin\AppData\Local\Temp\Unicorn-10767.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10767.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10767.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10767.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 2052 -ip 2052

C:\Users\Admin\AppData\Local\Temp\Unicorn-26911.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26911.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4432 -ip 4432

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5804 -ip 5804

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 5304 -ip 5304

C:\Users\Admin\AppData\Local\Temp\Unicorn-26165.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26165.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5404 -ip 5404

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 5152 -ip 5152

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 5760 -ip 5760

C:\Users\Admin\AppData\Local\Temp\Unicorn-19341.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19341.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59989.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59989.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 4012 -ip 4012

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5276 -ip 5276

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4116 -ip 4116

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 4048 -ip 4048

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 5596 -ip 5596

C:\Users\Admin\AppData\Local\Temp\Unicorn-61468.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61468.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61468.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61468.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40109.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40109.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 5316 -ip 5316

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 3564 -ip 3564

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3528 -ip 3528

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5344 -ip 5344

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 3360 -ip 3360

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1780 -ip 1780

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 1624 -ip 1624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 5428 -ip 5428

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 4528 -ip 4528

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5700 -ip 5700

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5640 -ip 5640

C:\Users\Admin\AppData\Local\Temp\Unicorn-28433.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28433.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 5116 -ip 5116

C:\Users\Admin\AppData\Local\Temp\Unicorn-25693.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25693.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21609.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21609.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33861.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33861.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33861.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33861.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13440.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13440.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54089.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54089.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54089.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54089.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58173.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58173.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58173.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58173.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62257.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62257.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-804.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-804.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50005.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50005.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 5084 -ip 5084

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 5672 -ip 5672

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 4336 -ip 4336

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 2288 -ip 2288

C:\Users\Admin\AppData\Local\Temp\Unicorn-63217.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63217.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63217.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63217.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 5436 -ip 5436

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 4604 -ip 4604

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 1220 -ip 1220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 3112 -ip 3112

C:\Users\Admin\AppData\Local\Temp\Unicorn-21801.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21801.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 5396 -ip 5396

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 660

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 1460 -ip 1460

C:\Users\Admin\AppData\Local\Temp\Unicorn-18677.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18677.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42989.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42989.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26653.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26653.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5436 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 4852 -ip 4852

C:\Users\Admin\AppData\Local\Temp\Unicorn-48417.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48417.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48417.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48417.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52501.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52501.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52501.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52501.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53248.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53248.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 4428 -ip 4428

C:\Users\Admin\AppData\Local\Temp\Unicorn-31697.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31697.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 4328 -ip 4328

C:\Users\Admin\AppData\Local\Temp\Unicorn-65521.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65521.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65521.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65521.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4815.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4815.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2552 -ip 2552

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 4484 -ip 4484

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 5500 -ip 5500

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 5340 -ip 5340

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 380 -ip 380

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 5840 -ip 5840

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 3824 -ip 3824

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 5160 -ip 5160

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5724 -ip 5724

C:\Users\Admin\AppData\Local\Temp\Unicorn-25427.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25427.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 4476 -ip 4476

C:\Users\Admin\AppData\Local\Temp\Unicorn-7288.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7288.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7288.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7288.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 3436 -ip 3436

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 4448 -ip 4448

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 5384 -ip 5384

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 5392 -ip 5392

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 5764 -ip 5764

C:\Users\Admin\AppData\Local\Temp\Unicorn-38830.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38830.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 6120 -ip 6120

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 828 -ip 828

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5384 -s 464

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 4620 -ip 4620

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2176 -ip 2176

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 3936 -ip 3936

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 2416 -ip 2416

C:\Users\Admin\AppData\Local\Temp\Unicorn-52426.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52426.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52426.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52426.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56510.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56510.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60594.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60594.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39790.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39790.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39790.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39790.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43874.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43874.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 3228 -ip 3228

C:\Users\Admin\AppData\Local\Temp\Unicorn-31622.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31622.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31622.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31622.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 320 -ip 320

C:\Users\Admin\AppData\Local\Temp\Unicorn-64486.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64486.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 2248 -ip 2248

C:\Users\Admin\AppData\Local\Temp\Unicorn-19178.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19178.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23262.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23262.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 2444 -ip 2444

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 5960 -ip 5960

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5752 -ip 5752

C:\Users\Admin\AppData\Local\Temp\Unicorn-16438.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16438.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16246.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16246.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28498.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28498.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12161.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12161.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20330.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20330.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16246.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16246.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12161.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12161.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3008 -ip 3008

C:\Users\Admin\AppData\Local\Temp\Unicorn-40366.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40366.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40366.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40366.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24414.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24414.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24414.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24414.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 5544 -ip 5544

C:\Users\Admin\AppData\Local\Temp\Unicorn-41710.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41710.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45794.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45794.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4384 -ip 4384

C:\Users\Admin\AppData\Local\Temp\Unicorn-53962.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53962.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5940 -ip 5940

C:\Users\Admin\AppData\Local\Temp\Unicorn-24990.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24990.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49686.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49686.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49686.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49686.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49686.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49686.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49686.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49686.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54922.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54922.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54922.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54922.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63090.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63090.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4984 -ip 4984

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5508 -ip 5508

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3636 -ip 3636

C:\Users\Admin\AppData\Local\Temp\Unicorn-43054.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43054.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1756 -ip 1756

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 4120 -ip 4120

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 3188 -ip 3188

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 1140 -ip 1140

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 3536 -ip 3536

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5984 -ip 5984

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3132 -ip 3132

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 5440 -ip 5440

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 3488 -ip 3488

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 5416 -ip 5416

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 3956 -ip 3956

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 1056 -ip 1056

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 4656 -ip 4656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 4212 -ip 4212

C:\Users\Admin\AppData\Local\Temp\Unicorn-44590.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44590.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 5796 -ip 5796

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 3660 -ip 3660

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 4224 -ip 4224

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5136 -ip 5136

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 3472 -ip 3472

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 5360 -ip 5360

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 4612 -ip 4612

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 5932 -ip 5932

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 5192 -ip 5192

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 1824 -ip 1824

C:\Users\Admin\AppData\Local\Temp\Unicorn-16926.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16926.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 4416 -ip 4416

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 1684 -ip 1684

C:\Users\Admin\AppData\Local\Temp\Unicorn-49790.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49790.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4788 -ip 4788

C:\Users\Admin\AppData\Local\Temp\Unicorn-53874.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53874.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53874.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53874.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53874.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53874.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53874.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53874.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53874.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53874.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53874.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53874.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4692 -ip 4692

C:\Users\Admin\AppData\Local\Temp\Unicorn-53874.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53874.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53874.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53874.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 4408 -ip 4408

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 4900 -ip 4900

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 3780 -ip 3780

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 4508 -ip 4508

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 4892 -ip 4892

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 4980 -ip 4980

C:\Users\Admin\AppData\Local\Temp\Unicorn-205.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-205.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5652 -ip 5652

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 5272 -ip 5272

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 5372 -ip 5372

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 5588 -ip 5588

C:\Users\Admin\AppData\Local\Temp\Unicorn-37922.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37922.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 3764 -ip 3764

C:\Users\Admin\AppData\Local\Temp\Unicorn-42198.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42198.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46282.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46282.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54450.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54450.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54450.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54450.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5408 -ip 5408

C:\Users\Admin\AppData\Local\Temp\Unicorn-973.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-973.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-973.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-973.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5020 -ip 5020

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3996 -ip 3996

C:\Users\Admin\AppData\Local\Temp\Unicorn-62234.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62234.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5588 -s 664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 1980 -ip 1980

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1844 -ip 1844

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 6040 -ip 6040

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 608

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 652

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5408 -s 756

C:\Users\Admin\AppData\Local\Temp\Unicorn-43158.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43158.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47242.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47242.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4528 -ip 4528

C:\Users\Admin\AppData\Local\Temp\Unicorn-10101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47050.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47050.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47050.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47050.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51134.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51134.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 808 -ip 808

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 2324 -ip 2324

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 5656 -ip 5656

C:\Users\Admin\AppData\Local\Temp\Unicorn-9717.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9717.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 4936 -ip 4936

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 1564 -ip 1564

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 4392 -ip 4392

C:\Users\Admin\AppData\Local\Temp\Unicorn-2701.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2701.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 5316 -ip 5316

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 5516 -ip 5516

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 5676 -ip 5676

C:\Users\Admin\AppData\Local\Temp\Unicorn-30906.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30906.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 5948 -ip 5948

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 5928 -ip 5928

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 4424 -ip 4424

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4436 -ip 4436

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 3348 -ip 3348

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 736 -ip 736

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 1584 -ip 1584

C:\Users\Admin\AppData\Local\Temp\Unicorn-60454.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60454.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3684 -ip 3684

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 4264 -ip 4264

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3640 -ip 3640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 6016 -ip 6016

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2528 -ip 2528

C:\Users\Admin\AppData\Local\Temp\Unicorn-16682.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16682.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16682.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16682.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16682.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16682.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5888 -ip 5888

C:\Users\Admin\AppData\Local\Temp\Unicorn-24850.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24850.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25596.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25596.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 6024 -ip 6024

C:\Users\Admin\AppData\Local\Temp\Unicorn-29680.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29680.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5048 -ip 5048

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 1212 -ip 1212

C:\Users\Admin\AppData\Local\Temp\Unicorn-20574.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20574.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 5900 -ip 5900

C:\Users\Admin\AppData\Local\Temp\Unicorn-33572.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33572.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33572.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33572.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 5296 -ip 5296

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 924 -ip 924

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 4528 -ip 4528

C:\Users\Admin\AppData\Local\Temp\Unicorn-35649.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35649.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 1488 -ip 1488

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5716 -ip 5716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3480 -ip 3480

C:\Users\Admin\AppData\Local\Temp\Unicorn-50314.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50314.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 4020 -ip 4020

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 4512 -ip 4512

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3108 -ip 3108

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 1932 -ip 1932

C:\Users\Admin\AppData\Local\Temp\Unicorn-21150.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21150.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 6140 -ip 6140

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 5700 -ip 5700

C:\Users\Admin\AppData\Local\Temp\Unicorn-37294.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37294.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37294.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37294.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12789.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12789.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 5596 -ip 5596

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5396 -ip 5396

C:\Users\Admin\AppData\Local\Temp\Unicorn-5965.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5965.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5965.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5965.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 2260 -ip 2260

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5596 -s 608

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 5380 -ip 5380

C:\Users\Admin\AppData\Local\Temp\Unicorn-1689.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1689.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9857.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9857.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9857.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9857.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46806.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46806.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5968 -ip 5968

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 6068 -ip 6068

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5396 -s 728

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3940 -ip 3940

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 5308 -ip 5308

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 932 -ip 932

C:\Users\Admin\AppData\Local\Temp\Unicorn-33978.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33978.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42146.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42146.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 696

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 5444 -ip 5444

C:\Users\Admin\AppData\Local\Temp\Unicorn-3168.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3168.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 1952 -ip 1952

C:\Users\Admin\AppData\Local\Temp\Unicorn-60537.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60537.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60537.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60537.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27864.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27864.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47730.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47730.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 5400 -ip 5400

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5380 -s 748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5820 -ip 5820

C:\Users\Admin\AppData\Local\Temp\Unicorn-48093.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48093.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 5672 -ip 5672

C:\Users\Admin\AppData\Local\Temp\Unicorn-30626.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30626.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 5640 -ip 5640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 2072 -ip 2072

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 2728 -ip 2728

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 6092 -ip 6092

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 5856 -ip 5856

C:\Users\Admin\AppData\Local\Temp\Unicorn-52753.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52753.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7081.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7081.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7081.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7081.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7081.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7081.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7081.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7081.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7081.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7081.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7081.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7081.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52198.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52198.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56282.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56282.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 1892 -ip 1892

C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60174.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60174.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 4832 -ip 4832

C:\Users\Admin\AppData\Local\Temp\Unicorn-28056.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28056.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5204 -ip 5204

C:\Users\Admin\AppData\Local\Temp\Unicorn-24570.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24570.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 1292 -ip 1292

C:\Users\Admin\AppData\Local\Temp\Unicorn-12317.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12317.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5800 -ip 5800

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 3264 -ip 3264

C:\Users\Admin\AppData\Local\Temp\Unicorn-16956.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16956.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16956.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16956.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 2408 -ip 2408

C:\Users\Admin\AppData\Local\Temp\Unicorn-57050.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57050.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37184.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37184.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24932.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24932.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44798.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44798.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5940 -ip 5940

C:\Users\Admin\AppData\Local\Temp\Unicorn-38336.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38336.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42420.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42420.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5760 -ip 5760

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 744

C:\Users\Admin\AppData\Local\Temp\Unicorn-41674.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41674.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8617.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8617.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12701.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12701.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16786.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16786.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 4536 -ip 4536

C:\Users\Admin\AppData\Local\Temp\Unicorn-45566.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45566.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-449.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-449.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34274.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34274.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 4428 -ip 4428

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 6036 -ip 6036

C:\Users\Admin\AppData\Local\Temp\Unicorn-5493.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5493.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9577.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9577.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5124 -ip 5124

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 4908 -ip 4908

C:\Users\Admin\AppData\Local\Temp\Unicorn-13469.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13469.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58394.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58394.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50226.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50226.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50226.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50226.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52125.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52125.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 672

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 4160 -ip 4160

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 5388 -ip 5388

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6036 -s 624

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 152.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\Unicorn-50665.exe

MD5 ff49dac6269a29025225d951ef1efa22
SHA1 d5922db7b7fed5f298ec8965f7cbb5b3e9e34af1
SHA256 8729bec8d3d9b230a2e108f47ccb45ee7598f380ebb00b460e8ecfd759d8a1e8
SHA512 df7f4e9d035b5ec247874aaaf78b81c8706529f44716ed42c3db96519819339a196c9114da819f24a28038ff305c66855fd1b7446e2afec53ab936a7eb660e2f

C:\Users\Admin\AppData\Local\Temp\Unicorn-32165.exe

MD5 b7d9ee06c6b689cd55bf1397c33e4236
SHA1 9ab96d1fe33ca38c5326f0573a320cb639cc9459
SHA256 15229fc86d5ac5e80a9a4b9f4589446aed8b902e95a13e8512a490364e98b69c
SHA512 f1b03a70f124ca1ef6fb7c60cfe21a17d5df4fb6a9d022644cc171d46e41c22f5d3eb3dc2cdbdcc5c37978c9f5262f42b96c109311e2a909e0c4534d736d3692

C:\Users\Admin\AppData\Local\Temp\Unicorn-53332.exe

MD5 5ef21f7230c9546f990935d4705f5bfb
SHA1 8a75cc03d05e337e473caf0a79e3af76bdbf3e29
SHA256 cded4b5e5d9c1782dc186662dd73649380991f71191aa13ff373c69075eeab11
SHA512 f28be53cc975bc7b620cb8cde2c70a66694a4a6b7e90965fc3963c5ae1674c6c0c4f9bc5796172e63a5dc3a8de081f4e04f962b8f8e7bdecd61c1a4112ec24ee

C:\Users\Admin\AppData\Local\Temp\Unicorn-44137.exe

MD5 21a3a0bbe9a61913e1d92be58db3fc32
SHA1 9bacfeb0dac76db808fb1722f878369ba4c465a9
SHA256 3e6f0d35cb577a462cfba0e6e42f6d7c770c00f556322d8aab612cc317c4f01d
SHA512 5f2958280a4e5832d459f97ee60cdd144d7afeeb7aaa449e83e2873a074f89a1604904cbe50b0fa31832b05c5295d43afa4fda786c50a904daa00a632dadebe6

C:\Users\Admin\AppData\Local\Temp\Unicorn-32439.exe

MD5 0071d9333e94933ab10d671073faa950
SHA1 459c9f23ae146b8cd7fd3defab0049107c75e558
SHA256 96a0a167e080a0ed3a3a8d815497986b7699c0c6a01e87237985f17dfae3af55
SHA512 62c6255b5cd7e45a6750a0ec4ab9dde896dd686228791b73efc23f044f694738067d60cc67de2feb40d198666b3d0eb57098f5d3dc9ebbf8e152cf847b98ae54

C:\Users\Admin\AppData\Local\Temp\Unicorn-35969.exe

MD5 bd557ca3a0e271458a3952ab80affa3d
SHA1 215a7e9ffb08155acefba930bf032704acb52770
SHA256 917dc56b1db3d32a71d74b3e651af856fac4820c2ef4cc0bbe6ebb62d8eba68f
SHA512 26a44f45a55eee53e65144ddab9ae12be1035c482a9d306320839f9f86b67a7cf4941689057586253c6c46482d2a5e09cb9af81bf53fec72776b42198c401f66

C:\Users\Admin\AppData\Local\Temp\Unicorn-13192.exe

MD5 4f317c547061a1aaa14ce01ac4af074a
SHA1 25d3b3c75d4913aef3e78d9575b550518a47306c
SHA256 707f9c79202257a81db507d056ff1640f38dbd2e88f942bb0ec4c445e8ebcd87
SHA512 cf9b5157b3019eaaefe622942c03ea46e9933cee4f57014af7bfa320d0ab09cffa786a1cf325c78ff638d8c8a3eba71d08b0fedd99d06a2fb71ca655d5987ae8

C:\Users\Admin\AppData\Local\Temp\Unicorn-1495.exe

MD5 1779b057e0af9e3c6ec5cd8c2da42203
SHA1 6d5a9e606fbc2da747f909bdd68d76cf5be318a6
SHA256 00ce513906036a1a4160c7df613ef2fd160cc814789e8d0abdb57a7733570626
SHA512 b22d08137aa8ecc4cd8b4b4eff21fcc18e853f7e288eb240b7b7aee53aef6b945f8f9c21ea0eb912e4f5fb172aa7e00185c067273d5bdb406cdc941cea55c875

C:\Users\Admin\AppData\Local\Temp\Unicorn-54225.exe

MD5 15a7036bcb718d57d7d7d3b7afc25810
SHA1 c70fc52f7f9f7d96a84827695f3d27bc2ebc8432
SHA256 c0a2fdb81b6f7d7cc1ff8b07ca9c58c90787e7059edd91c89203a566ae32dd34
SHA512 83149c5d030605d4be74563c55ae0d15b5d21e6f126dd17fd4ccef420ee3a47d3d7cbee8e6d07beae3a22e757cf4931c7985e65bf89a6106239c6a470dfeb658

C:\Users\Admin\AppData\Local\Temp\Unicorn-33805.exe

MD5 66d708843a42fcf6ca328a0ae2274110
SHA1 cc3f940714a9504a62e42808d66f6b9f01469603
SHA256 5972f185d3f132c7f36f02525f88790e34df20007b2405bba4a8859dd4a8f7ab
SHA512 830d58cb37eac2510397aafcb3fd9d9b3d78fb7d9f14b02d48f7a7f8d2703efe544b89e6d0a2b95264817524a1814593b2ef494aa5d38654a0fd87890177e7c5

C:\Users\Admin\AppData\Local\Temp\Unicorn-58672.exe

MD5 c05e98bf666dc87c3ad6abb3be487a6e
SHA1 b6d384e1231815c3dc1c50ccfdf0f64873cb7466
SHA256 5b994c4fb358726d03e446f56b9c7ac17b15838134091b53dcb5a1891124ccf1
SHA512 4f2c4c6c6aa27774b80208b5b69efa523fa14318e3a7a84b722f96ec7f2d1b0915efe751d6381bac9cb77bc5b3f596fc039b2c7da86a0eb6de46f456bc846a7b

C:\Users\Admin\AppData\Local\Temp\Unicorn-33141.exe

MD5 48dc7c8f23526dafb25113b926f831d6
SHA1 80ea67b5c0f31bafc10ab69e911d17a5c93976d9
SHA256 4b954b2a42a0777d1664eeca90a2d4e9f02a6b3a9b59823ab7959c3a6c0a7e09
SHA512 14856b8ac77b9baa0b00a13a1d0f6bb43b834c0024f12309a2c574fa9e3e27c4a847f72416499359c4fc88a0afd09d47432bf71ada86a5193878ac480401d7bd

C:\Users\Admin\AppData\Local\Temp\Unicorn-58008.exe

MD5 71443d71810e83d7fd237d7e211ab944
SHA1 ba486693a30e22c703504a3a235c30587463b13b
SHA256 e4888b42c6b3873cd771b67f452c01a0bff246e5c1a6dee53172071020fbb944
SHA512 ca177bea66fd3346cc76b9cf5af235120ccb78daff95f647834286d75366972bc232228ac742df612f0b74e07a6930265a90b97e866afc43a339fd2255a4b291

C:\Users\Admin\AppData\Local\Temp\Unicorn-57453.exe

MD5 785c3392091e310d2dc9a2c62fbd0a9a
SHA1 e6f67b6740632725775ac53b3f09cff44dd0f601
SHA256 f2838b6fa5e43ecdb21256d3c612f121afe4e1fe55318c46f5bf5665eb242723
SHA512 abb9cb087db3e28c84640e5857005de8a1d928b69ced9380472e68fbafe1d876e1f330c8d024c5502047a81859c88bfc6d3e304c9b6e74ca769894781e23a82f

C:\Users\Admin\AppData\Local\Temp\Unicorn-24781.exe

MD5 930d6ead627ad93c14df8c9f77cc34a8
SHA1 023f283f024eaaa8deecf4979af7ef6e5449b19a
SHA256 54c82a17c1883f108cdaec6475a5321a2bfa5152af718fecdb76eabb032926bf
SHA512 64af217c9edea4b5b3db7bdbc98fc3a883fb9492e28e278f8071a738044ce8718883ad2b7dcc8de2cf05044eaa7c18767b4630b2786997e7cbce88a84807809c

C:\Users\Admin\AppData\Local\Temp\Unicorn-12144.exe

MD5 fbeb7b278e524f5b9a6a7f0e729fff44
SHA1 7923abb3fa35c1342313d23aba3ddd1e2a941012
SHA256 a2ed2dc3ea4b9feb23d06d7e5a33b4dd7895d3cfbba09aa1f53cb6f5ce63d2c7
SHA512 ce0e26f67538b96791619ed3a7495f7e43f0c73d142fdb12542c03391babe8a10443181006f4ba8d4b4dc1a83091517bd71167caf97b847b7c505be92b787404

C:\Users\Admin\AppData\Local\Temp\Unicorn-8060.exe

MD5 235ac9ad241add1d16bd42a5a5e2d636
SHA1 7dcb6264e7a87e64e5dbdeec00cadc9f8849295e
SHA256 28858274a1d958945557fcfc4a6d3f0777e20d4b2ce71ff373a9fb4c2ed5637d
SHA512 2f1e06c7c8fa221319b2a51f68580981acfc9e015c567bbadb8f381c44598670c6acb89c54a79587579803364df1667193484129d24dc1ff87e771842395e122

C:\Users\Admin\AppData\Local\Temp\Unicorn-37395.exe

MD5 afc7ecfc30d5e5e37c7bf54f17b1bc57
SHA1 3811fe70e575597caf7febb36dcb27ed79c4ba02
SHA256 3d289e082bdf7e0b7ee3b959d4903aba1accbaebd1025d9d1170414d80d7ee35
SHA512 02ae8030962b1ee93e6fdefd887560956f9000cc89199f1acf8003b92d2efd698922170ab0cfa16f9ab2067321c2ca3ec3c5ec20f7f551451d92bad6b67ae541

C:\Users\Admin\AppData\Local\Temp\Unicorn-57816.exe

MD5 e8339971c53a1b2869eac4bf4436d8a0
SHA1 af49ec21bc8efd024a7b8cc635da0a9578d73984
SHA256 f1cf597b6646423ac7508d54f9dfdd5d37b2e721961e6050b16c6fe699d28e0c
SHA512 2e182bbb6f2e821ef6e02c44a4154f98bb95dca1c949ff73d36f2d9eeb8189e580c142fcba27e2482996422e1a9adb56802be98c19b7880a618ad01b36031560

C:\Users\Admin\AppData\Local\Temp\Unicorn-64609.exe

MD5 cbc4d66bbde382bf6451c86b879cf0b5
SHA1 08864bd7d2aae131a20634a2a60425cd590023ca
SHA256 7302a96404365c6af562fb47f971e2ba4fce0bde2d032adc400498c2a3920606
SHA512 ddfed1c313222a8a6ab8426312435d8dd50d099954204943678e416e5a11f8e304b2eb45addf5c80c95202b148f0cd0132fd6753677240cdbaac1c0c3c4681e9

C:\Users\Admin\AppData\Local\Temp\Unicorn-28407.exe

MD5 7b290a8ecf79a14ac6c52b9558027568
SHA1 64f352ede0861938b40dd9e4b7bfac701c074a2a
SHA256 968fd72fbf99ced1ec5a81f5edd5c8c3c5abdee19bc56fb02196223eb014b195
SHA512 28aecc9b42a61e687f2fcf1ba41206d6084fb4c59ae37840300115c880fcb76e733806e929fa8ad3c1ab3f82f0d915cb117ece4f5d3c1928310c4ebf8e6c1d93

C:\Users\Admin\AppData\Local\Temp\Unicorn-36021.exe

MD5 a1f15c3bab07442bfbb92331479223fa
SHA1 8957355d50d7c1e0552d797191aa561e805d76ca
SHA256 384797090d545a4ce6aeeef7b7bf4255d1941a92071a435d9b93b3cfe23e8f21
SHA512 3aed42fc2adcb99efd74b24e72ec8298fd5908ffa71af1cf8e66520b7f3e6a2fb1280115dce485f3009c5a0bf07d51d2b4e4cef0e4bd4fa0b5be2d37d3ae89bc

C:\Users\Admin\AppData\Local\Temp\Unicorn-2964.exe

MD5 bddf6adc3144ec65dcde57ad12131753
SHA1 d850a0e9205c9cd044edadbd3d193aa888234bde
SHA256 e698302ac64cec72ee4596cdf01f9a6fb5edd1f761113d3d12a79002f8268395
SHA512 48f4b44622175640a7a2aa7ec46f8f1396d16094c22ed0cdaaada8e12b1d753485b404eb1b26c4f34be0914c7c145fbe1def64cbd454b6e5afb89244bd081228

C:\Users\Admin\AppData\Local\Temp\Unicorn-3711.exe

MD5 d4f67f2d8dbdb0268abfaf977016b790
SHA1 5808a4f7ec9e75e3bf1f5431f1f7909ecdedfd50
SHA256 65928c4c11906ea38ff89d4112245310a7b62a7abd920dbfdf47ed90c36576ad
SHA512 2d168ef1004c0f861cfa46f1ab5fa99ae8827cb99dc9e2dacfe0dce455b95abc101b4677eba6d1ead2e7e90504f15d146c7b57d824eab4f86b38895b3b089a0c

C:\Users\Admin\AppData\Local\Temp\Unicorn-15024.exe

MD5 b4a727f543c7397947efa2b85a40e5c3
SHA1 7362c41d67c0f601bdbc01986a5a058b00bca4a3
SHA256 eb0c59c7c42928369410ceb12bef0da573aafefa94c52700a796247cc8925965
SHA512 ff98b8ecf6ef0b9242108797d57365507907010d4cd11972253d383cac3f75d1a052fe2920b91856d828f4670b65f1cf009cbf9a1127cf49e5732d9d2cf5a255

C:\Users\Admin\AppData\Local\Temp\Unicorn-2772.exe

MD5 427e07cbbb11d52a0cdb41afa2ca8a2f
SHA1 60df2b1256385df3553957623d3d449e967ff1f4
SHA256 43828299cc196f643fdb7b5371ff98298b429aa33c349a296547c430027e0be1
SHA512 f46b0e902e1abb11c89bb5c476aae32cdb870040db8658f1a813c2b10faf7b8f34bc363c87867b1106e82e88728a0d199afb15b97d7a49821bf775c7674e2651

C:\Users\Admin\AppData\Local\Temp\Unicorn-43805.exe

MD5 faeea6c1a5ed3c5ae1a1732fa8cfb4c3
SHA1 97943cd7ddd4bf7aa8e8887c056b995b8147058e
SHA256 899dae92c0833ecec3899d4ad2af759e48d3e83b1a3b251f366c3638f95453e2
SHA512 0a6826a49e47ea97d00c426b7b705bdc171c359df0bfc264688cb5e2cbd5ed77e7a213b6e5c39fc0f1feb400c47f59bbe432da4734eca353d1ae294450394357

C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe

MD5 9cb6941c6a2b73d35c5eaadff5a34d62
SHA1 cd9606a9deb7dcb1c2e09af4c0db6844755953b8
SHA256 aefa2994f51fa0bf0d62d56545aaa42187b7b6dfff8b314ff2f198ee5744db56
SHA512 eec0ed3866569231b68f8c6fc4262dda34dd45e29520005bdfa21a9d15ff194b0f5a4fb8689f1d500aa503dc4817007849d72b8440dfac9c2711c6249f2fce3d

C:\Users\Admin\AppData\Local\Temp\Unicorn-35637.exe

MD5 d57c4329272e1093c4140c9f6fe46857
SHA1 186456eff232e8b8d44875a708b0f4d2121ff368
SHA256 dacf0598e76205d755ad5cf699fd27561783d84451cfa899b7bce7a2f1710b9f
SHA512 e642b6014dbe536a685cd85f7f1494f572d41d3828e6e8d9beefe3961f236fc3a4a05d184a14710a44104f85e334a2267907e5861357b463a304450dff7fbed4

C:\Users\Admin\AppData\Local\Temp\Unicorn-62040.exe

MD5 361015ba4980206637ce0d0087147a9e
SHA1 22cfd2ce670a36bfe5776343706c6053f4642499
SHA256 f6cc5653e837d48cea1ff08580a0bc4f559d01fa96fcbfd5207238fcfd006718
SHA512 5a16236edb467fd1e97e93ac2f6149fdcf4285c6e0aba6107bc3d3eea95353bfbe6a2167ebeb8a6a44af8bf6e9c9dde52fca6cc6856ab9aecd6e0b1be51c7f9c

C:\Users\Admin\AppData\Local\Temp\Unicorn-16369.exe

MD5 f7c7b8c49b2a4aa958eead61c99e9ae9
SHA1 dd03f89ad8a44e817eae9fb7e00ea546482840d5
SHA256 3372e1ea2c3b574c406c06d4a11e4f6b37e2af29df853b6045f38d461f96b070
SHA512 664c25c7c07c463eb7bb2aaa44e53af41d32f8ce869b85f3ba91e75675abe73820c239e6b9c4594f1af2a99faad345fa03081b271b74c6ff24746351429efa60

C:\Users\Admin\AppData\Local\Temp\Unicorn-26901.exe

MD5 9c6315db22b05ad59179217dd17b4b83
SHA1 b8a9575c430815febc4e930a1e7a9feceff385b2
SHA256 5605c60e2fcdeb289264f8edef9459bab1679188ead4c805f879bca32a78e7f6
SHA512 4b44b77390ef5348329656b0b19b082175718960bd1f157dac27063d647eea3d59deb0547c3138f7a045a9819f94fb89fb1afa59a4706605e8743128d008b59a

C:\Users\Admin\AppData\Local\Temp\Unicorn-2552.exe

MD5 169fa2a580d9bf39898cea71e3e14cbb
SHA1 9893fb69218bf0beaa55e362a58c5e4e57ad3e13
SHA256 b321d87b0053a7ab585f77c074f8ce5c40d796eff5ff889675be8f4f6e476fab
SHA512 75da9bd96b3c51a3c444948609d8091d978ef32270f9e1bd834e1651e713141614ef195bdef33965a9c1563d91166e69b752c4f200f6b4a4005c396ed1ef3cae

C:\Users\Admin\AppData\Local\Temp\Unicorn-63673.exe

MD5 15ba13a7c20ee32946db305a3f542e07
SHA1 61f3dfbd796dcd6288e62dffde00c525e134fe50
SHA256 582a21f79998178536df8a428c8b59f7d3e00130227fd2f83e99b025ab6b86b2
SHA512 69347771581a375a9e664050cae4da12ac29a480146bce3d0cdb9220ef2e482c04b499857ce3898d69314d8ed93fea3782dd24fd002bfc7ffaa07e8f0910b223

C:\Users\Admin\AppData\Local\Temp\Unicorn-62257.exe

MD5 afcf6991db892db9d63b8462a9beadde
SHA1 53798419af8d781f99d0a2ce718d0771a780ee44
SHA256 8220ded47fce997106560b54831412c511c34403b6fabc209ba3aca70de4c5c1
SHA512 b21264f43f93a3ae80a353735d354aca83b75eef72cdb2d78b1fcd3131d7d59554da56042e4145e91e40abea1a33f6ddfffdd6f16941da4e0a8f909985a640e6

C:\Users\Admin\AppData\Local\Temp\Unicorn-16786.exe

MD5 d5d0f1653708270876b40283746f85f3
SHA1 ad768c3b7a07cf76efcc1fa49d1dd31826a9b617
SHA256 e6ce3be87f7f196bde35ba9887843675524ff32500d7edc950dffff82bdec848
SHA512 4e2e1e2eada0f8102c2065f033190e528bf16135ed31dd409a5a75cfdad4213f3fe769194cff3ebc4d6286da5c86cabd7a54cc3a055e2bc4e10c2c40b53321ae

C:\Users\Admin\AppData\Local\Temp\Unicorn-55582.exe

MD5 72248984da18dd446c7e54f6b2866425
SHA1 8abfe943286265dc3634d13f0d3f1c093538cb6e
SHA256 9f5263417a3c836fb93f2328a51422c741c84a1127fb271fbe92607323931f69
SHA512 5c0eac8a77449d1687b12c133b139d1ae0d27d97b530448767b0c11433a56a5ebc304d72c72f0ba454577a85d8a4d3d89da7e5d0fe23d723aa9bba61461db865

C:\Users\Admin\AppData\Local\Temp\Unicorn-59002.exe

MD5 246a5aa0734ca9f7064afa31b2b646ea
SHA1 3512c77be4ae7ae2574923b1711744f949c5ed28
SHA256 baf97bd6b71af5d9005ad09007ca2e3dd8628cc0c5d7ab365017cac91e1e9a24
SHA512 adfebc8d0b2e79ebe0ed4dfc002d8943a185f1a5593c99b1f701756b8c2d8d4d6b7f873e1b06cd30eab7d6bbe2735faa96ea97dc46e0cd833ea4cdab7fe78387