Malware Analysis Report

2025-01-18 00:02

Sample ID 240603-qp3s5sfh6v
Target a4ec832cbc98fa81feeb5ff9b06b7c30_NeikiAnalytics.exe
SHA256 25e1552e901f089cd45586cf3d2ddc2e750be2bdca24adec0c10964947ec050d
Tags
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

25e1552e901f089cd45586cf3d2ddc2e750be2bdca24adec0c10964947ec050d

Threat Level: Shows suspicious behavior

The file a4ec832cbc98fa81feeb5ff9b06b7c30_NeikiAnalytics.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary


Loads dropped DLL

Executes dropped EXE

Program crash

Unsigned PE

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-03 13:27

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 13:27

Reported

2024-06-03 13:29

Platform

win7-20240419-en

Max time kernel

150s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a4ec832cbc98fa81feeb5ff9b06b7c30_NeikiAnalytics.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65151.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64440.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27107.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38805.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29926.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21758.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63345.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17674.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63345.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18202.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54596.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50512.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26562.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46428.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29153.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1119.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16901.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42151.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30497.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6547.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22329.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63916.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55748.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36610.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12660.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12105.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57777.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1005.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29786.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1752.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58182.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37762.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23049.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33678.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5644.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21426.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56379.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49835.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48211.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50432.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9077.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-41941.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25736.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1786.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-45964.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33712.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9762.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25544.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1594.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13291.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13291.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50795.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5123.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46711.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46711.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62492.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4ec832cbc98fa81feeb5ff9b06b7c30_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4ec832cbc98fa81feeb5ff9b06b7c30_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4ec832cbc98fa81feeb5ff9b06b7c30_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65151.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65151.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4ec832cbc98fa81feeb5ff9b06b7c30_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64440.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64440.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65151.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65151.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27107.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27107.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64440.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38805.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64440.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38805.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29926.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29926.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27107.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27107.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63345.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63345.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17674.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17674.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38805.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38805.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63345.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63345.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\a4ec832cbc98fa81feeb5ff9b06b7c30_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-65151.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64440.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27107.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38805.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29926.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-21758.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63345.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17674.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63345.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1005.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42152.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18202.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54596.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-50512.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-46428.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26562.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29153.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1119.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-16901.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-30497.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6547.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-10076.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22329.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14160.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55748.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63916.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-36610.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12660.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12105.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57777.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1752.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29786.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-58182.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33678.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37762.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-21426.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-23049.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-5644.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42151.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-49835.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-56379.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48211.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1594.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-62492.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-13291.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-45964.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25544.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9762.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-41941.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-46711.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4604.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17049.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-50084.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-50432.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25736.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-45808.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-45253.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-41169.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9077.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1786.exe

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4ec832cbc98fa81feeb5ff9b06b7c30_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65151.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64440.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27107.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38805.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29926.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21758.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63345.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17674.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63345.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18202.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54596.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50512.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26562.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46428.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29153.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1119.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16901.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42151.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30497.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6547.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22329.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63916.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55748.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36610.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12660.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12105.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57777.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29786.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1752.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58182.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37762.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33678.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23049.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5644.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21426.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56379.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49835.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48211.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50432.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9077.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-41941.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25736.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1786.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-45964.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33712.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9762.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25544.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1594.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13291.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13291.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50795.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46711.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5123.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46711.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62492.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2428 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\a4ec832cbc98fa81feeb5ff9b06b7c30_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-65151.exe
PID 2428 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\a4ec832cbc98fa81feeb5ff9b06b7c30_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-65151.exe
PID 2428 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\a4ec832cbc98fa81feeb5ff9b06b7c30_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-65151.exe
PID 2428 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\a4ec832cbc98fa81feeb5ff9b06b7c30_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-65151.exe
PID 2088 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65151.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64440.exe
PID 2088 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65151.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64440.exe
PID 2088 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65151.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64440.exe
PID 2088 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65151.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64440.exe
PID 2428 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\a4ec832cbc98fa81feeb5ff9b06b7c30_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe
PID 2428 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\a4ec832cbc98fa81feeb5ff9b06b7c30_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe
PID 2428 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\a4ec832cbc98fa81feeb5ff9b06b7c30_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe
PID 2428 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\a4ec832cbc98fa81feeb5ff9b06b7c30_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe
PID 2428 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\a4ec832cbc98fa81feeb5ff9b06b7c30_NeikiAnalytics.exe C:\Windows\SysWOW64\WerFault.exe
PID 2428 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\a4ec832cbc98fa81feeb5ff9b06b7c30_NeikiAnalytics.exe C:\Windows\SysWOW64\WerFault.exe
PID 2428 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\a4ec832cbc98fa81feeb5ff9b06b7c30_NeikiAnalytics.exe C:\Windows\SysWOW64\WerFault.exe
PID 2428 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\a4ec832cbc98fa81feeb5ff9b06b7c30_NeikiAnalytics.exe C:\Windows\SysWOW64\WerFault.exe
PID 2776 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64440.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe
PID 2776 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64440.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe
PID 2776 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64440.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe
PID 2776 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64440.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe
PID 2088 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65151.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27107.exe
PID 2088 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65151.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27107.exe
PID 2088 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65151.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27107.exe
PID 2088 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65151.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27107.exe
PID 2832 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38805.exe
PID 2832 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38805.exe
PID 2832 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38805.exe
PID 2832 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38805.exe
PID 2088 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65151.exe C:\Windows\SysWOW64\WerFault.exe
PID 2088 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65151.exe C:\Windows\SysWOW64\WerFault.exe
PID 2088 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65151.exe C:\Windows\SysWOW64\WerFault.exe
PID 2088 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65151.exe C:\Windows\SysWOW64\WerFault.exe
PID 2764 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27107.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29926.exe
PID 2764 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27107.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29926.exe
PID 2764 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27107.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29926.exe
PID 2764 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27107.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29926.exe
PID 2632 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-21758.exe
PID 2632 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-21758.exe
PID 2632 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-21758.exe
PID 2632 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-21758.exe
PID 2776 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64440.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63345.exe
PID 2776 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64440.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63345.exe
PID 2776 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64440.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63345.exe
PID 2776 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64440.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63345.exe
PID 2828 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38805.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17674.exe
PID 2828 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38805.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17674.exe
PID 2828 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38805.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17674.exe
PID 2828 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38805.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17674.exe
PID 2832 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63345.exe
PID 2832 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63345.exe
PID 2832 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63345.exe
PID 2832 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63345.exe
PID 2776 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64440.exe C:\Windows\SysWOW64\WerFault.exe
PID 2776 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64440.exe C:\Windows\SysWOW64\WerFault.exe
PID 2776 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64440.exe C:\Windows\SysWOW64\WerFault.exe
PID 2776 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64440.exe C:\Windows\SysWOW64\WerFault.exe
PID 2832 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe C:\Windows\SysWOW64\WerFault.exe
PID 2832 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe C:\Windows\SysWOW64\WerFault.exe
PID 2832 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe C:\Windows\SysWOW64\WerFault.exe
PID 2832 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe C:\Windows\SysWOW64\WerFault.exe
PID 2356 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29926.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42152.exe
PID 2356 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29926.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42152.exe
PID 2356 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29926.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42152.exe
PID 2356 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29926.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42152.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a4ec832cbc98fa81feeb5ff9b06b7c30_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\a4ec832cbc98fa81feeb5ff9b06b7c30_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\Unicorn-65151.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65151.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64440.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64440.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27107.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27107.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38805.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38805.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-29926.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29926.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21758.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21758.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63345.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63345.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63345.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63345.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17674.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17674.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-42152.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42152.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18202.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18202.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54596.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54596.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50512.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50512.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26562.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26562.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46428.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46428.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-29153.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29153.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1119.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1119.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16901.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16901.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42151.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42151.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30497.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30497.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6547.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6547.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22329.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22329.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63916.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63916.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14160.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14160.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55748.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55748.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10076.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10076.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-36610.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36610.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12660.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12660.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-57777.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57777.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12105.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12105.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1005.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1005.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 148

C:\Users\Admin\AppData\Local\Temp\Unicorn-29786.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29786.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1752.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1752.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58182.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58182.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37762.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37762.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33678.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33678.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23049.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23049.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5644.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5644.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21426.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21426.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-56379.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56379.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49835.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49835.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48211.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48211.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50432.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50432.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9077.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9077.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-41941.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41941.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25736.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25736.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1786.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1786.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63239.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63239.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45964.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45964.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33712.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33712.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9762.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9762.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25544.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25544.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1594.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1594.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13291.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13291.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13291.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13291.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50795.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50795.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5123.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5123.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46711.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46711.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46711.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46711.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62492.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62492.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58024.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58024.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-4604.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4604.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57889.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57889.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29855.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29855.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-17049.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17049.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-50084.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50084.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-8304.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8304.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45808.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45808.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45253.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45253.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41169.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41169.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8859.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8859.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16473.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16473.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9456.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9456.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42875.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42875.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54573.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54573.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38237.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38237.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5180.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5180.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5180.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5180.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34515.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34515.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54381.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54381.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30431.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30431.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42129.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42129.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38045.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38045.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10011.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10011.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10011.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10011.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25793.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25793.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17625.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17625.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17625.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17625.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54744.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54744.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54744.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54744.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9072.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9072.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46576.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46576.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-904.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-904.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-904.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-904.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42491.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42491.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-7977.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7977.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53094.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53094.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25060.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25060.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36758.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36758.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11869.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11869.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-49373.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49373.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52902.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52902.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-19654.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19654.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11485.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11485.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53073.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53073.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48989.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48989.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44905.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44905.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12793.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12793.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61994.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61994.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29876.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29876.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29322.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29322.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-904.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-904.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16686.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16686.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17755.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17755.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53634.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53634.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43005.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43005.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38921.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38921.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1781.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1781.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50982.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50982.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-14630.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14630.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10546.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10546.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39881.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39881.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35797.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35797.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39327.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39327.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34859.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34859.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30775.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30775.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30775.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30775.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60110.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60110.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56026.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56026.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6270.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6270.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35605.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35605.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51387.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51387.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34667.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34667.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14246.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14246.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6078.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6078.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1994.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1994.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51195.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51195.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47111.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47111.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23161.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23161.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43027.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43027.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-375608510546233.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-375608510546233.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6441.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6441.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 372 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-15206.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15206.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56239.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56239.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6846.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6846.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48242.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48242.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36587.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36587.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-46571.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46571.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-45440.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45440.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-9046.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9046.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-6306.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6306.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5922.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5922.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 292 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-64189.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64189.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60105.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60105.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60105.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60105.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-11651.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11651.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7567.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7567.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-11096.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11096.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-61449.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61449.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-53281.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53281.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12995.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12995.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32861.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32861.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7972.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7972.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-25055.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25055.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12248.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12248.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52897.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52897.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61812.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61812.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3504.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3504.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-11864.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11864.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 268 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-53857.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53857.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-10556.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10556.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30422.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30422.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 820 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-58626.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58626.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50458.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50458.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46374.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46374.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46374.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46374.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30038.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30038.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2565.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2565.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 300 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 888 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-51574.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51574.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51574.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51574.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55658.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55658.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18902.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18902.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10349.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10349.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47298.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47298.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35046.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35046.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22794.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22794.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22794.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22794.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51745.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51745.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-35408.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35408.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-30770.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30770.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-60702.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60702.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-31922.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31922.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-43982.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43982.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-32607.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32607.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-45819.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45819.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41735.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41735.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-12762.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12762.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-510.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-510.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49711.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49711.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14106.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14106.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55139.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55139.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51055.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51055.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59031.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59031.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-50671.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50671.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-54563.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54563.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42311.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42311.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-369358082142881.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-369358082142881.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38227.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38227.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55907.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55907.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39379.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39379.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64760.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64760.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36940.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36940.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-5227.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5227.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45876.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45876.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-18802.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18802.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 988 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3508 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-48253.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48253.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-33069.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33069.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 608 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-13333.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13333.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-10209.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10209.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30822.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30822.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5933.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5933.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38798.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38798.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3584 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-5741.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5741.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-38606.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38606.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-18186.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18186.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-46582.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46582.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52010.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52010.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-35674.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35674.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3280 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-6509.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6509.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-23038.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23038.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32083.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32083.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8730.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8730.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45679.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45679.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-24875.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24875.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3848 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-24683.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24683.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28767.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28767.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9498.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9498.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5222.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5222.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38087.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38087.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5030.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5030.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50147.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50147.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29727.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29727.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17091.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17091.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4036 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-43131.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43131.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3972 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-14158.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14158.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-47900.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47900.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-48860.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48860.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40308.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40308.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31948.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31948.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15611.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15611.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3752 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-40747919590713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40747919590713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16728.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16728.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25642.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25642.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-1631.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1631.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3892 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-1076.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1076.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63873.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63873.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30817.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30817.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63681.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63681.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22457.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22457.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2036.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2036.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3660 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-22265.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22265.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35861.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35861.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35861.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35861.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3188.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3188.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11164.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11164.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27117.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27117.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40713.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5112 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-45290.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45290.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24870.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24870.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-51486.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51486.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-18622.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18622.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3332 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-53323.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53323.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49239.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49239.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4100 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4296 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-57983.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57983.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-49431.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49431.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-55316.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55316.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5164 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5368 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-59841.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59841.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-26593.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26593.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4309.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4309.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5248 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5132 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5152 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4208 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-29520.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29520.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-46624.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46624.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5412 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-7703.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7703.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45529.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45529.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42213.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42213.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5456.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5456.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58357.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58357.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37553.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37553.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33469.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33469.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10308.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10308.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55425.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55425.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38513.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38513.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31414.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31414.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40734.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40734.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65430.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65430.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44626.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44626.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5488 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-24206.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24206.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24014.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24014.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15846.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15846.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36074.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36074.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5524 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-49442.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49442.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45358.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45358.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5688 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-16386.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16386.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16386.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16386.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63339.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63339.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55171.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55171.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26583.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26583.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27735.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27735.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27351.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27351.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62628.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62628.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42208.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42208.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5936 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-59504.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59504.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39084.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39084.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6128 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-214616330916897.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-214616330916897.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45005.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45005.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45005.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45005.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24009.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24009.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19925.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19925.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11756.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11756.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5244 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-25353.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25353.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13100.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13100.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12908.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12908.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49857.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49857.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20885.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20885.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-464.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-464.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-464.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-464.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5388 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-272.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-272.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5468 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-22097.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22097.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39118.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39118.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5544 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5700 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5736 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-22590.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22590.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44354.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44354.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5264 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5520 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5396 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5140 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5408 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5484 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6208 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6280 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6340 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6392 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6472 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-4452.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4452.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33363.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33363.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6604 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6776 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-63295.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63295.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6632 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6852 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6760 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6824 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-63871.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63871.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6720 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6956 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7044 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-34899.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34899.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7160 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6688 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6704 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-27089.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27089.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6816 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6836 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-52325.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52325.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6980 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7100 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7052 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6368 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6976 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6696 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6792 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6848 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-30810.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30810.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6156 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6740 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7056 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6152 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6336 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5664 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5600 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7244 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7272 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7024 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7464 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7548 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7780 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7808 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-49772.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49772.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-379.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-379.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61832.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61832.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8064 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8140 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-26202.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26202.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58490.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58490.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7412 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-17458.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17458.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10633.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10633.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42922.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42922.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14333.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14333.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50898.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50898.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42730.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42730.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42730.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42730.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38646.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38646.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22310.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22310.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43882.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43882.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65179.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65179.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3534.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3534.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56819.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56819.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40483.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40483.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54079.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54079.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54811.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54811.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54811.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54811.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50535.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50535.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32314.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32314.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32314.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32314.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52180.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52180.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53887.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53887.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17130.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17130.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13944.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13944.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9860.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9860.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8364 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-21729.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21729.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8532 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8456 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-18797.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18797.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64489.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64489.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62818.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62818.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9068 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9148 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8328 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8612 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8712 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8300 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9080 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9180 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9076 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8656 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8448 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9380 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8384 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9136 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9308 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9232 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9416 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9644 -s 204

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9532 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9516 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8388 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8788 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9636 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9352 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9272 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9716 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9744 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9888 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9788 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-61874.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61874.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16374.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16374.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9956 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10032 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-19747.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19747.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31096.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31096.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19612.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19612.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21891878597363.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21891878597363.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24765.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24765.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1568.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1568.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34049.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34049.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21413.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21413.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7297.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7297.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7297.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7297.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39586.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39586.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27334.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27334.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64282.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64282.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20510.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20510.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12341.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12341.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57266.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57266.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56882.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56882.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-857.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-857.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49866.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49866.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46275.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46275.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10168 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10204 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-8615.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8615.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49648.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49648.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9332 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9368 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9580 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9504 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-20697.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20697.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9568 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9632 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-19218.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19218.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9756 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9712 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9952 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9856 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10044 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10176 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10076 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9228 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9328 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10236 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9740 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9832 -s 216

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\Unicorn-65151.exe

MD5 65765f919ad5fc1f0351786f53a46239
SHA1 4a52920a55eb59f152a1fc593dc3524170cc6194
SHA256 61229241404ea9fbfcb2b26aa7d33be17db762024273753af671b762f910d1c8
SHA512 cd7e826e8dba8055ee50c49d27b555345789c3f10f219ae349f4584add05bf30f58262746b79da1e1b45463c8c49d7d414a0d014e391d345f71fe62bb58f9d96

\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe

MD5 45d262e0e5111b7ff0a679e2c1a8c499
SHA1 eaf5d5a5399ef9afa2a20dfaaad9f8696f63a342
SHA256 2a2f2cf7317d2151abb6b6d62ceaaa01cd3a53295c7fac4040ca3f0118f7101f
SHA512 e417fa4e2726232bdb4de7459155930176442df50d863f4be462e43d2937f83224725927c37a2ef054d6bac25d787b02cb9a5e8c5596018f2ba486cf030eb496

\Users\Admin\AppData\Local\Temp\Unicorn-64440.exe

MD5 fd3c7c096297c6cd92a244ece841bbd4
SHA1 dae3d1f746236731004f50a89e359c54e19bb865
SHA256 bfe9ed2a433ec16f7d6ba652e47ab4439f59b0ab2aabe5aa03eb772a8743786b
SHA512 fc5c567dd6ec96526e6791e53f0133e9250890fd36f84faf7af7f7f340a8e8072f748f1e06151a3e295891d7d04a34b984cde210d9480fc876e4c0359708e04a

\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe

MD5 a4c871b9dbc426e5e402cbea144a5d08
SHA1 f4651cce20f13fe5f0111edf1a3ca88c457a296b
SHA256 7bb1d9da824efc1e3efc4f30e1561b4e2634274d9fcdc96ef437a2583b3dd09e
SHA512 3a06640737369ffa92fd8caac6b3a8f9f43d2edba41ae7ae98159f31d3fa0f24242809cd7c30dc64a0b647ffbdec798c6bed85adcd97002ffc1595c51d1c5407

\Users\Admin\AppData\Local\Temp\Unicorn-27107.exe

MD5 9637e0ff0070880325afedd4d4f77163
SHA1 11b98e47b1f4f18ec03eab430a02b76ecdd6e23a
SHA256 1f59beb8be0f4a6d27779289ac553c3bbb90498caaae2cfff906b0691e24f953
SHA512 64c280a141736bdb54b81ed12c9b2c142c22c87d8ed77533ec53f53db95a20a17534d197da544f79138f985f310138d0e45f08806a070ad610f6be21bed1c30e

\Users\Admin\AppData\Local\Temp\Unicorn-38805.exe

MD5 8fc205358e4c2b243897e21048007f75
SHA1 8f6dcc44822261dfada8052d76e14c3782972b83
SHA256 e97ac60bd904bed722ea4e83ea1694c0cecf33f7da86176a10cb941534769710
SHA512 1b4a93b35555488cfa735d210f8a0ebf7ccd50772aa4d10de5b38f61ed7ab9dbd65c33c19b373749f3898cef83e0013b0b094b26d2f4ed3c56e3a3e94e3ff11a

\Users\Admin\AppData\Local\Temp\Unicorn-29926.exe

MD5 41d296e1acc49dc8abeacb67af2e7f36
SHA1 87960089e75c9943e280ab71361847aed0139b2c
SHA256 caa6949a3a87af86474800606b4cfa2fd2e151b3d3c4d5b008f102e656026c6f
SHA512 56b2e8a87b9891d1321279e12a1b09a6598d6c8739b4520b6eab7aedaeb22e286f91983fcf53e7417f1ce1509fd17770ecd7dba042f8aea5f65f6c42f703148c

\Users\Admin\AppData\Local\Temp\Unicorn-21758.exe

MD5 654fad8725888fd2f3e707998bdd63ed
SHA1 efe33dd731505630c4080c60ba36169a640d394f
SHA256 11c03ff23ace7b63f825310e777eeb9f3e5a71d264b3b86c4646634f50e8d11d
SHA512 3f3d79d2527919496202fe7b793e290a3937709215417f2dd2acf4b4c76163ec71a5dca698abf9caa92cf3fcbf01c84143c3f10246ee96793cc5012fa6c1807f

\Users\Admin\AppData\Local\Temp\Unicorn-63345.exe

MD5 662cf7353b365d8d09fce950fe3ef047
SHA1 0b224e19f032b0a4ee0685e282bf5fd3cff5e389
SHA256 b5594a249a8e7b12c3786a90be953da09b14f5dea5db6f2acc144ee3c7920db8
SHA512 9924dcc92046a2c836ad434b7c544f48acb45227188213ca2b946fdbd90711613eef39f88ed6e755290219fd54d794d412c21dc64abb01efb45907db13df7249

C:\Users\Admin\AppData\Local\Temp\Unicorn-17674.exe

MD5 41d84944131b5f5c04f1cda022a59b71
SHA1 e64fc493a17e0179ba1c16cf8bba8417b4db2734
SHA256 94dac99ab334e74cf509dce8640ac51877c34590f49dd7f45155be829f30ade0
SHA512 24a7d30a7029c91a4b4b9d554ac38b424e003244e0538bfe059318636684431ec985c30318248fc342f2b2e3673b85c99801d28d8c3376da6fb35ccbe9f2589c

\Users\Admin\AppData\Local\Temp\Unicorn-42152.exe

MD5 9b0789fa5c114fb31505ddfc7bd5a8d6
SHA1 3fc426a349897d838c78adb042a9e5dd7ee5b19e
SHA256 1fd93e39d1bcb789c5b8dccfec85ded411d39d774e01931b10c8477729b5e758
SHA512 e06be519f8b4d55fef599a3a6a461e93531a00b6554e9188fd850f69d0d3123f544219b3debb81fcd1b004fe6bf6ed9c0bb1f883ca1d92f945ba2fb112e7a240

\Users\Admin\AppData\Local\Temp\Unicorn-18202.exe

MD5 bb9791b4f11b4084e5845e850b33b166
SHA1 0da554be6ca6d06c240bf355c4b4f80e8bb337b2
SHA256 cbddc57215360c37086cbff904351a9d3dc4008f38b5e72254d7d8fceec1b914
SHA512 361e8b427dfdfa6916f534d1e081e0c59cca9b3b9d27840f04a8bc6de2dbf7a1f61c0e55d3fe5fed34f0a10a67f8d0aacc05ace0e4628cbefc11c61a766caf98

\Users\Admin\AppData\Local\Temp\Unicorn-54596.exe

MD5 cece3dff3b09d12eb5a9563ace1c559f
SHA1 550b0748c99f6414852f8ed1dbac8aeab31688a0
SHA256 cc251a6843d7de673fe9f8620ef37db3ed74a0ae0a705249ad0d50f143424650
SHA512 ab6efc46f53480b10ee1cf5f00becba4de0971214dfecd1ac3e0e1f6267aeb2a22ed866a10002af1dd35c7c58a449a51cd0ceecaba95586e03cb6c6e3e28e396

C:\Users\Admin\AppData\Local\Temp\Unicorn-39881.exe

MD5 bdd285c0cf2967617fcff1e30b366616
SHA1 f3ad7efa3681aa0a834b396ac203be820355febd
SHA256 7f39ba97b88fc6d595198d2169ee708b481938a79ca0abe077af88bbb7820b34
SHA512 49ded105f720dc768eed5f636cc362fa1444869eb4eca5d8c289dc4e45db3654d7271b0fc1da8a1aef4c9f5c1777236d2e66b2745a6a5aafb75b0a7e7591d118

C:\Users\Admin\AppData\Local\Temp\Unicorn-6078.exe

MD5 5d49c1a681c80685217ab415648da266
SHA1 2d461c78accd4372d962b6761ad1fc5a2b0fa85c
SHA256 b375d66f2986ccb33785e692524ea231eaf1d8f835321ac5254691264f5373dc
SHA512 f62083821a56748041364c7b7844b5a554f9abc2f1ce3a2d6aac62f3607ff02495176794d1e88f85859ee648d4d0ec749625e2fa850d93895ac2cb13087a6d9b

C:\Users\Admin\AppData\Local\Temp\Unicorn-6846.exe

MD5 b4d6cbaa8770d82c93c02a86a0d3ce4f
SHA1 30a9a06f6227b04649515a9ecc21d6d11578bbaf
SHA256 00f4d6685f247e82c2ca85140487c895e21752f59ad606ce7d977b8354794532
SHA512 89de3277cbdd99505e8c8f93f76ad2ac5c00bcb9caab9641a3bbfdcc17e118dea878f810c36db19b6125c57cadc9954d49a12d727cef7b10dd8ee051d64cd600

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-03 13:27

Reported

2024-06-03 13:29

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

112s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a4ec832cbc98fa81feeb5ff9b06b7c30_NeikiAnalytics.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33932.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65016.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-41066.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5639.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54840.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22722.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13371.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50875.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50320.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9650.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9095.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15255.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44591.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-39952.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15063.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44399.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64264.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-39760.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19894.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37980.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48047.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47492.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22412.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59915.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63444.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27242.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22220.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5883.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63252.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-39302.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27050.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59168.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1210.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29052.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12715.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50219.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46348.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51179.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58408.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58216.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17930.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-45772.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38948.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26696.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26696.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56031.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10359.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47863.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56031.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2191.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56031.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27272.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3322.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51392.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19274.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30972.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22804.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64391.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20064.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\a4ec832cbc98fa81feeb5ff9b06b7c30_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33932.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-41066.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-65016.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-5639.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54840.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22722.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-13371.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-50875.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-50320.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9650.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9095.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15255.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44591.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15063.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-39952.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44399.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64264.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37980.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48047.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-47492.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63444.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27050.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25160.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-5883.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32892.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37744.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-51688.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-30344.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9046.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53224.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59119.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-287.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-3758.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-23432.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-39296.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-17650.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-40552.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33344.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35818.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24984.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27458.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-10951.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48092.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9223.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29748.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-65004.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44179.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-28160.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-40116.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-40116.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-52747.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34630.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12887.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34164.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-58175.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-43012.exe
N/A N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26868.exe
N/A N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35716.exe
N/A N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16936.exe
N/A N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17128.exe
N/A N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53692.exe
N/A N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37740.exe

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4ec832cbc98fa81feeb5ff9b06b7c30_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33932.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-41066.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65016.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5639.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54840.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22722.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13371.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50875.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50320.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9650.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9095.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15255.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44591.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-39952.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15063.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44399.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-39760.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64264.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19894.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37980.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48047.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47492.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22412.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59915.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63444.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27242.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22220.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5883.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59168.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-63252.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-39302.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27050.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25160.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1210.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29052.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12715.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50219.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46348.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51179.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58408.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58216.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-17930.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-45772.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38948.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26696.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26696.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47863.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56031.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10359.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56031.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56031.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2191.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27272.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3322.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51392.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30972.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19274.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64391.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22804.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3500 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\a4ec832cbc98fa81feeb5ff9b06b7c30_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33932.exe
PID 3500 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\a4ec832cbc98fa81feeb5ff9b06b7c30_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33932.exe
PID 3500 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\a4ec832cbc98fa81feeb5ff9b06b7c30_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33932.exe
PID 4092 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33932.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-65016.exe
PID 4092 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33932.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-65016.exe
PID 4092 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33932.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-65016.exe
PID 3500 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\a4ec832cbc98fa81feeb5ff9b06b7c30_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-41066.exe
PID 3500 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\a4ec832cbc98fa81feeb5ff9b06b7c30_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-41066.exe
PID 3500 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\a4ec832cbc98fa81feeb5ff9b06b7c30_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-41066.exe
PID 5044 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-41066.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-5639.exe
PID 5044 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-41066.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-5639.exe
PID 5044 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-41066.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-5639.exe
PID 1920 wrote to memory of 6132 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65016.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54840.exe
PID 1920 wrote to memory of 6132 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65016.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54840.exe
PID 1920 wrote to memory of 6132 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65016.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54840.exe
PID 4092 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33932.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22722.exe
PID 4092 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33932.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22722.exe
PID 4092 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33932.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22722.exe
PID 1152 wrote to memory of 5156 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5639.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-13371.exe
PID 1152 wrote to memory of 5156 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5639.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-13371.exe
PID 1152 wrote to memory of 5156 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5639.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-13371.exe
PID 5044 wrote to memory of 5184 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-41066.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-50875.exe
PID 5044 wrote to memory of 5184 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-41066.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-50875.exe
PID 5044 wrote to memory of 5184 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-41066.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-50875.exe
PID 6132 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54840.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-50320.exe
PID 6132 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54840.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-50320.exe
PID 6132 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54840.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-50320.exe
PID 1920 wrote to memory of 5380 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65016.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9650.exe
PID 1920 wrote to memory of 5380 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65016.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9650.exe
PID 1920 wrote to memory of 5380 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65016.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9650.exe
PID 3356 wrote to memory of 5776 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22722.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9095.exe
PID 3356 wrote to memory of 5776 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22722.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9095.exe
PID 3356 wrote to memory of 5776 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22722.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9095.exe
PID 5156 wrote to memory of 3636 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13371.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15255.exe
PID 5156 wrote to memory of 3636 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13371.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15255.exe
PID 5156 wrote to memory of 3636 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13371.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15255.exe
PID 1152 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5639.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44591.exe
PID 1152 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5639.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44591.exe
PID 1152 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5639.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44591.exe
PID 5184 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50875.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-39952.exe
PID 5184 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50875.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-39952.exe
PID 5184 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50875.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-39952.exe
PID 4588 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50320.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15063.exe
PID 4588 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50320.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15063.exe
PID 4588 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50320.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15063.exe
PID 6132 wrote to memory of 5572 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54840.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44399.exe
PID 6132 wrote to memory of 5572 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54840.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44399.exe
PID 6132 wrote to memory of 5572 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54840.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44399.exe
PID 5380 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9650.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64264.exe
PID 5380 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9650.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64264.exe
PID 5380 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9650.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64264.exe
PID 5776 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9095.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-39760.exe
PID 5776 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9095.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-39760.exe
PID 5776 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9095.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-39760.exe
PID 3356 wrote to memory of 3992 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22722.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19894.exe
PID 3356 wrote to memory of 3992 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22722.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19894.exe
PID 3356 wrote to memory of 3992 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22722.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19894.exe
PID 3636 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15255.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37980.exe
PID 3636 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15255.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37980.exe
PID 3636 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15255.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37980.exe
PID 5156 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13371.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48047.exe
PID 5156 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13371.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48047.exe
PID 5156 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13371.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48047.exe
PID 3272 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44591.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-47492.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a4ec832cbc98fa81feeb5ff9b06b7c30_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\a4ec832cbc98fa81feeb5ff9b06b7c30_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\Unicorn-33932.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33932.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65016.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65016.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41066.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41066.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3500 -ip 3500

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 708

C:\Users\Admin\AppData\Local\Temp\Unicorn-5639.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5639.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54840.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54840.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22722.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22722.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4092 -ip 4092

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 724

C:\Users\Admin\AppData\Local\Temp\Unicorn-13371.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13371.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50875.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50875.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50320.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50320.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9650.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9650.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9095.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9095.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5044 -ip 5044

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 712

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1920 -ip 1920

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 740

C:\Users\Admin\AppData\Local\Temp\Unicorn-15255.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15255.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44591.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44591.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39952.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39952.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15063.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15063.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44399.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44399.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64264.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64264.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39760.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39760.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19894.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19894.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1152 -ip 1152

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 756

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 6132 -ip 6132

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6132 -s 768

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3356 -ip 3356

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 756

C:\Users\Admin\AppData\Local\Temp\Unicorn-37980.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37980.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48047.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48047.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47492.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47492.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22412.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22412.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59915.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59915.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63444.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63444.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27242.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27242.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22220.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22220.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5883.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5883.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63252.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63252.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39302.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39302.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59168.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59168.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27050.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27050.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5156 -ip 5156

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5156 -s 740

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5184 -ip 5184

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5184 -s 728

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4588 -ip 4588

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 752

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5380 -ip 5380

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5380 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5776 -ip 5776

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5776 -s 716

C:\Users\Admin\AppData\Local\Temp\Unicorn-25160.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25160.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1210.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1210.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29052.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29052.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12715.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12715.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50219.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50219.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46348.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46348.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51179.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51179.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58408.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58408.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58216.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58216.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17930.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17930.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45772.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45772.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38948.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38948.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26696.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26696.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26696.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26696.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10359.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10359.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56031.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56031.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56031.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56031.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47863.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47863.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2191.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2191.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56031.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56031.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3636 -ip 3636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 740

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3272 -ip 3272

C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27272.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27272.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3322.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3322.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3176 -ip 3176

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2436 -ip 2436

C:\Users\Admin\AppData\Local\Temp\Unicorn-51392.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51392.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19274.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19274.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5572 -ip 5572

C:\Users\Admin\AppData\Local\Temp\Unicorn-30972.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30972.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3812 -ip 3812

C:\Users\Admin\AppData\Local\Temp\Unicorn-22804.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22804.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64391.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64391.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3992 -ip 3992

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2984 -ip 2984

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5572 -s 744

C:\Users\Admin\AppData\Local\Temp\Unicorn-20064.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20064.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57567.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57567.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19872.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19872.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64988.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64988.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32486.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32486.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 744

C:\Users\Admin\AppData\Local\Temp\Unicorn-64796.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64796.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36378.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36378.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43992.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43992.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41806.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41806.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21386.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21386.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32892.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32892.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62227.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62227.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28424.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28424.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24340.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24340.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49591.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49591.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42574.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42574.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4364 -ip 4364

C:\Users\Admin\AppData\Local\Temp\Unicorn-9347.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9347.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62248.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62248.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41828.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41828.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37744.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37744.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37744.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37744.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37744.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37744.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62995.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62995.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62995.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62995.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4236 -ip 4236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4312 -ip 4312

C:\Users\Admin\AppData\Local\Temp\Unicorn-45528.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45528.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41444.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41444.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41444.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41444.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13410.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13410.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35174.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35174.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 764

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4380 -ip 4380

C:\Users\Admin\AppData\Local\Temp\Unicorn-30344.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30344.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26260.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26260.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9923.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9923.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54656.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54656.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26622.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26622.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2996 -ip 2996

C:\Users\Admin\AppData\Local\Temp\Unicorn-34236.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34236.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 532 -ip 532

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4628 -ip 4628

C:\Users\Admin\AppData\Local\Temp\Unicorn-51688.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51688.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51688.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51688.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19016.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19016.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39244.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4412 -ip 4412

C:\Users\Admin\AppData\Local\Temp\Unicorn-63940.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63940.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 940 -ip 940

C:\Users\Admin\AppData\Local\Temp\Unicorn-63748.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63748.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35714.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35714.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55580.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55580.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55580.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55580.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55580.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55580.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47028.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47028.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 368 -ip 368

C:\Users\Admin\AppData\Local\Temp\Unicorn-6187.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6187.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32590.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32590.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32590.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32590.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12170.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12170.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27952.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27952.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4002.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4002.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11615.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11615.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65263.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65263.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57095.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57095.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 532 -s 716

C:\Users\Admin\AppData\Local\Temp\Unicorn-11786.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11786.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40566.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40566.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56348.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56348.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53224.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53224.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 6012 -ip 6012

C:\Users\Admin\AppData\Local\Temp\Unicorn-44864.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44864.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11807.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11807.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25404.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25404.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21320.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21320.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17236.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17236.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6012 -s 740

C:\Users\Admin\AppData\Local\Temp\Unicorn-9067.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9067.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4980 -ip 4980

C:\Users\Admin\AppData\Local\Temp\Unicorn-58268.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58268.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62352.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62352.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62352.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62352.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58631.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58631.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4776 -ip 4776

C:\Users\Admin\AppData\Local\Temp\Unicorn-38210.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38210.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42102.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42102.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 2292 -ip 2292

C:\Users\Admin\AppData\Local\Temp\Unicorn-13130.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13130.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9046.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9046.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50676.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50676.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1432 -ip 1432

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 6100 -ip 6100

C:\Users\Admin\AppData\Local\Temp\Unicorn-59036.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59036.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62928.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62928.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62928.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62928.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 3200 -ip 3200

C:\Users\Admin\AppData\Local\Temp\Unicorn-1283.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1283.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1283.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1283.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46955.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46955.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5384 -ip 5384

C:\Users\Admin\AppData\Local\Temp\Unicorn-54184.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54184.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5756 -ip 5756

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 744

C:\Users\Admin\AppData\Local\Temp\Unicorn-51444.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51444.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27302.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27302.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6100 -s 740

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 6008 -ip 6008

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1116 -ip 1116

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 1396 -ip 1396

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 2056 -ip 2056

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3028 -ip 3028

C:\Users\Admin\AppData\Local\Temp\Unicorn-35876.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35876.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27708.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27708.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3758.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3758.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3758.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3758.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60572.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60572.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4216 -ip 4216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 5480 -ip 5480

C:\Users\Admin\AppData\Local\Temp\Unicorn-23432.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23432.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 5728 -ip 5728

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3364 -ip 3364

C:\Users\Admin\AppData\Local\Temp\Unicorn-51636.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51636.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4396 -ip 4396

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6008 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 4480 -ip 4480

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 3288 -ip 3288

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 6132 -ip 6132

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3552 -ip 3552

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 656 -ip 656

C:\Users\Admin\AppData\Local\Temp\Unicorn-20308.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20308.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48704.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48704.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44620.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44620.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44620.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44620.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16032.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16032.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16032.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16032.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11947.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11947.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16032.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16032.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16032.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16032.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16032.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16032.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 2532 -ip 2532

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5552 -ip 5552

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 3108 -ip 3108

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1128 -ip 1128

C:\Users\Admin\AppData\Local\Temp\Unicorn-49259.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49259.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49259.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49259.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 4852 -ip 4852

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3460 -ip 3460

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 6092 -ip 6092

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4932 -ip 4932

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 5020 -ip 5020

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1160 -ip 1160

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4780 -ip 4780

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 4588 -ip 4588

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 2820 -ip 2820

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 4956 -ip 4956

C:\Users\Admin\AppData\Local\Temp\Unicorn-13234.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13234.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62435.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62435.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4896 -ip 4896

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 2096 -ip 2096

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3824 -ip 3824

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 840 -ip 840

C:\Users\Admin\AppData\Local\Temp\Unicorn-63395.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63395.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63395.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63395.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59119.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59119.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59119.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59119.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 724

C:\Users\Admin\AppData\Local\Temp\Unicorn-63416.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63416.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 668

C:\Users\Admin\AppData\Local\Temp\Unicorn-14983.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14983.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6815.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6815.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10899.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10899.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14983.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14983.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47464.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47464.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47464.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47464.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47464.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47464.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43380.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43380.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47464.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47464.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39296.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39296.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47464.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47464.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39296.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39296.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31128.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31128.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39296.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39296.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10707.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10707.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10707.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10707.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39296.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39296.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39296.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39296.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 452 -ip 452

C:\Users\Admin\AppData\Local\Temp\Unicorn-6623.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6623.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27044.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27044.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 4880 -ip 4880

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 1632 -ip 1632

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 1580 -ip 1580

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4544 -ip 4544

C:\Users\Admin\AppData\Local\Temp\Unicorn-59716.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59716.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55632.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55632.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55632.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55632.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 3100 -ip 3100

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 820 -ip 820

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 2424 -ip 2424

C:\Users\Admin\AppData\Local\Temp\Unicorn-48424.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48424.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11859.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11859.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 452 -s 640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 728

C:\Users\Admin\AppData\Local\Temp\Unicorn-20028.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20028.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5484 -ip 5484

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 5936 -ip 5936

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 4248 -ip 4248

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 2516 -ip 2516

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5032 -ip 5032

C:\Users\Admin\AppData\Local\Temp\Unicorn-183.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-183.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61636.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61636.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40832.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40832.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 5976 -ip 5976

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 5208 -ip 5208

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 5076 -ip 5076

C:\Users\Admin\AppData\Local\Temp\Unicorn-5227.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5227.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 888 -ip 888

C:\Users\Admin\AppData\Local\Temp\Unicorn-17288.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17288.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17288.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17288.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17288.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17288.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17288.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17288.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 388 -ip 388

C:\Users\Admin\AppData\Local\Temp\Unicorn-54236.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54236.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45684.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45684.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41600.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41600.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41600.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41600.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17650.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17650.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33432.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33432.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-567.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-567.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4960 -ip 4960

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 3520 -ip 3520

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 1004 -ip 1004

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5456 -ip 5456

C:\Users\Admin\AppData\Local\Temp\Unicorn-14163.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14163.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18248.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18248.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 3796 -ip 3796

C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 3188 -ip 3188

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 5560 -ip 5560

C:\Users\Admin\AppData\Local\Temp\Unicorn-2274.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2274.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 5296 -ip 5296

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 4824 -ip 4824

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 816 -ip 816

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 4424 -ip 4424

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4720 -ip 4720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3136 -ip 3136

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1544 -ip 1544

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 4924 -ip 4924

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 5056 -ip 5056

C:\Users\Admin\AppData\Local\Temp\Unicorn-35870.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35870.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31786.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31786.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 444 -ip 444

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 712 -ip 712

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 1500 -ip 1500

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1184 -ip 1184

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 1232 -ip 1232

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 4708 -ip 4708

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 1920 -ip 1920

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 5700 -ip 5700

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 1120 -ip 1120

C:\Users\Admin\AppData\Local\Temp\Unicorn-44444.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44444.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44444.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44444.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39976.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39976.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44444.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44444.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44444.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44444.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44444.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44444.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44444.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44444.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3582.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3582.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3582.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3582.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3582.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3582.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44444.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44444.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 3464 -ip 3464

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 5236 -ip 5236

C:\Users\Admin\AppData\Local\Temp\Unicorn-6919.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6919.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4192 -ip 4192

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 760 -ip 760

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 3656 -ip 3656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 3896 -ip 3896

C:\Users\Admin\AppData\Local\Temp\Unicorn-53380.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53380.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53380.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53380.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 2884 -ip 2884

C:\Users\Admin\AppData\Local\Temp\Unicorn-28492.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28492.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3987.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3987.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3987.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3987.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1100 -ip 1100

C:\Users\Admin\AppData\Local\Temp\Unicorn-45020.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45020.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45020.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45020.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45020.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45020.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40552.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40552.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40552.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40552.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 4300 -ip 4300

C:\Users\Admin\AppData\Local\Temp\Unicorn-36468.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36468.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 3684 -ip 3684

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3376 -ip 3376

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 448 -ip 448

C:\Users\Admin\AppData\Local\Temp\Unicorn-33344.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33344.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29260.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29260.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 4556 -ip 4556

C:\Users\Admin\AppData\Local\Temp\Unicorn-49872.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49872.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45788.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45788.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24984.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24984.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 936 -ip 936

C:\Users\Admin\AppData\Local\Temp\Unicorn-28876.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28876.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4940 -ip 4940

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 5664 -ip 5664

C:\Users\Admin\AppData\Local\Temp\Unicorn-287.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-287.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4404 -ip 4404

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5372 -ip 5372

C:\Users\Admin\AppData\Local\Temp\Unicorn-62892.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62892.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 1520 -ip 1520

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 6048 -ip 6048

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 1576 -ip 1576

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 2484 -ip 2484

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 2864 -ip 2864

C:\Users\Admin\AppData\Local\Temp\Unicorn-13307.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13307.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9223.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9223.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9223.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9223.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13307.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13307.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9223.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9223.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9223.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9223.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62508.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62508.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 1416 -ip 1416

C:\Users\Admin\AppData\Local\Temp\Unicorn-35072.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35072.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13307.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13307.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35818.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35818.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 3088 -ip 3088

C:\Users\Admin\AppData\Local\Temp\Unicorn-27458.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27458.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27458.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27458.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18714.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18714.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5736 -ip 5736

C:\Users\Admin\AppData\Local\Temp\Unicorn-27672.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27672.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 556 -ip 556

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2480 -ip 2480

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3624 -ip 3624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 2024 -ip 2024

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 636

C:\Users\Admin\AppData\Local\Temp\Unicorn-27480.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27480.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2924 -ip 2924

C:\Users\Admin\AppData\Local\Temp\Unicorn-64428.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64428.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5736 -s 548

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 5128 -ip 5128

C:\Users\Admin\AppData\Local\Temp\Unicorn-48092.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48092.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10951.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10951.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 3928 -ip 3928

C:\Users\Admin\AppData\Local\Temp\Unicorn-44179.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44179.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 6208 -ip 6208

C:\Users\Admin\AppData\Local\Temp\Unicorn-65388.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65388.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7827.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7827.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 6196 -ip 6196

C:\Users\Admin\AppData\Local\Temp\Unicorn-65196.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65196.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 3164 -ip 3164

C:\Users\Admin\AppData\Local\Temp\Unicorn-65004.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65004.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40116.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40116.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40116.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40116.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40116.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40116.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61283.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61283.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 6164 -ip 6164

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 6184 -ip 6184

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 6872 -ip 6872

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1492 -ip 1492

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 6652 -ip 6652

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 7064 -ip 7064

C:\Users\Admin\AppData\Local\Temp\Unicorn-21772.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21772.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 6172 -ip 6172

C:\Users\Admin\AppData\Local\Temp\Unicorn-13603.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13603.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54636.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54636.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46468.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46468.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 3724 -ip 3724

C:\Users\Admin\AppData\Local\Temp\Unicorn-29748.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29748.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 6220 -ip 6220

C:\Users\Admin\AppData\Local\Temp\Unicorn-29556.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29556.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58720.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58720.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25472.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25472.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 5596 -ip 5596

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 844 -ip 844

C:\Users\Admin\AppData\Local\Temp\Unicorn-62420.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62420.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42000.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42000.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 6916 -ip 6916

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 6332 -ip 6332

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 2552 -ip 2552

C:\Users\Admin\AppData\Local\Temp\Unicorn-14371.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14371.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 3612 -ip 3612

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 6324 -ip 6324

C:\Users\Admin\AppData\Local\Temp\Unicorn-35346.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35346.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35346.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35346.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35346.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35346.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42960.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42960.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 4528 -ip 4528

C:\Users\Admin\AppData\Local\Temp\Unicorn-59104.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59104.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46852.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46852.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 6928 -ip 6928

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 6864 -ip 6864

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 6936 -ip 6936

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 1496 -ip 1496

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 6692 -ip 6692

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1644 -ip 1644

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 5160 -ip 5160

C:\Users\Admin\AppData\Local\Temp\Unicorn-18840.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18840.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 6580 -ip 6580

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 2392 -ip 2392

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 6088 -ip 6088

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6936 -s 748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 5504 -ip 5504

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 2572 -ip 2572

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 712 -ip 712

C:\Users\Admin\AppData\Local\Temp\Unicorn-36328.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36328.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28160.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28160.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4210.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4210.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28160.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28160.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28160.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28160.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28160.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28160.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 4140 -ip 4140

C:\Users\Admin\AppData\Local\Temp\Unicorn-3655.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3655.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3655.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3655.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3655.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3655.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3655.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3655.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7739.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7739.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6160 -ip 6160

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2056 -ip 2056

C:\Users\Admin\AppData\Local\Temp\Unicorn-64724.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64724.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 532 -ip 532

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 712 -s 628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 2300 -ip 2300

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 4788 -ip 4788

C:\Users\Admin\AppData\Local\Temp\Unicorn-57708.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57708.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3516 -ip 3516

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 5316 -ip 5316

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 6536 -ip 6536

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5216 -ip 5216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2820 -ip 2820

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 6528 -ip 6528

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 6668 -ip 6668

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2896 -ip 2896

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 184 -ip 184

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 6688 -ip 6688

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 6664 -ip 6664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4852 -ip 4852

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 6704 -ip 6704

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 6436 -ip 6436

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 7152 -ip 7152

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 3632 -ip 3632

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 6416 -ip 6416

C:\Users\Admin\AppData\Local\Temp\Unicorn-33396.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33396.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 6912 -ip 6912

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 4584 -ip 4584

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5756 -ip 5756

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 4440 -ip 4440

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 2020 -ip 2020

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 6556 -ip 6556

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 6856 -ip 6856

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 4468 -ip 4468

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 7008 -ip 7008

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 6824 -ip 6824

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 6440 -ip 6440

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 7060 -ip 7060

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3356 -ip 3356

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 6736 -ip 6736

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 5004 -ip 5004

C:\Users\Admin\AppData\Local\Temp\Unicorn-531.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-531.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61984.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61984.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 6152 -ip 6152

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 6848 -ip 6848

C:\Users\Admin\AppData\Local\Temp\Unicorn-49732.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49732.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45648.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45648.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34548.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34548.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22296.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22296.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 7048 -ip 7048

C:\Users\Admin\AppData\Local\Temp\Unicorn-34548.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34548.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55715.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55715.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5959.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5959.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 3796 -ip 3796

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 6428 -ip 6428

C:\Users\Admin\AppData\Local\Temp\Unicorn-51631.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51631.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 6968 -ip 6968

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6152 -s 640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4368 -ip 4368

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7048 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 1596 -ip 1596

C:\Users\Admin\AppData\Local\Temp\Unicorn-34164.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34164.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30080.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30080.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17828.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17828.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17828.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17828.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 4856 -ip 4856

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1984 -ip 1984

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 6884 -ip 6884

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 6732 -ip 6732

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 4544 -ip 4544

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1768 -ip 1768

C:\Users\Admin\AppData\Local\Temp\Unicorn-43640.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43640.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 6592 -ip 6592

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 1796 -ip 1796

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 2304 -ip 2304

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 1944 -ip 1944

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 4960 -ip 4960

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 6964 -ip 6964

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4992 -ip 4992

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5576 -ip 5576

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3188 -ip 3188

C:\Users\Admin\AppData\Local\Temp\Unicorn-51424.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51424.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35088.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35088.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35088.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35088.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35088.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35088.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35088.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35088.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 3992 -ip 3992

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 3472 -ip 3472

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1388 -ip 1388

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 6600 -ip 6600

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5460 -ip 5460

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 624

C:\Users\Admin\AppData\Local\Temp\Unicorn-19712.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19712.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 752 -ip 752

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4032 -ip 4032

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 632

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1260 -ip 1260

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 5236 -ip 5236

C:\Users\Admin\AppData\Local\Temp\Unicorn-7267.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7267.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7267.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7267.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 3120 -ip 3120

C:\Users\Admin\AppData\Local\Temp\Unicorn-60552.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60552.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 6540 -ip 6540

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 712

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6772 -ip 6772

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 6680 -ip 6680

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 1800 -ip 1800

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 6544 -ip 6544

C:\Users\Admin\AppData\Local\Temp\Unicorn-52747.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52747.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20074.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20074.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20074.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20074.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 4064 -ip 4064

C:\Users\Admin\AppData\Local\Temp\Unicorn-20074.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20074.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 6016 -ip 6016

C:\Users\Admin\AppData\Local\Temp\Unicorn-36218.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36218.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56084.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56084.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 6296 -ip 6296

C:\Users\Admin\AppData\Local\Temp\Unicorn-19882.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19882.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 6132 -ip 6132

C:\Users\Admin\AppData\Local\Temp\Unicorn-49260.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49260.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29394.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29394.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13058.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13058.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 6128 -ip 6128

C:\Users\Admin\AppData\Local\Temp\Unicorn-53515.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53515.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6132 -s 640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6128 -s 632

C:\Users\Admin\AppData\Local\Temp\Unicorn-48684.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48684.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48684.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48684.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48684.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48684.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48684.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48684.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48684.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48684.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36432.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36432.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17164.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17164.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4048 -ip 4048

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 3368 -ip 3368

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 3100 -ip 3100

C:\Users\Admin\AppData\Local\Temp\Unicorn-12887.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12887.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58004.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58004.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20864.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20864.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16780.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16780.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 484 -ip 484

C:\Users\Admin\AppData\Local\Temp\Unicorn-49644.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49644.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21610.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21610.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54091.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54091.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54091.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54091.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41838.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41838.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37754.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37754.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 752

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 492 -ip 492

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 2864 -ip 2864

C:\Users\Admin\AppData\Local\Temp\Unicorn-55243.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55243.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9571.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9571.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42990.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42990.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42990.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42990.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42990.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42990.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42990.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42990.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42990.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42990.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42990.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42990.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42436.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42436.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29800.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29800.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29800.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29800.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21632.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21632.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21632.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21632.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59135.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59135.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55051.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55051.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34630.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34630.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 3816 -ip 3816

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 1460 -ip 1460

C:\Users\Admin\AppData\Local\Temp\Unicorn-18102.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18102.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37968.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37968.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26868.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26868.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35782.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35782.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 5472 -ip 5472

C:\Users\Admin\AppData\Local\Temp\Unicorn-64179.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64179.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2534.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2534.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43012.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43012.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34844.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34844.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30376.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30376.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63795.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63795.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55627.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55627.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 7136 -ip 7136

C:\Users\Admin\AppData\Local\Temp\Unicorn-60500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60500.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55648.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55648.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60863.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60863.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60863.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60863.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 4688 -ip 4688

C:\Users\Admin\AppData\Local\Temp\Unicorn-52140.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52140.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 5432 -ip 5432

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 752

C:\Users\Admin\AppData\Local\Temp\Unicorn-23722.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23722.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43588.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43588.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16152.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16152.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12067.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12067.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12067.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12067.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12067.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12067.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7983.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7983.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20982.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20982.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12067.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12067.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49187.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49187.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 6904 -ip 6904

C:\Users\Admin\AppData\Local\Temp\Unicorn-48995.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48995.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 3964 -ip 3964

C:\Users\Admin\AppData\Local\Temp\Unicorn-40826.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40826.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6904 -s 748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 872 -ip 872

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 3092 -ip 3092

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5952 -ip 5952

C:\Users\Admin\AppData\Local\Temp\Unicorn-57895.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57895.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36920.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36920.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 2532 -ip 2532

C:\Users\Admin\AppData\Local\Temp\Unicorn-1123.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1123.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22290.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22290.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5207.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5207.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 5896 -ip 5896

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 6104 -ip 6104

C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12991.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12991.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4823.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4823.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-739.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-739.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2428 -ip 2428

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 1684 -ip 1684

C:\Users\Admin\AppData\Local\Temp\Unicorn-41772.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41772.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37688.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37688.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5952 -s 660

C:\Users\Admin\AppData\Local\Temp\Unicorn-49940.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49940.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29520.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29520.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25436.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25436.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25436.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25436.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29520.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29520.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25436.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25436.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25436.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25436.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22504.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22504.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29520.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29520.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47755.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47755.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 6344 -ip 6344

C:\Users\Admin\AppData\Local\Temp\Unicorn-59452.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59452.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33604.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33604.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22504.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22504.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 1628 -ip 1628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 6060 -ip 6060

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 1352 -ip 1352

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 3456 -ip 3456

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 3492 -ip 3492

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 2996 -ip 2996

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5288 -ip 5288

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2044 -ip 2044

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5304 -ip 5304

C:\Users\Admin\AppData\Local\Temp\Unicorn-50708.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50708.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46624.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46624.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19188.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19188.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11019.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11019.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52052.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52052.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47968.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47968.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35716.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35716.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35716.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35716.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 6892 -ip 6892

C:\Users\Admin\AppData\Local\Temp\Unicorn-39416.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39416.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 3604 -ip 3604

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 4416 -ip 4416

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 4600 -ip 4600

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 5060 -ip 5060

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 5548 -ip 5548

C:\Users\Admin\AppData\Local\Temp\Unicorn-53183.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53183.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 2484 -ip 2484

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 1356 -ip 1356

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 6260 -ip 6260

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 7036 -ip 7036

C:\Users\Admin\AppData\Local\Temp\Unicorn-60967.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60967.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60967.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60967.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52799.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52799.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52799.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52799.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44631.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44631.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56328.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56328.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56328.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56328.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44076.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44076.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 6208 -ip 6208

C:\Users\Admin\AppData\Local\Temp\Unicorn-7874.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7874.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45228.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45228.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45228.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45228.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 6804 -ip 6804

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1164 -ip 1164

C:\Users\Admin\AppData\Local\Temp\Unicorn-57288.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57288.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 1184 -ip 1184

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 6080 -ip 6080

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 5688 -ip 5688

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 840 -ip 840

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 1920 -ip 1920

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 4036 -ip 4036

C:\Users\Admin\AppData\Local\Temp\Unicorn-9047.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9047.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 7104 -ip 7104

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5492 -ip 5492

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 2200 -ip 2200

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 6488 -ip 6488

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 4700 -ip 4700

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 4816 -ip 4816

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 2340 -ip 2340

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 2136 -ip 2136

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 844 -ip 844

C:\Users\Admin\AppData\Local\Temp\Unicorn-17984.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17984.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17984.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17984.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17984.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17984.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17984.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17984.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17984.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17984.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13899.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13899.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 7020 -ip 7020

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 6392 -ip 6392

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 4536 -ip 4536

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 1988 -ip 1988

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 6000 -ip 6000

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 1316 -ip 1316

C:\Users\Admin\AppData\Local\Temp\Unicorn-34682.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34682.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34682.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34682.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34682.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34682.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26514.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26514.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26514.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26514.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26514.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26514.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 5908 -ip 5908

C:\Users\Admin\AppData\Local\Temp\Unicorn-34682.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34682.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3236 -ip 3236

C:\Users\Admin\AppData\Local\Temp\Unicorn-26514.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26514.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 6608 -ip 6608

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 6280 -ip 6280

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 5960 -ip 5960

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 1004 -ip 1004

C:\Users\Admin\AppData\Local\Temp\Unicorn-11315.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11315.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3147.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3147.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64600.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64600.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64600.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64600.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 6328 -ip 6328

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 6072 -ip 6072

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 3968 -ip 3968

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 2844 -ip 2844

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3200 -ip 3200

C:\Users\Admin\AppData\Local\Temp\Unicorn-51964.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51964.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 6828 -ip 6828

C:\Users\Admin\AppData\Local\Temp\Unicorn-4107.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4107.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4588 -ip 4588

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 6832 -ip 6832

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 3608 -ip 3608

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 4560 -ip 4560

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6828 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 3080 -ip 3080

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2328 -ip 2328

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 6672 -ip 6672

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 4012 -ip 4012

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 5792 -ip 5792

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 6428 -ip 6428

C:\Users\Admin\AppData\Local\Temp\Unicorn-20060.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20060.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17128.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17128.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17128.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17128.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17128.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17128.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17128.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17128.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58160.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58160.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6604 -ip 6604

C:\Users\Admin\AppData\Local\Temp\Unicorn-54076.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54076.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25488.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25488.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 6320 -ip 6320

C:\Users\Admin\AppData\Local\Temp\Unicorn-49992.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49992.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16936.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16936.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41824.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41824.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 1528 -ip 1528

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 1384 -ip 1384

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 2224 -ip 2224

C:\Users\Admin\AppData\Local\Temp\Unicorn-37740.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37740.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45716.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45716.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37740.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37740.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37740.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37740.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4491.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4491.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8575.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8575.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8575.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8575.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53692.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53692.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33080.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33080.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33080.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33080.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33080.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33080.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6236 -ip 6236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 4196 -ip 4196

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 7028 -ip 7028

C:\Users\Admin\AppData\Local\Temp\Unicorn-34232.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34232.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 6528 -ip 6528

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 6480 -ip 6480

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 4440 -ip 4440

C:\Users\Admin\AppData\Local\Temp\Unicorn-54460.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54460.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2660 -ip 2660

C:\Users\Admin\AppData\Local\Temp\Unicorn-38124.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38124.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38124.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38124.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 5980 -ip 5980

C:\Users\Admin\AppData\Local\Temp\Unicorn-38124.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38124.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29956.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29956.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17320.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17320.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 7052 -ip 7052

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 7160 -ip 7160

C:\Users\Admin\AppData\Local\Temp\Unicorn-10111.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10111.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38892.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38892.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4456 -ip 4456

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 1768 -ip 1768

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 4496 -ip 4496

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 6648 -ip 6648

C:\Users\Admin\AppData\Local\Temp\Unicorn-63204.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63204.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2932 -ip 2932

C:\Users\Admin\AppData\Local\Temp\Unicorn-42784.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42784.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 4896 -ip 4896

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 4924 -ip 4924

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1796 -ip 1796

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 6524 -ip 6524

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 5712 -ip 5712

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5424 -ip 5424

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 5348 -ip 5348

C:\Users\Admin\AppData\Local\Temp\Unicorn-32452.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32452.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28368.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28368.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28368.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28368.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60848.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60848.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5416 -ip 5416

C:\Users\Admin\AppData\Local\Temp\Unicorn-64932.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64932.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3479.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3479.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60848.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60848.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56764.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56764.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12394.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12394.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4226.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4226.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64932.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64932.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19624.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19624.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53043.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53043.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 6732 -ip 6732

C:\Users\Admin\AppData\Local\Temp\Unicorn-48404.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48404.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37364.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37364.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 5788 -ip 5788

C:\Users\Admin\AppData\Local\Temp\Unicorn-37172.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37172.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37172.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37172.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29004.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29004.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29004.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29004.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33088.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33088.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33088.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33088.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33088.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33088.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 6476 -ip 6476

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 4076 -ip 4076

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 3752 -ip 3752

C:\Users\Admin\AppData\Local\Temp\Unicorn-57592.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57592.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-223.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-223.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 6400 -ip 6400

C:\Users\Admin\AppData\Local\Temp\Unicorn-45148.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45148.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 2572 -ip 2572

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 2516 -ip 2516

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 6916 -ip 6916

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3148 -ip 3148

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 6908 -ip 6908

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4396 -ip 4396

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4408 -ip 4408

C:\Users\Admin\AppData\Local\Temp\Unicorn-2143.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2143.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10311.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10311.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 4064 -ip 4064

C:\Users\Admin\AppData\Local\Temp\Unicorn-6035.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6035.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 5296 -ip 5296

C:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 3472 -ip 3472

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 2896 -ip 2896

C:\Users\Admin\AppData\Local\Temp\Unicorn-1567.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1567.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 3724 -ip 3724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 940 -ip 940

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 6792 -ip 6792

C:\Users\Admin\AppData\Local\Temp\Unicorn-43560.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43560.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39476.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39476.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35392.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35392.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31308.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31308.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27224.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27224.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 7060 -ip 7060

C:\Users\Admin\AppData\Local\Temp\Unicorn-23140.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23140.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23140.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23140.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6803.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6803.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 220 -ip 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-6611.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6611.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2527.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2527.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43176.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43176.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43176.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43176.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14587.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14587.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6419.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6419.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 5240 -ip 5240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 5496 -ip 5496

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 6460 -ip 6460

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 2908 -ip 2908

Network

Country Destination Domain Proto
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.129:443 www.bing.com tcp
US 8.8.8.8:53 1.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 129.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 216.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\Unicorn-33932.exe

MD5 5dcc0407430befb248725790040ae1ce
SHA1 648690ee6591fa448de1741b54da27a305796868
SHA256 d1c14413b6f5a8c4fb60c2127de8608c183741aa0b3717a020704977994fad93
SHA512 63ddc658e6fbe92409a9f00d134c31e1a28b38fc23799e342f5e3714e72b1281c7a6c87f956f4dca6a57a1414805657147a4afec06855d0e32bf96cebad40449

C:\Users\Admin\AppData\Local\Temp\Unicorn-65016.exe

MD5 2a28e9e11a950e9c9d7c0d95e755f583
SHA1 1637e72dcb7e1ca8f09a592defdac012db2a4bbd
SHA256 7e29dad14f65179b3a0be187cd251f061ff5b90fee0ed748340fc273bb1a45fb
SHA512 d0e44b51d69419cad1998321b789cbeaee409300fc4c692c52e2120924360b3e88493eb69ff2c518a42132b3a4ddd8c45c10eaaed5cdb1c139db63e104c8bf59

C:\Users\Admin\AppData\Local\Temp\Unicorn-41066.exe

MD5 b1c78cc8218061da6be8c64701ac7008
SHA1 bb3a40b1e8a3fcef36755c8c62c8d9dbadce0ba4
SHA256 52af4a9b4db926d9e5c113b6b712e6522820f3e83f8265d03b8dd948637fee99
SHA512 de6f3b03556be33b4870e11ee1e86cff84cab3ddbefded25db6e00fe0d552873b5038cf735fe282487764da538e2819cf36e8f5ac8cd444bf7a7f8fdbaf0c251

C:\Users\Admin\AppData\Local\Temp\Unicorn-5639.exe

MD5 210129e9a262356875dd240207f21911
SHA1 5d8f66a8ef74c6ff843ec75ffab77cabaf4c74d9
SHA256 2c9639cdc7582a2c676138bf9c4e5d602c1bd58b47a304230ca2358da0ef5cf9
SHA512 de1d57125a4e3c41051eb510828eac4dd533263424b100f86c5f761ca4f1da165878690c1e306e1026938aee05ce9e7b751fe766f4a21903b9f0f9230b43d916

C:\Users\Admin\AppData\Local\Temp\Unicorn-54840.exe

MD5 d3dfca346240910b4a6af03ef64c6c33
SHA1 b5e54d1365f1bfaba629e1a02fe5e267050fe94d
SHA256 25c4e4d0481c1f72fab14ccc6fa3d1d306bd515d4e57535b4d9b2e93261991cf
SHA512 3912f86b3db9b5829f0d43366ee69b15a7741c71ab39044344477ffd421e5495085fd2c56afe747695e9b99e947b9bc107bf1e112632d6e3dfd41789fd7cc7aa

C:\Users\Admin\AppData\Local\Temp\Unicorn-22722.exe

MD5 5b827e3a96c995a82ef4db165004583c
SHA1 1e0d7438e2fb0b858310119fcc159a65d2e84328
SHA256 fee433270a1636761cca7d0e75c07db74e140ed37e9564daeb9739eeb441e29e
SHA512 eaca81a9b039749ee406ea5951d607247e1c5e52c7873f551ba472130f228dd011c749946a48fe8cad1ca1a39d459ea055a4b76f05597e3992a408ebfd43b658

C:\Users\Admin\AppData\Local\Temp\Unicorn-13371.exe

MD5 8eab3dc0b18f3860283dd94b3f77e69c
SHA1 52f20c533ef436bf2e2ab7c65f4f076905dde53e
SHA256 cc52a88e44cf7f8397b041bc887a42570cb692e703d68d837a95fbcd635e31be
SHA512 61397936155b8d0b820d178291c86c0817aaf90c6cbac64f5046d8307f1a72fff8795469450cf97c00c059d41d44cd88d7c9063a46a6cba43bbe07016ad335bf

C:\Users\Admin\AppData\Local\Temp\Unicorn-50875.exe

MD5 8ad990fb7c4a14a5ddbc4e916a0f4cee
SHA1 31c399bbf5b4f839ed25524fa1dce31188403638
SHA256 1d35679b2aa377247ccd0d67c71af9fb25df3d75be20a16c24892fb88851bc43
SHA512 665af51bcc0e9b3b4e48875af9c77bc9dfbce9d77c3d383683bb81de854a8d03ab4cb10b7465b9e98752e9a18284fe570434b6689f31155587a82fc5db4e279e

C:\Users\Admin\AppData\Local\Temp\Unicorn-50320.exe

MD5 d0bbc432011045a9b7fb1e98a9ffff67
SHA1 7b46ff39ef1e0005161cef9d337c1da9d9931133
SHA256 8d86b4d0b5b6bbd8cbce0b257516d5909f36b3734eb8678d11aea2ac0ab5d97d
SHA512 bcb081ed390171e72bb214ba2c419759b562498a92ca3efa369a0d3403fc6b24f844881289c1fe7cef83c52ab4b39681b932b25fc28c9f466052fcdf3e7d22dc

C:\Users\Admin\AppData\Local\Temp\Unicorn-9650.exe

MD5 d351d50f179a293e673d41acaa4c114a
SHA1 fd0052d032bcf1c5d04d095524fb1f333fdcfed4
SHA256 799d6769c79f829ebe8e974444f01252199afb28104523c3c01ee6957f1c3cfb
SHA512 08dab4b2f9590a2f2becf7af82b2e6431c02a02994a1c01bdf4ad89be9788d2fb62b07bf0c7bd4bdca39b4119edf8eac0f25d8085db6b1778da1aa773f3c923d

C:\Users\Admin\AppData\Local\Temp\Unicorn-9095.exe

MD5 0190a17d5061c787917ef3ab8caa75e6
SHA1 22cef874932c7996ed28bc18d28229c53e684605
SHA256 7113221e50f8303a83b6e4094d07833ba61af32c50d2b93f447993e34209fcd5
SHA512 ce963d00f16e5461ff871aafaa542272678fe4df676f0dae2722e2d340ea6810f46bfd239961bcd29e2e5ccca11ab56cc6fce6f0299403a5c25c3176209d5266

C:\Users\Admin\AppData\Local\Temp\Unicorn-15255.exe

MD5 96980b06a01c3a76b4b357b85183c5ab
SHA1 a02a01bb58578aa89a673fa4fc02c660f8d949cc
SHA256 f451e5b3e7aae121243dbfeb33a59d9c653bbb076d3e30f0da83643c0ff240e2
SHA512 16ba97c7e69b820a7e6fa6e7259ea37874c1699d5ab7db2422c49b3d1aa81e5f94e3bf2352ab702d737f4778eb98dad53b990a31fa5cd4e0716d143e345d30c2

C:\Users\Admin\AppData\Local\Temp\Unicorn-44591.exe

MD5 36a1c411f3e133b733913588b9ea0165
SHA1 d01943bc1c1d79270d7c114260626dcf826176fa
SHA256 3445156717888b925a780893e2ffce6ec6893b0a321a34c875b1ae9e3085fee4
SHA512 e70ab137b2e2971d85d6786e767afdf37c20a7d115c324d17088db377b5b89c81f32c0a7f1064b8bd35eb6372b670c892a89edb042b999c63a9641276b0f6d17

C:\Users\Admin\AppData\Local\Temp\Unicorn-39952.exe

MD5 2d3efcee484bea2e4cbb5a8bf22b30e9
SHA1 d021e06f06a26657f1cd873fd029614626b00193
SHA256 098cd3f848655c6b8c04d7063c8a883d91b753f43e6f097a67421df29b5315bf
SHA512 9c6f452cee0383bf230f2f3edfbade351c2c2490924a0ccc4ee47e9b52acf5675cb3c1453831f239849687a4a92f86ce762011a148aa5e29ef4b270242e558bc

C:\Users\Admin\AppData\Local\Temp\Unicorn-15063.exe

MD5 6a24cb103ac99e70a06d141625221184
SHA1 dbbd9c0aa5ae9fb23e27f1ec81743899ccd77a21
SHA256 b53957f591980d0de856891ed5503e8a08e440e013100f944e293d1a9e2f43ef
SHA512 4eb3343a73f94f15378c88a0985de172e7d1416b4db638d472d2d63db7dc3ddd833186324dde50530bdf8aad69343be648da5bae73ac5e459012e204f393a956

C:\Users\Admin\AppData\Local\Temp\Unicorn-44399.exe

MD5 623f13450ac4326b226be0e169122861
SHA1 4cfd71d882719d9e22ffb50b8bd1a1017c3181c3
SHA256 cc0745b615a203cc882d182a2abbb9625af4ef3624a7a85358d6260af10f6979
SHA512 cec61c376dd3ccfc9412f6783b97a886525ed06d690fd16b2132826c67944d41294e6322b659c2d0ccd219633550a5738a1e8f3cacab7f593106ddd2a1f80ab0

C:\Users\Admin\AppData\Local\Temp\Unicorn-64264.exe

MD5 d4aa52715c65aba2156cf9dddd18a573
SHA1 a628f031a45dd76618436bef04df790eb849a3dd
SHA256 e4772b306a9969b218741ce49e5ffa1b8615552af96bb951438c9700688f3d4d
SHA512 fb2c682c7b90deb39b18e60240dad5ff6ca2c7832cbe1fafe461b13875481f89deebde3657ce4b4e5a07c1337d5faf48bab5131362cd928d053cc288464b1d03

C:\Users\Admin\AppData\Local\Temp\Unicorn-39760.exe

MD5 0276010a0005b75980b81fac4062af89
SHA1 fe7cb07ec9f1cbaa2168b4e09e21842551471f57
SHA256 c3d99fba9a1efad9a53dad7adca350454bf65abbed28a56b9c809f587c0f908c
SHA512 796252495ecb74bc2ac2addf64508ce0af0bb8972a1a158a1667023236e491f97601de335be62af79fca15bb9a84b40ae9101e9a6e0b52be612d1460013f17ce

C:\Users\Admin\AppData\Local\Temp\Unicorn-19894.exe

MD5 b56fec0e27ae4da840bb217ed38a9d55
SHA1 21869ac3d06a892a2255ed79e5a74ac0b51d2e80
SHA256 cbc42015e6bb997b3fd22b26172d0e85358e260ec90e684f88475d3a3e7fd884
SHA512 22f26951171cba44cda2ec0b8ded7812cfe532061c8f97c99fdbcee9194c86c5198527b6184ead0a6ba2e6a80f661d09c3b4ad8eb8c759111442bedd226b032f

C:\Users\Admin\AppData\Local\Temp\Unicorn-37980.exe

MD5 f2f59c74f8b9153e22e3277b2de921a7
SHA1 f4625e7bdc59efb27505d26a30a49f2013ee521d
SHA256 eaccabf4196cc752c731da754a6102dc79133b8b506f5461ed4bd0575f38643e
SHA512 23bdfa30ea6e056c2ebb687ae7e5bcf422656837e85b7fc94b4ad323f858cc73e8d85f488f3756ca741ac784dfbce072842006132bac73fd7cd3314c3845a21b

C:\Users\Admin\AppData\Local\Temp\Unicorn-48047.exe

MD5 aecbad5aa662bff6a2d4d0c42db49721
SHA1 646bac571c536a083aa406a27b03a6b80b894cce
SHA256 f85848ffcde4bb8afc46928ecd849362b790a3adf305b7375c0b2540074544c3
SHA512 07a57f3cca70ae86b6fe38964d7d44e2377711f8f760da3eafde4d5eb625778229ccf4f80c3328bdab92aa5fc6eec6feddedf221cd97c927720be863c8fd4b31

C:\Users\Admin\AppData\Local\Temp\Unicorn-47492.exe

MD5 7036922cffc8db3a7214829f68847145
SHA1 7f335ebebf1af26231eb16642baa53d79ad92bf7
SHA256 9c25ea0118b4fcb8771c2c5dcb4b8e6e1f17027f7c5d7425b8bb75d4cdf4b005
SHA512 4db98aa33210f50c98324289e1420075c85def6a5394374cddf16ec4b2f003522a1f93664702ba1a3307c66f2cb303951ffdc5d3a947bc616acc7c984d71638c

C:\Users\Admin\AppData\Local\Temp\Unicorn-22412.exe

MD5 5a515781554dd9154fed43b572f62ba0
SHA1 987808bf621b0768495e4efcd0eab02af5492663
SHA256 52214b86307700872ddef6566e84f7d32e474e1d88ee715b17a31130914c2746
SHA512 59405597449ea2ac975f95fa0af27e4c87a72b64125352a74fddc3a9553295c8e3e35fcc4295e00ccf5292fedff3f2f40dabdd9bf8f29923c556744e6b0c2000

C:\Users\Admin\AppData\Local\Temp\Unicorn-59915.exe

MD5 a7fff793e115ca32f6a0bd22b5ee0033
SHA1 c0c60e877bdc3e138c6c45e7e77b671299e48a05
SHA256 61c89fe7f9340e4197f99a38d4ee805996e3b8429f192708752214a2a542e010
SHA512 9a6b29118b59068143a78c5ec848ab1bd189d74c713739816acbfaae6ec9a4346ec062f5236850caba5dac6cb5b92d85d4a6ae4abf09325388cd7cb057fe6b0a

C:\Users\Admin\AppData\Local\Temp\Unicorn-63444.exe

MD5 155e504d3a3cffc9240816e53414c6f9
SHA1 529a3e861f59524bc4d7b6b81a48dda430881a0f
SHA256 3640f7417731a37086e6067d14602f0fca7d1746456e682c32556dff3caba02b
SHA512 78284fbd3fba11158d068d8a1fdb680c07cc88e18e18251dc5b2eff21e3d6ed601a1046c1fbe71c14c198aaf7439cc44982c59faed2bb6525a5be9943269411e

C:\Users\Admin\AppData\Local\Temp\Unicorn-27242.exe

MD5 83fd33c284a588b9fa2bbcc12a075eda
SHA1 5417c89cb5ec9542480c3fc8f4ed4306894d0e90
SHA256 df0e5cb8b6ea678e7a48d8a43c99571a4a2d808e768aa6b3022e0017fb42e128
SHA512 77e051143d9268b74d89f3dbb91bbf97caf1781ddb65e34a2865e58881054eb3d8c7df4704d7feb945e961337c145f0dc45e02daf5535d30caa9208d9b2550f3

C:\Users\Admin\AppData\Local\Temp\Unicorn-22220.exe

MD5 f80c45bf32879a12f657b187ffe1fc40
SHA1 1a1a40a2c51d87f770738304c0f579c4bab53c60
SHA256 2f17ede0cca008c59f72b4019bd143b69856529abd14413d066d2079cf1d509e
SHA512 121d191f84eee86cbd93dc86d2bbd7f50f9c86684ef884cfb0de3aff59267a6278bc62d7d1ac4e9841ff4ae14e1af02ba15c8a037926d78b77cc99e2b21eb5ca

C:\Users\Admin\AppData\Local\Temp\Unicorn-5883.exe

MD5 522e5931cdc61f0c349f93c1394130c7
SHA1 5100e256543bc8b7b7baa2b35e5e367bb5a93165
SHA256 f8a180df17fc11236dfa8b0d0506e2af9fc73ca20515fc29ecbe245bcc31a990
SHA512 2bf6b3022ed31d582c66f8b97252e7d16240735b3b9eb40f9bbb846df529c3363624e7a95d66d425bc693ebb130dd3611ee7ea83b380417e58e0af6fda2cedde

C:\Users\Admin\AppData\Local\Temp\Unicorn-39302.exe

MD5 a6e2c3d62c09a51384c541fd9f1b3ba2
SHA1 d295c0c5e4b61736e50bc690e3f62b717ce180a0
SHA256 e3f400db4a54aae448ab132387861237e0fa7c04e667288236d329fc36827035
SHA512 8783187ddce82ef1c2f937a727d6d0317741c052804ade939cb2640c400b2878abe5358ce8283ff919770b74425526bf2e1052aa32fc06cfc8855a260df085c4

C:\Users\Admin\AppData\Local\Temp\Unicorn-27050.exe

MD5 00abd7024a2552d80800214407c726e9
SHA1 479d10124d1feaa8a0bc239f4a37620aa5a19eae
SHA256 ec8dc90e4fab66b48b4a78c3ff3f366c011be1e1275f6c1df0be75398076d448
SHA512 666c1a1843d3bafbefc1c72f994f17100b6972f06156ead395e40f29d7b5918fd41cdbb3607a70a2c0da6f44f506d64ac1e5d25a2861836d4c87473baf666552

C:\Users\Admin\AppData\Local\Temp\Unicorn-59168.exe

MD5 a0184445dbf69267e0ff24df9f7f004f
SHA1 4538f960c08e3b914b4ae6a17f15636c44966e68
SHA256 98083d472f557fe32853756c389b7d6da52539418a98122e98783bddf5fb2fa6
SHA512 76f33cc3d5e2428d281da2e904827be95ef854d93f8c9676015b74de08fb41e537e7d40484e6a8e3f1fd9cb4444c8019c4eb1d204f7fa38905779c5a3cdfa35d

C:\Users\Admin\AppData\Local\Temp\Unicorn-63252.exe

MD5 e44bae345c39e7d752cfa62c8bb22d1f
SHA1 da5c728eff64492d43f31e16d9786585b441aae9
SHA256 5e2aff0c3b5820d24eab3705ad28a63d338e2d5f0cac769a735e74ed8197f53e
SHA512 ae021687835f9ee41894d58a61459220d4bd67fc5aecab0f1398b9b99867366497942140818d91dc79ee3c0f43bb67c9c749a2622d3b45fd47634a5d20190ba1

C:\Users\Admin\AppData\Local\Temp\Unicorn-26696.exe

MD5 63f7058ce482e745f81aa25627afcee4
SHA1 508c6dbcb6c0445ff1165be16655493bcf71e289
SHA256 56eb93b539e3381a3f6d0f10fae9a11dc6466514c2e8a99f2dbc4abccd80696a
SHA512 a917bc244ae8693ec63d73d5a20981a066937cfc6e1300e936dc7cc3c7fbe81c58e0c9e7a9bb14935280adb95d96cd6477989f73ae0268e9d9cd04c3e00b8f14

C:\Users\Admin\AppData\Local\Temp\Unicorn-27458.exe

MD5 848227e5e7a4ad4893024ecd0245daa2
SHA1 c4899eea9651678c9fdb62b089ebfe4e784fd5cf
SHA256 f683bee9394eb10b4a80686b3d5fc76dbeb71c346fb94f9c111b75fa127086e6
SHA512 c148ad6875a15fd0c3d410bad779ce7b7d2f21ef8c4721f1e2de3175d0c550d7dba24d6348ff7f8e87a022568d81d329e4c296921458295d40bd29e6d3b9c9e5

C:\Users\Admin\AppData\Local\Temp\Unicorn-21772.exe

MD5 674d0e0994ff7cd0a7b0d0d078c813de
SHA1 9166172d69b8cfebf1728c37c217713e33477a19
SHA256 025ff4b37ce57c4d3fe962659a0e6b823711216f37146ed10c9e57edc047c2a8
SHA512 011db4f551785a89b3de475d8a09fb6bb0c65acd8b764db64405a38a0308f11ed2466b783732981b4d0fa400dd4680496612aeca692c30e35d401d6d9458b4ab

C:\Users\Admin\AppData\Local\Temp\Unicorn-60863.exe

MD5 c933e17b66061552807ad3cc9c1204e7
SHA1 d74b7efb4b8a9efc0c90cfbe3a9827a6e9836e13
SHA256 ed05dac3816033ccdce96bfc325cfd6f91d1594ccdd82c366d4aab5e5d378193
SHA512 814f8639c95146fd7f54a34b748ae4d1a44bb57aa116f6afc8bbd794d6561bbe4c660337098b1d0777194992df9ad1fc8fddd44924f85640a8f8beba7d5b0f06

C:\Users\Admin\AppData\Local\Temp\Unicorn-42784.exe

MD5 320cc8af084f08da2f4c78198dc9fad6
SHA1 596e7cd1f22e5ae52b006f673a36cc83e1a14d0d
SHA256 f61eaf2ed810ea6d22d0cb252cb4b6dfe54352d3c5f57e7663aa7ad7be7fdf50
SHA512 3f0464aa323a57e159a7a6c02971dbfa0d057d9b269689b1b70fa1a43a11564e09b2a4a4ef398db49d2fb2820b2767166b039d1de0f27eb7687c5436c1a57b99

C:\Users\Admin\AppData\Local\Temp\Unicorn-21848.exe

MD5 654535dacec68071d8ef5d87e7ce6faa
SHA1 a956e5b89dbc99e74522cb89372ec608f873e202
SHA256 fb7096833d4f4f13cbf90c638824d8d56d88086ca0c2612b0bcfc998f2207c35
SHA512 c695591577f2fe9979ca3ee7d0ffdb05fade962c09a256e9499a663d8dd2e7293d6e5eb88f8b1bf459e2a5f341caa64385d0c411ee7706271287c9eee6712ad4

C:\Users\Admin\AppData\Local\Temp\Unicorn-4286.exe

MD5 38d1b17ac7d7d1210002622ac73a926c
SHA1 87c44e95465212f3e122eb3f2137149c1be8cca7
SHA256 2893aeae9461e09108d2067cf9b5546550b1127841b16222c4df6601c7a0ee9f
SHA512 8447e49a5398198ee1b5aba1beb86ff8c7ad3d163b07e52dfc31a804ea42fb6b46d2d0f48bb434073243a242bd42257db55daea42c3f0109d14f52857e85bacf

C:\Users\Admin\AppData\Local\Temp\Unicorn-19944.exe

MD5 5a0b905bd7b1762d1dd330577d20382c
SHA1 51ec148036090f59fd1d2953fb2b69fbf662591a
SHA256 094d48f066f36d31dac1936b1621c66dca8a974c2a42e1ad73b57ddf04ea5b19
SHA512 1b34abb38c7c16966ba332c40de4b20d1798b18dc9a150dba2b39af859857ade19d25d10bccc539299563cde41fa4b874ce66e114e19eca2dd9006e49cd31e1f

C:\Users\Admin\AppData\Local\Temp\Unicorn-49700.exe

MD5 bcd7815c331f114254cedef5d9812dcc
SHA1 6dbde486aced40616e828c9131b4abcae4d736c8
SHA256 b5cf7632d6cb91105b70ab1dd5a6ca51ef2a079c849a87a658652aba4c376779
SHA512 c9cd3471a082a463e0e009d70dda5ea7ea45df39f2a5796566afe7803a4bff99393e408f6ec25dbbaad544f217cec48823a6d39599c3b3f69e8b71bdf30f12f7

C:\Users\Admin\AppData\Local\Temp\Unicorn-40970.exe

MD5 bfd0c5bf702a6c6d216327d64de3e398
SHA1 e1c8258e292ffae1f70c62cba504526147a94465
SHA256 a4d53ae066afeb2ccca7c7a3782fc5864072e8223638b56362472a6a010b3312
SHA512 e2ea9f1e10980bbd4cd936b504c43790dd0bff42e8855293d29a95c600d8103a37f0eb3db8f061db9d4f7e1172447d3bb0e43a0463ad8d1cfe937189c6f3d860