Malware Analysis Report

2025-01-17 22:48

Sample ID 240603-qw18wsgc2v
Target a52d1b81e8a330e0bb78aed4624d0760_NeikiAnalytics.exe
SHA256 a0ecff11df4c3bab7d08eec155400db89271e4607d1ca7020ef3c96370e85825
Tags
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

a0ecff11df4c3bab7d08eec155400db89271e4607d1ca7020ef3c96370e85825

Threat Level: Shows suspicious behavior

The file a52d1b81e8a330e0bb78aed4624d0760_NeikiAnalytics.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary


Executes dropped EXE

Loads dropped DLL

Unsigned PE

Program crash

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-03 13:37

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 13:37

Reported

2024-06-03 13:40

Platform

win7-20240221-en

Max time kernel

150s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a52d1b81e8a330e0bb78aed4624d0760_NeikiAnalytics.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49352.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48641.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35294.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60545.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2621.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35616.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7582.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4095.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16540.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57743.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7987.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3903.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49575.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64837.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-52585.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-28635.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15444.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32527.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31589.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19337.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60924.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36056.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UnicËrn-55922.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31972.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7084.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26950.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2445.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44033.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47562.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15060.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15060.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18590.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60177.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-43286.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38818.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10784.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26566.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21963.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UnicËrn-10779.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UnicËrn-23394.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36436.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32352.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-234.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16016.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7463.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44967.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32714.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56664.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-40328.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-8210.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-8210.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19908.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15824.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64640.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-40690.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a52d1b81e8a330e0bb78aed4624d0760_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a52d1b81e8a330e0bb78aed4624d0760_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a52d1b81e8a330e0bb78aed4624d0760_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a52d1b81e8a330e0bb78aed4624d0760_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49352.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49352.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48641.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48641.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49352.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49352.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35294.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35294.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48641.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48641.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60545.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60545.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2621.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2621.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\a52d1b81e8a330e0bb78aed4624d0760_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-49352.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48641.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35294.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-60545.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-2621.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7582.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4095.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35616.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-16540.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57743.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-49575.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-3903.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7987.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64837.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-52585.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-28635.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15444.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32527.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31589.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-65008.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-19337.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-60924.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-36056.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\UnicËrn-55922.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38818.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7084.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31972.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18590.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26950.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-47562.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-60177.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35118.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44033.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\UnicËrn-10779.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-234.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-10784.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20270.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-60556.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-40136.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-40690.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-8210.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-56664.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26566.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64640.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15060.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-43286.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48304.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15060.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-21963.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-44967.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\UnicËrn-51272.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34573.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\UnicËrn-38465.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-10623.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32352.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\UnicËrn-9684.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\UnicËrn-23394.exe

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a52d1b81e8a330e0bb78aed4624d0760_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49352.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48641.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35294.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60545.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2621.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7582.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35616.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4095.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16540.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57743.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3903.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7987.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49575.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64837.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-52585.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-28635.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15444.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32527.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31589.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60924.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19337.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36056.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UnicËrn-55922.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31972.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7084.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26950.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2445.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44033.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47562.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15060.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15060.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60177.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18590.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-43286.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38818.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10784.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26566.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21963.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UnicËrn-10779.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UnicËrn-23394.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-36436.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32352.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16016.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-234.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7463.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-44967.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32714.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56664.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-40328.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-8210.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-8210.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-19908.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15824.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64640.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1464 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\a52d1b81e8a330e0bb78aed4624d0760_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe
PID 1464 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\a52d1b81e8a330e0bb78aed4624d0760_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe
PID 1464 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\a52d1b81e8a330e0bb78aed4624d0760_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe
PID 1464 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\a52d1b81e8a330e0bb78aed4624d0760_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe
PID 2836 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-49352.exe
PID 2836 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-49352.exe
PID 2836 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-49352.exe
PID 2836 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-49352.exe
PID 1464 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\a52d1b81e8a330e0bb78aed4624d0760_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe
PID 1464 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\a52d1b81e8a330e0bb78aed4624d0760_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe
PID 1464 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\a52d1b81e8a330e0bb78aed4624d0760_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe
PID 1464 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\a52d1b81e8a330e0bb78aed4624d0760_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe
PID 1464 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\a52d1b81e8a330e0bb78aed4624d0760_NeikiAnalytics.exe C:\Windows\SysWOW64\WerFault.exe
PID 1464 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\a52d1b81e8a330e0bb78aed4624d0760_NeikiAnalytics.exe C:\Windows\SysWOW64\WerFault.exe
PID 1464 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\a52d1b81e8a330e0bb78aed4624d0760_NeikiAnalytics.exe C:\Windows\SysWOW64\WerFault.exe
PID 1464 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\a52d1b81e8a330e0bb78aed4624d0760_NeikiAnalytics.exe C:\Windows\SysWOW64\WerFault.exe
PID 2760 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49352.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48641.exe
PID 2760 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49352.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48641.exe
PID 2760 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49352.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48641.exe
PID 2760 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49352.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48641.exe
PID 2836 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe
PID 2836 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe
PID 2836 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe
PID 2836 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe
PID 2608 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
PID 2608 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
PID 2608 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
PID 2608 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
PID 2836 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe C:\Windows\SysWOW64\WerFault.exe
PID 2836 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe C:\Windows\SysWOW64\WerFault.exe
PID 2836 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe C:\Windows\SysWOW64\WerFault.exe
PID 2836 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe C:\Windows\SysWOW64\WerFault.exe
PID 2424 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48641.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35294.exe
PID 2424 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48641.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35294.exe
PID 2424 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48641.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35294.exe
PID 2424 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48641.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35294.exe
PID 2760 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49352.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-60545.exe
PID 2760 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49352.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-60545.exe
PID 2760 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49352.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-60545.exe
PID 2760 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49352.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-60545.exe
PID 2588 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-2621.exe
PID 2588 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-2621.exe
PID 2588 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-2621.exe
PID 2588 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-2621.exe
PID 2668 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
PID 2668 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
PID 2668 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
PID 2668 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
PID 2608 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe
PID 2608 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe
PID 2608 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe
PID 2608 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe
PID 2760 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49352.exe C:\Windows\SysWOW64\WerFault.exe
PID 2760 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49352.exe C:\Windows\SysWOW64\WerFault.exe
PID 2760 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49352.exe C:\Windows\SysWOW64\WerFault.exe
PID 2760 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-49352.exe C:\Windows\SysWOW64\WerFault.exe
PID 2608 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe C:\Windows\SysWOW64\WerFault.exe
PID 2608 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe C:\Windows\SysWOW64\WerFault.exe
PID 2608 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe C:\Windows\SysWOW64\WerFault.exe
PID 2608 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe C:\Windows\SysWOW64\WerFault.exe
PID 2464 wrote to memory of 692 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35294.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35616.exe
PID 2464 wrote to memory of 692 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35294.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35616.exe
PID 2464 wrote to memory of 692 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35294.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35616.exe
PID 2464 wrote to memory of 692 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35294.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35616.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a52d1b81e8a330e0bb78aed4624d0760_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\a52d1b81e8a330e0bb78aed4624d0760_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49352.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49352.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-48641.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48641.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-35294.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35294.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60545.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60545.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2621.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2621.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-35616.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35616.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7582.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7582.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4095.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4095.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16540.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16540.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57743.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57743.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7987.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7987.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3903.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3903.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49575.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49575.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-64837.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64837.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52585.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52585.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28635.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28635.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15444.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15444.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32527.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32527.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31589.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31589.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19337.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19337.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65008.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65008.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60924.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60924.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-36056.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36056.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-55922.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-55922.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31972.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31972.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-35118.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35118.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7084.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7084.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26950.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26950.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2445.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2445.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44033.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44033.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47562.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47562.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15060.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15060.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15060.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15060.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18590.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18590.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60177.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60177.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43286.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43286.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38818.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38818.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10784.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10784.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26566.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26566.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 692 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 308 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-21963.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21963.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-10779.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-10779.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-23394.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-23394.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36436.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36436.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32352.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32352.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-234.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-234.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16016.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16016.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7463.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7463.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44967.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44967.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32714.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32714.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56664.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56664.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40328.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40328.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8210.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8210.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8210.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8210.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19908.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19908.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15824.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15824.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64640.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64640.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40690.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40690.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60556.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60556.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28438.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28438.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48304.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48304.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40136.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40136.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20270.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20270.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 888 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-34573.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34573.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10623.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10623.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 292 -s 240

C:\Users\Admin\AppData\Local\Temp\UnicËrn-9684.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-9684.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-51272.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-51272.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-38465.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-38465.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31641.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31641.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60592.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36087.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36087.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11391.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11391.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60961.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60961.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11568.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11568.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44988.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44988.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48517.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48517.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57754.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57754.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45502.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45502.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17468.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17468.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12445.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12445.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48325.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48325.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16207.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16207.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36073.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36073.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41226.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41226.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17276.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17276.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28590.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28590.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4640.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4640.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20422.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20422.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53841.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53841.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4085.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4085.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61454.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61454.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53286.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53286.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57370.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57370.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25252.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25252.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17084.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17084.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14152.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14152.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34018.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34018.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10068.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10068.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-14173.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14173.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-6005.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-6005.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 236

C:\Users\Admin\AppData\Local\Temp\UnicËrn-59290.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-59290.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-23088.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23088.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-14536.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-14536.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30318.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30318.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-63182.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-63182.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-35148.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-35148.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50930.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50930.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42762.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42762.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10260.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10260.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30126.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30126.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9705.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9705.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43124.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43124.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10774.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10774.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12118.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12118.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36300.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36300.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53514.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53514.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3758.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3758.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48491.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48491.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16373.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16373.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49046.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49046.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-45175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13057.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13057.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16587.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16587.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37753.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37753.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33669.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33669.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44983.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44983.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36815.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36815.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-613.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-613.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26461.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26461.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46327.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46327.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6041.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6041.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5486.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5486.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58771.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58771.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9933.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9933.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-59840.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59840.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-23084.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23084.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-20344.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20344.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-48740.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48740.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60800.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60800.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12346.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12346.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-13304.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13304.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 240

C:\Users\Admin\AppData\Local\Temp\UnicËrn-58421.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-58421.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50253.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50253.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30985.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30985.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-2396.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2396.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-2396.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-2396.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22625.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22625.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-2204.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2204.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-63657.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-63657.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55489.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55489.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-38769.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-38769.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38769.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38769.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26517.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26517.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2012.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2012.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47129.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47129.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30409.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30409.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 596 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 696 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-11140.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11140.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16102.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16102.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12017.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12017.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19994.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19994.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19994.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19994.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3657.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3657.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29506.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29506.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21338.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21338.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-917.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-917.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-61986.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-61986.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41566.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41566.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45458.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45458.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5769.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5769.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42334.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42334.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58478.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58478.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-64975.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64975.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28219.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28219.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8950.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8950.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14103.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14103.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54067.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54067.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25479.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25479.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54944.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54944.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21888.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21888.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-9635.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9635.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58836.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58836.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-18920.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18920.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2583.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2583.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-52168.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52168.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28349.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28349.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-17441.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17441.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17441.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17441.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-17249.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17249.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3484 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-58089.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58089.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 236

C:\Users\Admin\AppData\Local\Temp\UnicËrn-46797.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-46797.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3352 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-54581.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54581.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35313.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35313.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27145.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36382.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36382.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-15962.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-15962.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 236

C:\Users\Admin\AppData\Local\Temp\UnicËrn-7793.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-7793.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11685.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11685.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-7601.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-7601.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7601.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7601.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27830.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27830.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27830.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27830.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27830.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27830.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23746.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23746.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64778.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64778.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48058.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48058.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15385.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15385.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64586.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64586.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28982.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28982.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-28790.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28790.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-28406.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28406.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-16154.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16154.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7985.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7985.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-9329.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9329.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10398.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10398.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-22459.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-22459.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18183.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18183.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22075.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22075.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64259.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64259.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5200 -s 188

C:\Users\Admin\AppData\Local\Temp\Unicorn-14866.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14866.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3824 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-62915.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62915.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-40269.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40269.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21001.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21001.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41613.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41613.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57757.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57757.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-45505.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45505.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3668 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-4280.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4280.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-8172.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8172.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-53289.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53289.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29937.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29937.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-1156.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1156.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-17301.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17301.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41997.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41997.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41997.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41997.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8940.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8940.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-52002.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52002.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4392 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3972 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4224 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-39195.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39195.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-55339.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55339.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-42703.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42703.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64659.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64659.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12251.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12251.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-64960.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64960.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20036.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20036.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53668.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53668.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-191.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-191.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61644.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61644.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20804.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20804.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12635.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12635.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6112 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-1535.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1535.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-38484.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-38484.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30316.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30316.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46460.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46460.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-38292.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-38292.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38292.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38292.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-52573.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52573.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11348.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11348.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35661.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35661.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-16393.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-16393.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12308.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12308.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45173.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45173.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49257.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49257.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-28453.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-28453.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-12116.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-12116.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44981.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44981.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20093.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20093.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-36621.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36621.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-26075.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26075.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-29221.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29221.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4976 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4296 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-8738.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8738.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5148 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5216 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5340 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6084 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5764 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5804 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6016 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5756 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5976 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5616 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5368 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5476 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5572 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5968 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6032 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5328 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-60565.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60565.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5792 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6060 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5908 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5872 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5204 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6068 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-1141.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1141.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5984 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6048 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6092 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-52755.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52755.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5636 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-5090.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5090.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54291.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54291.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51852.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51852.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51852.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51852.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6684 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-14903.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14903.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2651.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2651.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8079.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8079.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28308.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28308.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36284.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36284.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64680.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64680.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24956.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24956.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6188 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-20654.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20654.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21998.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21998.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13829.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13829.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6784 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-50778.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50778.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21806.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21806.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25698.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25698.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5277.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5277.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54286.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54286.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-29782.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-29782.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29782.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29782.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18682.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18682.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14597.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14597.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10513.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10513.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10513.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10513.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44447.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44447.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7114.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7114.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39294.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39294.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-39294.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-39294.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52231.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52231.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11006.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11006.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40939.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40939.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8266.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8266.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8266.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8266.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-8266.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-8266.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-98.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-98.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-40747.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-40747.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-40747.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-40747.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32579.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32579.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8074.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8074.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57275.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57275.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57275.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57275.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7240 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-57083.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57083.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43138.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43138.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6496 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6468 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6540 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6640 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6592 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6948 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6820 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6860 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6992 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7052 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7060 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7080 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7156 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-59901.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59901.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7284 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7392 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7576 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7464 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7520 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7620 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7672 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7992 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7760 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7704 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7792 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7836 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7732 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8000 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8184 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7952 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7872 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7260 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7652 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7436 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7720 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7776 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7528 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7712 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7616 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-14024.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14024.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8008 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7584 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7636 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7828 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-48041.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48041.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7900 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-15945.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15945.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8292 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-57574.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57574.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50558.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50558.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51326.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51326.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1549.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1549.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22821.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22821.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35073.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35073.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9028 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-31949.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31949.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8388 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-31757.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31757.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19588.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19588.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9236 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-43708.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43708.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57112.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57112.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33148.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33148.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9360 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9324 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9400 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9456 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-13360.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13360.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17445.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17445.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9448 -s 216

C:\Users\Admin\AppData\Local\Temp\UnicËrn-58093.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-58093.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63329.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63329.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2068.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2068.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22297.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22297.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47761.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47761.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1767.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1767.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9664 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9500 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9556 -s 216

C:\Users\Admin\AppData\Local\Temp\UnicËrn-18452.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-18452.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38872.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38872.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9528 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-19796.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19796.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9620 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-35556.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35556.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30595.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30595.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9692 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-35639.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35639.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64611.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64611.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9860 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-64227.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64227.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2774.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2774.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9732 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-24347.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24347.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56635.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56635.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3350.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3350.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9432 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-27855.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27855.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40299.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40299.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16755.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16755.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9384 -s 212

C:\Users\Admin\AppData\Local\Temp\UnicËrn-25115.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-25115.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28130.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28130.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15301.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15301.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-3241.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-3241.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-15493.exe

C:\Users\Admin\AppData\Local\Temp\UnicËrn-15493.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50086.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50086.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10212 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10200 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9676 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10076 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10008 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10048 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10160 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10124 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9688 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9564 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9464 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9388 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9636 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9392 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9644 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9708 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9616 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10144 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10056 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9248 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9988 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10208 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-31306.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31306.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9524 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10072 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10064 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 10100 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9796 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9444 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9660 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9780 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-33465.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33465.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49692.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49692.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5727.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5727.exe

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe

MD5 2fea4940909fe58b0c29a9615759fd5c
SHA1 afb7eb02dba0b1f96bac1de95022fb9245b1dcb8
SHA256 256589b28a36f1562fb97395d3937c6be65be6265448d710fa0c1858031867f5
SHA512 cdb8f2f9389b291a3e21ecce551abe8ee5b9f605616e3c8154b770e138251dd21b8bed59783cb433752c1d5396a4c49cfe6a33969b95603895d062511f7eb550

\Users\Admin\AppData\Local\Temp\Unicorn-49352.exe

MD5 6ef6fc248ceee9db1f99e39dd66541ed
SHA1 3a4426b2a4d2af8737e8d7130bb5953b547a002a
SHA256 8209b02b1d6415afe19988d1ef0a142485bc2906d7d04e49555f9e0430d8b9ec
SHA512 2e9e57c4d2ba5065f3fc285faabde99c42d6f6edecb18571b49ddcda69c96cc4b2c4670f7a3114b2935edc5178e2524b75310f626f1a97b26ad1d277a815d71b

\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe

MD5 745a480730340ea09a266dee17e968b0
SHA1 6113d80370d31c198d9f52f30ec7588a715a54a8
SHA256 6948dcaa08f2d6f381ef7d85382c4a707bfe6554ef7b10db45158f3e890434a9
SHA512 025821f8c817e19b221a435261786479e8ccc4851bf2552da536b4184ac691f0b675f04352390ddb10f558a69925a85dc62d4876e573112b035ff8a7697aefb5

\Users\Admin\AppData\Local\Temp\Unicorn-48641.exe

MD5 2ea7a12fd05efc18eba074577c36e4f8
SHA1 585349726c88ff7b11e5efaa4ab95bf7064fa845
SHA256 9b66d940d868dfcb7f66d88ee43ba2d70f6c3e7b5a0b2379493a815bafb0bc6a
SHA512 3f1564245067885085bb5374542c11d3b27617a88ebffe78732ff3dc763e81f8d5dfac03a7b120ee575e0d54c93689037e4e1ea01da8d56011740c7a8b6f8dd7

\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe

MD5 f12f1b145009672be1b27c3c66499260
SHA1 0d4d1c18939fcb0d6138e57425bce24b15f00f41
SHA256 074d336aa82d6510bebc21ce437b7f57ae9300a1cc7619516765ea224ec5924e
SHA512 62dcae57acf3c45f70232eb576d5c48db38b3d4146363485288f8f18aeaa4f348eab208d36ca24b8675a465cbf20c03aa38153a9590cf75aa1c68ef7f6f0ebe5

\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe

MD5 0c9a08ac08381966bdcd5859e09bbda6
SHA1 796a67276e58438d7abf6f0b96f691359a8e3709
SHA256 b65501b89ace98d7061d90d809aa776b59aa83c65628345734bd60c7db85d690
SHA512 a74502207c58464682f451c0dd66a01dffc85618a8eb6e60d1a6bc1463f57f684be036961454db22a676959e984917d51116d25ced72a734ca31fa0d0ee73e58

\Users\Admin\AppData\Local\Temp\Unicorn-35294.exe

MD5 c249c37f0a7acf15227b3ff7f7790e68
SHA1 5190c4bcc1d50423b2e388c4b6bb587a67e59487
SHA256 99befa40adc772f47d4419a130729b778445c40b3681eec844fb3d12411fbe53
SHA512 e42b0e9f3d79129291b4d63b9e0fa0cdff5e94a40e15cd50af09f9497c20a044f376f7e42894589f0d44433a280619159b74b0b4d8e6b7c368495e8ebb3ca450

\Users\Admin\AppData\Local\Temp\Unicorn-60545.exe

MD5 c365bbeec21336fd888237f8af08bebe
SHA1 b8dfef2eddfc6af29f141cd5bb3b73f4d845a8fc
SHA256 bff7c192d79984ec661766f59a95143d7678a9ec0cc9ca2f6576df70d9b6122c
SHA512 8f8b9d018b3d8ff5e7a4a82b599c92f7ceb9d23c7ae8690722b2281068996023fd089a70ed2f0ef1493cfb9941928fb36bb5801899f7d00f5883f0574f35164f

\Users\Admin\AppData\Local\Temp\Unicorn-2621.exe

MD5 f88225840bec86f049c1a4ff199a450b
SHA1 937d5ef6c7c09f8e6f010d0eef06ff5692234bc7
SHA256 dd9b2538b4b2958d795771ab01e3a71467259b696a3dad469620102a27b2edc2
SHA512 be560957a8feae904cb2d9718d6c71c048aa09faac847905a6852d9c5e1bba4702926063b7fc4e00e007efa867b1ec970d7a356f88ec6822860ca43bf3f3225a

\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe

MD5 15152c34286cdd9763ed8ce3f8b82aa0
SHA1 fc06b01fbf0188c1b907c5cf58af1c7f172bbe22
SHA256 4147428a98b7bed9473eea9232a05da5f1e1c4db86b30a9b890c988b12d6d2d4
SHA512 04fc54906ae56b9a26735a08ccb618276c0a9b419b34dd55fe4a63e8d0dccd506a63073000fe1023772a2a7733f50a4bb8d0706638b3006b02413a4a4357eaae

\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe

MD5 cb523797be9ab5f53e467ef7d12b1856
SHA1 34c8966939cc6b94fb3be7bfa01c69cb866969a0
SHA256 36b02fec2431b373b8f39906dd9dbc564c68c79a8f0493db6c543fb6043ac483
SHA512 0a763a611a9f1d911961bdd68d79dd8f5118f143e3ba4a3055e01e0118e20e69a37643b5fd448796f853d1238c650a088d6ee4f4670157271eaa01a8b6b9ef66

\Users\Admin\AppData\Local\Temp\Unicorn-35616.exe

MD5 77069c136159abb88ad577dd5f74f81e
SHA1 8792024ced486a2d20483f409ffc2465ab222edd
SHA256 5603573c1781f030f99cf76c524949b57fe62cf50a4a3e2c7d84dfa4793a4152
SHA512 501abc029a937555718976c316fba7852b48b2131e15c23dd250cad5001a0d250b7024c3a8fcfce147bad3ce43f59ef3d84d740a96b0b38f72b98bf2d199eb3e

\Users\Admin\AppData\Local\Temp\Unicorn-7582.exe

MD5 29c7dceefebcde12bd1442ef53fc5ed7
SHA1 c051c62e944b5ae424b3c53137f0a0be45e929e7
SHA256 ad273aa4407a469271913264721e9b7301ad85e04f4a46701333a2ad16063a04
SHA512 87bb03e6d2ee83291a5cd048cbfcecf79be3850998281bf1ad8870c3eac6d4734c7ca3eb946519d5bd9042eb612a8916e3ae1a920f8bd4df7283bd58c1a92994

\Users\Admin\AppData\Local\Temp\Unicorn-4095.exe

MD5 04e96c6273cf7b73cabd332ee3a75c7f
SHA1 a584cfd6db98beb0304f615b3ca3e3535b62917b
SHA256 e863177c89f2221b25f9f2cbf09699024843bc19b76ffc560e11b24cd05aa5db
SHA512 0349be2e8afbae682c8846f8ccc1ad131d87d4d595d5a1470bb1722498f8c6b0177b7be5fa95c36324a0d594ae7d8d44ecc1cd31ec4785c0fa37166b9cfae029

C:\Users\Admin\AppData\Local\Temp\Unicorn-40690.exe

MD5 e26ead4e44c4954db2faa57748fd19d6
SHA1 476d9dcc24a9a83c5a1f37f74ad59f4d6738d710
SHA256 7b6862894a745213586d74f9d429a57f2c236821e8f68483d8c6550db4cc67c8
SHA512 65c4cb4ec90adab01fa4d7e5414b9d00714c519ff3de651ef157ee76db742d1047974a8f284eda7c40d59891e2c27c1a5a74b0e5c47142ecfdebff2b6e42b473

C:\Users\Admin\AppData\Local\Temp\Unicorn-9705.exe

MD5 65415b8a0a9813bdead2bf07b16f285a
SHA1 bdef73d3a7fe799c4179c6e55f9614ff31480480
SHA256 cd8aa474994503f404c34ebf03511d0f917c1e4d7e1f6b52a2922fcfab1a8619
SHA512 41b91d2317b6481a5e8279e84ed9a3c6302e7eae936376d57fc21152650fcba02c7075c695358774e8e06157a86c68d8972c5bd95c39701ae18501751640217c

C:\Users\Admin\AppData\Local\Temp\Unicorn-5486.exe

MD5 88c409f6d72e8291a9ec2b5e5c2edaa3
SHA1 8677f2401f8d51286f14ffdd3f5b6ca564f7b750
SHA256 1736c43b7c1ab2cd4ecd31f33d6d98a28e2dc331a37db1f0aba637f8325ffe7e
SHA512 47920588c3d63ba1be58dc1de23e5f3a6ac1d7fa93c9a728b84cfd928aa02ea2c23b2c6bdc46738fbd4ed2795f7307433d3d68aaf2ac8ded0768f2da32ba4fcb

C:\Users\Admin\AppData\Local\Temp\Unicorn-5769.exe

MD5 e4d8249ad5b2fa665937ffa61398fa00
SHA1 bf57ad2c722f7f9deaed6863b3e659e38c4dba97
SHA256 178c49c501e47f3ba348753c37d05573482a4194451bfa5be4827784d2130464
SHA512 cdb1b1fdff80ed715a5868b39eeacce25cee1692006272c9bff69c9520e507a1c813e6b2cbc55740d2295600f979dd6defcbdc82052fec31dcd87d4aa8045ce5

C:\Users\Admin\AppData\Local\Temp\Unicorn-1549.exe

MD5 805118e7aaf157c17bb5506b4b37b864
SHA1 3fe882f0dbeb0f49f289034281474660290ad143
SHA256 34286d9b53b09a6346ac2cb47a7ab6a8948b06f8b780c9432ef536f072c254de
SHA512 a0951936f913422959de4b006cb28a3b509722f910b0f3387c75d0b3b502dc555b21a053d92a5b93eefac30595d0b7f0d4cd3153685e1f2709cda788ae3df9fd

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-03 13:37

Reported

2024-06-03 13:40

Platform

win10v2004-20240226-en

Max time kernel

151s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a52d1b81e8a330e0bb78aed4624d0760_NeikiAnalytics.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64266.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6233.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22932.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-8153.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33404.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32466.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35694.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56861.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60390.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31418.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-52585.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18730.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27644.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22430.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31344.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51210.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27068.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55102.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1817.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12445.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29528.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4085.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38294.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38656.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-45886.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22534.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51869.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26042.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26788.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18620.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\a52d1b81e8a330e0bb78aed4624d0760_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64266.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6233.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22932.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-8153.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33404.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32466.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35694.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-56861.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-60390.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31418.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27644.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18730.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22430.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26788.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29528.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-61786.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-36789.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12785.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32246.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-51182.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42630.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64498.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4389.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-2609.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-13045.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32646.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-28562.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-52402.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-2817.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-8245.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27846.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-45962.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64846.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-41074.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-39360.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37632.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42100.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37632.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24634.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-56538.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42100.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31126.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4561.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53762.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-8710.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-16111.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-65519.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7034.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15202.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-13453.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-58119.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-418.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-52447.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-56754.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14206.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-11637.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20839.exe

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a52d1b81e8a330e0bb78aed4624d0760_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64266.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6233.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22932.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-8153.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33404.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32466.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35694.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56861.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60390.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31418.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-52585.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18730.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27644.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22430.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31344.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51210.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27068.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1817.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55102.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12445.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29528.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4085.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38294.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38656.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22534.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-45886.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51869.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26042.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18620.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26788.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3252 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\a52d1b81e8a330e0bb78aed4624d0760_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64266.exe
PID 3252 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\a52d1b81e8a330e0bb78aed4624d0760_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64266.exe
PID 3252 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\a52d1b81e8a330e0bb78aed4624d0760_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64266.exe
PID 2448 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64266.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6233.exe
PID 2448 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64266.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6233.exe
PID 2448 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64266.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6233.exe
PID 3252 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\a52d1b81e8a330e0bb78aed4624d0760_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22932.exe
PID 3252 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\a52d1b81e8a330e0bb78aed4624d0760_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22932.exe
PID 3252 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\a52d1b81e8a330e0bb78aed4624d0760_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22932.exe
PID 4936 wrote to memory of 3700 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6233.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-8153.exe
PID 4936 wrote to memory of 3700 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6233.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-8153.exe
PID 4936 wrote to memory of 3700 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6233.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-8153.exe
PID 2448 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64266.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33404.exe
PID 2448 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64266.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33404.exe
PID 2448 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64266.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33404.exe
PID 4028 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22932.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32466.exe
PID 4028 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22932.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32466.exe
PID 4028 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22932.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32466.exe
PID 3700 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-8153.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35694.exe
PID 3700 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-8153.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35694.exe
PID 3700 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-8153.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-35694.exe
PID 4936 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6233.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-56861.exe
PID 4936 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6233.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-56861.exe
PID 4936 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-6233.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-56861.exe
PID 1764 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33404.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-60390.exe
PID 1764 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33404.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-60390.exe
PID 1764 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33404.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-60390.exe
PID 2240 wrote to memory of 644 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32466.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31418.exe
PID 2240 wrote to memory of 644 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32466.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31418.exe
PID 2240 wrote to memory of 644 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32466.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31418.exe
PID 4028 wrote to memory of 4164 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22932.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-52585.exe
PID 4028 wrote to memory of 4164 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22932.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-52585.exe
PID 4028 wrote to memory of 4164 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22932.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-52585.exe
PID 1700 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35694.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18730.exe
PID 1700 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35694.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18730.exe
PID 1700 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35694.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18730.exe
PID 3700 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-8153.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27644.exe
PID 3700 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-8153.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27644.exe
PID 3700 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-8153.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27644.exe
PID 3880 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60390.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22430.exe
PID 3880 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60390.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22430.exe
PID 3880 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60390.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22430.exe
PID 1764 wrote to memory of 4172 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33404.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31344.exe
PID 1764 wrote to memory of 4172 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33404.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31344.exe
PID 1764 wrote to memory of 4172 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33404.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-31344.exe
PID 4668 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56861.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-51210.exe
PID 4668 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56861.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-51210.exe
PID 4668 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56861.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-51210.exe
PID 644 wrote to memory of 4268 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31418.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1817.exe
PID 644 wrote to memory of 4268 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31418.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1817.exe
PID 644 wrote to memory of 4268 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-31418.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1817.exe
PID 2240 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32466.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27068.exe
PID 2240 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32466.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27068.exe
PID 2240 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32466.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27068.exe
PID 4164 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-52585.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55102.exe
PID 4164 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-52585.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55102.exe
PID 4164 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-52585.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55102.exe
PID 624 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18730.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12445.exe
PID 624 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18730.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12445.exe
PID 624 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18730.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12445.exe
PID 1700 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35694.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29528.exe
PID 1700 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35694.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29528.exe
PID 1700 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35694.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29528.exe
PID 2228 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27644.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4085.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a52d1b81e8a330e0bb78aed4624d0760_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\a52d1b81e8a330e0bb78aed4624d0760_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\Unicorn-64266.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64266.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6233.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6233.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22932.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22932.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3252 -ip 3252

C:\Users\Admin\AppData\Local\Temp\Unicorn-8153.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8153.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33404.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33404.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32466.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32466.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 2448 -ip 2448

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 752

C:\Users\Admin\AppData\Local\Temp\Unicorn-35694.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35694.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56861.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56861.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60390.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60390.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31418.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31418.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52585.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52585.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 4936 -ip 4936

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 736

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4028 -ip 4028

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 740

C:\Users\Admin\AppData\Local\Temp\Unicorn-18730.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18730.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27644.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27644.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22430.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22430.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31344.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31344.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51210.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51210.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1817.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1817.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27068.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27068.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55102.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55102.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3700 -ip 3700

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1764 -ip 1764

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2240 -ip 2240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 720

C:\Users\Admin\AppData\Local\Temp\Unicorn-12445.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12445.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29528.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29528.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4085.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4085.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38294.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38294.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38656.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38656.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45886.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45886.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22534.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22534.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51869.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51869.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26042.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26042.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26788.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26788.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18620.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18620.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1700 -ip 1700

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3880 -ip 3880

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4668 -ip 4668

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 752

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 644 -ip 644

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4164 -ip 4164

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 752

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 752

C:\Users\Admin\AppData\Local\Temp\Unicorn-27770.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27770.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15517.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15517.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7349.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7349.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52829.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52829.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52829.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52829.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61786.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61786.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16478.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16478.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53981.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53981.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8480.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8480.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8480.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8480.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37858.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37858.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42688.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42688.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17246.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17246.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36789.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36789.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49726.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49726.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49726.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49726.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41558.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41558.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59793.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59793.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2228 -ip 2228

C:\Users\Admin\AppData\Local\Temp\Unicorn-6589.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6589.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6589.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6589.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2505.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2505.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51877.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51877.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 624 -ip 624

C:\Users\Admin\AppData\Local\Temp\Unicorn-11804.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11804.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3636.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3636.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19418.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19418.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31670.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31670.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 952 -ip 952

C:\Users\Admin\AppData\Local\Temp\Unicorn-7165.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7165.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7165.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7165.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 752

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1176 -ip 1176

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4216 -ip 4216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4268 -ip 4268

C:\Users\Admin\AppData\Local\Temp\Unicorn-40414.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40414.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32246.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32246.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4172 -ip 4172

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 736

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2456 -ip 2456

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3772 -ip 3772

C:\Users\Admin\AppData\Local\Temp\Unicorn-12785.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12785.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24846.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50694.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50694.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4408 -ip 4408

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 2976 -ip 2976

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 3124 -ip 3124

C:\Users\Admin\AppData\Local\Temp\Unicorn-62370.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62370.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58286.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58286.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3872 -ip 3872

C:\Users\Admin\AppData\Local\Temp\Unicorn-63714.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63714.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55546.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55546.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1880 -ip 1880

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 728 -ip 728

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 2780 -ip 2780

C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51846.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51846.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27342.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27342.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7284.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7284.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3276 -ip 3276

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2012 -ip 2012

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1764 -ip 1764

C:\Users\Admin\AppData\Local\Temp\Unicorn-28302.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28302.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4376 -ip 4376

C:\Users\Admin\AppData\Local\Temp\Unicorn-44446.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44446.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52614.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52614.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5092 -ip 5092

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 3936 -ip 3936

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3252 -ip 3252

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3596 -ip 3596

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 224 -ip 224

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 740

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3440 -ip 3440

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 1124 -ip 1124

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 4880 -ip 4880

C:\Users\Admin\AppData\Local\Temp\Unicorn-62474.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62474.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 676

C:\Users\Admin\AppData\Local\Temp\Unicorn-38930.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38930.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51182.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51182.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 2656 -ip 2656

C:\Users\Admin\AppData\Local\Temp\Unicorn-18510.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18510.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14425.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14425.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18510.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18510.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14425.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14425.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34654.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34654.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4084 -ip 4084

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4444 -ip 4444

C:\Users\Admin\AppData\Local\Temp\Unicorn-50798.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50798.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42630.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42630.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42630.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42630.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3360 -ip 3360

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 4976 -ip 4976

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4276 -ip 4276

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 660

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2972 -ip 2972

C:\Users\Admin\AppData\Local\Temp\Unicorn-15193.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15193.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15193.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15193.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 4348 -ip 4348

C:\Users\Admin\AppData\Local\Temp\Unicorn-14617.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14617.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14617.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14617.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 376 -ip 376

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 3720 -ip 3720

C:\Users\Admin\AppData\Local\Temp\Unicorn-35998.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35998.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35998.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35998.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4404 -ip 4404

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 1560 -ip 1560

C:\Users\Admin\AppData\Local\Temp\Unicorn-57570.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57570.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4900 -ip 4900

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4452 -ip 4452

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3592 -ip 3592

C:\Users\Admin\AppData\Local\Temp\Unicorn-63169.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63169.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1328 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4420 -ip 4420

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1748 -ip 1748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1732 -ip 1732

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 4820 -ip 4820

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2312 -ip 2312

C:\Users\Admin\AppData\Local\Temp\Unicorn-9905.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9905.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62998.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62998.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35142.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35142.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35142.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35142.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55562.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55562.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51478.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51478.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 5376 -ip 5376

C:\Users\Admin\AppData\Local\Temp\Unicorn-30674.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30674.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5648 -ip 5648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5816 -ip 5816

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5240 -ip 5240

C:\Users\Admin\AppData\Local\Temp\Unicorn-64498.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64498.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 5468 -ip 5468

C:\Users\Admin\AppData\Local\Temp\Unicorn-15105.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15105.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5440 -ip 5440

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5376 -s 720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5924 -ip 5924

C:\Users\Admin\AppData\Local\Temp\Unicorn-40762.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40762.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 5696 -ip 5696

C:\Users\Admin\AppData\Local\Temp\Unicorn-44654.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44654.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5088 -ip 5088

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5816 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 488 -ip 488

C:\Users\Admin\AppData\Local\Temp\Unicorn-21110.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21110.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53782.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53782.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49314.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49314.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49314.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49314.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 5672 -ip 5672

C:\Users\Admin\AppData\Local\Temp\Unicorn-4389.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4389.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4389.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4389.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4389.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4389.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53590.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53590.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5256 -ip 5256

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 6072 -ip 6072

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5936 -ip 5936

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5980 -ip 5980

C:\Users\Admin\AppData\Local\Temp\Unicorn-41914.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41914.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 5712 -ip 5712

C:\Users\Admin\AppData\Local\Temp\Unicorn-18754.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18754.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55702.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55702.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43066.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43066.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 5432 -ip 5432

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5256 -s 716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 3944 -ip 3944

C:\Users\Admin\AppData\Local\Temp\Unicorn-44026.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44026.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 5448 -ip 5448

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 5532 -ip 5532

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5636 -ip 5636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 5660 -ip 5660

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5808 -ip 5808

C:\Users\Admin\AppData\Local\Temp\Unicorn-56086.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56086.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11332.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11332.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2609.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2609.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36626.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36626.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 5692 -ip 5692

C:\Users\Admin\AppData\Local\Temp\Unicorn-2609.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2609.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5896 -ip 5896

C:\Users\Admin\AppData\Local\Temp\Unicorn-6693.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6693.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5760 -ip 5760

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5720 -ip 5720

C:\Users\Admin\AppData\Local\Temp\Unicorn-25852.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25852.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2284 -ip 2284

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5608 -ip 5608

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5644 -ip 5644

C:\Users\Admin\AppData\Local\Temp\Unicorn-1369.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1369.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 3296 -ip 3296

C:\Users\Admin\AppData\Local\Temp\Unicorn-21214.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21214.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13045.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13045.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13045.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13045.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5212 -ip 5212

C:\Users\Admin\AppData\Local\Temp\Unicorn-42978.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42978.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5592 -ip 5592

C:\Users\Admin\AppData\Local\Temp\Unicorn-63590.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63590.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 5724 -ip 5724

C:\Users\Admin\AppData\Local\Temp\Unicorn-1945.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1945.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1945.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1945.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63398.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63398.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41909.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41909.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47062.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47062.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 5476 -ip 5476

C:\Users\Admin\AppData\Local\Temp\Unicorn-21982.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21982.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31494.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31494.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4148 -ip 4148

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6048 -ip 6048

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5724 -s 664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 5232 -ip 5232

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5592 -s 648

C:\Users\Admin\AppData\Local\Temp\Unicorn-23710.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23710.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 5756 -ip 5756

C:\Users\Admin\AppData\Local\Temp\Unicorn-27602.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27602.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52298.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52298.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4996.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4996.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 5572 -ip 5572

C:\Users\Admin\AppData\Local\Temp\Unicorn-4249.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4249.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 1768 -ip 1768

C:\Users\Admin\AppData\Local\Temp\Unicorn-32646.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32646.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28562.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28562.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32646.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32646.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 5180 -ip 5180

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 5612 -ip 5612

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1588 -ip 1588

C:\Users\Admin\AppData\Local\Temp\Unicorn-62578.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62578.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50497.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50497.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 5152 -ip 5152

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1236 -ip 1236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 920 -ip 920

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2276 -ip 2276

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 6100 -ip 6100

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5228 -ip 5228

C:\Users\Admin\AppData\Local\Temp\Unicorn-56678.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56678.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64846.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64846.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64846.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64846.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64846.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64846.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64846.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64846.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4976 -ip 4976

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 660

C:\Users\Admin\AppData\Local\Temp\Unicorn-11369.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11369.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52402.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52402.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2908 -ip 2908

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 4156 -ip 4156

C:\Users\Admin\AppData\Local\Temp\Unicorn-15069.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15069.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2817.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2817.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2817.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2817.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5748 -ip 5748

C:\Users\Admin\AppData\Local\Temp\Unicorn-52018.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52018.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8245.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8245.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 3628 -ip 3628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 3720 -ip 3720

C:\Users\Admin\AppData\Local\Temp\Unicorn-7861.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7861.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2456 -ip 2456

C:\Users\Admin\AppData\Local\Temp\Unicorn-45962.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45962.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41878.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41878.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 5948 -ip 5948

C:\Users\Admin\AppData\Local\Temp\Unicorn-41302.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41302.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38370.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38370.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 1560 -ip 1560

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 5784 -ip 5784

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4864 -ip 4864

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 684

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 2032 -ip 2032

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5780 -ip 5780

C:\Users\Admin\AppData\Local\Temp\Unicorn-43222.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43222.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 3252 -ip 3252

C:\Users\Admin\AppData\Local\Temp\Unicorn-55837.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55837.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55837.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55837.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 2844 -ip 2844

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 1600 -ip 1600

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4448 -ip 4448

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 1944 -ip 1944

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 3000 -ip 3000

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 4472 -ip 4472

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6060 -ip 6060

C:\Users\Admin\AppData\Local\Temp\Unicorn-6657.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6657.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 2972 -ip 2972

C:\Users\Admin\AppData\Local\Temp\Unicorn-15786.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15786.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27846.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27846.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 2516 -ip 2516

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 5732 -ip 5732

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4940 -ip 4940

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6060 -s 696

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 4364 -ip 4364

C:\Users\Admin\AppData\Local\Temp\Unicorn-53658.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53658.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49574.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49574.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5804 -ip 5804

C:\Users\Admin\AppData\Local\Temp\Unicorn-28578.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28578.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20410.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20410.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 5752 -ip 5752

C:\Users\Admin\AppData\Local\Temp\Unicorn-45106.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45106.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 6056 -ip 6056

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 2312 -ip 2312

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 1528 -ip 1528

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 4612 -ip 4612

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5764 -ip 5764

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3668 -ip 3668

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 632

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 5292 -ip 5292

C:\Users\Admin\AppData\Local\Temp\Unicorn-59278.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59278.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1764 -ip 1764

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 3532 -ip 3532

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 5760 -ip 5760

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 5448 -ip 5448

C:\Users\Admin\AppData\Local\Temp\Unicorn-30114.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30114.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34944.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34944.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5692 -ip 5692

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5556 -ip 5556

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5216 -ip 5216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 5616 -ip 5616

C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6377.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6377.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43326.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43326.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5556 -s 752

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5692 -s 608

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1876 -ip 1876

C:\Users\Admin\AppData\Local\Temp\Unicorn-56538.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56538.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48370.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48370.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28504.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28504.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3276 -ip 3276

C:\Users\Admin\AppData\Local\Temp\Unicorn-24634.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24634.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12381.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12381.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 5800 -ip 5800

C:\Users\Admin\AppData\Local\Temp\Unicorn-37632.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37632.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37632.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37632.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1876 -s 748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 5236 -ip 5236

C:\Users\Admin\AppData\Local\Temp\Unicorn-8105.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8105.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5376 -ip 5376

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5816 -ip 5816

C:\Users\Admin\AppData\Local\Temp\Unicorn-9236.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9236.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42100.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42100.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25764.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25764.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33186.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33186.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39360.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39360.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 5076 -ip 5076

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5896 -ip 5896

C:\Users\Admin\AppData\Local\Temp\Unicorn-30808.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30808.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5816 -s 644

C:\Users\Admin\AppData\Local\Temp\Unicorn-18350.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18350.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24546.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24546.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49797.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49797.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41074.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41074.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36990.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36990.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5640 -ip 5640

C:\Users\Admin\AppData\Local\Temp\Unicorn-23970.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23970.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5856 -ip 5856

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 5684 -ip 5684

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 5336 -ip 5336

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5640 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 5904 -ip 5904

C:\Users\Admin\AppData\Local\Temp\Unicorn-50202.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50202.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5856 -s 664

C:\Users\Admin\AppData\Local\Temp\Unicorn-55630.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55630.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 5956 -ip 5956

C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31126.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31126.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18490.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18490.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18490.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18490.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18490.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18490.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14405.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14405.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14405.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14405.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6237.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6237.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6237.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6237.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14405.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14405.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 3872 -ip 3872

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5684 -s 716

C:\Users\Admin\AppData\Local\Temp\Unicorn-2153.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2153.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2153.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2153.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47078.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47078.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 6036 -ip 6036

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5904 -s 644

C:\Users\Admin\AppData\Local\Temp\Unicorn-30742.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30742.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6408.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6408.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 2136 -ip 2136

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 6080 -ip 6080

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 6012 -ip 6012

C:\Users\Admin\AppData\Local\Temp\Unicorn-51738.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51738.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19642.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19642.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 5416 -ip 5416

C:\Users\Admin\AppData\Local\Temp\Unicorn-56590.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56590.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52506.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52506.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52506.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52506.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 5624 -ip 5624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 1304 -ip 1304

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 1424 -ip 1424

C:\Users\Admin\AppData\Local\Temp\Unicorn-45838.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45838.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2976 -ip 2976

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 984 -ip 984

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 4368 -ip 4368

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 5132 -ip 5132

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 6064 -ip 6064

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 6092 -ip 6092

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 3772 -ip 3772

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 3392 -ip 3392

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 5144 -ip 5144

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 3796 -ip 3796

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 3692 -ip 3692

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 1164 -ip 1164

C:\Users\Admin\AppData\Local\Temp\Unicorn-57654.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57654.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57654.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57654.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 180 -ip 180

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5324 -ip 5324

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 4164 -ip 4164

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 4864 -ip 4864

C:\Users\Admin\AppData\Local\Temp\Unicorn-17006.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17006.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62122.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62122.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29450.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29450.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-477.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-477.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-477.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-477.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61930.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61930.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53762.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53762.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 5196 -ip 5196

C:\Users\Admin\AppData\Local\Temp\Unicorn-4561.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4561.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25366.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25366.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 5784 -ip 5784

C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 5432 -ip 5432

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3668 -ip 3668

C:\Users\Admin\AppData\Local\Temp\Unicorn-5713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1629.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1629.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58998.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58998.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50830.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50830.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42662.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42662.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 3124 -ip 3124

C:\Users\Admin\AppData\Local\Temp\Unicorn-26326.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26326.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 5560 -ip 5560

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 5352 -ip 5352

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 2904 -ip 2904

C:\Users\Admin\AppData\Local\Temp\Unicorn-3910.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3910.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 2760 -ip 2760

C:\Users\Admin\AppData\Local\Temp\Unicorn-37329.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37329.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33651.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33651.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 5656 -ip 5656

C:\Users\Admin\AppData\Local\Temp\Unicorn-5809.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5809.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49603.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49603.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5428 -ip 5428

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 2776 -ip 2776

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 5424 -ip 5424

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 3164 -ip 3164

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 452 -ip 452

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 5548 -ip 5548

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 5384 -ip 5384

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 5592 -ip 5592

C:\Users\Admin\AppData\Local\Temp\Unicorn-24663.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24663.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15919.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15919.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 1528 -ip 1528

C:\Users\Admin\AppData\Local\Temp\Unicorn-16111.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16111.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56951.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56951.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 2708 -ip 2708

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 632

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 452 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5424 -s 652

C:\Users\Admin\AppData\Local\Temp\Unicorn-350.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-350.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 5472 -ip 5472

C:\Users\Admin\AppData\Local\Temp\Unicorn-8710.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8710.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16879.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16879.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12794.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12794.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 3308 -ip 3308

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 2188 -ip 2188

C:\Users\Admin\AppData\Local\Temp\Unicorn-37299.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37299.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29131.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29131.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33215.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33215.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 4708 -ip 4708

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 3780 -ip 3780

C:\Users\Admin\AppData\Local\Temp\Unicorn-1658.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1658.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21887.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21887.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17803.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17803.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17803.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17803.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 636

C:\Users\Admin\AppData\Local\Temp\Unicorn-14486.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14486.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 5248 -ip 5248

C:\Users\Admin\AppData\Local\Temp\Unicorn-26931.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26931.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5472 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 5944 -ip 5944

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 3592 -ip 3592

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 5812 -ip 5812

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 4440 -ip 4440

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 2800 -ip 2800

C:\Users\Admin\AppData\Local\Temp\Unicorn-55903.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55903.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4376 -ip 4376

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 5524 -ip 5524

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 1172 -ip 1172

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 5748 -ip 5748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 5496 -ip 5496

C:\Users\Admin\AppData\Local\Temp\Unicorn-20875.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20875.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 5364 -ip 5364

C:\Users\Admin\AppData\Local\Temp\Unicorn-13453.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13453.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 4464 -ip 4464

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4928 -ip 4928

C:\Users\Admin\AppData\Local\Temp\Unicorn-41103.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41103.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 5136 -ip 5136

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 2464 -ip 2464

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 5912 -ip 5912

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4236 -ip 4236

C:\Users\Admin\AppData\Local\Temp\Unicorn-63443.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63443.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1880 -ip 1880

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5168 -ip 5168

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5852 -ip 5852

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6132 -ip 6132

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 3460 -ip 3460

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 5696 -ip 5696

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 5884 -ip 5884

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 6116 -ip 6116

C:\Users\Admin\AppData\Local\Temp\Unicorn-7034.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7034.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15202.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15202.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23371.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23371.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14626.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14626.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10734.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10734.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14818.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14818.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14818.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14818.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14818.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14818.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18711.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18711.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18711.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18711.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35239.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35239.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35239.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35239.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 5268 -ip 5268

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 5288 -ip 5288

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 5588 -ip 5588

C:\Users\Admin\AppData\Local\Temp\Unicorn-65519.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65519.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65519.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65519.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5004 -ip 5004

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2248 -ip 2248

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 5488 -ip 5488

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 3388 -ip 3388

C:\Users\Admin\AppData\Local\Temp\Unicorn-1134.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1134.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 4880 -ip 4880

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3636 -ip 3636

C:\Users\Admin\AppData\Local\Temp\Unicorn-54398.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54398.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54398.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54398.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 3552 -ip 3552

C:\Users\Admin\AppData\Local\Temp\Unicorn-58119.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58119.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50506.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50506.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 2808 -ip 2808

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 1532 -ip 1532

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 5716 -ip 5716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 5844 -ip 5844

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 952 -ip 952

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 2908 -ip 2908

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 6084 -ip 6084

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5492 -ip 5492

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 3392 -ip 3392

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 2784 -ip 2784

C:\Users\Admin\AppData\Local\Temp\Unicorn-26983.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26983.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 652

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 4172 -ip 4172

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 2548 -ip 2548

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3244 -ip 3244

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 6064 -ip 6064

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 5744 -ip 5744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 5504 -ip 5504

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 5196 -ip 5196

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5772 -ip 5772

C:\Users\Admin\AppData\Local\Temp\Unicorn-26791.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26791.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26791.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26791.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 656

C:\Users\Admin\AppData\Local\Temp\Unicorn-52447.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52447.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52447.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52447.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 4404 -ip 4404

C:\Users\Admin\AppData\Local\Temp\Unicorn-3246.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3246.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 4312 -ip 4312

C:\Users\Admin\AppData\Local\Temp\Unicorn-19583.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19583.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27751.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35919.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35919.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 2128 -ip 2128

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 5876 -ip 5876

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 6072 -ip 6072

C:\Users\Admin\AppData\Local\Temp\Unicorn-64315.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64315.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3417.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3417.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 3436 -ip 3436

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 6032 -ip 6032

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 4984 -ip 4984

C:\Users\Admin\AppData\Local\Temp\Unicorn-20521.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20521.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20521.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20521.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 1876 -ip 1876

C:\Users\Admin\AppData\Local\Temp\Unicorn-16075.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16075.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16075.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16075.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 3936 -ip 3936

C:\Users\Admin\AppData\Local\Temp\Unicorn-49707.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49707.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50646.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50646.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 6012 -ip 6012

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 5240 -ip 5240

C:\Users\Admin\AppData\Local\Temp\Unicorn-37263.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37263.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25565.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25565.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63438.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63438.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63438.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63438.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30787.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30787.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47507.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47507.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48062.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48062.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55099.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55099.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 3580 -ip 3580

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5240 -s 724

C:\Users\Admin\AppData\Local\Temp\Unicorn-43999.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43999.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15218.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15218.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52359.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52359.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56443.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56443.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 740

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 5344 -ip 5344

C:\Users\Admin\AppData\Local\Temp\Unicorn-23195.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23195.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 1764 -ip 1764

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 1332 -ip 1332

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 4588 -ip 4588

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 2328 -ip 2328

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 4476 -ip 4476

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 3824 -ip 3824

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5344 -s 660

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 60 -ip 60

C:\Users\Admin\AppData\Local\Temp\Unicorn-36215.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36215.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36215.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36215.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3592 -ip 3592

C:\Users\Admin\AppData\Local\Temp\Unicorn-40299.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40299.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-418.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-418.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4502.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4502.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20839.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20839.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29945.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29945.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 2176 -ip 2176

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 5160 -ip 5160

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 2060 -ip 2060

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 5400 -ip 5400

C:\Users\Admin\AppData\Local\Temp\Unicorn-20647.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20647.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 2912 -ip 2912

C:\Users\Admin\AppData\Local\Temp\Unicorn-54471.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54471.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63194.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63194.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17523.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17523.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33859.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33859.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54663.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54663.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 1176 -ip 1176

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 5924 -ip 5924

C:\Users\Admin\AppData\Local\Temp\Unicorn-54834.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54834.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1954.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1954.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14206.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14206.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18291.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18291.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14206.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14206.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 560 -ip 560

C:\Users\Admin\AppData\Local\Temp\Unicorn-42411.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42411.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42411.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42411.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 2144 -ip 2144

C:\Users\Admin\AppData\Local\Temp\Unicorn-18099.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18099.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 4164 -ip 4164

C:\Users\Admin\AppData\Local\Temp\Unicorn-19059.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19059.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4084 -ip 4084

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 5500 -ip 5500

C:\Users\Admin\AppData\Local\Temp\Unicorn-56754.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56754.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3469.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3469.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 5528 -ip 5528

C:\Users\Admin\AppData\Local\Temp\Unicorn-11637.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11637.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15721.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15721.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 740

C:\Users\Admin\AppData\Local\Temp\Unicorn-2530.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2530.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53210.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53210.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5500 -s 720

C:\Users\Admin\AppData\Local\Temp\Unicorn-38623.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38623.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2580 -ip 2580

C:\Users\Admin\AppData\Local\Temp\Unicorn-5950.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5950.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5072 -ip 5072

C:\Users\Admin\AppData\Local\Temp\Unicorn-13734.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13734.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13734.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13734.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42515.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42515.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 3360 -ip 3360

C:\Users\Admin\AppData\Local\Temp\Unicorn-13734.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13734.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 5600 -ip 5600

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2724 -ip 2724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 2464 -ip 2464

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 2168 -ip 2168

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 4976 -ip 4976

C:\Users\Admin\AppData\Local\Temp\Unicorn-40351.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40351.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40351.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40351.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44435.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44435.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48519.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48519.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48519.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48519.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56687.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56687.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 5404 -ip 5404

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 716

C:\Users\Admin\AppData\Local\Temp\Unicorn-36075.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36075.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43859.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43859.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43859.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43859.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60195.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60195.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 5692 -ip 5692

C:\Users\Admin\AppData\Local\Temp\Unicorn-6910.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6910.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5348 -ip 5348

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5788 -ip 5788

C:\Users\Admin\AppData\Local\Temp\Unicorn-45011.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45011.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 3372 -ip 3372

C:\Users\Admin\AppData\Local\Temp\Unicorn-8254.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8254.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 5896 -ip 5896

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6024 -ip 6024

C:\Users\Admin\AppData\Local\Temp\Unicorn-36267.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36267.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 5704 -ip 5704

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 640 -ip 640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 4316 -ip 4316

C:\Users\Admin\AppData\Local\Temp\Unicorn-8638.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8638.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8638.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8638.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3476 -ip 3476

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 5652 -ip 5652

C:\Users\Admin\AppData\Local\Temp\Unicorn-18093.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18093.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18093.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18093.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 1288 -ip 1288

C:\Users\Admin\AppData\Local\Temp\Unicorn-30345.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30345.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30345.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30345.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 1600 -ip 1600

C:\Users\Admin\AppData\Local\Temp\Unicorn-39111.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39111.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5136 -ip 5136

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 4372 -ip 4372

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 4992 -ip 4992

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 2768 -ip 2768

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 3004 -ip 3004

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 4896 -ip 4896

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3696 -ip 3696

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 3348 -ip 3348

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 4840 -ip 4840

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 6136 -ip 6136

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 5424 -ip 5424

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 6052 -ip 6052

C:\Users\Admin\AppData\Local\Temp\Unicorn-61067.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61067.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24887.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24887.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62027.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62027.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-574.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-574.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4658.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4658.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8742.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8742.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25079.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25079.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 3960 -ip 3960

C:\Users\Admin\AppData\Local\Temp\Unicorn-29163.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29163.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8166.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8166.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5532 -ip 5532

C:\Users\Admin\AppData\Local\Temp\Unicorn-57559.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57559.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57559.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57559.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 4148 -ip 4148

C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42183.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42183.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58519.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58519.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62603.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62603.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34207.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34207.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 3164 -ip 3164

C:\Users\Admin\AppData\Local\Temp\Unicorn-4850.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4850.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4448 -ip 4448

C:\Users\Admin\AppData\Local\Temp\Unicorn-29547.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29547.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5884 -ip 5884

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 4708 -ip 4708

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5364 -ip 5364

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5532 -s 660

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 5860 -ip 5860

C:\Users\Admin\AppData\Local\Temp\Unicorn-63179.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63179.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 3936 -ip 3936

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 260 -ip 260

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 4216 -ip 4216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5168 -ip 5168

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 4960 -ip 4960

C:\Users\Admin\AppData\Local\Temp\Unicorn-40537.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40537.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40537.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40537.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 4908 -ip 4908

C:\Users\Admin\AppData\Local\Temp\Unicorn-40175.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40175.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5644 -ip 5644

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 1588 -ip 1588

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 4344 -ip 4344

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5648 -ip 5648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 5752 -ip 5752

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 2780 -ip 2780

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 2140 -ip 2140

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5976 -ip 5976

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 3320 -ip 3320

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 2176 -ip 2176

C:\Users\Admin\AppData\Local\Temp\Unicorn-14082.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14082.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50455.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50455.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50455.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50455.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54539.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54539.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54539.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54539.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62707.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62707.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21675.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21675.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62707.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62707.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9614.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9614.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5530.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5530.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 5568 -ip 5568

C:\Users\Admin\AppData\Local\Temp\Unicorn-27103.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27103.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27103.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27103.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6682.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6682.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 5304 -ip 5304

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 5156 -ip 5156

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
GB 142.250.200.42:443 tcp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 225.107.17.2.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\Unicorn-64266.exe

MD5 8ac25a047ae8b986c301a51c09905333
SHA1 fcb42aa68f52c4c39c8f78b600a2af724b4a636b
SHA256 9c35f16d1145eea0141b73cf982d0868e26912518e52100cbdc1a9257a41e0af
SHA512 d85b55ebe09486d16aae57d1b0bfc6a23afc3c4a127fb8a66dc1ef198544f6dc3924a2b0ce97fff9b668248b4d4d6b3f3a01be055a035c44ed87ce02512421b4

C:\Users\Admin\AppData\Local\Temp\Unicorn-6233.exe

MD5 f2b3a7e91e51bd509df17aea532b3a2c
SHA1 c1950e9980166f15fa03bef1268f3d6c94af6f3a
SHA256 7bb66c08264a066a02760f4e87ef241f620d61f8926ffa24433ad8e662751abc
SHA512 ff15814458dfb6f39975cdf298868c24d344499f24166742a6be585168de839deec584afbf615a13c04f1c825552fc34625cde1f106443bf7cf447a19ac8f210

C:\Users\Admin\AppData\Local\Temp\Unicorn-22932.exe

MD5 babd500085d7924523481b4c08405c99
SHA1 f669369024f4b6e4955cab3eade315da7d1a1bce
SHA256 1ef90b84bc931625bb2f19ee7b1640009e409f642a8ba0f3ffe8f380cabb5eb5
SHA512 7d48447207cef7de7010499885e37a343dc5dc6bbdad38e9cc438a206ab266cff38eebed7af32c4ccb696263bd0982504ad216dfc87d813a25f15c20aca3f030

C:\Users\Admin\AppData\Local\Temp\Unicorn-8153.exe

MD5 bd4542c1fab29fdee00d3814da924720
SHA1 993bd477f994b2bf17c08193249c78629e238ec7
SHA256 4ae35cc2f874aa7654dd170a6c1f25049551be638923c2f052f004507eb04755
SHA512 bd3d8babc062ef78ed6e3a627351cf33b2c7d180cd5b1ef31bddbc602867e0248fe1b16e72adb541b4a662d4e400bac4e99aabc1be18522a2d46fbf5a2f125b3

C:\Users\Admin\AppData\Local\Temp\Unicorn-33404.exe

MD5 663f673e617629dce84ec54a3192c7c9
SHA1 e0cc7b188711cb28362c01cbe1dea7b943467004
SHA256 3e109ccf289fa317b617a8e9b8ec88a4f548856824f7ba7e57424693b6c61039
SHA512 28bd2f55f4f872a0c3617a73ec9f303488e89c0d01b8e6f272ab8c1db02fed0e9195cb3e41af2a77a203bb4e15a20edd439ad9c70fd317705df530e61c482ab3

C:\Users\Admin\AppData\Local\Temp\Unicorn-32466.exe

MD5 1794e38388fef7fa56206b80bc95db11
SHA1 521be5891f0fe630365f9415ea945d306f1a47b2
SHA256 301d23712a00ecbc8559e4416d1eda19248178fdf696fc71e948b0d81abb7fbb
SHA512 d58520aabb91903b9ffad375985770f8a260648771bcf92a6e912e0661512ca87778323d46d75ac223743c4ff71d88065e925d536396c1811a9884169f7692e3

C:\Users\Admin\AppData\Local\Temp\Unicorn-35694.exe

MD5 8b977b2c04b425138798ae577894cc00
SHA1 40125fba57a155d7f6af52005cc2e5b0e5808418
SHA256 07d72a895139fdd599cf8d69010ab93971000e43367e645a9960fce16ac85448
SHA512 330f59f9f2febe31600394dee2c0ff9df8b9199a7759898d6f8f67fb466309d1a2544b157f4f0e06c52006aa6b91a43a608c1ce8f4ad7e5c8aaf73dc99bb4757

C:\Users\Admin\AppData\Local\Temp\Unicorn-56861.exe

MD5 cd3e08d07a80b140d67ca8b012230786
SHA1 6a101fb59a4fceb38807ecffb637d6abf6fa4f0d
SHA256 76c9abf1ccba6d4863911556f667689af91adcaa50570298d69ff8be86af0a43
SHA512 3d4f6c8e6fdcb87a355e576561cfea90c91e300e1498f0e41ca355ed5bcb70b2f5aa8822f858d933c919b3ad99b510804474f92b2ff9b88f357f76333216a43c

C:\Users\Admin\AppData\Local\Temp\Unicorn-60390.exe

MD5 c746ef5932475a755265bfecec76f1f6
SHA1 fd0837c18707f8ed83e939415c17a32b9141946d
SHA256 083497e499244f9e0f67e039ce6a8439220a32fd33a16047c0e23fd46e7e3c15
SHA512 2bf99d592e0377d17c8a6731bf45f3159bcd6ba84b6e83ee63c118565b2a013ecb67b034225fba61460c607cf6089e056ec60a179600fd00cf41b75f5ca394c4

C:\Users\Admin\AppData\Local\Temp\Unicorn-31418.exe

MD5 1e4673eae2ba5aa329a0f37922cfcd93
SHA1 68fd53cec5ebb9641c99cdebe9e0f6ebc00e74f1
SHA256 75459995feee0f192a49ca83129fcb50bdd942f142e512a77ef0e5c57d3928a8
SHA512 df09fe8f13f0d05365231793e717d08058f838dc452f927a6e1af00882b3ebbcb1f3682566768462ab030e46133bbad380238372752f744adcdcbed9114e9684

C:\Users\Admin\AppData\Local\Temp\Unicorn-52585.exe

MD5 ef71ce76ce12608e1ca46831b6d9520d
SHA1 add3049e44c41c183fa53eb881b7d5244f919586
SHA256 242d7be14cf872938135de47a1df475547d88c177844168b3084d2fb74246f46
SHA512 46a0238a87806d2c8c0d3f9c9d9d98669fd7d19b479cec5788b764c18d2d68fef21a4f450b6f4e55173cf3a35ce0cc73b0e9af2d850222fb9e8fd4dcde15234a

C:\Users\Admin\AppData\Local\Temp\Unicorn-18730.exe

MD5 ef05a56576f6473153f1b523cc63bca5
SHA1 75f4eadceac282b91302e6129e66b286e519a2a7
SHA256 56946fe407006e098bd45763491e6388d095a9cf5fef819a8c426b775892dad9
SHA512 38f4f5e432c07138a4f4b30a9418ae320049d8e2a60fe0206b42bbb719fb03158630341af79ed69ff2caba7e124c92f58a056b8622706b17ed3b1bb4b091f384

C:\Users\Admin\AppData\Local\Temp\Unicorn-27644.exe

MD5 af134ad8857c6403ee3a813c90798626
SHA1 2afceb3886c5e61f11dba1a426b4fa0707d67a34
SHA256 0a5a414396d8de2266215ceaffacd255f54d1e9bb19f923749a937584df17828
SHA512 ab6f7cdd028f14adbea1f20a4915757af682aea8ef9d386ecd13ac1a0f4db94b59ebb99e9b22fe840b37e6d9c28909e2a0351142a7f079b65c52f9d1f4fbea6f

C:\Users\Admin\AppData\Local\Temp\Unicorn-22430.exe

MD5 817b7d0d48b5af36e89f089235962482
SHA1 380c0670b48ea6417976bfd86cbda9da4db52374
SHA256 7bef5f109f61383d9e44d415737d08cc92578073b172e9d1425e9620d63f5be0
SHA512 7f30bb78a92279804e53685b1b8aacd13dde176a1df160d55b31f47ec4366eda8e6d82559dd1a2c8989271091079f5189ee1ada3d99e9320ca9346d6e6230f26

C:\Users\Admin\AppData\Local\Temp\Unicorn-31344.exe

MD5 ab8578cedf5a9dcb6ea458a978d6bd95
SHA1 3cc23feeae6ce5b8da85b52aa24805479cf223b0
SHA256 6362c986bbc02df2bc27d5c21a3de9a34e4b9aa4651b10b15ec4827460bd45c6
SHA512 11ae167d9e9e94432dc8278de307b914341b2ed8ba926a732c08c5d13f539e1576b543a0b13efe01e6b7e0507715b71f3105d81dcaec8eaa6735830ee941d597

C:\Users\Admin\AppData\Local\Temp\Unicorn-51210.exe

MD5 f51afaea9dadf3af91d4451453678813
SHA1 4527de4ce10ea50c184e1cabca3fbdee9e43c52a
SHA256 d222dc97b1e8afe2fad889b09e40abc75a1ed0c38638ca0811e488d93f410452
SHA512 a527fd47c2e31f5f8ea97da54715bb865971d019e8cf718f0ff467c5ea9623ba3e50b15936fbcb6f3ec1e86d7ca91a2bfe5e20f1d2f8280d2bbfd27c7625cd19

C:\Users\Admin\AppData\Local\Temp\Unicorn-55102.exe

MD5 81448f42be12b1a3fe0fa1d8b3013587
SHA1 835f29b6064421ea115f7b4c9a3827a47d50ddfb
SHA256 724e854a9952f0633cf3552ef4fc890b3c5835be7458cdb1448edc50f782281b
SHA512 d22dd3834dda074a2445f80fcc7cfba1e405e3f41b9a3e0b299430ba892005a62fd71598e3ce8790989e97ac4eadecc7324c7c573fdc7a70e9248db1b7fe16dd

C:\Users\Admin\AppData\Local\Temp\Unicorn-27068.exe

MD5 5b6af2d19cb87bfeca98336551de5753
SHA1 c3a1282bf83d2e612285f326edc8d22d5d9d115a
SHA256 b3dc30c508a027cc62dae9f54be933e493f8154cfcb1c425403a2d537736e61f
SHA512 01b67ea89635e97f2d893638c17288f6b5440a753462d417d273a852cb3a35f407fa2017763c0484b98455b753694a99df2e6bda4d22a6f6fe5fdc69eb689fc2

C:\Users\Admin\AppData\Local\Temp\Unicorn-1817.exe

MD5 6ea0a74196091bec1c70448e5189b66b
SHA1 a5e0864a48109acedd293d0ea22ce7b29a042b39
SHA256 42b0d4e3a8088cf984c70a732c9bd01c2a7df2b77ca67468ab355feb9a21d575
SHA512 1c9aae7080cc28e96b110100fc6d21bdf22bd75d093e7fcb7209485cfecb21c24c67e9fbdb0a2b75adf32a5734e398fd09d6114de0bfd56b343b1b29cc5074cf

C:\Users\Admin\AppData\Local\Temp\Unicorn-12445.exe

MD5 685567a8badd6ae1c699fee66b018839
SHA1 1303312d2d334acc3a70b991df16eb853cec655e
SHA256 a8a752e42092778a005d128f22c77c6e7d08f8baf4542c46b30ad2ad925ceacf
SHA512 e37c6075d1f6199e9f3c555585225117445b5cd95583b24c11c742c5f136ae649c232e918ad8ca8de3928c058c8417a483c3d6e27cb9be65a9479402eb6bddb2

C:\Users\Admin\AppData\Local\Temp\Unicorn-29528.exe

MD5 03a8a11d41a533967731d180649c27f1
SHA1 c2f59666efe8eede553aef234ac43ddf00f02412
SHA256 ef302277505a1bcc7a9cf2dc53341c793aeae493d9d6b7929a89e13b8d265628
SHA512 88c4d10e9e33db739acec446d12c7881ae7ebd88017c4e7cdb4e9e3578f8eca0b3ddbc8bc9e7ec482c3d66885751c3ff0ef6685d9279a7c4bb8caee3925623a2

C:\Users\Admin\AppData\Local\Temp\Unicorn-4085.exe

MD5 03219cd2ba15e2cab08ec06511d88001
SHA1 238362b43b4c1e43479a2522154962f2b69a5cb9
SHA256 e628097c88702f5a1641f70ee48af6c273c603e01ced8caeb400f6a3fe6021a3
SHA512 7d7452acd2cec931efc1216952a04c190df190ad5c312725da1977f4f227e385e781689e0a6611d502723fe140dc135c1cb539fb6afc36feb90b911b2b5812d8

C:\Users\Admin\AppData\Local\Temp\Unicorn-38294.exe

MD5 08ed11fd36b9af282741823021aaa28c
SHA1 59af3cad16b1f2f8028a4b56ddc150f1a47ac350
SHA256 347ef0efcac1179577c8f70ff5af3a529c78aabbd803073b9cfa20b4b9023243
SHA512 4dac95a8641c3cdae7719147924d79eca2c712129743deff027909ede124985de060320e186ef11af878ec2d7b73954110a2ecb70a9f8ef80577665c4bc39dbe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38656.exe

MD5 2afdf32542bee6ac45db49379f8d6585
SHA1 8961258c51e8b652e8392b65da036e1a1fa83d5b
SHA256 ca130e73118b44bb6beacb10ddc580b7fcc3686e211079efa859b68d197cdb57
SHA512 9c21c40c0b3fb2f7d99402f109b1565f28d3dc61bef45f4f90690d0c04c86f6f874897cada093188696df95e0934bf9f1c85ecd9fa8b2e3ec154ebfa8d36b2ac

C:\Users\Admin\AppData\Local\Temp\Unicorn-45886.exe

MD5 a852d8cf1a6fe8de1b1563911d9cf98b
SHA1 e69c3950449b59bc137f7801815a21fd3d5250d3
SHA256 f23580b2c477e2d8e1a3a0111279c7a12109ddacf37bd2aeb43e1505dfb8d1b1
SHA512 4610619341ed656e2bea16c534f37864ac89c5a5f728790caaf8af5cb1b1b99b23344ffbc2e717d9210c5fcdf4b7027a88c0a45608e723a114996a71647e24cd

C:\Users\Admin\AppData\Local\Temp\Unicorn-22534.exe

MD5 19ec8dbcc06e5cecc1a16f34df6b05a0
SHA1 e13d4e5dba5c410aaada27ed4d0ad7be28d3d881
SHA256 56cfe56b66ab81c04670ba46f68250aea7990410c61751b64e2c2f701ff09f37
SHA512 cbdceaeb480426b6268d603aa9a979b2c15199a509488613ad04692f4b555f404c648beeef21bbdd0c1c20a4c4f1f0f6c7e5ce6cfcd9e93ff19a42cedc7fcac1

C:\Users\Admin\AppData\Local\Temp\Unicorn-51869.exe

MD5 dad8a6a3c645009a0a5e1f8e18f5a315
SHA1 948e2e186123033365cb780877bfb87613715f36
SHA256 e0a35690e0045fec5fddc794e760397be05b07eb0d225166ba2353d89fb9d321
SHA512 deb537bc63bfcc271159e49dcc4b95908b115d9a19ee55b20623ed7d7af9890eb36ce51551608bea2a62bab75335b5cfc8243fc965456c3b9bbf2d723882ea99

C:\Users\Admin\AppData\Local\Temp\Unicorn-26042.exe

MD5 c55ce6d6d8df7ab83f69789b3057a7f6
SHA1 d4b9cddd6a103b24a9f71f742d36be07e2a2d711
SHA256 6e806a58b215e9425b6e116b1d74e27783a18e9ad7436841da8a75bcf882684f
SHA512 d4c9d4e6ffb07db5067890363d6d4c66fa185716f7fa05db68a2d4e5c1f9d22cbb778aeadfb317bb69f302ddedb94880da4cc617168b6aa77080c672e853f7e8

C:\Users\Admin\AppData\Local\Temp\Unicorn-26788.exe

MD5 996586c753308477515e98565b02ab7e
SHA1 f717ffe9c3392bef2c8e59e611989133f79b26f8
SHA256 4d66b75c36a3036c2331c8aa3930d2f961d7968f43f55f9193bf12086a4732a4
SHA512 ed51fde14a07a1798767d1c4bb993974efc9e51ccf6e9e7e25e336272cd032f4e3bef8da477562698c18dc215999955cf7c94b71a552482f71317e418d1c8378

C:\Users\Admin\AppData\Local\Temp\Unicorn-18620.exe

MD5 ebbef8b0a2ca91af7c7fc8804feaccd4
SHA1 c07d5eb0891cff1f1c2b11ed4ce2c8fc485e8f7f
SHA256 fe1f0faad533120e369bbf97d6dbf859a034a78c4a15917e6cc37cb0fc5fea8a
SHA512 33ec7e2f205703d3aa0e6e431346a7240db0b26325b8b026231863789975afea8726b245d779b14db098adb1c594dfb0c1f0387db7a91bd97476fae117d96cde

C:\Users\Admin\AppData\Local\Temp\Unicorn-15517.exe

MD5 1574bd6538d0ea2733514a0ecb9dda3f
SHA1 ff7df20739ca2fefb9affd3bf5b2abbc73f7db3a
SHA256 3e4cb1127e2c5fb4c1bea94a2e81e5ab986ae663ccaabada889d1848f49cfa1c
SHA512 38f56bfb2516f3f1f9a44141e8a5fc5fa8627f9f66254e66ad58a321fdef072703964de0baaefc7cbd5bf0c7868be2dff751678207b46dbb4da3cded21f761a4

C:\Users\Admin\AppData\Local\Temp\Unicorn-27770.exe

MD5 9986e53ba338f85daff4136a2fa165f3
SHA1 7b20eb4c947b44679561d4cffcdfa53e44f6e39d
SHA256 07b9d15decd90d79a445b1d840e2c937e729273e106476b08756ecabc4cd6ca6
SHA512 8ab39ca5d381e7374f1ae2eea7f4e3b1aaf0984109a27d03d2f4a80843e0316ca658606d591c9776b1cec7acc9d288e2d1efadd53716814ea102a3460400a269

C:\Users\Admin\AppData\Local\Temp\Unicorn-62370.exe

MD5 85cdc657cfa35a5f36232d02e4949b35
SHA1 c5a7d00acd794f6393fff3f982c4ab983edef898
SHA256 2b757ffb4dc438cbbe95a31a09ac3440f045833dd7e0d9e676bb064aae852f42
SHA512 d608a3935dc0673256b279f5c2e01133e63a293f5a85b77da0fa9a2706c15a120a2a4d66409200a1981da9cb8ebe248a4932179cab0050704edc7b7dd4209c38

C:\Users\Admin\AppData\Local\Temp\Unicorn-23970.exe

MD5 98016e71200f796254e8818e6b61f66e
SHA1 acfa5590641ce87183ea64047a9f394fe10e4bde
SHA256 d64c98462c85b58fa7ade8192caf666ad4254e491ffe4715754ed2cac4596916
SHA512 9a36e82f955920a0c6db85f87b5ceca105b7a69ca66a95d678fc317e1637de12f3620d764cc2ac10d67df052994a0128e5076b36c3f8f9ad911a082e88254970

C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe

MD5 8f8141ee59fcbe9d369e99c82121f0fc
SHA1 80c360d9df92ecccb0c8e5122a8b2bacbc8b9105
SHA256 e0b92cb98e0275071d65faed92d25cc1a0b40d30c3e4d1e89aa4c785fa16cff4
SHA512 9f826d9a16d4cb2d6747f5bc644512759b85542e65d2fd919a5a00c1864443f98c2bc14c24015caf22889c27fe4533fbe82293b0731ebfb093cdd0b6f6f9c717

C:\Users\Admin\AppData\Local\Temp\Unicorn-37299.exe

MD5 04f07a2f50db08819fc88312f3264c41
SHA1 bfc836493e243eb11e34b56a6392f0118a8d3275
SHA256 eb6c4070cd9e6f19033c725236fa06722b5a7e785a85302c4337e586c6e551ab
SHA512 f9ef47936123148f3cb5fe9b432ea9cf25614d7df50c52a3eb292eb2e5a013148aa1e653c5f744812a9b089093eed838665990d0aa9cad7d659e475050c1e6e5

C:\Users\Admin\AppData\Local\Temp\Unicorn-8638.exe

MD5 4012534bed86d42ca3619fe48274af46
SHA1 13cc00c537ca688301997e8546ef48f78d112d3e
SHA256 005c805ac71f960923529725bac583ab921f3bbdcb34cfe092b386ddf3fedb3f
SHA512 5189c28e5d3ee0d65d05a49a7749047e77664e7ffcdf47b3a9cc7b6ade23c06d72e1e800cad6d1c068d2ef2e906f631fc90dc0a3e2bdd131247c3aeebe25ebbf