Malware Analysis Report

2025-08-10 21:50

Sample ID 240608-h1fhzsba78
Target 97683b1b076a64ec26b3f05267349650_NeikiAnalytics.exe
SHA256 8635c8294f795986094ca61ab296352dd35c73181eb162023a4ff67a54172646
Tags
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

8635c8294f795986094ca61ab296352dd35c73181eb162023a4ff67a54172646

Threat Level: Shows suspicious behavior

The file 97683b1b076a64ec26b3f05267349650_NeikiAnalytics.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary


Executes dropped EXE

Loads dropped DLL

Program crash

Unsigned PE

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-08 07:11

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-08 07:11

Reported

2024-06-08 07:14

Platform

win7-20240221-en

Max time kernel

150s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\97683b1b076a64ec26b3f05267349650_NeikiAnalytics.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9294.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21952.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24962.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9476.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55335.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20655.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4510.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25485.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18849.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13695.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-40207.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37816.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50623.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21288.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29512.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15553.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23722.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-45081.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64069.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14868.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53441.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55169.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58013.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25149.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38339.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-41869.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25279.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5605.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33639.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27391.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32029.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-11438.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3462.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47790.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51127.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22046.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22046.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3908.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10348.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15798.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-40302.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7821.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61661.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20628.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57214.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53685.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22041.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18703.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4614.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32840.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34568.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14702.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23062.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26784.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35144.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12865.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5081.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\97683b1b076a64ec26b3f05267349650_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97683b1b076a64ec26b3f05267349650_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97683b1b076a64ec26b3f05267349650_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97683b1b076a64ec26b3f05267349650_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9294.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9294.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9294.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21952.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9294.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21952.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24962.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24962.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9476.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9476.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21952.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21952.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55335.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24962.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55335.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24962.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4510.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20655.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4510.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20655.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9476.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9476.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25485.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25485.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\97683b1b076a64ec26b3f05267349650_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9294.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-21952.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24962.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9476.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55335.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4510.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20655.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25485.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18849.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-40207.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-54152.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-21288.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-13695.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26118.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37816.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-50623.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64069.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25149.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-45081.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-58013.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55169.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29512.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14868.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-5605.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-3462.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33639.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15553.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-11438.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25279.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57214.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-22046.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-47790.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-51127.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38339.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-10348.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20628.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53441.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7821.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-41869.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-23722.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27391.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32029.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15798.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-40302.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-32840.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-43621.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-23062.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-43922.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-16312.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64129.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1656.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26784.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-2313.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59025.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-47985.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-3908.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-43730.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-61661.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-27251.exe

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\97683b1b076a64ec26b3f05267349650_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9294.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21952.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24962.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9476.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55335.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20655.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4510.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25485.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18849.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13695.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-40207.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37816.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54152.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-50623.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21288.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29512.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23722.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15553.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-45081.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14868.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53441.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64069.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55169.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25149.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58013.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-38339.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-41869.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25279.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33639.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-5605.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-27391.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32029.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-11438.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3462.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-47790.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-51127.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22046.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22046.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3908.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10348.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15798.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-40302.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7821.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61661.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20628.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-53685.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57214.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22041.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18703.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-16312.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4614.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-32840.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34568.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14702.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23062.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26784.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-35144.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12865.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1500 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\97683b1b076a64ec26b3f05267349650_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9294.exe
PID 1500 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\97683b1b076a64ec26b3f05267349650_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9294.exe
PID 1500 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\97683b1b076a64ec26b3f05267349650_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9294.exe
PID 1500 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\97683b1b076a64ec26b3f05267349650_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9294.exe
PID 1500 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\97683b1b076a64ec26b3f05267349650_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe
PID 1500 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\97683b1b076a64ec26b3f05267349650_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe
PID 1500 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\97683b1b076a64ec26b3f05267349650_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe
PID 1500 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\97683b1b076a64ec26b3f05267349650_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe
PID 2684 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9294.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-21952.exe
PID 2684 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9294.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-21952.exe
PID 2684 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9294.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-21952.exe
PID 2684 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9294.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-21952.exe
PID 1500 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\97683b1b076a64ec26b3f05267349650_NeikiAnalytics.exe C:\Windows\SysWOW64\WerFault.exe
PID 1500 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\97683b1b076a64ec26b3f05267349650_NeikiAnalytics.exe C:\Windows\SysWOW64\WerFault.exe
PID 1500 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\97683b1b076a64ec26b3f05267349650_NeikiAnalytics.exe C:\Windows\SysWOW64\WerFault.exe
PID 1500 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\97683b1b076a64ec26b3f05267349650_NeikiAnalytics.exe C:\Windows\SysWOW64\WerFault.exe
PID 2944 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24962.exe
PID 2944 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24962.exe
PID 2944 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24962.exe
PID 2944 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-24962.exe
PID 2684 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9294.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe
PID 2684 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9294.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe
PID 2684 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9294.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe
PID 2684 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9294.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe
PID 2620 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21952.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9476.exe
PID 2620 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21952.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9476.exe
PID 2620 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21952.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9476.exe
PID 2620 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21952.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9476.exe
PID 2684 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9294.exe C:\Windows\SysWOW64\WerFault.exe
PID 2684 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9294.exe C:\Windows\SysWOW64\WerFault.exe
PID 2684 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9294.exe C:\Windows\SysWOW64\WerFault.exe
PID 2684 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9294.exe C:\Windows\SysWOW64\WerFault.exe
PID 2404 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24962.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55335.exe
PID 2404 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24962.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55335.exe
PID 2404 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24962.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55335.exe
PID 2404 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-24962.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55335.exe
PID 2944 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe
PID 2944 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe
PID 2944 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe
PID 2944 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe
PID 2640 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20655.exe
PID 2640 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20655.exe
PID 2640 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20655.exe
PID 2640 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20655.exe
PID 2872 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9476.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4510.exe
PID 2872 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9476.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4510.exe
PID 2872 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9476.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4510.exe
PID 2872 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9476.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4510.exe
PID 2620 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21952.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25485.exe
PID 2620 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21952.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25485.exe
PID 2620 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21952.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25485.exe
PID 2620 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21952.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25485.exe
PID 2944 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe C:\Windows\SysWOW64\WerFault.exe
PID 2944 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe C:\Windows\SysWOW64\WerFault.exe
PID 2944 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe C:\Windows\SysWOW64\WerFault.exe
PID 2944 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe C:\Windows\SysWOW64\WerFault.exe
PID 2620 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21952.exe C:\Windows\SysWOW64\WerFault.exe
PID 2620 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21952.exe C:\Windows\SysWOW64\WerFault.exe
PID 2620 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21952.exe C:\Windows\SysWOW64\WerFault.exe
PID 2620 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21952.exe C:\Windows\SysWOW64\WerFault.exe
PID 1304 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18849.exe
PID 1304 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18849.exe
PID 1304 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18849.exe
PID 1304 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18849.exe

Processes

C:\Users\Admin\AppData\Local\Temp\97683b1b076a64ec26b3f05267349650_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\97683b1b076a64ec26b3f05267349650_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\Unicorn-9294.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9294.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21952.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21952.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-24962.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24962.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9476.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9476.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-55335.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55335.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20655.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20655.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4510.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4510.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25485.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25485.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-18849.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18849.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13695.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13695.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40207.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40207.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37816.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37816.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54152.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54152.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26118.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26118.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50623.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50623.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21288.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21288.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29512.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29512.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15553.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15553.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23722.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23722.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45081.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45081.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64069.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64069.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53441.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53441.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14868.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14868.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55169.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55169.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58013.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58013.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41869.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41869.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25149.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25149.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38339.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38339.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 392 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-25279.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25279.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-33639.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33639.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5605.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5605.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-27391.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27391.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32029.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32029.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11438.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11438.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3462.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47790.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47790.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51127.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51127.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22046.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22046.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22046.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22046.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10348.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10348.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3908.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3908.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15798.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15798.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40302.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40302.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7821.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7821.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61661.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61661.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20628.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20628.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57214.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57214.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53685.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53685.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-22041.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22041.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-18703.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18703.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-16312.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16312.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4614.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4614.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32840.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32840.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34568.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34568.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14702.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14702.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23062.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23062.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26784.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26784.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35144.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35144.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12865.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12865.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5081.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5081.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58003.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-27251.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27251.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40441.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40441.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60307.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60307.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55434.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55434.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1786.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1786.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1656.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1656.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59025.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59025.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11057.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11057.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43730.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43730.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43730.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43730.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60066.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60066.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48753.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48753.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43922.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43922.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35754.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35754.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11633.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11633.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64129.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64129.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47985.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47985.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2313.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2313.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 972 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-43621.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43621.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4762.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4762.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-22703.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22703.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-17742.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17742.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63413.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63413.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21551.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21551.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7004.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7004.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10725.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10725.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 380 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-48421.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48421.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-19278.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19278.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-9957.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9957.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50798.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50798.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42137.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42137.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63112.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63112.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-52033.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52033.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2832.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2832.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 596 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-60393.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60393.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-44249.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44249.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 220

C:\Users\Admin\AppData\Local\Temp\Unicorn-3408.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3408.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30160.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30160.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30352.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30352.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60009.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60009.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60009.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60009.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61737.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61737.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7575.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7575.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20958.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20958.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47840.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47840.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64176.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64176.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63299.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63299.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40056.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40056.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-31888.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31888.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19683.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19683.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-49781.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49781.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60253.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60253.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11099.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11099.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-52983.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52983.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-32838.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32838.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-23710.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23710.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 240

C:\Users\Admin\AppData\Local\Temp\Unicorn-59262.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59262.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65017.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65017.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23985.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23985.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-65401.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65401.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-22937.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22937.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50456.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50456.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50456.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50456.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-35272.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35272.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 476 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-34504.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34504.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 896 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-11234.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11234.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-11618.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11618.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43139.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43139.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10658.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10658.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 792 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-40674.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40674.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64602.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64602.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54509.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54509.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54701.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54701.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54893.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54893.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-51084.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51084.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10435.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10435.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59636.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59636.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-58484.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58484.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8598.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8598.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8598.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8598.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59911.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59911.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19071.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19071.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43767.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43767.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59143.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59143.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1966.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1966.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48967.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48967.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 608 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-27369.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27369.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 848 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-18272.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18272.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-98.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-98.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3660 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3724 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-60202.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60202.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 340 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-11084.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11084.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-1956.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1956.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2148.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2148.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20981.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20981.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 324 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-12078.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12078.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-39380.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39380.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 672 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-8160.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8160.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-57553.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57553.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57553.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57553.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8544.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8544.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34118.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34118.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34118.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34118.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3604 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-11341.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11341.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58150.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58150.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43075.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43075.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58835.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58835.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59027.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59027.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26163.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26163.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3495.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3495.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58103.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58103.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-14652.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14652.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41653.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41653.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41653.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41653.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33210.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33210.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9281.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9281.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31394.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31394.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-23418.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23418.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56474.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56474.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14289.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14289.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-14673.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14673.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24103.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24103.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-41399.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41399.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50143.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50143.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-44964.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44964.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-19765.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19765.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19957.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19957.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-57647.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57647.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8638.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8638.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-17492.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17492.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-6355.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6355.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6355.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6355.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61726.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61726.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61555.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61555.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37243.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37243.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63008.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63008.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21976.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21976.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16797.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16797.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41493.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41493.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18717.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18717.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-27762.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27762.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44098.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44098.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-33538.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33538.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25754.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25754.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58919.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58919.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44695.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44695.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61031.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61031.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-20492.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20492.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-47108.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47108.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14627.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14627.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-23097.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23097.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25209.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25209.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-57497.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57497.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32801.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32801.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5608 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-8906.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8906.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3234.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3234.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5216 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5588 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-22176.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22176.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5636 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-61309.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61309.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5644 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-27869.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27869.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5580 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-30666.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30666.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5876 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-57391.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57391.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5684 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5812 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6000 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5940 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5968 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6084 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6052 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5604 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5848 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5952 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5212 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5516 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5788 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5532 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5872 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6048 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5660 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5280 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5836 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6564 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-9021.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9021.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9021.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9021.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1237.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1237.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1237.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1237.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57646.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57646.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3266.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3266.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60827.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60827.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28539.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28539.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51891.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51891.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37667.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37667.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22784.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22784.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5487.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5487.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32213.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32213.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7292 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7592 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-39686.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39686.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7420 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6820 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-7589.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7589.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7228 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-26915.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26915.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7240 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-60163.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60163.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42675.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42675.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27792.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27792.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7316 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6860 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6856 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-3980.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3980.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6600 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-10996.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10996.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10996.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10996.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43861.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43861.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7960 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-52029.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52029.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42443.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42443.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7124 -s 236

C:\Users\Admin\AppData\Local\Temp\Unicorn-39450.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39450.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24012.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24012.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60249.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60249.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7072 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-19430.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19430.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19731.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19731.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50986.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50986.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8468 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5708 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-65288.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65288.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24448.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24448.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8504 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8560 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7008 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6848 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6780 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8444 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6948 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8776 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7364 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7080 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8680 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7684 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-49518.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49518.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11090.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11090.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7712 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-13887.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13887.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6280 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7468 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-51952.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51952.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7020 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-52445.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52445.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8620 -s 216

C:\Users\Admin\AppData\Local\Temp\Unicorn-24874.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24874.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51407.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51407.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18756.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18756.exe

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\Unicorn-9294.exe

MD5 dc4c1d61f021224279831ea9b1948fd6
SHA1 62a63fdb367962c3f43478056a1c3a4b46a90c75
SHA256 e318b032b78f02ac0e70b600570143d17ebad53b8d12107220e11af8c92ecb50
SHA512 dd33861f5206d01413652cbc4a4d8c4cec70b501c5597316cbe7583b7ed69bd4484202dae9f04e7e0b415d6ad666e857f463f1aa2b3ebf20d61ba3c6c2ddd62f

\Users\Admin\AppData\Local\Temp\Unicorn-21952.exe

MD5 0064fe9a18a0e61bcb66846e13675ab7
SHA1 538e0f5fe10b1e380cd95206611c8f16729d956c
SHA256 9aa2b936116f7aa3f26398da93442d3838bd5e4deac8e127b2dd2c95e4f4963f
SHA512 23bec0bc81261b6cf878395fb5e93494eee636c50ac1a377b883ca8fdc7cb83153b69d941b8fa20e9252dc55009f8271fc56d6bcb70693d8231145952203bfdd

C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe

MD5 4915b4c74d9cf86db731058d7c1852a2
SHA1 83e58a6c3957c1a368789ad5b6f2684e617c2c6f
SHA256 5559abe7654f97df1fed80dd614140fa8d9e8f0dc6868aa1a87e8abc8d2cd165
SHA512 6529208b5d1fe351005519a6755c2f6d77548106436c7d980db24c81ee421472ddf660c2b925876b799cce110f34c477ce5436b533d1fddd1a561e2f06821d4d

\Users\Admin\AppData\Local\Temp\Unicorn-24962.exe

MD5 decf133e389bdb70293903a7dd95784e
SHA1 1799392bfbb034edfa6041769c70581c294ed2ac
SHA256 cfe6a1cac8404049f47d0b92160a21232a1fbb872e79d105da87f11ced54674a
SHA512 ca239a6244ca121e4bd6aeced93011f0b8988f8309b5216deca29521e4fe61d9cc031fa1f6064b3df3d02dd8963612c7cc35f5163cb678df5df6ec1a6f0acbab

\Users\Admin\AppData\Local\Temp\Unicorn-9476.exe

MD5 91a80d5623964ee771f9ab2566c45bff
SHA1 ea85a4bb63f5650b37f8102b37a770c048e0b82a
SHA256 bafb9737bb923fdfb3df6990970c83d167752bc2b6a4ee4ef2bb9dba6d7681ba
SHA512 f04e23949112fe53a94b97c6c27556cbe1413f63033f2b697606ae8aa3f101490ac0499a464fe0e968b11b2f8206f656c35e5feff263368e481a2c9acaff066a

\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe

MD5 f54cb45fe5e7ebe25f8b1f95df1bd05d
SHA1 26008eb310190d86c2b1888d13636cc5180fdc93
SHA256 caa75e368a28f5a2111fc68538e4ef4510ce751a65d1790c69cbe91962aa9698
SHA512 49c768d0e2053e8e128f98fb24a3f59b932c1f0e168f516893a5978941f8a1fcf773eb9e5243bd6fbdfddd8d6a9b7d756d58108387aa608fb8397cc2eb696ff4

\Users\Admin\AppData\Local\Temp\Unicorn-55335.exe

MD5 ad51089f7430ba9a131845d845d4b192
SHA1 7d528e42719a43869b4273fbe8064cf0a9decf01
SHA256 0b6df2783c11b27f4d409534198acbf0ca5b51e36951307f2afbedb39aac386a
SHA512 ddaf098a37cfe7bad193fb5eced32b64b3ab62a71ff858ae3f87ff038bd56c802e944e8eea1e3dbfdcc868e452736f5b9d5fa7b367792ea68330754958316913

C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe

MD5 94f2dc05021e1659c365d85f233b78ef
SHA1 f7958cf4d54673815477b9ad86e23777023ede25
SHA256 0a0346250cf8845377d8294d9d706435ae935e2d7dbbf089057c731f73ccf2b4
SHA512 f5968029534c38715e7b2daa8d3407ec6bcbe060ee994745ae9909aa41153cf5a6dc2b612dab350f4152dfde2cc1124b1c92c5566f0a651b75a12316e76b3834

\Users\Admin\AppData\Local\Temp\Unicorn-20655.exe

MD5 2d82426de46b78962700765e2d97ef11
SHA1 8063c3d5e6ae96307bee5f957338cebfe38ebfd2
SHA256 a89dbec31d13de9892089597bd7f056877d29d5ed4bc306986006df35260af22
SHA512 49841ca607ea9a44a6804facbad6a3ba0d6d90ed791087cf5a3bc19ba0811802e6d7c89efb21360ddcb5d33082a8f3b597b7fe80511f5a081a2f6c5bf2ec5b50

\Users\Admin\AppData\Local\Temp\Unicorn-4510.exe

MD5 fbce9bd3a7cae862d6fe8341d22c78e1
SHA1 014419ae0a6c72c16e1c8fc0fd66965f40ebef79
SHA256 c44022b787693e389464d683869c6e6e70c1d46ab27ca3fde47c854ccfb22ab9
SHA512 4b1fff640fa33e9c700099fdd5d27dc3390caf1d4194f54d6d57fcfc7a53f6b4c72ecba8db1e0430eb5be0e7c09d89a1e057caf0679db70c33842b4131c81b96

\Users\Admin\AppData\Local\Temp\Unicorn-25485.exe

MD5 d63a932f86ed0e3ea5e1256554c8f509
SHA1 979ae372bb69a38731b30202ccfdfa7d106e63b0
SHA256 023ea547cfed656e05014d03db14c4a6f83c3868fe21608deb76413a160029f5
SHA512 c562698b8026d393a1d14803fd12d8dd4fa22ef983e7f8e526dc4d076008f5f3b9da87ca7c67a84c41d05fb125a5945a10ad254e5b312ce65bdf132e16e235d8

C:\Users\Admin\AppData\Local\Temp\Unicorn-18849.exe

MD5 f4881d5501e9033414ef09e1fb81ec0c
SHA1 86242cb65b6ad2a5e9d831643e1d85b51734fb5b
SHA256 36f967b5644bcaf3bcf9464be1c49347de25944bee248db35c261f0284174a24
SHA512 68c2bfc810db20f9f5885db4af75e4c9e688b8c8e3d618070b72cc5263eb5a4d9d2dbe29dcb870206559c04d8afb6c861491242d54265a8366a7c3bd7a0de083

\Users\Admin\AppData\Local\Temp\Unicorn-13695.exe

MD5 4e99e68dfb70f8dc9c7f95f85331b30e
SHA1 21c5d2dfa05cc5c8283ded85a39e78edff6f672e
SHA256 21097c62ed39c78e79b609985de2d648f4f3b7b38447945a3609b58b538b6e04
SHA512 6c5503fd1a27701ecf3205ed727df8cff78c581391542d912d5985e7226df34471ee2de398baed0432b5de69d4dd0f03b81482b599038f704299be40452e2d8b

\Users\Admin\AppData\Local\Temp\Unicorn-40207.exe

MD5 7a9a7a627fb7c4eabf8bb150ea7fe087
SHA1 a9b3b456c9945371bb9a60001aa02b05d238aeb2
SHA256 56d1287af511439cbb2b938eca87511c3b79b6ec5f07294e5428bc16d9b3069a
SHA512 ce7d9b9e234ad62d5750846c5291e57ef06db41273fbe4be81a28ec118a8687a8a1c0e0698088b92d63b7cf3488416a3d7524f62ef0307c6d464a51b5ce9024a

C:\Users\Admin\AppData\Local\Temp\Unicorn-47840.exe

MD5 97ae96a13c0303d8960a2334273d9dee
SHA1 0c9ecafe07e1946c6b7a82d6c0f286afa54c03fa
SHA256 dfb4755818fa89b54d18f2076f832b8d7e42db32e4beee9e2ab30fbe0d0ea352
SHA512 75a7c0d07ba312d4b8b731faa2ef3e8d4d2b9d5bb5d338dac05c5946df06d55b1b149e8995af163c9d8d1c5391263eb5c8a787dfdcdfd1be1fd0df7686223a1a

C:\Users\Admin\AppData\Local\Temp\Unicorn-14289.exe

MD5 6153fe379ec59e4af438fc762a9c8ba8
SHA1 9b42251e8294d02a7324a05ac495fa1c9630a667
SHA256 9a02c66dfba5bd4639f43dfa9fb88e5e3d161e771b7ae1794f3dd1fe2e83243c
SHA512 78c4897282cfe9f0234004c86286fab9d87a1d4318641ac863d5c6e3af088ac2853707e69ed858cad791d27fd03339899e5fd4add4e87dc128fb90ad48713ce7

C:\Users\Admin\AppData\Local\Temp\Unicorn-24103.exe

MD5 8a0d07829ff4271a7087fcc953b36a1c
SHA1 2e6794f011fc8c9d1d0c8b6c331d09ca9a3c58ac
SHA256 e57e8fb05de1d1a604d32ee515bea395bdff6a4a107617143622de895cb9b2b0
SHA512 21b0d3ba4af8ef624f0156bc19a8dcfceb19951b0e805616a534df25ee73863ecf156aaabc3527e34f51fa04cd50c8236dfdc4e1223b682cea3f6e6262666fc7

C:\Users\Admin\AppData\Local\Temp\Unicorn-47108.exe

MD5 743b95fe679277188984eb5a6a69d570
SHA1 fa7f225b96b8446a64a05108e684e2dae0a3215e
SHA256 cd420d42d56dd9f44980a92a9dddea3661800c4a0625fca6ab3360c2519e82db
SHA512 f3fab1a433cd590b37f6ff2312093f10de1f6b5f91bd923ad104ed8a37451b2ca70ecc890683b3a5d2e0495048475fe93d167241b60cd8a9c0251d788d2490b9

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-08 07:11

Reported

2024-06-08 07:14

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\97683b1b076a64ec26b3f05267349650_NeikiAnalytics.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13684.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42163.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14587.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59533.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34837.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10628.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12740.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9211.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20909.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25547.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3140.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48812.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21781.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10083.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61661.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20629.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20629.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33819.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25651.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62725.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21693.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18547.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4588.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1059.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37645.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15252.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7084.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-28443.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56477.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7276.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23613.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20467.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64837.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61308.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55237.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2507.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55429.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60068.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14396.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54661.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62829.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59300.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54853.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2123.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65325.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-11443.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-39861.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-52668.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56389.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64557.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21915.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-748.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22107.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-41973.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58309.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54780.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-940.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30467.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\97683b1b076a64ec26b3f05267349650_NeikiAnalytics.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-13684.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42163.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-46845.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14587.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59533.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34837.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-10628.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12740.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9211.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25547.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48812.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-3140.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-21781.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-10083.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20629.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-61661.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20629.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-62725.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-21693.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-1059.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-18547.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64837.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-7084.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-23613.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-2507.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55237.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-55429.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-49285.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-37011.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-51973.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53924.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-4308.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-53317.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-3268.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-23253.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42869.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20685.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-6652.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38853.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-38557.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-316.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-63388.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-52618.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-10625.exe
N/A N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-30802.exe
N/A N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21202.exe
N/A N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9504.exe
N/A N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3713.exe
N/A N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18898.exe
N/A N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3713.exe
N/A N/A N/A
N/A N/A N/A
N/A N/A N/A
N/A N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62914.exe
N/A N/A N/A
N/A N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3049.exe
N/A N/A N/A
N/A N/A N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\97683b1b076a64ec26b3f05267349650_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13684.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42163.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14587.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59533.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34837.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10628.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12740.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9211.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25547.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20909.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-48812.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-3140.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21781.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10083.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20629.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20629.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61661.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25651.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-33819.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62725.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21693.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-18547.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-4588.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-1059.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-37645.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-15252.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7084.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-28443.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56477.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-23613.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-7276.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-20467.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-61308.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64837.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55237.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2507.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-55429.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14396.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-60068.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54661.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59300.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-62829.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54853.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-2123.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-65325.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-11443.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-39861.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-52668.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-56389.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64557.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-21915.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-748.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-54780.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-41973.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-940.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-58309.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-22107.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1980 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\97683b1b076a64ec26b3f05267349650_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-13684.exe
PID 1980 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\97683b1b076a64ec26b3f05267349650_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-13684.exe
PID 1980 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\97683b1b076a64ec26b3f05267349650_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-13684.exe
PID 2288 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13684.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-46845.exe
PID 2288 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13684.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-46845.exe
PID 2288 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13684.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-46845.exe
PID 1980 wrote to memory of 4320 N/A C:\Users\Admin\AppData\Local\Temp\97683b1b076a64ec26b3f05267349650_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42163.exe
PID 1980 wrote to memory of 4320 N/A C:\Users\Admin\AppData\Local\Temp\97683b1b076a64ec26b3f05267349650_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42163.exe
PID 1980 wrote to memory of 4320 N/A C:\Users\Admin\AppData\Local\Temp\97683b1b076a64ec26b3f05267349650_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-42163.exe
PID 4320 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42163.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe
PID 4320 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42163.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe
PID 4320 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42163.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe
PID 2288 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13684.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe
PID 2288 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13684.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe
PID 2288 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-13684.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe
PID 2644 wrote to memory of 3820 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46845.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14587.exe
PID 2644 wrote to memory of 3820 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46845.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14587.exe
PID 2644 wrote to memory of 3820 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-46845.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-14587.exe
PID 1008 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59533.exe
PID 1008 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59533.exe
PID 1008 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-59533.exe
PID 4320 wrote to memory of 4088 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42163.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
PID 4320 wrote to memory of 4088 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42163.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
PID 4320 wrote to memory of 4088 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-42163.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe
PID 908 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34837.exe
PID 908 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34837.exe
PID 908 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-34837.exe
PID 3820 wrote to memory of 5088 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14587.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-10628.exe
PID 3820 wrote to memory of 5088 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14587.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-10628.exe
PID 3820 wrote to memory of 5088 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14587.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-10628.exe
PID 1820 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59533.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12740.exe
PID 1820 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59533.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12740.exe
PID 1820 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59533.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-12740.exe
PID 1008 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9211.exe
PID 1008 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9211.exe
PID 1008 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-9211.exe
PID 4088 wrote to memory of 3764 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe
PID 4088 wrote to memory of 3764 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe
PID 4088 wrote to memory of 3764 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe
PID 4292 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34837.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20909.exe
PID 4292 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34837.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20909.exe
PID 4292 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-34837.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20909.exe
PID 908 wrote to memory of 4744 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25547.exe
PID 908 wrote to memory of 4744 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25547.exe
PID 908 wrote to memory of 4744 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-25547.exe
PID 5088 wrote to memory of 3096 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10628.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-3140.exe
PID 5088 wrote to memory of 3096 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10628.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-3140.exe
PID 5088 wrote to memory of 3096 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-10628.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-3140.exe
PID 3820 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14587.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48812.exe
PID 3820 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14587.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48812.exe
PID 3820 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-14587.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-48812.exe
PID 4064 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12740.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-21781.exe
PID 4064 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12740.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-21781.exe
PID 4064 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-12740.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-21781.exe
PID 1820 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59533.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-10083.exe
PID 1820 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59533.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-10083.exe
PID 1820 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-59533.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-10083.exe
PID 2800 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9211.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-61661.exe
PID 2800 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9211.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-61661.exe
PID 2800 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-9211.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-61661.exe
PID 4744 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25547.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20629.exe
PID 4744 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25547.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20629.exe
PID 4744 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-25547.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20629.exe
PID 3764 wrote to memory of 5040 N/A C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe C:\Users\Admin\AppData\Local\Temp\Unicorn-20629.exe

Processes

C:\Users\Admin\AppData\Local\Temp\97683b1b076a64ec26b3f05267349650_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\97683b1b076a64ec26b3f05267349650_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\Unicorn-13684.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13684.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46845.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-46845.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42163.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42163.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1980 -ip 1980

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 708

C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2288 -ip 2288

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 736

C:\Users\Admin\AppData\Local\Temp\Unicorn-14587.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14587.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34837.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34837.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4320 -ip 4320

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2644 -ip 2644

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 752

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 480

C:\Users\Admin\AppData\Local\Temp\Unicorn-10628.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10628.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12740.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12740.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9211.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9211.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20909.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20909.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25547.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25547.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1008 -ip 1008

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 752

C:\Users\Admin\AppData\Local\Temp\Unicorn-48812.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48812.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3140.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3140.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 908 -ip 908

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 756

C:\Users\Admin\AppData\Local\Temp\Unicorn-21781.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21781.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10083.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10083.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61661.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61661.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20629.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20629.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20629.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20629.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33819.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33819.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25651.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25651.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3820 -ip 3820

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3820 -s 764

C:\Users\Admin\AppData\Local\Temp\Unicorn-62725.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62725.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21693.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21693.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18547.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18547.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1820 -ip 1820

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4088 -ip 4088

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4292 -ip 4292

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 716

C:\Users\Admin\AppData\Local\Temp\Unicorn-4588.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4588.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1059.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1059.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37645.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37645.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15252.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15252.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7084.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7084.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28443.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28443.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56477.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56477.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7276.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7276.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23613.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23613.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20467.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20467.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64837.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64837.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61308.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61308.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5088 -ip 5088

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 756

C:\Users\Admin\AppData\Local\Temp\Unicorn-55237.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55237.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2507.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2507.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55429.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55429.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60068.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60068.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14396.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14396.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4064 -ip 4064

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2800 -ip 2800

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3764 -ip 3764

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4744 -ip 4744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4152 -ip 4152

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 740

C:\Users\Admin\AppData\Local\Temp\Unicorn-54661.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54661.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62829.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62829.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 672

C:\Users\Admin\AppData\Local\Temp\Unicorn-59300.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59300.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 736

C:\Users\Admin\AppData\Local\Temp\Unicorn-54853.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54853.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2123.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2123.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65325.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65325.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11443.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11443.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39861.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39861.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52668.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52668.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56389.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56389.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64557.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64557.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21915.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21915.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-748.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-748.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22107.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22107.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41973.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41973.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58309.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58309.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54780.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54780.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-940.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-940.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30467.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30467.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2476 -ip 2476

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3096 -ip 3096

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 720

C:\Users\Admin\AppData\Local\Temp\Unicorn-35533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32003.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19197.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19197.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5016 -ip 5016

C:\Users\Admin\AppData\Local\Temp\Unicorn-1516.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1516.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59077.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59077.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 756

C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1708.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1708.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 628 -ip 628

C:\Users\Admin\AppData\Local\Temp\Unicorn-14899.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14899.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 748

C:\Users\Admin\AppData\Local\Temp\Unicorn-18429.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18429.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45372.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45372.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5040 -ip 5040

C:\Users\Admin\AppData\Local\Temp\Unicorn-24781.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24781.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24781.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24781.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49285.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49285.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4532 -ip 4532

C:\Users\Admin\AppData\Local\Temp\Unicorn-84.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-84.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2524 -ip 2524

C:\Users\Admin\AppData\Local\Temp\Unicorn-53924.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53924.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53924.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53924.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2784 -ip 2784

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4604 -ip 4604

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 756

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4128 -ip 4128

C:\Users\Admin\AppData\Local\Temp\Unicorn-36627.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36627.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2836 -ip 2836

C:\Users\Admin\AppData\Local\Temp\Unicorn-7292.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7292.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 720

C:\Users\Admin\AppData\Local\Temp\Unicorn-24205.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24205.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37011.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37011.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17573.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17573.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1620.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1620.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58989.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58989.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58989.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58989.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47484.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47484.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63820.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63820.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1044.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1044.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54884.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54884.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35637.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35637.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51973.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51973.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51973.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51973.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43805.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43805.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51973.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51973.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60141.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60141.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56612.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56612.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15963.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15963.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15963.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15963.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1004 -ip 1004

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 1012 -ip 1012

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1168 -ip 1168

C:\Users\Admin\AppData\Local\Temp\Unicorn-19685.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19685.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6835.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6835.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26701.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26701.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1004 -s 752

C:\Users\Admin\AppData\Local\Temp\Unicorn-43229.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43229.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10364.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10364.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48060.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48060.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48060.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48060.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 736

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1268 -ip 1268

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4572 -ip 4572

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2676 -ip 2676

C:\Users\Admin\AppData\Local\Temp\Unicorn-4308.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4308.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4308.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4308.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61677.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61677.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45533.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 752

C:\Users\Admin\AppData\Local\Temp\Unicorn-12860.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12860.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17883.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17883.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29581.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29581.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3652 -ip 3652

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 708 -ip 708

C:\Users\Admin\AppData\Local\Temp\Unicorn-28813.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-28813.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33451.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33451.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53317.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53317.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53317.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53317.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53317.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53317.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45149.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45149.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49788.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49788.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3264 -ip 3264

C:\Users\Admin\AppData\Local\Temp\Unicorn-2012.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2012.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2012.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2012.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4824 -ip 4824

C:\Users\Admin\AppData\Local\Temp\Unicorn-6651.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6651.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3576 -ip 3576

C:\Users\Admin\AppData\Local\Temp\Unicorn-56044.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56044.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56044.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56044.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18541.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18541.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 708 -s 752

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3408 -ip 3408

C:\Users\Admin\AppData\Local\Temp\Unicorn-18733.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18733.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64404.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64404.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35069.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35069.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56044.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56044.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2116 -ip 2116

C:\Users\Admin\AppData\Local\Temp\Unicorn-5883.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5883.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14051.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14051.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2132 -ip 2132

C:\Users\Admin\AppData\Local\Temp\Unicorn-42277.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42277.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22603.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22603.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34301.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34301.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60725.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60725.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40859.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40859.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3548.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3548.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41243.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41243.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 720

C:\Users\Admin\AppData\Local\Temp\Unicorn-2780.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2780.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27285.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27285.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3208 -ip 3208

C:\Users\Admin\AppData\Local\Temp\Unicorn-11140.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11140.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60533.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35837.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35837.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 804 -ip 804

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 860 -ip 860

C:\Users\Admin\AppData\Local\Temp\Unicorn-62453.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62453.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62453.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62453.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5084.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5084.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5084.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5084.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29589.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29589.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21421.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21421.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5084.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5084.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49988.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49988.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8955.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8955.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20653.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20653.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3208 -s 720

C:\Users\Admin\AppData\Local\Temp\Unicorn-12676.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12676.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25675.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25675.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6620.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6620.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 752

C:\Users\Admin\AppData\Local\Temp\Unicorn-59692.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59692.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63413.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63413.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38525.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38525.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63413.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63413.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2707.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2707.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2707.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2707.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2707.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2707.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19043.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19043.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19043.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19043.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2184 -ip 2184

C:\Users\Admin\AppData\Local\Temp\Unicorn-37093.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37093.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3268.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3268.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52661.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52661.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3268.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3268.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2968 -ip 2968

C:\Users\Admin\AppData\Local\Temp\Unicorn-3268.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3268.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3268.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3268.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1280 -ip 1280

C:\Users\Admin\AppData\Local\Temp\Unicorn-3268.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3268.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19797.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19797.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3268.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3268.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1896 -ip 1896

C:\Users\Admin\AppData\Local\Temp\Unicorn-27965.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27965.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54581.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-54581.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29885.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29885.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3712 -ip 3712

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2796 -ip 2796

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2000 -ip 2000

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 3916 -ip 3916

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 4372 -ip 4372

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3656 -ip 3656

C:\Users\Admin\AppData\Local\Temp\Unicorn-21141.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21141.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2232 -ip 2232

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2376 -ip 2376

C:\Users\Admin\AppData\Local\Temp\Unicorn-4996.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4996.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 728

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4744 -ip 4744

C:\Users\Admin\AppData\Local\Temp\Unicorn-6916.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6916.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23253.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23253.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23253.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23253.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31421.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31421.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31421.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31421.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31421.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31421.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23253.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23253.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1800 -ip 1800

C:\Users\Admin\AppData\Local\Temp\Unicorn-48141.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48141.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7108.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7108.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23829.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23829.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23829.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23829.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2892 -ip 2892

C:\Users\Admin\AppData\Local\Temp\Unicorn-22485.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22485.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38821.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38821.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38821.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38821.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38821.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38821.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55541.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55541.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23829.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23829.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4520 -ip 4520

C:\Users\Admin\AppData\Local\Temp\Unicorn-55733.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55733.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55733.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55733.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55733.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55733.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 3492 -ip 3492

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 396 -ip 396

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4344 -ip 4344

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2724 -ip 2724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 452 -ip 452

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 636

C:\Users\Admin\AppData\Local\Temp\Unicorn-33341.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33341.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5016 -ip 5016

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 1160 -ip 1160

C:\Users\Admin\AppData\Local\Temp\Unicorn-61908.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61908.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12707.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12707.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 2556 -ip 2556

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 452 -s 648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4848 -ip 4848

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 3716 -ip 3716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3764 -ip 3764

C:\Users\Admin\AppData\Local\Temp\Unicorn-59132.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59132.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 1888 -ip 1888

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 4584 -ip 4584

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 3780 -ip 3780

C:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48821.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48821.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11275.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11275.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 604

C:\Users\Admin\AppData\Local\Temp\Unicorn-39885.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39885.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39885.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39885.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39885.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39885.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56221.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56221.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 3400 -ip 3400

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 3820 -ip 3820

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 448 -ip 448

C:\Users\Admin\AppData\Local\Temp\Unicorn-33445.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33445.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41997.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41997.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41997.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41997.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41997.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41997.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58333.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58333.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58333.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58333.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 4724 -ip 4724

C:\Users\Admin\AppData\Local\Temp\Unicorn-1156.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1156.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25661.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25661.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42381.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42381.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42381.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42381.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 2528 -ip 2528

C:\Users\Admin\AppData\Local\Temp\Unicorn-58717.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58717.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1624 -ip 1624

C:\Users\Admin\AppData\Local\Temp\Unicorn-41229.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41229.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41229.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41229.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41229.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41229.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 3296 -ip 3296

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 1668 -ip 1668

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 2136 -ip 2136

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 3524 -ip 3524

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 3852 -ip 3852

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 2688 -ip 2688

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 2312 -ip 2312

C:\Users\Admin\AppData\Local\Temp\Unicorn-51893.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51893.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2884.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2884.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2884.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2884.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2884.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2884.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3608 -ip 3608

C:\Users\Admin\AppData\Local\Temp\Unicorn-42765.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42765.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 3060 -ip 3060

C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59101.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26237.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26237.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2884.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2884.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2884.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2884.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2884.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2884.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26429.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26429.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 1264 -ip 1264

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1356 -ip 1356

C:\Users\Admin\AppData\Local\Temp\Unicorn-49117.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49117.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8084.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8084.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 908 -ip 908

C:\Users\Admin\AppData\Local\Temp\Unicorn-32205.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32205.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56709.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56709.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7508.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7508.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 3552 -ip 3552

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 4496 -ip 4496

C:\Users\Admin\AppData\Local\Temp\Unicorn-50461.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50461.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 3288 -ip 3288

C:\Users\Admin\AppData\Local\Temp\Unicorn-58821.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58821.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 628 -ip 628

C:\Users\Admin\AppData\Local\Temp\Unicorn-58821.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58821.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50653.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-50653.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25957.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25957.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1452.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1452.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3488 -ip 3488

C:\Users\Admin\AppData\Local\Temp\Unicorn-42869.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42869.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5368 -ip 5368

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 3132 -ip 3132

C:\Users\Admin\AppData\Local\Temp\Unicorn-13683.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13683.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38187.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38187.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 5384 -ip 5384

C:\Users\Admin\AppData\Local\Temp\Unicorn-41909.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41909.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 1164 -ip 1164

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 1540 -ip 1540

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 5588 -ip 5588

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 736 -ip 736

C:\Users\Admin\AppData\Local\Temp\Unicorn-19517.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19517.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 5216 -ip 5216

C:\Users\Admin\AppData\Local\Temp\Unicorn-52573.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52573.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4292 -ip 4292

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3484 -ip 3484

C:\Users\Admin\AppData\Local\Temp\Unicorn-64420.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64420.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 5624 -ip 5624

C:\Users\Admin\AppData\Local\Temp\Unicorn-61701.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61701.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 844 -ip 844

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 5348 -ip 5348

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 3240 -ip 3240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6048 -ip 6048

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 5872 -ip 5872

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 5740 -ip 5740

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5568 -ip 5568

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5284 -ip 5284

C:\Users\Admin\AppData\Local\Temp\Unicorn-42781.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42781.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51141.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51141.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42973.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42973.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42973.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42973.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42973.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42973.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42973.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42973.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1940.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1940.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 4260 -ip 4260

C:\Users\Admin\AppData\Local\Temp\Unicorn-51333.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51333.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43165.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43165.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2132.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2132.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59501.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59501.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15323.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15323.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51525.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51525.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 2292 -ip 2292

C:\Users\Admin\AppData\Local\Temp\Unicorn-34037.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34037.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34421.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34421.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34421.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34421.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34037.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34037.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 5824 -ip 5824

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 5928 -ip 5928

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 5548 -ip 5548

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 5040 -ip 5040

C:\Users\Admin\AppData\Local\Temp\Unicorn-52869.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52869.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44893.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44893.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44893.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44893.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44893.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44893.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 856 -ip 856

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5908 -ip 5908

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 5812 -ip 5812

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5860 -ip 5860

C:\Users\Admin\AppData\Local\Temp\Unicorn-37685.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37685.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5576 -ip 5576

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 5224 -ip 5224

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 6636 -ip 6636

C:\Users\Admin\AppData\Local\Temp\Unicorn-4244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-4244.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61613.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61613.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 4680 -ip 4680

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 5240 -ip 5240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5224 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 5076 -ip 5076

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5212 -ip 5212

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 4964 -ip 4964

C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 5924 -ip 5924

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 1832 -ip 1832

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 5608 -ip 5608

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 5960 -ip 5960

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 5160 -ip 5160

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 5708 -ip 5708

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 6092 -ip 6092

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 5936 -ip 5936

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 5132 -ip 5132

C:\Users\Admin\AppData\Local\Temp\Unicorn-20685.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20685.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20685.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20685.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20685.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20685.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20685.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20685.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20685.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20685.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20685.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20685.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20685.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20685.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20685.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20685.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45189.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45189.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 5248 -ip 5248

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 5816 -ip 5816

C:\Users\Admin\AppData\Local\Temp\Unicorn-5308.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5308.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 5596 -ip 5596

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 5420 -ip 5420

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 5700 -ip 5700

C:\Users\Admin\AppData\Local\Temp\Unicorn-38557.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38557.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38557.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38557.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1168 -ip 1168

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 5356 -ip 5356

C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 3084 -ip 3084

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 5792 -ip 5792

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5596 -s 624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 6044 -ip 6044

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 6060 -ip 6060

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 2212 -ip 2212

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 4572 -ip 4572

C:\Users\Admin\AppData\Local\Temp\Unicorn-23565.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23565.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64405.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64405.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 6000 -ip 6000

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5836 -ip 5836

C:\Users\Admin\AppData\Local\Temp\Unicorn-23949.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23949.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23949.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23949.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 644 -ip 644

C:\Users\Admin\AppData\Local\Temp\Unicorn-47493.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47493.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 3576 -ip 3576

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 4812 -ip 4812

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 5956 -ip 5956

C:\Users\Admin\AppData\Local\Temp\Unicorn-24909.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24909.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 1236 -ip 1236

C:\Users\Admin\AppData\Local\Temp\Unicorn-49413.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49413.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6652.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6652.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 5300 -ip 5300

C:\Users\Admin\AppData\Local\Temp\Unicorn-5427.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5427.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5427.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5427.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5427.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5427.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5427.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5427.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5427.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5427.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5427.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5427.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5427.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5427.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5427.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5427.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 5788 -ip 5788

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 5376 -ip 5376

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5456 -ip 5456

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 5324 -ip 5324

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 2216 -ip 2216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 5848 -ip 5848

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 708 -ip 708

C:\Users\Admin\AppData\Local\Temp\Unicorn-22325.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22325.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5492 -ip 5492

C:\Users\Admin\AppData\Local\Temp\Unicorn-43299.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-43299.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 5976 -ip 5976

C:\Users\Admin\AppData\Local\Temp\Unicorn-38853.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38853.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38853.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38853.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38853.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38853.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22709.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22709.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22709.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22709.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14540.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14540.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47021.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47021.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47021.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47021.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30877.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30877.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63357.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63357.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5988.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5988.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5988.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5988.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 1664 -ip 1664

C:\Users\Admin\AppData\Local\Temp\Unicorn-63357.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63357.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47021.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47021.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13388.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13388.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 6528 -ip 6528

C:\Users\Admin\AppData\Local\Temp\Unicorn-29725.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29725.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1084 -ip 1084

C:\Users\Admin\AppData\Local\Temp\Unicorn-5412.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5412.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38469.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38469.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 972 -ip 972

C:\Users\Admin\AppData\Local\Temp\Unicorn-5604.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5604.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 5660 -ip 5660

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 6592 -ip 6592

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 6512 -ip 6512

C:\Users\Admin\AppData\Local\Temp\Unicorn-56725.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56725.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48557.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48557.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48557.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48557.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1084 -s 608

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 6828 -ip 6828

C:\Users\Admin\AppData\Local\Temp\Unicorn-7524.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7524.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7524.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7524.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48557.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48557.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 6708 -ip 6708

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 6636 -ip 6636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 5632 -ip 5632

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6512 -s 648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 6920 -ip 6920

C:\Users\Admin\AppData\Local\Temp\Unicorn-64509.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64509.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 6024 -ip 6024

C:\Users\Admin\AppData\Local\Temp\Unicorn-25397.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25397.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25397.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25397.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33565.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33565.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 6576 -ip 6576

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 6304 -ip 6304

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 6584 -ip 6584

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 5880 -ip 5880

C:\Users\Admin\AppData\Local\Temp\Unicorn-33181.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33181.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57685.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57685.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-316.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-316.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-316.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-316.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 6552 -ip 6552

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 5768 -ip 5768

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 5904 -ip 5904

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 6496 -ip 6496

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 6936 -ip 6936

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 6620 -ip 6620

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 6436 -ip 6436

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 7164 -ip 7164

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 6540 -ip 6540

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 6488 -ip 6488

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 6560 -ip 6560

C:\Users\Admin\AppData\Local\Temp\Unicorn-26741.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26741.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18573.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18573.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34909.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34909.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10212.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10212.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 6644 -ip 6644

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 6568 -ip 6568

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 6864 -ip 6864

C:\Users\Admin\AppData\Local\Temp\Unicorn-15797.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-15797.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23773.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23773.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23773.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23773.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 6416 -ip 6416

C:\Users\Admin\AppData\Local\Temp\Unicorn-63388.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63388.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63388.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63388.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 6928 -ip 6928

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 6324 -ip 6324

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 7000 -ip 7000

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 7072 -ip 7072

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 2844 -ip 2844

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 6836 -ip 6836

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1896 -ip 1896

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 4584 -ip 4584

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 6360 -ip 6360

C:\Users\Admin\AppData\Local\Temp\Unicorn-41453.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41453.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33477.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-33477.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 6648 -ip 6648

C:\Users\Admin\AppData\Local\Temp\Unicorn-38307.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38307.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38307.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38307.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38307.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38307.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38307.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38307.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 6632 -ip 6632

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 6760 -ip 6760

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 2372 -ip 2372

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3520 -ip 3520

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 7024 -ip 7024

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 6628 -ip 6628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 6472 -ip 6472

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 5544 -ip 5544

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 7056 -ip 7056

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 4228 -ip 4228

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 6796 -ip 6796

C:\Users\Admin\AppData\Local\Temp\Unicorn-2532.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2532.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 6804 -ip 6804

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2644 -ip 2644

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 5640 -ip 5640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 7036 -ip 7036

C:\Users\Admin\AppData\Local\Temp\Unicorn-62013.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62013.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 2808 -ip 2808

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 4968 -ip 4968

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 5156 -ip 5156

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 5112 -ip 5112

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 2800 -ip 2800

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 6316 -ip 6316

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 6608 -ip 6608

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 1012 -ip 1012

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 2376 -ip 2376

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 4580 -ip 4580

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 6176 -ip 6176

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 6272 -ip 6272

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 3544 -ip 3544

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 4932 -ip 4932

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 1692 -ip 1692

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 672 -ip 672

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 6184 -ip 6184

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1512 -ip 1512

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 1960 -ip 1960

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1992 -ip 1992

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 2524 -ip 2524

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 672 -s 640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 892 -ip 892

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 3856 -ip 3856

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 1976 -ip 1976

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 3096 -ip 3096

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 2136 -ip 2136

C:\Users\Admin\AppData\Local\Temp\Unicorn-35514.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35514.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1172 -ip 1172

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6184 -s 696

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 6780 -ip 6780

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1996 -ip 1996

C:\Users\Admin\AppData\Local\Temp\Unicorn-27538.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27538.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 3964 -ip 3964

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 1160 -ip 1160

C:\Users\Admin\AppData\Local\Temp\Unicorn-35706.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35706.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11393.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11393.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11393.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11393.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11393.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11393.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 5796 -ip 5796

C:\Users\Admin\AppData\Local\Temp\Unicorn-52618.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52618.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52618.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52618.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 3488 -ip 3488

C:\Users\Admin\AppData\Local\Temp\Unicorn-11585.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11585.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52618.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-52618.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 4576 -ip 4576

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 4144 -ip 4144

C:\Users\Admin\AppData\Local\Temp\Unicorn-44258.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-44258.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36090.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-36090.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59442.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59442.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59442.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59442.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 1592 -ip 1592

C:\Users\Admin\AppData\Local\Temp\Unicorn-18410.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18410.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18410.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18410.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 3300 -ip 3300

C:\Users\Admin\AppData\Local\Temp\Unicorn-10433.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10433.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34938.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34938.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59826.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59826.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59826.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-59826.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10625.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10625.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10625.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10625.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 4304 -ip 4304

C:\Users\Admin\AppData\Local\Temp\Unicorn-26962.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26962.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27154.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27154.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27154.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27154.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 4704 -ip 4704

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 6220 -ip 6220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 6784 -ip 6784

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4960 -ip 4960

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2948 -ip 2948

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 748 -ip 748

C:\Users\Admin\AppData\Local\Temp\Unicorn-29458.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29458.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 6728 -ip 6728

C:\Users\Admin\AppData\Local\Temp\Unicorn-45794.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45794.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45794.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45794.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45794.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-45794.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37626.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-37626.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 6432 -ip 6432

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 3132 -ip 3132

C:\Users\Admin\AppData\Local\Temp\Unicorn-53194.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-53194.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12161.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-12161.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 940 -ip 940

C:\Users\Admin\AppData\Local\Temp\Unicorn-20522.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20522.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 5464 -ip 5464

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 6744 -ip 6744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 1820 -ip 1820

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5436 -ip 5436

C:\Users\Admin\AppData\Local\Temp\Unicorn-22442.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22442.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14465.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14465.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4724 -ip 4724

C:\Users\Admin\AppData\Local\Temp\Unicorn-30802.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30802.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 5404 -ip 5404

C:\Users\Admin\AppData\Local\Temp\Unicorn-38970.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38970.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 6736 -ip 6736

C:\Users\Admin\AppData\Local\Temp\Unicorn-47330.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47330.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 2264 -ip 2264

C:\Users\Admin\AppData\Local\Temp\Unicorn-29650.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29650.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17952.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-17952.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 6364 -ip 6364

C:\Users\Admin\AppData\Local\Temp\Unicorn-5529.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-5529.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5024 -ip 5024

C:\Users\Admin\AppData\Local\Temp\Unicorn-2000.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2000.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18336.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18336.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4836 -ip 4836

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 6080 -ip 6080

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 2784 -ip 2784

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 60 -ip 60

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6008 -ip 6008

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 6100 -ip 6100

C:\Users\Admin\AppData\Local\Temp\Unicorn-20448.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20448.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20448.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20448.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40506.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40506.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 1020 -ip 1020

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 856 -ip 856

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 5340 -ip 5340

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 7128 -ip 7128

C:\Users\Admin\AppData\Local\Temp\Unicorn-24362.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24362.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29000.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29000.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29000.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29000.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29000.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29000.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20832.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20832.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20832.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-20832.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 644

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 4352 -ip 4352

C:\Users\Admin\AppData\Local\Temp\Unicorn-3152.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3152.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3152.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3152.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3152.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3152.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3152.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3152.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3152.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3152.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29000.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-29000.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5568 -ip 5568

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6100 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 3320 -ip 3320

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 3264 -ip 3264

C:\Users\Admin\AppData\Local\Temp\Unicorn-21202.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21202.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13033.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13033.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13033.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13033.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13033.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-13033.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58705.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-58705.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9504.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9504.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 5084 -ip 5084

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5684 -ip 5684

C:\Users\Admin\AppData\Local\Temp\Unicorn-1912.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1912.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41600.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41600.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 5480 -ip 5480

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 6296 -ip 6296

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 5960 -ip 5960

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 5144 -ip 5144

C:\Users\Admin\AppData\Local\Temp\Unicorn-62042.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62042.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62042.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62042.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21010.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21010.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 3256 -ip 3256

C:\Users\Admin\AppData\Local\Temp\Unicorn-22738.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22738.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22738.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22738.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22738.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22738.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22738.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22738.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 4680 -ip 4680

C:\Users\Admin\AppData\Local\Temp\Unicorn-22930.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22930.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60433.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60433.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60433.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-60433.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47818.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-47818.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64154.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64154.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23122.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23122.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31290.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31290.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31290.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31290.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31290.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31290.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31290.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31290.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31290.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31290.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31290.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-31290.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 1912 -ip 1912

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 5176 -ip 5176

C:\Users\Admin\AppData\Local\Temp\Unicorn-26992.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26992.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5144 -s 740

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 5448 -ip 5448

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 3644 -ip 3644

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2936 -ip 2936

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 4088 -ip 4088

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 3680 -ip 3680

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 6792 -ip 6792

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 6448 -ip 6448

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5248 -ip 5248

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 6052 -ip 6052

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 5732 -ip 5732

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 6988 -ip 6988

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 5272 -ip 5272

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 2688 -ip 2688

C:\Users\Admin\AppData\Local\Temp\Unicorn-49546.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49546.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49546.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-49546.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-345.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-345.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48202.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48202.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24850.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-24850.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48586.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48586.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56946.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56946.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56946.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-56946.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48778.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48778.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65114.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-65114.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32250.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-32250.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63313.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63313.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6052 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 1808 -ip 1808

C:\Users\Admin\AppData\Local\Temp\Unicorn-30832.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-30832.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 3516 -ip 3516

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 5128 -ip 5128

C:\Users\Admin\AppData\Local\Temp\Unicorn-1881.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1881.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1881.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1881.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1881.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1881.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2308 -ip 2308

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 6328 -ip 6328

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 5844 -ip 5844

C:\Users\Admin\AppData\Local\Temp\Unicorn-9281.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9281.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1113.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1113.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9281.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-9281.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41954.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-41954.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39754.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39754.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 5836 -ip 5836

C:\Users\Admin\AppData\Local\Temp\Unicorn-3360.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3360.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23226.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23226.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23418.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-23418.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48306.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48306.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64642.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64642.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2836 -ip 2836

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 3344 -ip 3344

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 5708 -ip 5708

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 5376 -ip 5376

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 5700 -ip 5700

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 6656 -ip 6656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 2760 -ip 2760

C:\Users\Admin\AppData\Local\Temp\Unicorn-55706.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55706.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14673.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-14673.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6505.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-6505.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 3504 -ip 3504

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 5396 -ip 5396

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 804 -ip 804

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5376 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 5512 -ip 5512

C:\Users\Admin\AppData\Local\Temp\Unicorn-21616.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-21616.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 5164 -ip 5164

C:\Users\Admin\AppData\Local\Temp\Unicorn-22000.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22000.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22000.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22000.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22000.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-22000.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62841.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62841.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4848 -ip 4848

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4780 -ip 4780

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 4736 -ip 4736

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 1124 -ip 1124

C:\Users\Admin\AppData\Local\Temp\Unicorn-16210.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16210.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16210.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-16210.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 5772 -ip 5772

C:\Users\Admin\AppData\Local\Temp\Unicorn-8233.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8233.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 2420 -ip 2420

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 6876 -ip 6876

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 6136 -ip 6136

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4348 -ip 4348

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 736

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 5940 -ip 5940

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 6004 -ip 6004

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 6012 -ip 6012

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 1372 -ip 1372

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4596 -ip 4596

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 4988 -ip 4988

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 4616 -ip 4616

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5140 -ip 5140

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 6664 -ip 6664

C:\Users\Admin\AppData\Local\Temp\Unicorn-42634.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-42634.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1601.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1601.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 1340 -ip 1340

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 5408 -ip 5408

C:\Users\Admin\AppData\Local\Temp\Unicorn-7968.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7968.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7968.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-7968.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 5848 -ip 5848

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 6340 -ip 6340

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 7144 -ip 7144

C:\Users\Admin\AppData\Local\Temp\Unicorn-3713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61082.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61082.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61082.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-61082.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 5996 -ip 5996

C:\Users\Admin\AppData\Local\Temp\Unicorn-3713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25072.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-25072.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 6880 -ip 6880

C:\Users\Admin\AppData\Local\Temp\Unicorn-3713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3713.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3713.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 6972 -ip 6972

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 5884 -ip 5884

C:\Users\Admin\AppData\Local\Temp\Unicorn-18898.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18898.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18898.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18898.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18898.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18898.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18898.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18898.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18898.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18898.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10729.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10729.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18898.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18898.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35234.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35234.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35234.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35234.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51954.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-51954.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48425.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-48425.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10921.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10921.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35426.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-35426.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27258.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27258.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 5528 -ip 5528

C:\Users\Admin\AppData\Local\Temp\Unicorn-2945.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2945.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2945.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-2945.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19282.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19282.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19282.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-19282.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64953.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-64953.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 6908 -ip 6908

C:\Users\Admin\AppData\Local\Temp\Unicorn-27642.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27642.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27642.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27642.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 7140 -ip 7140

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 5768 -ip 5768

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 6260 -ip 6260

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 2272 -ip 2272

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 960 -ip 960

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 1668 -ip 1668

C:\Users\Admin\AppData\Local\Temp\Unicorn-63329.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-63329.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 1192 -ip 1192

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 5916 -ip 5916

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 5516 -ip 5516

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1260 -ip 1260

C:\Users\Admin\AppData\Local\Temp\Unicorn-57730.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57730.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57730.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57730.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8721.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8721.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39784.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-39784.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 6228 -ip 6228

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 7036 -ip 7036

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 1664 -ip 1664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 6720 -ip 6720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 468 -ip 468

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 7040 -ip 7040

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 4300 -ip 4300

C:\Users\Admin\AppData\Local\Temp\Unicorn-1897.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-1897.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 1704 -ip 1704

C:\Users\Admin\AppData\Local\Temp\Unicorn-18234.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18234.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18234.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18234.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55929.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-55929.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34954.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-34954.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 6280 -ip 6280

C:\Users\Admin\AppData\Local\Temp\Unicorn-26402.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-26402.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 932 -ip 932

C:\Users\Admin\AppData\Local\Temp\Unicorn-8840.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-8840.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 5544 -ip 5544

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 1008 -ip 1008

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 7032 -ip 7032

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4584 -ip 4584

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 6336 -ip 6336

C:\Users\Admin\AppData\Local\Temp\Unicorn-11217.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-11217.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3049.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-3049.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27554.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-27554.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 2320 -ip 2320

C:\Users\Admin\AppData\Local\Temp\Unicorn-40936.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-40936.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57273.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-57273.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 3060 -ip 3060

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 6544 -ip 6544

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6916 -ip 6916

C:\Users\Admin\AppData\Local\Temp\Unicorn-38410.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38410.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38410.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38410.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38410.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-38410.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62914.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62914.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62914.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-62914.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 3604 -ip 3604

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 652

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 6460 -ip 6460

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 4216 -ip 4216

C:\Users\Admin\AppData\Local\Temp\Unicorn-18928.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-18928.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 7100 -ip 7100

C:\Users\Admin\AppData\Local\Temp\Unicorn-10568.exe

C:\Users\Admin\AppData\Local\Temp\Unicorn-10568.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 240.143.123.92.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 10.179.89.13.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\Unicorn-13684.exe

MD5 5594958d40d1d399c255df116c94d35c
SHA1 7a99a2a78ddcfa3c8cf01d8565d2069e0beb832d
SHA256 b8e190544be05f96daa428601628e640c32bc94a805641042d130d1a5481e6d5
SHA512 647585fbba3a5d382cb871686e4be6c5c74b2298691c951148c727e18695bbf2a454dbcae229a9d3e5ee8442579b1b01640ad159316a6bace09d574f15f82652

C:\Users\Admin\AppData\Local\Temp\Unicorn-46845.exe

MD5 aa1a1c39cd773389697690c2306c514e
SHA1 5e6ea30b7338c6a75a24f0f26407a7b44cdd9a07
SHA256 6fa34462991ed59880bb034afd08e2785d3357e55d118bbec440b136ba8a3199
SHA512 45bf79e20aca1ce2feaff99678536ca5941f1a83deb076f5901cadd2eed2811b4b51549278c65756790129ee5f20d60db7a3e015d74e3994ffdf35c2e7f5d129

C:\Users\Admin\AppData\Local\Temp\Unicorn-42163.exe

MD5 6f0c6f8a9d4f63598dc6c6749d1f0195
SHA1 01239f7b34ad759f0593f45270f5e2bd11507f68
SHA256 33b814380efcdfc4242bce689e4588c88c30c937f8ec475206e64e1a949d77ce
SHA512 cbb52d1a57b45e7895f56da4eaf515f5302297beac15f0b5be5e74a802bd058c41c69b71bb1890ba50503c755bac9f86ed25f1dfbefe0553e83bb2efe9129d61

C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe

MD5 306900db321265d8aad067a27ba94ca8
SHA1 4707ad5203d622dc7874c443478ada020a6ab91f
SHA256 8f1c0d170de85f12042ed734faf382d0daeb2ecc30ba57e4b0d66805289c0bb2
SHA512 78ca3b27feb65c415a4461a0655c7c3503afe58cda1e45e0e7e7c0ab7378848e4e246cd4a09afa59e98a6cbbb682b70c2baacc948c5009745bdc20df756df133

C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe

MD5 fc0cfb35e9fab996cc7e1be42462c7a0
SHA1 287df531a28ea763546578956c80463e18e53d0e
SHA256 4dbc82755bd6c29162e83d7b7a490be3d8abe6472c78a5f679276104240c2d1c
SHA512 d13df9dd548f26007d2b4cb5c3b71b96037050c11032595a19ece1113c3920433c6c5faeff031b6d8d9c15b562f7b8df081f2c63cf8fff773141155bc5ff9d75

C:\Users\Admin\AppData\Local\Temp\Unicorn-14587.exe

MD5 b28027191e6a745b5785feb8ce34db34
SHA1 e140dc28c436aba2d1ffae1d70a775410b672597
SHA256 d99e501b5f58327dcbe4da068a8fe5482cd99bddc942c27da65c1f204f02d995
SHA512 b7889cdfe67611b7619fad431d2684b14cf56b1ab118624219af5116bc6311f3d3e83c92553f4350d853b9b5b000708d1db493f6ebf4e456f53f160b58cc4e12

C:\Users\Admin\AppData\Local\Temp\Unicorn-59533.exe

MD5 913bd12895956e63db11339bcd7f64e2
SHA1 0d92772c643f9b4c3c19d2f7145600f6f67db94b
SHA256 0d9d386f4617d36fcb9153b49d5902b68e290c07dc78a76de0e41ae47c4a4b08
SHA512 016b06d5cd8bf008ba5d5c037679b26cbd683cf13d47d3c905efa60a5510b3c168e0117d2a5d035cb5104775778ce097c15c6ce4d97e61e1704b12b005be821e

C:\Users\Admin\AppData\Local\Temp\Unicorn-64172.exe

MD5 c47234df9ba01c1fb6ac33fd5cf9cd4c
SHA1 d076f86b95ab407a974948b501b1e435086d9f02
SHA256 75c1524114422a5cce630a68ef9e1edd3c166d7d6ff3c51e65c546c7807835b1
SHA512 18122cb927769c29b62f10331e6be1560d32d812f372829bd29051568deed7fb7e7c44d4fccf7efe9fe8f0c5c416f13407841c2a18c878d2a120b9d221b09db1

C:\Users\Admin\AppData\Local\Temp\Unicorn-34837.exe

MD5 c4ab4f6016617bb32bbdb5aac1713dbf
SHA1 3bf6a1f1cfb1aab08f0e3faac6e6ee49c2d394ef
SHA256 f2a6574ccfedc248d245dcd9d2e4820b080843d51ce4e7acfe0c09539169297c
SHA512 ec02f0aa5c89f416ca93e0ff1f4c70f7c33e98273c2adb397a299e9c69b6502eb9882be4742a9629e0c8b3bcab56095b993dca7d6266332686b590d62b28f48e

C:\Users\Admin\AppData\Local\Temp\Unicorn-10628.exe

MD5 a693dba302156c05fb621ac8c60008b6
SHA1 762cab732c21d23c5f1fa6d7cd7e519178f42684
SHA256 ddaa51cfcdb9c24d0a11e966917e6745e9254322fda767ce858ebd2f69600fea
SHA512 5ece6ebc36fb2537038cf167daf52ffe92496e7161023518c286130679a9ac00dec55c5c6a87fa0837bafea577889c55cae241d01369a9a80ab4794c00cab729

C:\Users\Admin\AppData\Local\Temp\Unicorn-12740.exe

MD5 5564c80c764d778d11d2c93714917d50
SHA1 7c702aec430502e879095dd8283cdf0d68cd1913
SHA256 9b1c251851fd56a4efc9d722448caba3cc5618842879c295e8a695911a0bf6ce
SHA512 3710edaf680694ac540ead7655cd0e8d013dadb3ec9a82756ecd4b66ee0775aec0bc31c204c5bc349d148b050df4cf4877884b3a7ac2a4d58712b0fc95a8e6dd

C:\Users\Admin\AppData\Local\Temp\Unicorn-9211.exe

MD5 32c433bb51c5de5b64de062b571ed16e
SHA1 9873efbe57b57f1ff18fa1d36db745d7246c8ab2
SHA256 fd2bd81f818366edfb89fa4934579c2b03775aca46a53eac5799bd8e5f27e84c
SHA512 c22dc79afd90309bd52df500a0bf503c77c68cd8c360fad2708052ee06dbcff3fd2cffe985a24eb985dd42c25e15d5dd1b731aa7da48880b256534acc2a9ba19

C:\Users\Admin\AppData\Local\Temp\Unicorn-20909.exe

MD5 aab766e47e009023ea5d935365d9ad9d
SHA1 42056ec599440bfdba79960651790348b7d284ab
SHA256 78f5584756ac03a4833ce34f20786e57c11ef22a797976e1ef9b5d51c1f80535
SHA512 3e747fe0c694c19a97a3ab10fecd42d575e9dd1d1ae0fd1e652b81880d7913299a0d8fc62154f43f153cb97b62fd07c43a588a3108956cc44553e38132dd0ef6

C:\Users\Admin\AppData\Local\Temp\Unicorn-25547.exe

MD5 bea9594100f3921c157e862a1c115d99
SHA1 7b29610e20b6a5290605772f981f2a7c4e518d29
SHA256 2ab304b17ade33491eb886fe9b65127bbd7abce098acef97f63b473a82040b83
SHA512 dccacbc3f8b9f0bd937121aa4a586877d5492bc2e2611ab1791225c6df748b04833e7d0ad987e6ba88a2621da46ebd0c9722554708fb453a4495887b39b8703b

C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe

MD5 a57e7dd418164dcac6db9aa5596ab540
SHA1 9984e7faf13046564000ca0934eb3f4ca14fda98
SHA256 60bd29859a04f7099fc4ebd202628fd4d8c9b954512fcf78e3c09d2ae30eabf4
SHA512 707ec79d412160d3bb1ecb1e91f6a4a5c9cf5faf5bc7f4befb52b4e80cb84a70c59ab71497f3ae4ea3d7e18620383a795e188670b76d0b16e665862c9b29844c

C:\Users\Admin\AppData\Local\Temp\Unicorn-3140.exe

MD5 c6ae3176df1f5dc2b4c2ce3b313bfda4
SHA1 81657c72d8c839f7d41cb937721cc3c843a9a6cc
SHA256 08c52a662352f11053a8319945a0d380837b1677335b3f88da21f1e76c06074e
SHA512 16b4d9faf4171ce1748501809918d5891cbf63fa8b7b2dc7259f3f88fc4c2d378bebeaa166929eea9c6b2cd2a11ce2ea662560b6264526a7f54560a838a632a4

C:\Users\Admin\AppData\Local\Temp\Unicorn-48812.exe

MD5 a9209820f8423cfdad7a114265f1ba55
SHA1 f22c7c6b612103d7c0c3c82beb49f9b87bff3fd8
SHA256 8c90c1cd109f578f73d2c4e1f0d21e748f0013d358e95e34c1f8d7e68fd86370
SHA512 e1fff54c28043cc3867d7df4cab7e6a73c274392344ead47b10c17a426551c31187212e9822cfbb96057598a18f291119a77b74bba4203e79f68708ae059c899

C:\Users\Admin\AppData\Local\Temp\Unicorn-21781.exe

MD5 0dc1482bfdb4d7358722be42154841d6
SHA1 281ab59f348d3b1a6af675dcd3a5db2062804ddf
SHA256 dc08752f7464048947287c2d47628012d03a06edb5d66bc926712bff48bde21a
SHA512 914a937064f65ad7c236c8088a90df04d938d0740abedc52f41c7f1b0bfe566850857e421d1cf14ff33cbf665c1fb160ba709bb2f7135dfb0e68cc46e35dc510

C:\Users\Admin\AppData\Local\Temp\Unicorn-10083.exe

MD5 a5ee9dbe5fbb7590ca702f250406fccd
SHA1 7821f240bbcc604cacd80a33b346c79fd6f0adca
SHA256 1300a2eea30fcf5fd36e33ea4c7ffca3848145fe13e022efb457ccf6b1c3bc8c
SHA512 c11d4e2e2fe160459557138b04526f84e0aa25136ba62a1485c5266ca14fb075da872ac5568966995b4c3b0ccf9750a50eebe89eccd6f5a2254b5f6bde00a25b

C:\Users\Admin\AppData\Local\Temp\Unicorn-61661.exe

MD5 d018d9425ed6821a06cb679303c56f00
SHA1 c5e1a2fbecc86452183cf04f5c7173fe0644b43c
SHA256 87fc77b162f34e05901fd5ffe4820ed5ac002bccd883402b14c43a07cb7af87a
SHA512 151140b28a38f2344492be2c5a387a5507545030efed2019c65af57c3f7186f93961458f6869f6c6a0a6e24e7331e59a9dae82d06f153edccfd613b4800e7c27

C:\Users\Admin\AppData\Local\Temp\Unicorn-20629.exe

MD5 31f8696798a58951fc007fd0353526e8
SHA1 2581fe910d192a23fad81a7366b15330b356d8f5
SHA256 297fd68130f8d5e92a29820c7e7a3d56c5a8d0beb36e6cc645d2faf8941db72f
SHA512 e57ced898910b3f1cff3fe2ed73a1044647de2845bbf9d78ae6c3b19b2031ff4992446b1b67b86cfe4ee84437b98aadbf28d34d7085c7f99d417f05fc322f868

C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe

MD5 7b7e101553feda8feb28f759194a86fe
SHA1 6ed18e20eac61af078f5f8cd76a888a051a7bda2
SHA256 3e8238a5856940fc59ebf39b667286e4033a7ba355f01f7057099784dc0ea0fa
SHA512 63d1bcef466c90eea9b38cb1dcecfbfe3b4c35c5c6904269cb303019fd72aedcb6b07fa1c670994b5af38ae230f9916794c8f2107ca0b107c0a7412bc629861f

C:\Users\Admin\AppData\Local\Temp\Unicorn-33819.exe

MD5 922827c1f90f1fefe1d001f07339c2eb
SHA1 4698e75dd8aefb1fec44a521b9e597ea2e627d3a
SHA256 61ee553943748f57ec3c5b8895ebd600a8357071c493107dd8d2d8068d83f3f1
SHA512 9f0d18be80856fea9d31d7753f8dddb7c4c0d0d2e618976cc83ef74d825860d24db9d69c3c220ae0c9a79148df52210623a1a91b0145525fa3bcbf33a30f8cb9

C:\Users\Admin\AppData\Local\Temp\Unicorn-25651.exe

MD5 e3135d8d15bb702506302212863f92ac
SHA1 c08e6a3315422e6723f3df19e44ed87914bcbac0
SHA256 2b297b8da407ff1ce74b9835c9dacd252d0044fb0c45b58f9e1a6b862e108c82
SHA512 097165dd9eb70a2c1f27fecef6d848cf44585ce2f5f170519451f8a44a36087e79aa9ca463f5cfd19efae106e3beb46cd51303dea7755d838b9c6bdc80927ca7

C:\Users\Admin\AppData\Local\Temp\Unicorn-62725.exe

MD5 cc46fecdfc56c172947ddadbb71b88e6
SHA1 66ec48462aca677c650168f19d80d6119a64943f
SHA256 4750f9a8f410a653d164bda657b9ffa57fcffb26c4140a996fc7b1c93f373310
SHA512 8032441b609f064b11c6955cd88c00c00a66a57dbc61576764416ffe9399adb728c6df9eb6eae842954ef9588f72fac4f6a818d2465b7531b4d87f3ef496d459

C:\Users\Admin\AppData\Local\Temp\Unicorn-21693.exe

MD5 3c501778bdf2fd67dc3f961f4e121f4e
SHA1 3d6d19e103cac77df45218794187cd378afb3519
SHA256 2536a59627f92e01ed2a9b3008dca4b94bc6eb07135b3f4f011d66e8417110bf
SHA512 71ddb1a8e15f735c49addc1d7da5a6696f664da6f8ceeb3a016b7eecc203cac30e16207dd829f7cd970d250e1750ced5209e50f0e290f8f2b98f4aea33e5f46b

C:\Users\Admin\AppData\Local\Temp\Unicorn-18547.exe

MD5 364a016cead89ff6a5f6aa72338edf0f
SHA1 a2f0900fac979297085cea55862a636a73e986e2
SHA256 4fb632e28fc34ca4be8f7d6e548e6ca1cb31abb70739fd98a3a6dbf20389d016
SHA512 b0fa1bfa577850cf37b9d3fe43c7c8c32b72b9f8351b3b9fdf94f60c1a854e182abc6da2aff746e79b7346bcc18fb989d9f001ceefb306ad8fe411783f02c9ca

C:\Users\Admin\AppData\Local\Temp\Unicorn-4588.exe

MD5 510de034d3cd70c7e2a43f53744b77d7
SHA1 b7eb5a95154fd69516a6d1a45ab69bc8bfad580c
SHA256 912cc7a237db329a688ab8d56959df2c4f4e2fcff8f5eaadeedd8577d85765d8
SHA512 b1008c17fc879cb44fc99a6377dbd42483ebc55d6119fc57593ffbffdb6f86af6b9eefc18c5df448fa59584c0d77982afe51b552f214dec4e3e33a952eb7fed1

C:\Users\Admin\AppData\Local\Temp\Unicorn-1059.exe

MD5 a1ee466c0116b55559f69f597e90b628
SHA1 15333cf0503e5c32665764ca5529c9ffa384039d
SHA256 438ff278c52ab353c085ca85aff0de2e78d37a60b5771c4520429793cb6e6115
SHA512 3ef970ddff6a8162a16f96db932d56ac283d67f8bcd6ce4c3eaa52cbb81fb3e4ea6113bafa053e493e0a887966668591fee6e6c90726e08a8242031815062f91

C:\Users\Admin\AppData\Local\Temp\Unicorn-37645.exe

MD5 532226a05baa83b5cca915a5fa38ec60
SHA1 ad0eaf17072df0f90849fe7b02df7f4110b36a01
SHA256 6f6c72a3b950d3b94fb0a35deecd3fa2389560fa12b67986424c6ccabfdbfd69
SHA512 007da8b8e7ea8a1eb2ea7c48975274064ad30ea2889c1e13cb26e0fe2ab44271c6fe14cdeea1d4c5b7905859326112c3a3b6f1216161c3a64069177cef862b22

C:\Users\Admin\AppData\Local\Temp\Unicorn-15252.exe

MD5 d2e6f7a4bf22a2765d0475697af936a1
SHA1 27ab0e78b85690e37f2aa8545b29f9da85b30d12
SHA256 758816a503fd3bd128d13643ca41b970de082bb97e2126ef93fdbe3bd299f18e
SHA512 ad7f38da08d7b91cb25bb84ba979b70b17c819061aa53640eb49483d09e3afbd466942d3297345aa98ae3fdff42d9213a466a75248bb5f1db800d3b3777c4298

C:\Users\Admin\AppData\Local\Temp\Unicorn-61701.exe

MD5 ce3f367dc436929ca09bed9b6349b355
SHA1 f0d7230ae496f947bbe12ed6e288d5f5bf8a04c1
SHA256 9f7a611ca758194d6cbb2a2b9732673b937392d9cd64fbbb60ff669e4239ee67
SHA512 f48491808ddb4a5d86a1de799f9aeff806a5fc353d46572e1bbebe55d623707d2f55eb1f5b3edf346c3a5029f10392f253021b751bc43d80763bde3715f45768

C:\Users\Admin\AppData\Local\Temp\Unicorn-55426.exe

MD5 4fe3296a2fd3b2cbd8cba3e391968158
SHA1 3f2fddd2e9109dee288e9c6b6c4eb93e78554c84
SHA256 4425420c49c6f8055b8a75b28e8c27149f5ec2895cb36a412f2de666e4e299a3
SHA512 23fb189ef53b72aff02d4065761cc65b780ed23d1c9eb0f61edf6bd2069b1ed7bacb676c319297a89d7b589e62758ef8c227ea9f66ee9e4c5ccdd087b6b7f64a

C:\Users\Admin\AppData\Local\Temp\Unicorn-13625.exe

MD5 dc57e3f2446430746bb97d4f01e4e69d
SHA1 81bbcbfefcf40e221e50d884be021e336253da9f
SHA256 07b288312c621166f6e597a5e2690ca003138652de698897427688666e80809f
SHA512 f05f46abba2311ce89708c50f45cfb180cc3869a525f8d3a92a88706d6a46a1d5012ad602c866ff617e3566c4781966f8b5b4aede1f1ffb3d2a805a6cfa40b13

C:\Users\Admin\AppData\Local\Temp\Unicorn-32666.exe

MD5 235a3118a31180d2f74cb2ab7205f927
SHA1 70818a81a8b2d321a3d4e41cd41f2311846b1153
SHA256 6d500b1d392dba9748dde65c8ef0f9d3905b381eca8abdc10e66382b57a65af2
SHA512 e7b44389d7e205cc2b6a85161cbe7cdfc8d5b52c957fca9f1c6b1202540ff23fe3648540d5abc7f1c37dca6487eb27c1be35876b8894135d87beeb36ab91c3db

C:\Users\Admin\AppData\Local\Temp\Unicorn-29146.exe

MD5 be009bb1c93d42bb55ff3744c8331fa8
SHA1 be91df44fec09d1273d093352bbdf9f90710e66f
SHA256 2c90c9ba13002cbe93bcd1700c5278ea59ac66e5eb393c8b7d9e96ad446bb866
SHA512 b71b53ba609f4487d895de81c94c2c7890a835ecc9a36a73c084b32981966c52221c0264f1d55e885c4d4bdaeef28ec93a9cb8d71a7c196cace47d53d796076b

C:\Users\Admin\AppData\Local\Temp\Unicorn-13593.exe

MD5 28e4b794731b6654747bda051dbc7f41
SHA1 1002bf07ddf0b7e7d4d049ed094a55d8a8031388
SHA256 592ff27dffbe8ade6dfa64d207cf78a26b635138c1f071e9326e2ba72c90e766
SHA512 3e210c300a59714cb233337da7fa79a9853658903a7288582f764a58629230a54e0284a4be06444e643d1c6a002389e66f642491e53b4806628bf08107f06b31

C:\Users\Admin\AppData\Local\Temp\Unicorn-10633.exe

MD5 53981daf2ad303fde56215d2896d4d79
SHA1 9b3db9004c1af2cae909db0ef9416cd560aab569
SHA256 f9b65693fc3c1f5da80b3e30ee76372a3816fa1df39b260d85e0386e0908d6e6
SHA512 e8d594ae333a1a38f85587139f21895806cf93cddb5875097a659f9ccfbfb39df56930cdf0104e50112d2d53b172be22e4a94f0b669ca81972a6a2f8873789d9